Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0927
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans le noyau Linux de SUSE. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une atteinte à l'intégrité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| SUSE | N/A | SUSE Linux Enterprise High Performance Computing 15 SP5 | ||
| SUSE | N/A | Public Cloud Module 15-SP7 | ||
| SUSE | N/A | SUSE Linux Enterprise Real Time 15 SP7 | ||
| SUSE | N/A | SUSE Linux Micro 6.1 | ||
| SUSE | N/A | SUSE Linux Enterprise Workstation Extension 15 SP7 | ||
| SUSE | N/A | SUSE Linux Micro 6.0 | ||
| SUSE | N/A | Legacy Module 15-SP7 | ||
| SUSE | N/A | SUSE Linux Enterprise High Availability Extension 15 SP7 | ||
| SUSE | N/A | SUSE Linux Enterprise Desktop 15 SP7 | ||
| SUSE | N/A | SUSE Linux Enterprise Server for SAP Applications 15 SP7 | ||
| SUSE | N/A | openSUSE Leap 15.5 | ||
| SUSE | N/A | SUSE Linux Enterprise Live Patching 15-SP6 | ||
| SUSE | N/A | SUSE Linux Enterprise Server 15 SP5 | ||
| SUSE | N/A | SUSE Linux Enterprise Server for SAP Applications 15 SP5 | ||
| SUSE | N/A | SUSE Linux Enterprise Real Time 15 SP5 | ||
| SUSE | N/A | SUSE Linux Micro 6.2 | ||
| SUSE | N/A | SUSE Linux Enterprise Server 15 SP7 | ||
| SUSE | N/A | SUSE Linux Enterprise Live Patching 15-SP7 | ||
| SUSE | N/A | SUSE Linux Enterprise Live Patching 15-SP5 | ||
| SUSE | N/A | SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 | ||
| SUSE | N/A | SUSE Linux Enterprise Server 15 SP6 LTSS | ||
| SUSE | N/A | SUSE Linux Micro Extras 6.2 | ||
| SUSE | N/A | SUSE Linux Enterprise Real Time 15 SP6 | ||
| SUSE | N/A | openSUSE Leap 15.6 | ||
| SUSE | N/A | SUSE Linux Enterprise Server 15 SP5 LTSS | ||
| SUSE | N/A | SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 | ||
| SUSE | N/A | Development Tools Module 15-SP7 | ||
| SUSE | N/A | Basesystem Module 15-SP7 | ||
| SUSE | N/A | SUSE Linux Enterprise High Availability Extension 15 SP6 | ||
| SUSE | N/A | SUSE Linux Enterprise Server for SAP Applications 15 SP6 | ||
| SUSE | N/A | SUSE Linux Enterprise Server 15 SP6 | ||
| SUSE | N/A | SUSE Real Time Module 15-SP7 | ||
| SUSE | N/A | SUSE Linux Enterprise Micro 5.5 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "SUSE Linux Enterprise High Performance Computing 15 SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "Public Cloud Module 15-SP7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Real Time 15 SP7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Micro 6.1",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Workstation Extension 15 SP7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Micro 6.0",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "Legacy Module 15-SP7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise High Availability Extension 15 SP7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Desktop 15 SP7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server for SAP Applications 15 SP7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "openSUSE Leap 15.5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Live Patching 15-SP6",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 15 SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Real Time 15 SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Micro 6.2",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 15 SP7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Live Patching 15-SP7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Live Patching 15-SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise High Performance Computing LTSS 15 SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 15 SP6 LTSS",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Micro Extras 6.2",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Real Time 15 SP6",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "openSUSE Leap 15.6",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 15 SP5 LTSS",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "Development Tools Module 15-SP7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "Basesystem Module 15-SP7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise High Availability Extension 15 SP6",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Server 15 SP6",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Real Time Module 15-SP7",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
},
{
"description": "SUSE Linux Enterprise Micro 5.5",
"product": {
"name": "N/A",
"vendor": {
"name": "SUSE",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-39894",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-39894"
},
{
"name": "CVE-2025-40341",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40341"
},
{
"name": "CVE-2025-71089",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-71089"
},
{
"name": "CVE-2026-23248",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23248"
},
{
"name": "CVE-2023-20585",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-20585"
},
{
"name": "CVE-2026-31414",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31414"
},
{
"name": "CVE-2026-23393",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23393"
},
{
"name": "CVE-2026-31439",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31439"
},
{
"name": "CVE-2026-31441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31441"
},
{
"name": "CVE-2026-31447",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31447"
},
{
"name": "CVE-2026-31450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31450"
},
{
"name": "CVE-2026-31452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31452"
},
{
"name": "CVE-2026-31469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31469"
},
{
"name": "CVE-2026-31474",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31474"
},
{
"name": "CVE-2026-31485",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31485"
},
{
"name": "CVE-2026-31495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31495"
},
{
"name": "CVE-2026-31497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31497"
},
{
"name": "CVE-2026-31503",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31503"
},
{
"name": "CVE-2026-31509",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31509"
},
{
"name": "CVE-2026-31510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31510"
},
{
"name": "CVE-2026-31520",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31520"
},
{
"name": "CVE-2026-31522",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31522"
},
{
"name": "CVE-2026-31523",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31523"
},
{
"name": "CVE-2026-31524",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31524"
},
{
"name": "CVE-2026-31555",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31555"
},
{
"name": "CVE-2026-31566",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31566"
},
{
"name": "CVE-2026-31570",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31570"
},
{
"name": "CVE-2026-31674",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31674"
},
{
"name": "CVE-2026-31678",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31678"
},
{
"name": "CVE-2026-31680",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31680"
},
{
"name": "CVE-2026-31430",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31430"
},
{
"name": "CVE-2026-31532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31532"
},
{
"name": "CVE-2026-31533",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31533"
},
{
"name": "CVE-2026-31578",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31578"
},
{
"name": "CVE-2026-31583",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31583"
},
{
"name": "CVE-2026-31585",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31585"
},
{
"name": "CVE-2026-31586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31586"
},
{
"name": "CVE-2026-31587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31587"
},
{
"name": "CVE-2026-31596",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31596"
},
{
"name": "CVE-2026-31599",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31599"
},
{
"name": "CVE-2026-31603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31603"
},
{
"name": "CVE-2026-31604",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31604"
},
{
"name": "CVE-2026-31605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31605"
},
{
"name": "CVE-2026-31615",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31615"
},
{
"name": "CVE-2026-31618",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31618"
},
{
"name": "CVE-2026-31619",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31619"
},
{
"name": "CVE-2026-31623",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31623"
},
{
"name": "CVE-2026-31624",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31624"
},
{
"name": "CVE-2026-31625",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31625"
},
{
"name": "CVE-2026-31626",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31626"
},
{
"name": "CVE-2026-31627",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31627"
},
{
"name": "CVE-2026-31646",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31646"
},
{
"name": "CVE-2026-31651",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31651"
},
{
"name": "CVE-2026-31657",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31657"
},
{
"name": "CVE-2026-31659",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31659"
},
{
"name": "CVE-2026-31660",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31660"
},
{
"name": "CVE-2026-31661",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31661"
},
{
"name": "CVE-2026-31664",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31664"
},
{
"name": "CVE-2026-31665",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31665"
},
{
"name": "CVE-2026-31667",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31667"
},
{
"name": "CVE-2026-31670",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31670"
},
{
"name": "CVE-2026-31672",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31672"
},
{
"name": "CVE-2026-31673",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31673"
},
{
"name": "CVE-2026-31685",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31685"
},
{
"name": "CVE-2026-31466",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31466"
},
{
"name": "CVE-2026-31492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31492"
},
{
"name": "CVE-2026-31498",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31498"
},
{
"name": "CVE-2026-31540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31540"
},
{
"name": "CVE-2026-31545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31545"
},
{
"name": "CVE-2026-31548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31548"
},
{
"name": "CVE-2026-31549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31549"
},
{
"name": "CVE-2026-31551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31551"
},
{
"name": "CVE-2026-31552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31552"
},
{
"name": "CVE-2026-31720",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31720"
},
{
"name": "CVE-2026-31726",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31726"
},
{
"name": "CVE-2026-31728",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31728"
},
{
"name": "CVE-2026-31747",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31747"
},
{
"name": "CVE-2026-31748",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31748"
},
{
"name": "CVE-2026-31749",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31749"
},
{
"name": "CVE-2026-31751",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31751"
},
{
"name": "CVE-2026-31752",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31752"
},
{
"name": "CVE-2026-31754",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31754"
},
{
"name": "CVE-2026-31755",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31755"
},
{
"name": "CVE-2026-31756",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31756"
},
{
"name": "CVE-2026-31758",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31758"
},
{
"name": "CVE-2026-31761",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31761"
},
{
"name": "CVE-2026-31762",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31762"
},
{
"name": "CVE-2026-31763",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31763"
},
{
"name": "CVE-2026-31768",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31768"
},
{
"name": "CVE-2026-31770",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31770"
},
{
"name": "CVE-2026-31773",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31773"
},
{
"name": "CVE-2026-31776",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31776"
},
{
"name": "CVE-2026-31778",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31778"
},
{
"name": "CVE-2026-31779",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31779"
},
{
"name": "CVE-2026-31780",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31780"
},
{
"name": "CVE-2026-31781",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31781"
},
{
"name": "CVE-2026-43011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43011"
},
{
"name": "CVE-2026-43014",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43014"
},
{
"name": "CVE-2026-43015",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43015"
},
{
"name": "CVE-2026-43017",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43017"
},
{
"name": "CVE-2026-43018",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43018"
},
{
"name": "CVE-2026-43020",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43020"
},
{
"name": "CVE-2026-43024",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43024"
},
{
"name": "CVE-2026-43025",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43025"
},
{
"name": "CVE-2026-43027",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43027"
},
{
"name": "CVE-2026-43028",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43028"
},
{
"name": "CVE-2026-43032",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43032"
},
{
"name": "CVE-2026-43035",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43035"
},
{
"name": "CVE-2026-43037",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43037"
},
{
"name": "CVE-2026-43038",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43038"
},
{
"name": "CVE-2026-43043",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43043"
},
{
"name": "CVE-2026-43047",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43047"
},
{
"name": "CVE-2026-43051",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43051"
},
{
"name": "CVE-2026-43057",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43057"
},
{
"name": "CVE-2026-23276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23276"
},
{
"name": "CVE-2026-31429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31429"
},
{
"name": "CVE-2026-31438",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31438"
},
{
"name": "CVE-2026-31440",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31440"
},
{
"name": "CVE-2026-31479",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31479"
},
{
"name": "CVE-2026-31502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31502"
},
{
"name": "CVE-2026-31505",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31505"
},
{
"name": "CVE-2026-31511",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31511"
},
{
"name": "CVE-2026-31561",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31561"
},
{
"name": "CVE-2026-31576",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31576"
},
{
"name": "CVE-2026-31580",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31580"
},
{
"name": "CVE-2026-31581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31581"
},
{
"name": "CVE-2026-31616",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31616"
},
{
"name": "CVE-2026-31617",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31617"
},
{
"name": "CVE-2026-31647",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31647"
},
{
"name": "CVE-2026-31693",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31693"
},
{
"name": "CVE-2025-71302",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-71302"
},
{
"name": "CVE-2026-43191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43191"
},
{
"name": "CVE-2026-43243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43243"
},
{
"name": "CVE-2026-43300",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43300"
},
{
"name": "CVE-2026-43320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43320"
},
{
"name": "CVE-2026-43284",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43284"
},
{
"name": "CVE-2026-23394",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23394"
},
{
"name": "CVE-2026-31499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31499"
},
{
"name": "CVE-2026-43109",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43109"
},
{
"name": "CVE-2026-43220",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43220"
},
{
"name": "CVE-2026-43494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43494"
},
{
"name": "CVE-2026-43190",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43190"
},
{
"name": "CVE-2026-43255",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43255"
},
{
"name": "CVE-2026-43264",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43264"
},
{
"name": "CVE-2026-43437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43437"
},
{
"name": "CVE-2026-43158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43158"
},
{
"name": "CVE-2026-46243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46243"
},
{
"name": "CVE-2025-10263",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10263"
},
{
"name": "CVE-2025-71274",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-71274"
},
{
"name": "CVE-2026-43061",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43061"
},
{
"name": "CVE-2026-43062",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43062"
},
{
"name": "CVE-2026-43069",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43069"
},
{
"name": "CVE-2026-43124",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43124"
},
{
"name": "CVE-2026-43130",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43130"
},
{
"name": "CVE-2026-43132",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43132"
},
{
"name": "CVE-2026-43134",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43134"
},
{
"name": "CVE-2026-43135",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43135"
},
{
"name": "CVE-2026-43136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43136"
},
{
"name": "CVE-2026-43139",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43139"
},
{
"name": "CVE-2026-43140",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43140"
},
{
"name": "CVE-2026-43141",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43141"
},
{
"name": "CVE-2026-43147",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43147"
},
{
"name": "CVE-2026-43149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43149"
},
{
"name": "CVE-2026-43152",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43152"
},
{
"name": "CVE-2026-43156",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43156"
},
{
"name": "CVE-2026-43159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43159"
},
{
"name": "CVE-2026-43171",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43171"
},
{
"name": "CVE-2026-43180",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43180"
},
{
"name": "CVE-2026-43183",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43183"
},
{
"name": "CVE-2026-43187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43187"
},
{
"name": "CVE-2026-43194",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43194"
},
{
"name": "CVE-2026-43196",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43196"
},
{
"name": "CVE-2026-43202",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43202"
},
{
"name": "CVE-2026-43203",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43203"
},
{
"name": "CVE-2026-43207",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43207"
},
{
"name": "CVE-2026-43211",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43211"
},
{
"name": "CVE-2026-43218",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43218"
},
{
"name": "CVE-2026-43223",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43223"
},
{
"name": "CVE-2026-43226",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43226"
},
{
"name": "CVE-2026-43231",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43231"
},
{
"name": "CVE-2026-43232",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43232"
},
{
"name": "CVE-2026-43233",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43233"
},
{
"name": "CVE-2026-43236",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43236"
},
{
"name": "CVE-2026-43241",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43241"
},
{
"name": "CVE-2026-43242",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43242"
},
{
"name": "CVE-2026-43246",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43246"
},
{
"name": "CVE-2026-43251",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43251"
},
{
"name": "CVE-2026-43257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43257"
},
{
"name": "CVE-2026-43269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43269"
},
{
"name": "CVE-2026-43270",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43270"
},
{
"name": "CVE-2026-43277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43277"
},
{
"name": "CVE-2026-43283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43283"
},
{
"name": "CVE-2026-43287",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43287"
},
{
"name": "CVE-2026-43295",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43295"
},
{
"name": "CVE-2026-43314",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43314"
},
{
"name": "CVE-2026-43316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43316"
},
{
"name": "CVE-2026-43327",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43327"
},
{
"name": "CVE-2026-43336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43336"
},
{
"name": "CVE-2026-43339",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43339"
},
{
"name": "CVE-2026-43340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43340"
},
{
"name": "CVE-2026-43342",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43342"
},
{
"name": "CVE-2026-43343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43343"
},
{
"name": "CVE-2026-43357",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43357"
},
{
"name": "CVE-2026-43370",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43370"
},
{
"name": "CVE-2026-43373",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43373"
},
{
"name": "CVE-2026-43381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43381"
},
{
"name": "CVE-2026-43382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43382"
},
{
"name": "CVE-2026-43383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43383"
},
{
"name": "CVE-2026-43386",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43386"
},
{
"name": "CVE-2026-43387",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43387"
},
{
"name": "CVE-2026-43407",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43407"
},
{
"name": "CVE-2026-43425",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43425"
},
{
"name": "CVE-2026-43426",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43426"
},
{
"name": "CVE-2026-43427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43427"
},
{
"name": "CVE-2026-43428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43428"
},
{
"name": "CVE-2026-43429",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43429"
},
{
"name": "CVE-2026-43430",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43430"
},
{
"name": "CVE-2026-43432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43432"
},
{
"name": "CVE-2026-43445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43445"
},
{
"name": "CVE-2026-43449",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43449"
},
{
"name": "CVE-2026-43450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43450"
},
{
"name": "CVE-2026-43452",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43452"
},
{
"name": "CVE-2026-43458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43458"
},
{
"name": "CVE-2026-43459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43459"
},
{
"name": "CVE-2026-43466",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43466"
},
{
"name": "CVE-2026-43480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43480"
},
{
"name": "CVE-2026-45848",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45848"
},
{
"name": "CVE-2026-45857",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45857"
},
{
"name": "CVE-2026-45862",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45862"
},
{
"name": "CVE-2026-45867",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45867"
},
{
"name": "CVE-2026-45868",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45868"
},
{
"name": "CVE-2026-45869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45869"
},
{
"name": "CVE-2026-45870",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45870"
},
{
"name": "CVE-2026-45871",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45871"
},
{
"name": "CVE-2026-45875",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45875"
},
{
"name": "CVE-2026-45879",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45879"
},
{
"name": "CVE-2026-45883",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45883"
},
{
"name": "CVE-2026-45885",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45885"
},
{
"name": "CVE-2026-45899",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45899"
},
{
"name": "CVE-2026-45912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45912"
},
{
"name": "CVE-2026-45914",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45914"
},
{
"name": "CVE-2026-45916",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45916"
},
{
"name": "CVE-2026-45919",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45919"
},
{
"name": "CVE-2026-45920",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45920"
},
{
"name": "CVE-2026-45923",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45923"
},
{
"name": "CVE-2026-45936",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45936"
},
{
"name": "CVE-2026-45941",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45941"
},
{
"name": "CVE-2026-45948",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45948"
},
{
"name": "CVE-2026-45954",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45954"
},
{
"name": "CVE-2026-45958",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45958"
},
{
"name": "CVE-2026-45964",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45964"
},
{
"name": "CVE-2026-45965",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45965"
},
{
"name": "CVE-2026-45970",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45970"
},
{
"name": "CVE-2026-45974",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45974"
},
{
"name": "CVE-2026-45981",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45981"
},
{
"name": "CVE-2026-45983",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45983"
},
{
"name": "CVE-2026-45985",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45985"
},
{
"name": "CVE-2026-43120",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43120"
},
{
"name": "CVE-2026-43366",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43366"
},
{
"name": "CVE-2026-45834",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45834"
},
{
"name": "CVE-2026-45835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45835"
},
{
"name": "CVE-2026-45838",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45838"
},
{
"name": "CVE-2026-45839",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45839"
},
{
"name": "CVE-2026-45840",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45840"
},
{
"name": "CVE-2026-45841",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45841"
},
{
"name": "CVE-2026-45986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45986"
},
{
"name": "CVE-2026-45987",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45987"
},
{
"name": "CVE-2026-45994",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45994"
},
{
"name": "CVE-2026-45996",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45996"
},
{
"name": "CVE-2026-45997",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45997"
},
{
"name": "CVE-2026-45999",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45999"
},
{
"name": "CVE-2026-46005",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46005"
},
{
"name": "CVE-2026-46006",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46006"
},
{
"name": "CVE-2026-46009",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46009"
},
{
"name": "CVE-2026-46011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46011"
},
{
"name": "CVE-2026-46016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46016"
},
{
"name": "CVE-2026-46018",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46018"
},
{
"name": "CVE-2026-46019",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46019"
},
{
"name": "CVE-2026-46023",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46023"
},
{
"name": "CVE-2026-46024",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46024"
},
{
"name": "CVE-2026-46027",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46027"
},
{
"name": "CVE-2026-46033",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46033"
},
{
"name": "CVE-2026-46037",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46037"
},
{
"name": "CVE-2026-46040",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46040"
},
{
"name": "CVE-2026-46046",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46046"
},
{
"name": "CVE-2026-46048",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46048"
},
{
"name": "CVE-2026-46049",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46049"
},
{
"name": "CVE-2026-46050",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46050"
},
{
"name": "CVE-2026-46051",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46051"
},
{
"name": "CVE-2026-46052",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46052"
},
{
"name": "CVE-2026-46053",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46053"
},
{
"name": "CVE-2026-46056",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46056"
},
{
"name": "CVE-2026-46058",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46058"
},
{
"name": "CVE-2026-46063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46063"
},
{
"name": "CVE-2026-46064",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46064"
},
{
"name": "CVE-2026-46065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46065"
},
{
"name": "CVE-2026-46068",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46068"
},
{
"name": "CVE-2026-46069",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46069"
},
{
"name": "CVE-2026-46075",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46075"
},
{
"name": "CVE-2026-46077",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46077"
},
{
"name": "CVE-2026-46078",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46078"
},
{
"name": "CVE-2026-46079",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46079"
},
{
"name": "CVE-2026-46082",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46082"
},
{
"name": "CVE-2026-46086",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46086"
},
{
"name": "CVE-2026-46088",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46088"
},
{
"name": "CVE-2026-46089",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46089"
},
{
"name": "CVE-2026-46091",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46091"
},
{
"name": "CVE-2026-46099",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46099"
},
{
"name": "CVE-2026-46101",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46101"
},
{
"name": "CVE-2026-46102",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46102"
},
{
"name": "CVE-2026-46103",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46103"
},
{
"name": "CVE-2026-46108",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46108"
},
{
"name": "CVE-2026-46111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46111"
},
{
"name": "CVE-2026-46112",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46112"
},
{
"name": "CVE-2026-46116",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46116"
},
{
"name": "CVE-2026-46119",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46119"
},
{
"name": "CVE-2026-46120",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46120"
},
{
"name": "CVE-2026-46122",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46122"
},
{
"name": "CVE-2026-46124",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46124"
},
{
"name": "CVE-2026-46125",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46125"
},
{
"name": "CVE-2026-46128",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46128"
},
{
"name": "CVE-2026-46131",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46131"
},
{
"name": "CVE-2026-46132",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46132"
},
{
"name": "CVE-2026-46136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46136"
},
{
"name": "CVE-2026-46138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46138"
},
{
"name": "CVE-2026-46146",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46146"
},
{
"name": "CVE-2026-46150",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46150"
},
{
"name": "CVE-2026-46151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46151"
},
{
"name": "CVE-2026-46152",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46152"
},
{
"name": "CVE-2026-46160",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46160"
},
{
"name": "CVE-2026-46161",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46161"
},
{
"name": "CVE-2026-46163",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46163"
},
{
"name": "CVE-2026-46165",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46165"
},
{
"name": "CVE-2026-46167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46167"
},
{
"name": "CVE-2026-46172",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46172"
},
{
"name": "CVE-2026-46173",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46173"
},
{
"name": "CVE-2026-46177",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46177"
},
{
"name": "CVE-2026-46178",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46178"
},
{
"name": "CVE-2026-46185",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46185"
},
{
"name": "CVE-2026-46186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46186"
},
{
"name": "CVE-2026-46187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46187"
},
{
"name": "CVE-2026-46190",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46190"
},
{
"name": "CVE-2026-46191",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46191"
},
{
"name": "CVE-2026-46197",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46197"
},
{
"name": "CVE-2026-46198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46198"
},
{
"name": "CVE-2026-46199",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46199"
},
{
"name": "CVE-2026-46204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46204"
},
{
"name": "CVE-2026-46205",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46205"
},
{
"name": "CVE-2026-46206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46206"
},
{
"name": "CVE-2026-46212",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46212"
},
{
"name": "CVE-2026-46214",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46214"
},
{
"name": "CVE-2026-46218",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46218"
},
{
"name": "CVE-2026-46219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46219"
},
{
"name": "CVE-2026-46220",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46220"
},
{
"name": "CVE-2026-46225",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46225"
},
{
"name": "CVE-2026-46227",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46227"
},
{
"name": "CVE-2026-46229",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46229"
},
{
"name": "CVE-2026-46230",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46230"
},
{
"name": "CVE-2026-46231",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46231"
},
{
"name": "CVE-2026-46233",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46233"
},
{
"name": "CVE-2026-46236",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46236"
},
{
"name": "CVE-2026-46238",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46238"
},
{
"name": "CVE-2026-31568",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31568"
},
{
"name": "CVE-2026-43501",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43501"
},
{
"name": "CVE-2026-43303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43303"
},
{
"name": "CVE-2026-43260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43260"
},
{
"name": "CVE-2026-43279",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43279"
},
{
"name": "CVE-2026-46166",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46166"
},
{
"name": "CVE-2026-46331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46331"
},
{
"name": "CVE-2026-31560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31560"
},
{
"name": "CVE-2026-31663",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31663"
},
{
"name": "CVE-2026-46216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46216"
},
{
"name": "CVE-2026-46244",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46244"
},
{
"name": "CVE-2026-46320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46320"
},
{
"name": "CVE-2026-46321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46321"
},
{
"name": "CVE-2026-46322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46322"
},
{
"name": "CVE-2026-52908",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52908"
},
{
"name": "CVE-2026-52909",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52909"
},
{
"name": "CVE-2026-43198",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43198"
},
{
"name": "CVE-2026-43406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43406"
},
{
"name": "CVE-2026-43470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43470"
},
{
"name": "CVE-2026-46090",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46090"
},
{
"name": "CVE-2026-46259",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46259"
},
{
"name": "CVE-2026-46274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46274"
},
{
"name": "CVE-2026-46285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46285"
},
{
"name": "CVE-2026-46289",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46289"
},
{
"name": "CVE-2026-46291",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46291"
},
{
"name": "CVE-2026-46307",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46307"
},
{
"name": "CVE-2026-46312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46312"
},
{
"name": "CVE-2026-46319",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46319"
},
{
"name": "CVE-2026-46275",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46275"
},
{
"name": "CVE-2026-52915",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52915"
},
{
"name": "CVE-2026-52916",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52916"
},
{
"name": "CVE-2026-52919",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52919"
},
{
"name": "CVE-2026-52922",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52922"
},
{
"name": "CVE-2026-52923",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52923"
},
{
"name": "CVE-2026-52924",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52924"
},
{
"name": "CVE-2026-52926",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52926"
},
{
"name": "CVE-2026-52931",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52931"
},
{
"name": "CVE-2026-52943",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52943"
},
{
"name": "CVE-2026-53080",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53080"
},
{
"name": "CVE-2026-53133",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53133"
},
{
"name": "CVE-2026-53135",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53135"
},
{
"name": "CVE-2026-53143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53143"
},
{
"name": "CVE-2026-53146",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53146"
},
{
"name": "CVE-2026-53147",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53147"
},
{
"name": "CVE-2026-53148",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53148"
},
{
"name": "CVE-2026-53149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53149"
},
{
"name": "CVE-2026-53150",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53150"
},
{
"name": "CVE-2026-53158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53158"
},
{
"name": "CVE-2026-53159",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53159"
},
{
"name": "CVE-2026-53160",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53160"
},
{
"name": "CVE-2026-53161",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53161"
},
{
"name": "CVE-2026-53176",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53176"
},
{
"name": "CVE-2026-53181",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53181"
},
{
"name": "CVE-2026-53182",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53182"
},
{
"name": "CVE-2026-53186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53186"
},
{
"name": "CVE-2026-53194",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53194"
},
{
"name": "CVE-2026-53196",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53196"
},
{
"name": "CVE-2026-53209",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53209"
},
{
"name": "CVE-2026-53213",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53213"
},
{
"name": "CVE-2026-53215",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53215"
},
{
"name": "CVE-2026-53217",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53217"
},
{
"name": "CVE-2026-53218",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53218"
},
{
"name": "CVE-2026-53225",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53225"
},
{
"name": "CVE-2026-53227",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53227"
},
{
"name": "CVE-2026-53237",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53237"
},
{
"name": "CVE-2026-53239",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53239"
},
{
"name": "CVE-2026-53242",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53242"
},
{
"name": "CVE-2026-53245",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53245"
},
{
"name": "CVE-2026-53249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53249"
},
{
"name": "CVE-2026-53253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53253"
},
{
"name": "CVE-2026-53254",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53254"
},
{
"name": "CVE-2026-53255",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53255"
},
{
"name": "CVE-2026-53263",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53263"
},
{
"name": "CVE-2026-53266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53266"
},
{
"name": "CVE-2026-53268",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53268"
},
{
"name": "CVE-2026-53274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53274"
},
{
"name": "CVE-2026-31771",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31771"
},
{
"name": "CVE-2026-43074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43074"
},
{
"name": "CVE-2026-52918",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52918"
},
{
"name": "CVE-2026-53137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53137"
},
{
"name": "CVE-2026-53168",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53168"
},
{
"name": "CVE-2026-53190",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53190"
},
{
"name": "CVE-2026-53195",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53195"
},
{
"name": "CVE-2025-71286",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-71286"
},
{
"name": "CVE-2025-71291",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-71291"
},
{
"name": "CVE-2025-71297",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-71297"
},
{
"name": "CVE-2025-71305",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-71305"
},
{
"name": "CVE-2026-31687",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31687"
},
{
"name": "CVE-2026-31701",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31701"
},
{
"name": "CVE-2026-43058",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43058"
},
{
"name": "CVE-2026-43072",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43072"
},
{
"name": "CVE-2026-43083",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43083"
},
{
"name": "CVE-2026-43117",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43117"
},
{
"name": "CVE-2026-43123",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43123"
},
{
"name": "CVE-2026-43128",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43128"
},
{
"name": "CVE-2026-43133",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43133"
},
{
"name": "CVE-2026-43137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43137"
},
{
"name": "CVE-2026-43143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43143"
},
{
"name": "CVE-2026-43145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43145"
},
{
"name": "CVE-2026-43157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43157"
},
{
"name": "CVE-2026-43167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43167"
},
{
"name": "CVE-2026-43169",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43169"
},
{
"name": "CVE-2026-43175",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43175"
},
{
"name": "CVE-2026-43182",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43182"
},
{
"name": "CVE-2026-43189",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43189"
},
{
"name": "CVE-2026-43199",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43199"
},
{
"name": "CVE-2026-43200",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43200"
},
{
"name": "CVE-2026-43205",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43205"
},
{
"name": "CVE-2026-43215",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43215"
},
{
"name": "CVE-2026-43221",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43221"
},
{
"name": "CVE-2026-43222",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43222"
},
{
"name": "CVE-2026-43225",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43225"
},
{
"name": "CVE-2026-43238",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43238"
},
{
"name": "CVE-2026-43244",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43244"
},
{
"name": "CVE-2026-43248",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43248"
},
{
"name": "CVE-2026-43253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43253"
},
{
"name": "CVE-2026-43256",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43256"
},
{
"name": "CVE-2026-43278",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43278"
},
{
"name": "CVE-2026-43291",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43291"
},
{
"name": "CVE-2026-43302",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43302"
},
{
"name": "CVE-2026-43304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43304"
},
{
"name": "CVE-2026-43312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43312"
},
{
"name": "CVE-2026-43313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43313"
},
{
"name": "CVE-2026-43318",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43318"
},
{
"name": "CVE-2026-43319",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43319"
},
{
"name": "CVE-2026-43384",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43384"
},
{
"name": "CVE-2026-43491",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43491"
},
{
"name": "CVE-2026-43493",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43493"
},
{
"name": "CVE-2026-45851",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45851"
},
{
"name": "CVE-2026-45861",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45861"
},
{
"name": "CVE-2026-45877",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45877"
},
{
"name": "CVE-2026-45880",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45880"
},
{
"name": "CVE-2026-45881",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45881"
},
{
"name": "CVE-2026-45884",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45884"
},
{
"name": "CVE-2026-45891",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45891"
},
{
"name": "CVE-2026-45902",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45902"
},
{
"name": "CVE-2026-45921",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45921"
},
{
"name": "CVE-2026-45928",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45928"
},
{
"name": "CVE-2026-45946",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45946"
},
{
"name": "CVE-2026-45947",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45947"
},
{
"name": "CVE-2026-45969",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45969"
},
{
"name": "CVE-2026-45976",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45976"
},
{
"name": "CVE-2026-45982",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45982"
},
{
"name": "CVE-2026-46059",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46059"
},
{
"name": "CVE-2026-46071",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46071"
},
{
"name": "CVE-2026-46076",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46076"
},
{
"name": "CVE-2026-46092",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46092"
},
{
"name": "CVE-2026-46093",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46093"
},
{
"name": "CVE-2026-46247",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46247"
},
{
"name": "CVE-2026-46249",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46249"
},
{
"name": "CVE-2026-46253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46253"
},
{
"name": "CVE-2026-46254",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46254"
},
{
"name": "CVE-2026-46261",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46261"
},
{
"name": "CVE-2026-46266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46266"
},
{
"name": "CVE-2026-46267",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46267"
},
{
"name": "CVE-2026-46270",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46270"
},
{
"name": "CVE-2026-46276",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46276"
},
{
"name": "CVE-2026-46286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46286"
},
{
"name": "CVE-2026-46328",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46328"
},
{
"name": "CVE-2026-52904",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52904"
},
{
"name": "CVE-2026-52933",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52933"
},
{
"name": "CVE-2026-43036",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43036"
},
{
"name": "CVE-2026-43053",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43053"
},
{
"name": "CVE-2026-43101",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43101"
},
{
"name": "CVE-2026-43119",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43119"
},
{
"name": "CVE-2026-43345",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43345"
},
{
"name": "CVE-2026-43405",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43405"
},
{
"name": "CVE-2026-43469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43469"
},
{
"name": "CVE-2026-45894",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45894"
},
{
"name": "CVE-2026-45940",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45940"
},
{
"name": "CVE-2026-45961",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45961"
},
{
"name": "CVE-2026-46162",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46162"
},
{
"name": "CVE-2026-53325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53325"
},
{
"name": "CVE-2026-53362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53362"
},
{
"name": "CVE-2026-43010",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43010"
},
{
"name": "CVE-2026-46242",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46242"
},
{
"name": "CVE-2026-46252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46252"
},
{
"name": "CVE-2026-52975",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52975"
},
{
"name": "CVE-2026-53070",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53070"
},
{
"name": "CVE-2026-53139",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53139"
},
{
"name": "CVE-2026-53167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53167"
},
{
"name": "CVE-2026-53359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53359"
},
{
"name": "CVE-2026-43064",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43064"
},
{
"name": "CVE-2026-43080",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43080"
},
{
"name": "CVE-2026-43085",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43085"
},
{
"name": "CVE-2026-43089",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43089"
},
{
"name": "CVE-2026-43093",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43093"
},
{
"name": "CVE-2026-43094",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43094"
},
{
"name": "CVE-2026-43098",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43098"
},
{
"name": "CVE-2026-43104",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43104"
},
{
"name": "CVE-2026-43105",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43105"
},
{
"name": "CVE-2026-43111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43111"
},
{
"name": "CVE-2026-43113",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43113"
},
{
"name": "CVE-2026-43492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43492"
},
{
"name": "CVE-2026-43496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43496"
},
{
"name": "CVE-2026-43497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43497"
},
{
"name": "CVE-2026-43502",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43502"
},
{
"name": "CVE-2026-46143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46143"
},
{
"name": "CVE-2026-46179",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46179"
},
{
"name": "CVE-2026-46184",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46184"
},
{
"name": "CVE-2026-46235",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46235"
},
{
"name": "CVE-2026-46294",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46294"
},
{
"name": "CVE-2026-46314",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46314"
},
{
"name": "CVE-2026-52914",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52914"
},
{
"name": "CVE-2026-52948",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52948"
},
{
"name": "CVE-2026-52954",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52954"
},
{
"name": "CVE-2026-52955",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52955"
},
{
"name": "CVE-2026-52957",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52957"
},
{
"name": "CVE-2026-52958",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52958"
},
{
"name": "CVE-2026-52962",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52962"
},
{
"name": "CVE-2026-52963",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52963"
},
{
"name": "CVE-2026-52969",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52969"
},
{
"name": "CVE-2026-52972",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52972"
},
{
"name": "CVE-2026-52981",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52981"
},
{
"name": "CVE-2026-52982",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52982"
},
{
"name": "CVE-2026-52989",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52989"
},
{
"name": "CVE-2026-52993",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52993"
},
{
"name": "CVE-2026-52995",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52995"
},
{
"name": "CVE-2026-53003",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53003"
},
{
"name": "CVE-2026-53004",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53004"
},
{
"name": "CVE-2026-23451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23451"
},
{
"name": "CVE-2026-43022",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43022"
},
{
"name": "CVE-2026-43034",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43034"
},
{
"name": "CVE-2026-43081",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43081"
},
{
"name": "CVE-2026-43086",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43086"
},
{
"name": "CVE-2026-43107",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43107"
},
{
"name": "CVE-2026-43456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43456"
},
{
"name": "CVE-2026-46330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46330"
},
{
"name": "CVE-2026-53053",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53053"
},
{
"name": "CVE-2026-53122",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53122"
},
{
"name": "CVE-2026-53281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53281"
},
{
"name": "CVE-2026-53016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53016"
},
{
"name": "CVE-2026-53021",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53021"
},
{
"name": "CVE-2026-53022",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53022"
},
{
"name": "CVE-2026-53035",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53035"
},
{
"name": "CVE-2026-53036",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53036"
},
{
"name": "CVE-2026-53037",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53037"
},
{
"name": "CVE-2026-53039",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53039"
},
{
"name": "CVE-2026-53040",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53040"
},
{
"name": "CVE-2026-53041",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53041"
},
{
"name": "CVE-2026-53045",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53045"
},
{
"name": "CVE-2026-53047",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53047"
},
{
"name": "CVE-2026-53049",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53049"
},
{
"name": "CVE-2026-53050",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53050"
},
{
"name": "CVE-2026-53052",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53052"
},
{
"name": "CVE-2026-53056",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53056"
},
{
"name": "CVE-2026-53060",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53060"
},
{
"name": "CVE-2026-53065",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53065"
},
{
"name": "CVE-2026-53066",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53066"
},
{
"name": "CVE-2026-53068",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53068"
},
{
"name": "CVE-2026-53071",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53071"
},
{
"name": "CVE-2026-53072",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53072"
},
{
"name": "CVE-2026-53073",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53073"
},
{
"name": "CVE-2026-53075",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53075"
},
{
"name": "CVE-2026-53086",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53086"
},
{
"name": "CVE-2026-53093",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53093"
},
{
"name": "CVE-2026-53112",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53112"
},
{
"name": "CVE-2026-53136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53136"
},
{
"name": "CVE-2026-53208",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53208"
},
{
"name": "CVE-2026-53216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53216"
},
{
"name": "CVE-2026-53256",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53256"
},
{
"name": "CVE-2026-53279",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53279"
},
{
"name": "CVE-2026-53287",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53287"
},
{
"name": "CVE-2026-53306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53306"
},
{
"name": "CVE-2026-53329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53329"
},
{
"name": "CVE-2026-53339",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53339"
},
{
"name": "CVE-2026-53350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53350"
},
{
"name": "CVE-2026-53355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53355"
},
{
"name": "CVE-2026-53356",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53356"
},
{
"name": "CVE-2026-53357",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53357"
},
{
"name": "CVE-2026-52936",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52936"
},
{
"name": "CVE-2026-53013",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53013"
},
{
"name": "CVE-2026-53058",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53058"
},
{
"name": "CVE-2026-53293",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53293"
},
{
"name": "CVE-2026-53347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53347"
},
{
"name": "CVE-2025-71314",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-71314"
},
{
"name": "CVE-2026-31513",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31513"
},
{
"name": "CVE-2026-31727",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31727"
},
{
"name": "CVE-2026-31743",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31743"
},
{
"name": "CVE-2026-31765",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31765"
},
{
"name": "CVE-2026-43090",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43090"
},
{
"name": "CVE-2026-43118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43118"
},
{
"name": "CVE-2026-43161",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43161"
},
{
"name": "CVE-2026-43177",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43177"
},
{
"name": "CVE-2026-43204",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43204"
},
{
"name": "CVE-2026-43213",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43213"
},
{
"name": "CVE-2026-43240",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43240"
},
{
"name": "CVE-2026-43294",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43294"
},
{
"name": "CVE-2026-43298",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43298"
},
{
"name": "CVE-2026-43337",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43337"
},
{
"name": "CVE-2026-43346",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43346"
},
{
"name": "CVE-2026-43351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43351"
},
{
"name": "CVE-2026-43353",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43353"
},
{
"name": "CVE-2026-43374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43374"
},
{
"name": "CVE-2026-43403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43403"
},
{
"name": "CVE-2026-43443",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43443"
},
{
"name": "CVE-2026-43444",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43444"
},
{
"name": "CVE-2026-43465",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43465"
},
{
"name": "CVE-2026-45853",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45853"
},
{
"name": "CVE-2026-45888",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45888"
},
{
"name": "CVE-2026-45901",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45901"
},
{
"name": "CVE-2026-45922",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45922"
},
{
"name": "CVE-2026-45933",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45933"
},
{
"name": "CVE-2026-45963",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45963"
},
{
"name": "CVE-2026-46263",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46263"
},
{
"name": "CVE-2026-53140",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53140"
},
{
"name": "CVE-2026-53144",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53144"
},
{
"name": "CVE-2026-53156",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53156"
},
{
"name": "CVE-2026-53178",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53178"
},
{
"name": "CVE-2026-53192",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53192"
},
{
"name": "CVE-2026-53202",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53202"
},
{
"name": "CVE-2026-53203",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53203"
},
{
"name": "CVE-2026-53224",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53224"
},
{
"name": "CVE-2026-53229",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53229"
},
{
"name": "CVE-2026-53241",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53241"
},
{
"name": "CVE-2026-53246",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53246"
},
{
"name": "CVE-2026-53258",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53258"
},
{
"name": "CVE-2026-53262",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53262"
},
{
"name": "CVE-2026-53272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53272"
},
{
"name": "CVE-2026-53366",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53366"
},
{
"name": "CVE-2026-31730",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31730"
},
{
"name": "CVE-2026-43007",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43007"
},
{
"name": "CVE-2026-43016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43016"
},
{
"name": "CVE-2026-43019",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43019"
},
{
"name": "CVE-2026-43092",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43092"
},
{
"name": "CVE-2026-43129",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43129"
},
{
"name": "CVE-2026-43162",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43162"
},
{
"name": "CVE-2026-43324",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43324"
},
{
"name": "CVE-2026-43380",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43380"
},
{
"name": "CVE-2026-43395",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43395"
},
{
"name": "CVE-2026-43397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43397"
},
{
"name": "CVE-2026-43412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43412"
},
{
"name": "CVE-2026-43415",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43415"
},
{
"name": "CVE-2026-43436",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43436"
},
{
"name": "CVE-2026-43457",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43457"
},
{
"name": "CVE-2026-43467",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43467"
},
{
"name": "CVE-2026-43468",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43468"
},
{
"name": "CVE-2026-43471",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43471"
},
{
"name": "CVE-2026-43473",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43473"
},
{
"name": "CVE-2026-43476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43476"
},
{
"name": "CVE-2026-43488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43488"
},
{
"name": "CVE-2026-45837",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45837"
},
{
"name": "CVE-2026-45858",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45858"
},
{
"name": "CVE-2026-45911",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45911"
},
{
"name": "CVE-2026-46140",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46140"
},
{
"name": "CVE-2026-46201",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46201"
},
{
"name": "CVE-2026-46207",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46207"
},
{
"name": "CVE-2026-46211",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46211"
},
{
"name": "CVE-2026-46232",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46232"
},
{
"name": "CVE-2026-46313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46313"
},
{
"name": "CVE-2026-52951",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52951"
},
{
"name": "CVE-2026-52953",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52953"
},
{
"name": "CVE-2026-52956",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52956"
},
{
"name": "CVE-2026-52961",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52961"
},
{
"name": "CVE-2026-52964",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52964"
},
{
"name": "CVE-2026-52976",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52976"
},
{
"name": "CVE-2026-52980",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52980"
},
{
"name": "CVE-2026-53009",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53009"
},
{
"name": "CVE-2026-53015",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53015"
},
{
"name": "CVE-2026-53078",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53078"
},
{
"name": "CVE-2026-53081",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53081"
},
{
"name": "CVE-2026-53090",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53090"
},
{
"name": "CVE-2026-53098",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53098"
},
{
"name": "CVE-2026-53103",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53103"
},
{
"name": "CVE-2026-53285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53285"
},
{
"name": "CVE-2026-53286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53286"
},
{
"name": "CVE-2026-53313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53313"
},
{
"name": "CVE-2026-53358",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53358"
},
{
"name": "CVE-2026-53360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53360"
}
],
"initial_release_date": "2026-07-24T00:00:00",
"last_revision_date": "2026-07-24T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0927",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-07-24T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de SUSE. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de SUSE",
"vendor_advisories": [
{
"published_at": "2026-07-20",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22762-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622762-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22735-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622735-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22693-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622693-1"
},
{
"published_at": "2026-07-21",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22769-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622769-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22696-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622696-1"
},
{
"published_at": "2026-07-21",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:3166-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20263166-1"
},
{
"published_at": "2026-07-21",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22742-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622742-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22732-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622732-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22698-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622698-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22682-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622682-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22751-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622751-1"
},
{
"published_at": "2026-07-20",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:3130-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20263130-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22748-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622748-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22691-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622691-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22677-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622677-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22685-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622685-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22734-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622734-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22749-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622749-1"
},
{
"published_at": "2026-07-20",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22761-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622761-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22680-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622680-1"
},
{
"published_at": "2026-07-17",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:3089-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20263089-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22690-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622690-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22733-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622733-1"
},
{
"published_at": "2026-07-18",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22755-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622755-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22687-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622687-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22686-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622686-1"
},
{
"published_at": "2026-07-20",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22758-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622758-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22694-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622694-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22692-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622692-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22684-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622684-1"
},
{
"published_at": "2026-07-20",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22759-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622759-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22695-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622695-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22681-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622681-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22676-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622676-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22678-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622678-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22683-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622683-1"
},
{
"published_at": "2026-07-20",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22766-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622766-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22679-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622679-1"
},
{
"published_at": "2026-07-21",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:3156-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20263156-1"
},
{
"published_at": "2026-07-20",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22763-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622763-1"
},
{
"published_at": "2026-07-16",
"title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SU-2026:22697-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622697-1"
}
]
}
CVE-2026-46220 (GCVE-0-2026-46220)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-06-14 18:03
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
sdma_v4_0_ring_emit_fence() contains two BUG_ON(addr & 0x3) assertions
that verify fence writeback addresses are dword-aligned. These
assertions can be reached from unprivileged userspace via crafted
DRM_IOCTL_AMDGPU_CS submissions, causing a fatal kernel panic in a
scheduler worker thread.
Replace both BUG_ON() calls with WARN_ON() to log the condition without
crashing the kernel. A misaligned fence address at this point indicates
a driver bug, but crashing the kernel is never the correct response when
the assertion is reachable from userspace.
The CS IOCTL path is the correct place to filter invalid submissions;
the ring emission callback is too late to do anything about it.
(cherry picked from commit b90250bd933afd1ba94d86d6b13821997b22b18e)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 Version: 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 Version: 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 Version: 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 Version: 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 Version: 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 Version: 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 Version: 2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ecaa80318e900ca0c3f687742ede33b41cfd2f8e",
"status": "affected",
"version": "2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7",
"versionType": "git"
},
{
"lessThan": "25e7d56a39657d56d1ea6d78992f7ed15dedb412",
"status": "affected",
"version": "2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7",
"versionType": "git"
},
{
"lessThan": "d4c56932d29773e278be6a65a5384a36c95b89a4",
"status": "affected",
"version": "2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7",
"versionType": "git"
},
{
"lessThan": "4f7ca00fa91daf0795ec6b3b130c5ebba1f155fe",
"status": "affected",
"version": "2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7",
"versionType": "git"
},
{
"lessThan": "d331fb241a4602253976ddd65144a8ba2b05665d",
"status": "affected",
"version": "2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7",
"versionType": "git"
},
{
"lessThan": "0b91ea46bb68abf98a082bf239092253bbd6aaa2",
"status": "affected",
"version": "2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7",
"versionType": "git"
},
{
"lessThan": "a4fd82fb0757c180bf622907397c528b89a827b2",
"status": "affected",
"version": "2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7",
"versionType": "git"
},
{
"lessThan": "78d2e624fa073c14970aa097adcf3ea31c157a66",
"status": "affected",
"version": "2130f89ced2cc0f5113bb427c1cbc7a4ca7729c7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission\n\nsdma_v4_0_ring_emit_fence() contains two BUG_ON(addr \u0026 0x3) assertions\nthat verify fence writeback addresses are dword-aligned. These\nassertions can be reached from unprivileged userspace via crafted\nDRM_IOCTL_AMDGPU_CS submissions, causing a fatal kernel panic in a\nscheduler worker thread.\n\nReplace both BUG_ON() calls with WARN_ON() to log the condition without\ncrashing the kernel. A misaligned fence address at this point indicates\na driver bug, but crashing the kernel is never the correct response when\nthe assertion is reachable from userspace.\n\nThe CS IOCTL path is the correct place to filter invalid submissions;\nthe ring emission callback is too late to do anything about it.\n\n(cherry picked from commit b90250bd933afd1ba94d86d6b13821997b22b18e)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:03:38.077Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ecaa80318e900ca0c3f687742ede33b41cfd2f8e"
},
{
"url": "https://git.kernel.org/stable/c/25e7d56a39657d56d1ea6d78992f7ed15dedb412"
},
{
"url": "https://git.kernel.org/stable/c/d4c56932d29773e278be6a65a5384a36c95b89a4"
},
{
"url": "https://git.kernel.org/stable/c/4f7ca00fa91daf0795ec6b3b130c5ebba1f155fe"
},
{
"url": "https://git.kernel.org/stable/c/d331fb241a4602253976ddd65144a8ba2b05665d"
},
{
"url": "https://git.kernel.org/stable/c/0b91ea46bb68abf98a082bf239092253bbd6aaa2"
},
{
"url": "https://git.kernel.org/stable/c/a4fd82fb0757c180bf622907397c528b89a827b2"
},
{
"url": "https://git.kernel.org/stable/c/78d2e624fa073c14970aa097adcf3ea31c157a66"
}
],
"title": "drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46220",
"datePublished": "2026-05-28T09:40:35.971Z",
"dateReserved": "2026-05-13T15:03:33.106Z",
"dateUpdated": "2026-06-14T18:03:38.077Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31580 (GCVE-0-2026-31580)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bcache: fix cached_dev.sb_bio use-after-free and crash
In our production environment, we have received multiple crash reports
regarding libceph, which have caught our attention:
```
[6888366.280350] Call Trace:
[6888366.280452] blk_update_request+0x14e/0x370
[6888366.280561] blk_mq_end_request+0x1a/0x130
[6888366.280671] rbd_img_handle_request+0x1a0/0x1b0 [rbd]
[6888366.280792] rbd_obj_handle_request+0x32/0x40 [rbd]
[6888366.280903] __complete_request+0x22/0x70 [libceph]
[6888366.281032] osd_dispatch+0x15e/0xb40 [libceph]
[6888366.281164] ? inet_recvmsg+0x5b/0xd0
[6888366.281272] ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]
[6888366.281405] ceph_con_process_message+0x79/0x140 [libceph]
[6888366.281534] ceph_con_v1_try_read+0x5d7/0xf30 [libceph]
[6888366.281661] ceph_con_workfn+0x329/0x680 [libceph]
```
After analyzing the coredump file, we found that the address of
dc->sb_bio has been freed. We know that cached_dev is only freed when it
is stopped.
Since sb_bio is a part of struct cached_dev, rather than an alloc every
time. If the device is stopped while writing to the superblock, the
released address will be accessed at endio.
This patch hopes to wait for sb_write to complete in cached_dev_free.
It should be noted that we analyzed the cause of the problem, then tell
all details to the QWEN and adopted the modifications it made.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 Version: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 Version: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 Version: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 Version: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 Version: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 Version: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 Version: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 Version: cafe563591446cf80bfbc2fe3bc72a2e36cf1060 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/bcache/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "81f44ed8c3f54abb7561ece774ea4cca5070b2f2",
"status": "affected",
"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
"versionType": "git"
},
{
"lessThan": "f50e7c325ab1207fe941555bcff659f6d7050572",
"status": "affected",
"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
"versionType": "git"
},
{
"lessThan": "9467d360be70e6ee55b0c1cd2a1f1424f57b5b85",
"status": "affected",
"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
"versionType": "git"
},
{
"lessThan": "47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1",
"status": "affected",
"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
"versionType": "git"
},
{
"lessThan": "add4982510f3b7c318a2dd7438bdc9c63171e753",
"status": "affected",
"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
"versionType": "git"
},
{
"lessThan": "2d6965581e164fa2ba3f7652ddae5535f6336576",
"status": "affected",
"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
"versionType": "git"
},
{
"lessThan": "4f71c8ba2dc009042493021d94a9718fbe2ebf27",
"status": "affected",
"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
"versionType": "git"
},
{
"lessThan": "383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9",
"status": "affected",
"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
"versionType": "git"
},
{
"lessThan": "fec114a98b8735ee89c75216c45a78e28be0f128",
"status": "affected",
"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/bcache/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix cached_dev.sb_bio use-after-free and crash\n\nIn our production environment, we have received multiple crash reports\nregarding libceph, which have caught our attention:\n\n```\n[6888366.280350] Call Trace:\n[6888366.280452] blk_update_request+0x14e/0x370\n[6888366.280561] blk_mq_end_request+0x1a/0x130\n[6888366.280671] rbd_img_handle_request+0x1a0/0x1b0 [rbd]\n[6888366.280792] rbd_obj_handle_request+0x32/0x40 [rbd]\n[6888366.280903] __complete_request+0x22/0x70 [libceph]\n[6888366.281032] osd_dispatch+0x15e/0xb40 [libceph]\n[6888366.281164] ? inet_recvmsg+0x5b/0xd0\n[6888366.281272] ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]\n[6888366.281405] ceph_con_process_message+0x79/0x140 [libceph]\n[6888366.281534] ceph_con_v1_try_read+0x5d7/0xf30 [libceph]\n[6888366.281661] ceph_con_workfn+0x329/0x680 [libceph]\n```\n\nAfter analyzing the coredump file, we found that the address of\ndc-\u003esb_bio has been freed. We know that cached_dev is only freed when it\nis stopped.\n\nSince sb_bio is a part of struct cached_dev, rather than an alloc every\ntime. If the device is stopped while writing to the superblock, the\nreleased address will be accessed at endio.\n\nThis patch hopes to wait for sb_write to complete in cached_dev_free.\n\nIt should be noted that we analyzed the cause of the problem, then tell\nall details to the QWEN and adopted the modifications it made."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:42:06.405Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/81f44ed8c3f54abb7561ece774ea4cca5070b2f2"
},
{
"url": "https://git.kernel.org/stable/c/f50e7c325ab1207fe941555bcff659f6d7050572"
},
{
"url": "https://git.kernel.org/stable/c/9467d360be70e6ee55b0c1cd2a1f1424f57b5b85"
},
{
"url": "https://git.kernel.org/stable/c/47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1"
},
{
"url": "https://git.kernel.org/stable/c/add4982510f3b7c318a2dd7438bdc9c63171e753"
},
{
"url": "https://git.kernel.org/stable/c/2d6965581e164fa2ba3f7652ddae5535f6336576"
},
{
"url": "https://git.kernel.org/stable/c/4f71c8ba2dc009042493021d94a9718fbe2ebf27"
},
{
"url": "https://git.kernel.org/stable/c/383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9"
},
{
"url": "https://git.kernel.org/stable/c/fec114a98b8735ee89c75216c45a78e28be0f128"
}
],
"title": "bcache: fix cached_dev.sb_bio use-after-free and crash",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31580",
"datePublished": "2026-04-24T14:42:10.874Z",
"dateReserved": "2026-03-09T15:48:24.119Z",
"dateUpdated": "2026-06-14T17:42:06.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31770 (GCVE-0-2026-31770)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-05-11 22:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (occ) Fix division by zero in occ_show_power_1()
In occ_show_power_1() case 1, the accumulator is divided by
update_tag without checking for zero. If no samples have been
collected yet (e.g. during early boot when the sensor block is
included but hasn't been updated), update_tag is zero, causing
a kernel divide-by-zero crash.
The 2019 fix in commit 211186cae14d ("hwmon: (occ) Fix division by
zero issue") only addressed occ_get_powr_avg() used by
occ_show_power_2() and occ_show_power_a0(). This separate code
path in occ_show_power_1() was missed.
Fix this by reusing the existing occ_get_powr_avg() helper, which
already handles the zero-sample case and uses mul_u64_u32_div()
to multiply before dividing for better precision. Move the helper
above occ_show_power_1() so it is visible at the call site.
[groeck: Fix alignment problems reported by checkpatch]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c10e753d43ebd1d17e1c62bcee20c6124c2c7cca Version: c10e753d43ebd1d17e1c62bcee20c6124c2c7cca Version: c10e753d43ebd1d17e1c62bcee20c6124c2c7cca Version: c10e753d43ebd1d17e1c62bcee20c6124c2c7cca Version: c10e753d43ebd1d17e1c62bcee20c6124c2c7cca Version: c10e753d43ebd1d17e1c62bcee20c6124c2c7cca Version: c10e753d43ebd1d17e1c62bcee20c6124c2c7cca Version: c10e753d43ebd1d17e1c62bcee20c6124c2c7cca |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/occ/common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c7d3712362c8ab8f82f441b649d9e446e7b9aa9d",
"status": "affected",
"version": "c10e753d43ebd1d17e1c62bcee20c6124c2c7cca",
"versionType": "git"
},
{
"lessThan": "53e6175756b8c474b6247bbcea0aad3d68357475",
"status": "affected",
"version": "c10e753d43ebd1d17e1c62bcee20c6124c2c7cca",
"versionType": "git"
},
{
"lessThan": "2502684b9e835de9a992ec47c3e6c6faabe3858d",
"status": "affected",
"version": "c10e753d43ebd1d17e1c62bcee20c6124c2c7cca",
"versionType": "git"
},
{
"lessThan": "37ae8fadc74ed68e5bc364ffd17746d88e449ae3",
"status": "affected",
"version": "c10e753d43ebd1d17e1c62bcee20c6124c2c7cca",
"versionType": "git"
},
{
"lessThan": "bbbefc48f6617cfb738dcff7f44beb50b5dfeb38",
"status": "affected",
"version": "c10e753d43ebd1d17e1c62bcee20c6124c2c7cca",
"versionType": "git"
},
{
"lessThan": "243d55bd3f08cb15eee9d63f4716d4d4cdd760f5",
"status": "affected",
"version": "c10e753d43ebd1d17e1c62bcee20c6124c2c7cca",
"versionType": "git"
},
{
"lessThan": "7b89ce0c98bf3015f493ca4285b2d1056cd8c733",
"status": "affected",
"version": "c10e753d43ebd1d17e1c62bcee20c6124c2c7cca",
"versionType": "git"
},
{
"lessThan": "39e2a5bf970402a8530a319cf06122e216ba57b8",
"status": "affected",
"version": "c10e753d43ebd1d17e1c62bcee20c6124c2c7cca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/occ/common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (occ) Fix division by zero in occ_show_power_1()\n\nIn occ_show_power_1() case 1, the accumulator is divided by\nupdate_tag without checking for zero. If no samples have been\ncollected yet (e.g. during early boot when the sensor block is\nincluded but hasn\u0027t been updated), update_tag is zero, causing\na kernel divide-by-zero crash.\n\nThe 2019 fix in commit 211186cae14d (\"hwmon: (occ) Fix division by\nzero issue\") only addressed occ_get_powr_avg() used by\nocc_show_power_2() and occ_show_power_a0(). This separate code\npath in occ_show_power_1() was missed.\n\nFix this by reusing the existing occ_get_powr_avg() helper, which\nalready handles the zero-sample case and uses mul_u64_u32_div()\nto multiply before dividing for better precision. Move the helper\nabove occ_show_power_1() so it is visible at the call site.\n\n[groeck: Fix alignment problems reported by checkpatch]"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:15:28.590Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c7d3712362c8ab8f82f441b649d9e446e7b9aa9d"
},
{
"url": "https://git.kernel.org/stable/c/53e6175756b8c474b6247bbcea0aad3d68357475"
},
{
"url": "https://git.kernel.org/stable/c/2502684b9e835de9a992ec47c3e6c6faabe3858d"
},
{
"url": "https://git.kernel.org/stable/c/37ae8fadc74ed68e5bc364ffd17746d88e449ae3"
},
{
"url": "https://git.kernel.org/stable/c/bbbefc48f6617cfb738dcff7f44beb50b5dfeb38"
},
{
"url": "https://git.kernel.org/stable/c/243d55bd3f08cb15eee9d63f4716d4d4cdd760f5"
},
{
"url": "https://git.kernel.org/stable/c/7b89ce0c98bf3015f493ca4285b2d1056cd8c733"
},
{
"url": "https://git.kernel.org/stable/c/39e2a5bf970402a8530a319cf06122e216ba57b8"
}
],
"title": "hwmon: (occ) Fix division by zero in occ_show_power_1()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31770",
"datePublished": "2026-05-01T14:14:59.256Z",
"dateReserved": "2026-03-09T15:48:24.140Z",
"dateUpdated": "2026-05-11T22:15:28.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46125 (GCVE-0-2026-46125)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: remove station if connection prep fails
If connection preparation fails for MLO connections, then the
interface is completely reset to non-MLD. In this case, we must
not keep the station since it's related to the link of the vif
being removed. Delete an existing station. Any "new_sta" is
already being removed, so that doesn't need changes.
This fixes a use-after-free/double-free in debugfs if that's
enabled, because a vif going from MLD (and to MLD, but that's
not relevant here) recreates its entire debugfs.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 81151ce462e533551f3284bfdb8e0f461c9220e6 Version: 81151ce462e533551f3284bfdb8e0f461c9220e6 Version: 81151ce462e533551f3284bfdb8e0f461c9220e6 Version: 81151ce462e533551f3284bfdb8e0f461c9220e6 Version: 81151ce462e533551f3284bfdb8e0f461c9220e6 Version: 81151ce462e533551f3284bfdb8e0f461c9220e6 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.26.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.82.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.134.1.rt7.475.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.134.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.147.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.147.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.17.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.176.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.176.1.rt14.461.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.132.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.123.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s mac80211 Wi-Fi subsystem. When Multi-Link Operation (MLO) connection preparation fails, the system may not correctly remove the associated station. This can lead to a use-after-free or double-free vulnerability in the debugfs component, potentially causing system instability or unexpected behavior."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-825",
"description": "Expired Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:51:27.525Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-46125"
},
{
"name": "RHBZ#2482608",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482608"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46125.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27731"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27288"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26515"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27735"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27708"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27789"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26427"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26563"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26428"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26462"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:27731: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:27288: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:26515: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:27735: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:27708: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:27789: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:26427: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:26563: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:26428: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:26462: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-28T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-28T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: wifi: mac80211: remove station if connection prep fails",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "18fed0a209500bfea5c4c08609ec93855e4e500b",
"status": "affected",
"version": "81151ce462e533551f3284bfdb8e0f461c9220e6",
"versionType": "git"
},
{
"lessThan": "fe75fa1ac9a92990f7fc3d34b17808fd933071b2",
"status": "affected",
"version": "81151ce462e533551f3284bfdb8e0f461c9220e6",
"versionType": "git"
},
{
"lessThan": "afcbaed89cdc1a001b43270cbf5394bb4804270a",
"status": "affected",
"version": "81151ce462e533551f3284bfdb8e0f461c9220e6",
"versionType": "git"
},
{
"lessThan": "9e28654f79f443bca9b29ff3ae7cf18abfba58a0",
"status": "affected",
"version": "81151ce462e533551f3284bfdb8e0f461c9220e6",
"versionType": "git"
},
{
"lessThan": "1c2b72ea89882aeb948340498391e69c58d466f1",
"status": "affected",
"version": "81151ce462e533551f3284bfdb8e0f461c9220e6",
"versionType": "git"
},
{
"lessThan": "283fc9e44ff5b5ac967439b4951b80bd4299f4e4",
"status": "affected",
"version": "81151ce462e533551f3284bfdb8e0f461c9220e6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: remove station if connection prep fails\n\nIf connection preparation fails for MLO connections, then the\ninterface is completely reset to non-MLD. In this case, we must\nnot keep the station since it\u0027s related to the link of the vif\nbeing removed. Delete an existing station. Any \"new_sta\" is\nalready being removed, so that doesn\u0027t need changes.\n\nThis fixes a use-after-free/double-free in debugfs if that\u0027s\nenabled, because a vif going from MLD (and to MLD, but that\u0027s\nnot relevant here) recreates its entire debugfs."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is in mac80211 station-side MLME, triggered by a malicious/rogue AP that the station attempts an MLO association with; WiFi requires the attacker to be within radio range (same wireless segment).\nAC:L - A rogue AP can reliably let authentication create the station and then craft association/channel parameters that fail connection prep on the MLO path, repeatably; the required CONFIG_MAC80211_DEBUGFS is commonly enabled.\nPR:N - 802.11 authentication/association management frames are processed before any credential proof (4-way handshake/SAE), so a rogue AP reaches this path without holding any credentials on the victim.\nUI:N - Stations auto-reconnect to saved networks, so an attacker spoofing a known SSID drives the connection (and the failing MLO assoc) with no user action.\nS:U - The corruption stays within the kernel\u0027s own memory/security authority with no boundary crossing such as VM or IOMMU escape.\nC:H - A use-after-free over the freed station/link-debugfs objects can be leveraged for attacker-controlled reads of kernel memory.\nI:H - The use-after-free/double-free enables heap grooming and write primitives that can corrupt adjacent kernel state and hijack control flow.\nA:H - The use-after-free/double-free reliably causes kernel oops/panic, a full denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:54.918Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/18fed0a209500bfea5c4c08609ec93855e4e500b"
},
{
"url": "https://git.kernel.org/stable/c/fe75fa1ac9a92990f7fc3d34b17808fd933071b2"
},
{
"url": "https://git.kernel.org/stable/c/afcbaed89cdc1a001b43270cbf5394bb4804270a"
},
{
"url": "https://git.kernel.org/stable/c/9e28654f79f443bca9b29ff3ae7cf18abfba58a0"
},
{
"url": "https://git.kernel.org/stable/c/1c2b72ea89882aeb948340498391e69c58d466f1"
},
{
"url": "https://git.kernel.org/stable/c/283fc9e44ff5b5ac967439b4951b80bd4299f4e4"
}
],
"title": "wifi: mac80211: remove station if connection prep fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46125",
"datePublished": "2026-05-28T09:35:39.809Z",
"dateReserved": "2026-05-13T15:03:33.099Z",
"dateUpdated": "2026-08-05T12:29:54.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43397 (GCVE-0-2026-43397)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-05-11 22:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/bridge: samsung-dsim: Fix memory leak in error path
In samsung_dsim_host_attach(), drm_bridge_add() is called to add the
bridge. However, if samsung_dsim_register_te_irq() or
pdata->host_ops->attach() fails afterwards, the function returns
without removing the bridge, causing a memory leak.
Fix this by adding proper error handling with goto labels to ensure
drm_bridge_remove() is called in all error paths. Also ensure that
samsung_dsim_unregister_te_irq() is called if the attach operation
fails after the TE IRQ has been registered.
samsung_dsim_unregister_te_irq() function is moved without changes
to be before samsung_dsim_host_attach() to avoid forward declaration.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/bridge/samsung-dsim.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "98310fe3a2a79671b739a5344c1a11d74c503e25",
"status": "affected",
"version": "e7447128ca4a250374d6721ee98e3e3cf99551a6",
"versionType": "git"
},
{
"lessThan": "0b07f7d2c5a4078c2f1c11bb36685084fe4e5c95",
"status": "affected",
"version": "e7447128ca4a250374d6721ee98e3e3cf99551a6",
"versionType": "git"
},
{
"lessThan": "e6d779654cda63d632bd8dfcdcabd125057e30a5",
"status": "affected",
"version": "e7447128ca4a250374d6721ee98e3e3cf99551a6",
"versionType": "git"
},
{
"lessThan": "a40b92fb4b26d4cb1b5e439e55a56db7e79a82d1",
"status": "affected",
"version": "e7447128ca4a250374d6721ee98e3e3cf99551a6",
"versionType": "git"
},
{
"lessThan": "803ec1faf7c1823e6e3b1f2aaa81be18528c9436",
"status": "affected",
"version": "e7447128ca4a250374d6721ee98e3e3cf99551a6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/bridge/samsung-dsim.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: samsung-dsim: Fix memory leak in error path\n\nIn samsung_dsim_host_attach(), drm_bridge_add() is called to add the\nbridge. However, if samsung_dsim_register_te_irq() or\npdata-\u003ehost_ops-\u003eattach() fails afterwards, the function returns\nwithout removing the bridge, causing a memory leak.\n\nFix this by adding proper error handling with goto labels to ensure\ndrm_bridge_remove() is called in all error paths. Also ensure that\nsamsung_dsim_unregister_te_irq() is called if the attach operation\nfails after the TE IRQ has been registered.\n\nsamsung_dsim_unregister_te_irq() function is moved without changes\nto be before samsung_dsim_host_attach() to avoid forward declaration."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:23:47.602Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/98310fe3a2a79671b739a5344c1a11d74c503e25"
},
{
"url": "https://git.kernel.org/stable/c/0b07f7d2c5a4078c2f1c11bb36685084fe4e5c95"
},
{
"url": "https://git.kernel.org/stable/c/e6d779654cda63d632bd8dfcdcabd125057e30a5"
},
{
"url": "https://git.kernel.org/stable/c/a40b92fb4b26d4cb1b5e439e55a56db7e79a82d1"
},
{
"url": "https://git.kernel.org/stable/c/803ec1faf7c1823e6e3b1f2aaa81be18528c9436"
}
],
"title": "drm/bridge: samsung-dsim: Fix memory leak in error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43397",
"datePublished": "2026-05-08T14:21:40.185Z",
"dateReserved": "2026-05-01T14:12:56.007Z",
"dateUpdated": "2026-05-11T22:23:47.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43064 (GCVE-0-2026-43064)
Vulnerability from cvelistv5
Published
2026-05-05 15:23
Modified
2026-06-19 11:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: Fix not releasing workqueue on .release()
The workqueue associated with an DSA/IAA device is not released when
the object is freed.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 47c16ac27d4cb664cee53ee0b9b7e2f907923fb3 Version: 47c16ac27d4cb664cee53ee0b9b7e2f907923fb3 Version: 47c16ac27d4cb664cee53ee0b9b7e2f907923fb3 Version: 47c16ac27d4cb664cee53ee0b9b7e2f907923fb3 Version: 47c16ac27d4cb664cee53ee0b9b7e2f907923fb3 Version: 47c16ac27d4cb664cee53ee0b9b7e2f907923fb3 Version: 47c16ac27d4cb664cee53ee0b9b7e2f907923fb3 Version: 3f0e87eb9680975184e98aed0e8866b4442a31f6 Version: a13e4cf29da68630a116c1309072a265ade9566d Version: 5.11.22 ≤ Version: 5.12.5 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/idxd/sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "70ae35be58d476e2fd9f7a941a5e03b2f5fadb8d",
"status": "affected",
"version": "47c16ac27d4cb664cee53ee0b9b7e2f907923fb3",
"versionType": "git"
},
{
"lessThan": "b22fd53b2ceb35445475f0edab13a908c5fb8433",
"status": "affected",
"version": "47c16ac27d4cb664cee53ee0b9b7e2f907923fb3",
"versionType": "git"
},
{
"lessThan": "2bb9e9e93adff9cc8a138ae9a3a8d59b3452272e",
"status": "affected",
"version": "47c16ac27d4cb664cee53ee0b9b7e2f907923fb3",
"versionType": "git"
},
{
"lessThan": "d02c24af126dee45247dc7890409c86d1831859d",
"status": "affected",
"version": "47c16ac27d4cb664cee53ee0b9b7e2f907923fb3",
"versionType": "git"
},
{
"lessThan": "958e96533ddbd1edd127feb7624a7eed0cc379dc",
"status": "affected",
"version": "47c16ac27d4cb664cee53ee0b9b7e2f907923fb3",
"versionType": "git"
},
{
"lessThan": "fc34f199eb576b3a73089452fdf0056cc9a9301d",
"status": "affected",
"version": "47c16ac27d4cb664cee53ee0b9b7e2f907923fb3",
"versionType": "git"
},
{
"lessThan": "3d33de353b1ff9023d5ec73b9becf80ea87af695",
"status": "affected",
"version": "47c16ac27d4cb664cee53ee0b9b7e2f907923fb3",
"versionType": "git"
},
{
"status": "affected",
"version": "3f0e87eb9680975184e98aed0e8866b4442a31f6",
"versionType": "git"
},
{
"status": "affected",
"version": "a13e4cf29da68630a116c1309072a265ade9566d",
"versionType": "git"
},
{
"lessThan": "5.12",
"status": "affected",
"version": "5.11.22",
"versionType": "semver"
},
{
"lessThan": "5.13",
"status": "affected",
"version": "5.12.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/idxd/sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.12.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix not releasing workqueue on .release()\n\nThe workqueue associated with an DSA/IAA device is not released when\nthe object is freed."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-19T11:58:11.415Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/70ae35be58d476e2fd9f7a941a5e03b2f5fadb8d"
},
{
"url": "https://git.kernel.org/stable/c/b22fd53b2ceb35445475f0edab13a908c5fb8433"
},
{
"url": "https://git.kernel.org/stable/c/2bb9e9e93adff9cc8a138ae9a3a8d59b3452272e"
},
{
"url": "https://git.kernel.org/stable/c/d02c24af126dee45247dc7890409c86d1831859d"
},
{
"url": "https://git.kernel.org/stable/c/958e96533ddbd1edd127feb7624a7eed0cc379dc"
},
{
"url": "https://git.kernel.org/stable/c/fc34f199eb576b3a73089452fdf0056cc9a9301d"
},
{
"url": "https://git.kernel.org/stable/c/3d33de353b1ff9023d5ec73b9becf80ea87af695"
}
],
"title": "dmaengine: idxd: Fix not releasing workqueue on .release()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43064",
"datePublished": "2026-05-05T15:23:24.687Z",
"dateReserved": "2026-05-01T14:12:55.981Z",
"dateUpdated": "2026-06-19T11:58:11.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53313 (GCVE-0-2026-53313)
Vulnerability from cvelistv5
Published
2026-06-26 19:41
Modified
2026-06-26 19:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
In dc_dmub_srv_log_diagnostic_data() and
dc_dmub_srv_enable_dpia_trace().
Both functions check:
if (!dc_dmub_srv || !dc_dmub_srv->dmub)
and then call DC_LOG_ERROR() inside that block.
DC_LOG_ERROR() uses dc_dmub_srv->ctx internally. So if
dc_dmub_srv is NULL, the logging itself can dereference a
NULL pointer and cause a crash.
Fix this by splitting the checks.
First check if dc_dmub_srv is NULL and return immediately.
Then check dc_dmub_srv->dmub and log the error only when
dc_dmub_srv is valid.
Fixes the below:
../display/dc/dc_dmub_srv.c:962 dc_dmub_srv_log_diagnostic_data() error: we previously assumed 'dc_dmub_srv' could be null (see line 961)
../display/dc/dc_dmub_srv.c:1167 dc_dmub_srv_enable_dpia_trace() error: we previously assumed 'dc_dmub_srv' could be null (see line 1166)
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b37a978e6d8c33fbfa4abc5dcca4c7cfc6d01f22",
"status": "affected",
"version": "2631ac1ac328189031d1aefbbd4929050f72fb23",
"versionType": "git"
},
{
"lessThan": "4ae3e16f4b3bf64140f773629b765d605ee079a9",
"status": "affected",
"version": "2631ac1ac328189031d1aefbbd4929050f72fb23",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths\n\nIn dc_dmub_srv_log_diagnostic_data() and\ndc_dmub_srv_enable_dpia_trace().\n\nBoth functions check:\n\n if (!dc_dmub_srv || !dc_dmub_srv-\u003edmub)\n\nand then call DC_LOG_ERROR() inside that block.\n\nDC_LOG_ERROR() uses dc_dmub_srv-\u003ectx internally. So if\ndc_dmub_srv is NULL, the logging itself can dereference a\nNULL pointer and cause a crash.\n\nFix this by splitting the checks.\n\nFirst check if dc_dmub_srv is NULL and return immediately.\nThen check dc_dmub_srv-\u003edmub and log the error only when\ndc_dmub_srv is valid.\n\nFixes the below:\n../display/dc/dc_dmub_srv.c:962 dc_dmub_srv_log_diagnostic_data() error: we previously assumed \u0027dc_dmub_srv\u0027 could be null (see line 961)\n../display/dc/dc_dmub_srv.c:1167 dc_dmub_srv_enable_dpia_trace() error: we previously assumed \u0027dc_dmub_srv\u0027 could be null (see line 1166)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T19:41:06.568Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b37a978e6d8c33fbfa4abc5dcca4c7cfc6d01f22"
},
{
"url": "https://git.kernel.org/stable/c/4ae3e16f4b3bf64140f773629b765d605ee079a9"
}
],
"title": "drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53313",
"datePublished": "2026-06-26T19:41:06.568Z",
"dateReserved": "2026-06-09T07:44:35.397Z",
"dateUpdated": "2026-06-26T19:41:06.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71089 (GCVE-0-2025-71089)
Vulnerability from cvelistv5
Published
2026-01-13 15:34
Modified
2026-08-05 12:11
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu: disable SVA when CONFIG_X86 is set
Patch series "Fix stale IOTLB entries for kernel address space", v7.
This proposes a fix for a security vulnerability related to IOMMU Shared
Virtual Addressing (SVA). In an SVA context, an IOMMU can cache kernel
page table entries. When a kernel page table page is freed and
reallocated for another purpose, the IOMMU might still hold stale,
incorrect entries. This can be exploited to cause a use-after-free or
write-after-free condition, potentially leading to privilege escalation or
data corruption.
This solution introduces a deferred freeing mechanism for kernel page
table pages, which provides a safe window to notify the IOMMU to
invalidate its caches before the page is reused.
This patch (of 8):
In the IOMMU Shared Virtual Addressing (SVA) context, the IOMMU hardware
shares and walks the CPU's page tables. The x86 architecture maps the
kernel's virtual address space into the upper portion of every process's
page table. Consequently, in an SVA context, the IOMMU hardware can walk
and cache kernel page table entries.
The Linux kernel currently lacks a notification mechanism for kernel page
table changes, specifically when page table pages are freed and reused.
The IOMMU driver is only notified of changes to user virtual address
mappings. This can cause the IOMMU's internal caches to retain stale
entries for kernel VA.
Use-After-Free (UAF) and Write-After-Free (WAF) conditions arise when
kernel page table pages are freed and later reallocated. The IOMMU could
misinterpret the new data as valid page table entries. The IOMMU might
then walk into attacker-controlled memory, leading to arbitrary physical
memory DMA access or privilege escalation. This is also a
Write-After-Free issue, as the IOMMU will potentially continue to write
Accessed and Dirty bits to the freed memory while attempting to walk the
stale page tables.
Currently, SVA contexts are unprivileged and cannot access kernel
mappings. However, the IOMMU will still walk kernel-only page tables all
the way down to the leaf entries, where it realizes the mapping is for the
kernel and errors out. This means the IOMMU still caches these
intermediate page table entries, making the described vulnerability a real
concern.
Disable SVA on x86 architecture until the IOMMU can receive notification
to flush the paging cache before freeing the CPU kernel page table pages.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 26b25a2b98e45aeb40eedcedc586ad5034cbd984 Version: 26b25a2b98e45aeb40eedcedc586ad5034cbd984 Version: 26b25a2b98e45aeb40eedcedc586ad5034cbd984 Version: 26b25a2b98e45aeb40eedcedc586ad5034cbd984 Version: 26b25a2b98e45aeb40eedcedc586ad5034cbd984 Version: 26b25a2b98e45aeb40eedcedc586ad5034cbd984 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-71089",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-16T16:19:59.752068Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-16T16:20:14.545Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/iommu-sva.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b34289505180a83607fcfdce14b5a290d0528476",
"status": "affected",
"version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
"versionType": "git"
},
{
"lessThan": "7cad37e358970af1bb49030ff01f06a69fa7d985",
"status": "affected",
"version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
"versionType": "git"
},
{
"lessThan": "240cd7f2812cc25496b12063d11c823618f364e9",
"status": "affected",
"version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
"versionType": "git"
},
{
"lessThan": "c2c3f1a3fd74ef16cf115f0c558616a13a8471b4",
"status": "affected",
"version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
"versionType": "git"
},
{
"lessThan": "c341dee80b5df49a936182341b36395c831c2661",
"status": "affected",
"version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
"versionType": "git"
},
{
"lessThan": "72f98ef9a4be30d2a60136dd6faee376f780d06c",
"status": "affected",
"version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/iommu-sva.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.200",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.120",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.64",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.200",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.163",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.120",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.64",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.4",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: disable SVA when CONFIG_X86 is set\n\nPatch series \"Fix stale IOTLB entries for kernel address space\", v7.\n\nThis proposes a fix for a security vulnerability related to IOMMU Shared\nVirtual Addressing (SVA). In an SVA context, an IOMMU can cache kernel\npage table entries. When a kernel page table page is freed and\nreallocated for another purpose, the IOMMU might still hold stale,\nincorrect entries. This can be exploited to cause a use-after-free or\nwrite-after-free condition, potentially leading to privilege escalation or\ndata corruption.\n\nThis solution introduces a deferred freeing mechanism for kernel page\ntable pages, which provides a safe window to notify the IOMMU to\ninvalidate its caches before the page is reused.\n\n\nThis patch (of 8):\n\nIn the IOMMU Shared Virtual Addressing (SVA) context, the IOMMU hardware\nshares and walks the CPU\u0027s page tables. The x86 architecture maps the\nkernel\u0027s virtual address space into the upper portion of every process\u0027s\npage table. Consequently, in an SVA context, the IOMMU hardware can walk\nand cache kernel page table entries.\n\nThe Linux kernel currently lacks a notification mechanism for kernel page\ntable changes, specifically when page table pages are freed and reused. \nThe IOMMU driver is only notified of changes to user virtual address\nmappings. This can cause the IOMMU\u0027s internal caches to retain stale\nentries for kernel VA.\n\nUse-After-Free (UAF) and Write-After-Free (WAF) conditions arise when\nkernel page table pages are freed and later reallocated. The IOMMU could\nmisinterpret the new data as valid page table entries. The IOMMU might\nthen walk into attacker-controlled memory, leading to arbitrary physical\nmemory DMA access or privilege escalation. This is also a\nWrite-After-Free issue, as the IOMMU will potentially continue to write\nAccessed and Dirty bits to the freed memory while attempting to walk the\nstale page tables.\n\nCurrently, SVA contexts are unprivileged and cannot access kernel\nmappings. However, the IOMMU will still walk kernel-only page tables all\nthe way down to the leaf entries, where it realizes the mapping is for the\nkernel and errors out. This means the IOMMU still caches these\nintermediate page table entries, making the described vulnerability a real\nconcern.\n\nDisable SVA on x86 architecture until the IOMMU can receive notification\nto flush the paging cache before freeing the CPU kernel page table pages."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "IOMMU SVA stale kernel page table entries enable arbitrary physical memory DMA access. IOMMU caches kernel page table entries that become stale when freed and reallocated, allowing walk into attacker-controlled memory. Scope Changed as it breaks IOMMU hardware isolation boundary."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:11:58.679Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b34289505180a83607fcfdce14b5a290d0528476"
},
{
"url": "https://git.kernel.org/stable/c/7cad37e358970af1bb49030ff01f06a69fa7d985"
},
{
"url": "https://git.kernel.org/stable/c/240cd7f2812cc25496b12063d11c823618f364e9"
},
{
"url": "https://git.kernel.org/stable/c/c2c3f1a3fd74ef16cf115f0c558616a13a8471b4"
},
{
"url": "https://git.kernel.org/stable/c/c341dee80b5df49a936182341b36395c831c2661"
},
{
"url": "https://git.kernel.org/stable/c/72f98ef9a4be30d2a60136dd6faee376f780d06c"
}
],
"title": "iommu: disable SVA when CONFIG_X86 is set",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-71089",
"datePublished": "2026-01-13T15:34:51.079Z",
"dateReserved": "2026-01-13T15:30:19.649Z",
"dateUpdated": "2026-08-05T12:11:58.679Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43415 (GCVE-0-2026-43415)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-05-23 16:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
In __ufshcd_wl_suspend(), cancel_delayed_work_sync() is called to cancel
the UFS RTC work, but it is placed after ufshcd_vops_suspend(hba, pm_op,
POST_CHANGE). This creates a race condition where ufshcd_rtc_work() can
still be running while ufshcd_vops_suspend() is executing. When
UFSHCD_CAP_CLK_GATING is not supported, the condition
!hba->clk_gating.active_reqs is always true, causing ufshcd_update_rtc()
to be executed. Since ufshcd_vops_suspend() typically performs clock
gating operations, executing ufshcd_update_rtc() at that moment triggers
an SError. The kernel panic trace is as follows:
Kernel panic - not syncing: Asynchronous SError Interrupt
Call trace:
dump_backtrace+0xec/0x128
show_stack+0x18/0x28
dump_stack_lvl+0x40/0xa0
dump_stack+0x18/0x24
panic+0x148/0x374
nmi_panic+0x3c/0x8c
arm64_serror_panic+0x64/0x8c
do_serror+0xc4/0xc8
el1h_64_error_handler+0x34/0x4c
el1h_64_error+0x68/0x6c
el1_interrupt+0x20/0x58
el1h_64_irq_handler+0x18/0x24
el1h_64_irq+0x68/0x6c
ktime_get+0xc4/0x12c
ufshcd_mcq_sq_stop+0x4c/0xec
ufshcd_mcq_sq_cleanup+0x64/0x1dc
ufshcd_clear_cmd+0x38/0x134
ufshcd_issue_dev_cmd+0x298/0x4d0
ufshcd_exec_dev_cmd+0x1a4/0x1c4
ufshcd_query_attr+0xbc/0x19c
ufshcd_rtc_work+0x10c/0x1c8
process_scheduled_works+0x1c4/0x45c
worker_thread+0x32c/0x3e8
kthread+0x120/0x1d8
ret_from_fork+0x10/0x20
Fix this by moving cancel_delayed_work_sync() before the call to
ufshcd_vops_suspend(hba, pm_op, PRE_CHANGE), ensuring the UFS RTC work is
fully completed or cancelled at that point.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 06701a545e9a3c4e007cff6872a074bf97c40619 Version: 6bf999e0eb41850d5c857102535d5c53b2ede224 Version: 6bf999e0eb41850d5c857102535d5c53b2ede224 Version: 6bf999e0eb41850d5c857102535d5c53b2ede224 Version: 6bf999e0eb41850d5c857102535d5c53b2ede224 Version: 6.6.81 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ufs/core/ufshcd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a6a894413b043704b77a6294c379c93b1477e48d",
"status": "affected",
"version": "06701a545e9a3c4e007cff6872a074bf97c40619",
"versionType": "git"
},
{
"lessThan": "2fcc2fc21cae7a0cbe73053f7fc70680ce2a7f69",
"status": "affected",
"version": "6bf999e0eb41850d5c857102535d5c53b2ede224",
"versionType": "git"
},
{
"lessThan": "b17211b512cbf0e07de27e1932428ee6c20df910",
"status": "affected",
"version": "6bf999e0eb41850d5c857102535d5c53b2ede224",
"versionType": "git"
},
{
"lessThan": "c387a8f1d3713f6b0415ece8485042d0f134b91a",
"status": "affected",
"version": "6bf999e0eb41850d5c857102535d5c53b2ede224",
"versionType": "git"
},
{
"lessThan": "b0bd84c39289ef6a6c3827dd52c875659291970a",
"status": "affected",
"version": "6bf999e0eb41850d5c857102535d5c53b2ede224",
"versionType": "git"
},
{
"lessThan": "6.6.130",
"status": "affected",
"version": "6.6.81",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ufs/core/ufshcd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.6.81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend\n\nIn __ufshcd_wl_suspend(), cancel_delayed_work_sync() is called to cancel\nthe UFS RTC work, but it is placed after ufshcd_vops_suspend(hba, pm_op,\nPOST_CHANGE). This creates a race condition where ufshcd_rtc_work() can\nstill be running while ufshcd_vops_suspend() is executing. When\nUFSHCD_CAP_CLK_GATING is not supported, the condition\n!hba-\u003eclk_gating.active_reqs is always true, causing ufshcd_update_rtc()\nto be executed. Since ufshcd_vops_suspend() typically performs clock\ngating operations, executing ufshcd_update_rtc() at that moment triggers\nan SError. The kernel panic trace is as follows:\n\nKernel panic - not syncing: Asynchronous SError Interrupt\nCall trace:\n dump_backtrace+0xec/0x128\n show_stack+0x18/0x28\n dump_stack_lvl+0x40/0xa0\n dump_stack+0x18/0x24\n panic+0x148/0x374\n nmi_panic+0x3c/0x8c\n arm64_serror_panic+0x64/0x8c\n do_serror+0xc4/0xc8\n el1h_64_error_handler+0x34/0x4c\n el1h_64_error+0x68/0x6c\n el1_interrupt+0x20/0x58\n el1h_64_irq_handler+0x18/0x24\n el1h_64_irq+0x68/0x6c\n ktime_get+0xc4/0x12c\n ufshcd_mcq_sq_stop+0x4c/0xec\n ufshcd_mcq_sq_cleanup+0x64/0x1dc\n ufshcd_clear_cmd+0x38/0x134\n ufshcd_issue_dev_cmd+0x298/0x4d0\n ufshcd_exec_dev_cmd+0x1a4/0x1c4\n ufshcd_query_attr+0xbc/0x19c\n ufshcd_rtc_work+0x10c/0x1c8\n process_scheduled_works+0x1c4/0x45c\n worker_thread+0x32c/0x3e8\n kthread+0x120/0x1d8\n ret_from_fork+0x10/0x20\n\nFix this by moving cancel_delayed_work_sync() before the call to\nufshcd_vops_suspend(hba, pm_op, PRE_CHANGE), ensuring the UFS RTC work is\nfully completed or cancelled at that point."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:06:57.367Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a6a894413b043704b77a6294c379c93b1477e48d"
},
{
"url": "https://git.kernel.org/stable/c/2fcc2fc21cae7a0cbe73053f7fc70680ce2a7f69"
},
{
"url": "https://git.kernel.org/stable/c/b17211b512cbf0e07de27e1932428ee6c20df910"
},
{
"url": "https://git.kernel.org/stable/c/c387a8f1d3713f6b0415ece8485042d0f134b91a"
},
{
"url": "https://git.kernel.org/stable/c/b0bd84c39289ef6a6c3827dd52c875659291970a"
}
],
"title": "scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43415",
"datePublished": "2026-05-08T14:21:52.293Z",
"dateReserved": "2026-05-01T14:12:56.008Z",
"dateUpdated": "2026-05-23T16:06:57.367Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31730 (GCVE-0-2026-31730)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-08-05 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: possible double-free of cctx->remote_heap
fastrpc_init_create_static_process() may free cctx->remote_heap on the
err_map path but does not clear the pointer. Later, fastrpc_rpmsg_remove()
frees cctx->remote_heap again if it is non-NULL, which can lead to a
double-free if the INIT_CREATE_STATIC ioctl hits the error path and the rpmsg
device is subsequently removed/unbound.
Clear cctx->remote_heap after freeing it in the error path to prevent the
later cleanup from freeing it again.
This issue was found by an in-house analysis workflow that extracts AST-based
information and runs static checks, with LLM assistance for triage, and was
confirmed by manual code review.
No hardware testing was performed.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/misc/fastrpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4b8e527aca357a6488680713bd88007cf8f547fe",
"status": "affected",
"version": "0871561055e666da421d779397efcc1e5e964cab",
"versionType": "git"
},
{
"lessThan": "0bdee4118340c5a756220c1b29a7dab86bb0aa65",
"status": "affected",
"version": "0871561055e666da421d779397efcc1e5e964cab",
"versionType": "git"
},
{
"lessThan": "3a164f640953cc982804746e772d379171aff5c6",
"status": "affected",
"version": "0871561055e666da421d779397efcc1e5e964cab",
"versionType": "git"
},
{
"lessThan": "f67d368d26764a357691b2b3a33d3cb55b435bfc",
"status": "affected",
"version": "0871561055e666da421d779397efcc1e5e964cab",
"versionType": "git"
},
{
"lessThan": "ba2c83167b215da30fa2aae56b140198cf8d8408",
"status": "affected",
"version": "0871561055e666da421d779397efcc1e5e964cab",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/misc/fastrpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: possible double-free of cctx-\u003eremote_heap\n\nfastrpc_init_create_static_process() may free cctx-\u003eremote_heap on the\nerr_map path but does not clear the pointer. Later, fastrpc_rpmsg_remove()\nfrees cctx-\u003eremote_heap again if it is non-NULL, which can lead to a\ndouble-free if the INIT_CREATE_STATIC ioctl hits the error path and the rpmsg\ndevice is subsequently removed/unbound.\nClear cctx-\u003eremote_heap after freeing it in the error path to prevent the\nlater cleanup from freeing it again.\n\nThis issue was found by an in-house analysis workflow that extracts AST-based\ninformation and runs static checks, with LLM assistance for triage, and was\nconfirmed by manual code review.\nNo hardware testing was performed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - FastRPC is reached by a local process opening the fastrpc misc device and issuing FASTRPC_IOCTL_INIT_CREATE_STATIC through the ioctl path. There is no network, adjacent, or physical packet path to this driver entry point.\nAC:L - No race is required; the attacker controls the ioctl arguments and can drive the error path that frees cctx-\u003eremote_heap while leaving the stale pointer in the vulnerable code. The stale pointer can then be reached again by retrying the ioctl or during rpmsg teardown, so exploitation does not depend on conditions outside the attacker\u0027s practical control.\nPR:L - The driver path has no capable() or namespace privilege check; access is gated only by the fastrpc device node. In reasonable Qualcomm/Android-style deployments these nodes are exposed to untrusted local apps for DSP offload, so a basic unprivileged local user is sufficient.\nUI:N - Once the attacker has local code execution and device-node access, triggering the ioctl path requires no victim action. No user needs to open a file, mount anything, or interact with attacker-controlled content.\nS:U - The vulnerability corrupts kernel-owned memory from within a kernel driver and is scored as a standard local kernel compromise. It does not require crossing a separate security authority such as guest-to-host or IOMMU isolation.\nC:H - The bug leaves a freed fastrpc_buf pointer reachable and later dereferenced/freed again, creating a kernel use-after-free/double-free condition. Per kernel scoring guidance, this kind of memory corruption is treated as capable of high-impact information disclosure.\nI:H - The stale pointer and double-free can corrupt kernel heap/DMA allocation state and may be shaped through heap reuse, making code execution or arbitrary kernel memory modification plausible. Per guidance, UAF/double-free memory corruption warrants high integrity impact.\nA:H - Even without full exploitation, the second dereference/free of an already freed kernel object can cause an oops, panic, or allocator corruption. This is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:51.799Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4b8e527aca357a6488680713bd88007cf8f547fe"
},
{
"url": "https://git.kernel.org/stable/c/0bdee4118340c5a756220c1b29a7dab86bb0aa65"
},
{
"url": "https://git.kernel.org/stable/c/3a164f640953cc982804746e772d379171aff5c6"
},
{
"url": "https://git.kernel.org/stable/c/f67d368d26764a357691b2b3a33d3cb55b435bfc"
},
{
"url": "https://git.kernel.org/stable/c/ba2c83167b215da30fa2aae56b140198cf8d8408"
}
],
"title": "misc: fastrpc: possible double-free of cctx-\u003eremote_heap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31730",
"datePublished": "2026-05-01T14:14:29.522Z",
"dateReserved": "2026-03-09T15:48:24.135Z",
"dateUpdated": "2026-08-05T12:24:51.799Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45941 (GCVE-0-2026-45941)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-27 12:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure
get_burstcount() can return -EBUSY on timeout. When this happens, the
function returns directly without releasing the locality that was
acquired at the beginning of tpm_tis_i2c_send().
Use goto out_err to ensure proper cleanup when get_burstcount() fails.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: aad628c1d91a6db57e572e4c1f35e863d81061d7 Version: aad628c1d91a6db57e572e4c1f35e863d81061d7 Version: aad628c1d91a6db57e572e4c1f35e863d81061d7 Version: aad628c1d91a6db57e572e4c1f35e863d81061d7 Version: aad628c1d91a6db57e572e4c1f35e863d81061d7 Version: aad628c1d91a6db57e572e4c1f35e863d81061d7 Version: aad628c1d91a6db57e572e4c1f35e863d81061d7 Version: aad628c1d91a6db57e572e4c1f35e863d81061d7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/tpm/tpm_i2c_infineon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8f124c5582d443ac9fb690db26d08cab5d6ba76e",
"status": "affected",
"version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
"versionType": "git"
},
{
"lessThan": "c24c9c4cab11858f22f309521ba7ea5b1e7385f2",
"status": "affected",
"version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
"versionType": "git"
},
{
"lessThan": "1bb8f8826d0748b4b92a98fb6b6dfe52081739f5",
"status": "affected",
"version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
"versionType": "git"
},
{
"lessThan": "948966e546f29af04391d98b8e378e4a7670c1c1",
"status": "affected",
"version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
"versionType": "git"
},
{
"lessThan": "a61b8412e3eb8b71646dba867e8252d8560a1a27",
"status": "affected",
"version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
"versionType": "git"
},
{
"lessThan": "1a22048c1117cdfac185ba450aba67ed6b65dc87",
"status": "affected",
"version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
"versionType": "git"
},
{
"lessThan": "2f7a665e1323359d99c74301d1e180f5e2c40181",
"status": "affected",
"version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
"versionType": "git"
},
{
"lessThan": "bbd6e97c836cbeb9606d7b7e5dcf8a1d89525713",
"status": "affected",
"version": "aad628c1d91a6db57e572e4c1f35e863d81061d7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/tpm/tpm_i2c_infineon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure\n\nget_burstcount() can return -EBUSY on timeout. When this happens, the\nfunction returns directly without releasing the locality that was\nacquired at the beginning of tpm_tis_i2c_send().\n\nUse goto out_err to ensure proper cleanup when get_burstcount() fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:17:57.155Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8f124c5582d443ac9fb690db26d08cab5d6ba76e"
},
{
"url": "https://git.kernel.org/stable/c/c24c9c4cab11858f22f309521ba7ea5b1e7385f2"
},
{
"url": "https://git.kernel.org/stable/c/1bb8f8826d0748b4b92a98fb6b6dfe52081739f5"
},
{
"url": "https://git.kernel.org/stable/c/948966e546f29af04391d98b8e378e4a7670c1c1"
},
{
"url": "https://git.kernel.org/stable/c/a61b8412e3eb8b71646dba867e8252d8560a1a27"
},
{
"url": "https://git.kernel.org/stable/c/1a22048c1117cdfac185ba450aba67ed6b65dc87"
},
{
"url": "https://git.kernel.org/stable/c/2f7a665e1323359d99c74301d1e180f5e2c40181"
},
{
"url": "https://git.kernel.org/stable/c/bbd6e97c836cbeb9606d7b7e5dcf8a1d89525713"
}
],
"title": "tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45941",
"datePublished": "2026-05-27T12:17:57.155Z",
"dateReserved": "2026-05-13T15:03:33.087Z",
"dateUpdated": "2026-05-27T12:17:57.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43302 (GCVE-0-2026-43302)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-05-11 22:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Set DMA segment size to avoid debug warnings
When using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the
kernel occasionally reports a segment size mismatch. This is because
'max_seg_size' is not set. The kernel defaults to 64K. setting
'max_seg_size' to the maximum will prevent 'debug_dma_map_sg()'
from complaining about the over-mapping of the V3D segment length.
DMA-API: v3d 1002000000.v3d: mapping sg segment longer than device
claims to support [len=8290304] [max=65536]
WARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388
CPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1
Hardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)
pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : debug_dma_map_sg+0x330/0x388
lr : debug_dma_map_sg+0x330/0x388
sp : ffff8000829a3ac0
x29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000
x26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000
x23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002
x20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff
x17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573
x14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000
x11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c
x8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001
x5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280
Call trace:
debug_dma_map_sg+0x330/0x388
__dma_map_sg_attrs+0xc0/0x278
dma_map_sgtable+0x30/0x58
drm_gem_shmem_get_pages_sgt+0xb4/0x140
v3d_bo_create_finish+0x28/0x130 [v3d]
v3d_create_bo_ioctl+0x54/0x180 [v3d]
drm_ioctl_kernel+0xc8/0x140
drm_ioctl+0x2d4/0x4d8
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 57692c94dcbe99a1e0444409a3da13fb3443562c Version: 57692c94dcbe99a1e0444409a3da13fb3443562c Version: 57692c94dcbe99a1e0444409a3da13fb3443562c Version: 57692c94dcbe99a1e0444409a3da13fb3443562c Version: 57692c94dcbe99a1e0444409a3da13fb3443562c Version: 57692c94dcbe99a1e0444409a3da13fb3443562c Version: 57692c94dcbe99a1e0444409a3da13fb3443562c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/v3d/v3d_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "14d0d6c8b4504a60cfeea74775ab2e0164019e65",
"status": "affected",
"version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
"versionType": "git"
},
{
"lessThan": "225023e3619b81af6d8d0e680503fc2d68633023",
"status": "affected",
"version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
"versionType": "git"
},
{
"lessThan": "2663ef70c6123b2232190f917275e5c3175f97d0",
"status": "affected",
"version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
"versionType": "git"
},
{
"lessThan": "cf510785f74e74c54de40a43a955b7f844857487",
"status": "affected",
"version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
"versionType": "git"
},
{
"lessThan": "0290934d30abe7c88e18140fd5184c3f386b1e44",
"status": "affected",
"version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
"versionType": "git"
},
{
"lessThan": "db15f469a88d3bbeeaa9f8c9f5e74d856ba5d7d2",
"status": "affected",
"version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
"versionType": "git"
},
{
"lessThan": "9eb018828b1b30dfba689c060735c50fc5b9f704",
"status": "affected",
"version": "57692c94dcbe99a1e0444409a3da13fb3443562c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/v3d/v3d_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Set DMA segment size to avoid debug warnings\n\nWhen using V3D rendering with CONFIG_DMA_API_DEBUG enabled, the\nkernel occasionally reports a segment size mismatch. This is because\n\u0027max_seg_size\u0027 is not set. The kernel defaults to 64K. setting\n\u0027max_seg_size\u0027 to the maximum will prevent \u0027debug_dma_map_sg()\u0027\nfrom complaining about the over-mapping of the V3D segment length.\n\nDMA-API: v3d 1002000000.v3d: mapping sg segment longer than device\n claims to support [len=8290304] [max=65536]\nWARNING: CPU: 0 PID: 493 at kernel/dma/debug.c:1179 debug_dma_map_sg+0x330/0x388\nCPU: 0 UID: 0 PID: 493 Comm: Xorg Not tainted 6.12.53-yocto-standard #1\nHardware name: Raspberry Pi 5 Model B Rev 1.0 (DT)\npstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : debug_dma_map_sg+0x330/0x388\nlr : debug_dma_map_sg+0x330/0x388\nsp : ffff8000829a3ac0\nx29: ffff8000829a3ac0 x28: 0000000000000001 x27: ffff8000813fe000\nx26: ffffc1ffc0000000 x25: ffff00010fdeb760 x24: 0000000000000000\nx23: ffff8000816a9bf0 x22: 0000000000000001 x21: 0000000000000002\nx20: 0000000000000002 x19: ffff00010185e810 x18: ffffffffffffffff\nx17: 69766564206e6168 x16: 74207265676e6f6c x15: 20746e656d676573\nx14: 20677320676e6970 x13: 5d34303334393134 x12: 0000000000000000\nx11: 00000000000000c0 x10: 00000000000009c0 x9 : ffff8000800e0b7c\nx8 : ffff00010a315ca0 x7 : ffff8000816a5110 x6 : 0000000000000001\nx5 : 000000000000002b x4 : 0000000000000002 x3 : 0000000000000008\nx2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00010a315280\nCall trace:\n debug_dma_map_sg+0x330/0x388\n __dma_map_sg_attrs+0xc0/0x278\n dma_map_sgtable+0x30/0x58\n drm_gem_shmem_get_pages_sgt+0xb4/0x140\n v3d_bo_create_finish+0x28/0x130 [v3d]\n v3d_create_bo_ioctl+0x54/0x180 [v3d]\n drm_ioctl_kernel+0xc8/0x140\n drm_ioctl+0x2d4/0x4d8"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:21:55.721Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/14d0d6c8b4504a60cfeea74775ab2e0164019e65"
},
{
"url": "https://git.kernel.org/stable/c/225023e3619b81af6d8d0e680503fc2d68633023"
},
{
"url": "https://git.kernel.org/stable/c/2663ef70c6123b2232190f917275e5c3175f97d0"
},
{
"url": "https://git.kernel.org/stable/c/cf510785f74e74c54de40a43a955b7f844857487"
},
{
"url": "https://git.kernel.org/stable/c/0290934d30abe7c88e18140fd5184c3f386b1e44"
},
{
"url": "https://git.kernel.org/stable/c/db15f469a88d3bbeeaa9f8c9f5e74d856ba5d7d2"
},
{
"url": "https://git.kernel.org/stable/c/9eb018828b1b30dfba689c060735c50fc5b9f704"
}
],
"title": "drm/v3d: Set DMA segment size to avoid debug warnings",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43302",
"datePublished": "2026-05-08T13:11:22.886Z",
"dateReserved": "2026-05-01T14:12:56.000Z",
"dateUpdated": "2026-05-11T22:21:55.721Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31755 (GCVE-0-2026-31755)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-07-04 11:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: gadget: fix NULL pointer dereference in ep_queue
When the gadget endpoint is disabled or not yet configured, the ep->desc
pointer can be NULL. This leads to a NULL pointer dereference when
__cdns3_gadget_ep_queue() is called, causing a kernel crash.
Add a check to return -ESHUTDOWN if ep->desc is NULL, which is the
standard return code for unconfigured endpoints.
This prevents potential crashes when ep_queue is called on endpoints
that are not ready.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/cdns3/cdns3-gadget.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3cf0580a09d417eab41ce914a11f9cde3a121871",
"status": "affected",
"version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
"versionType": "git"
},
{
"lessThan": "3d1433fe34b224b90259e207e5389e95b504ef04",
"status": "affected",
"version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
"versionType": "git"
},
{
"lessThan": "fb2ad0c1334a3eccfe4ed203f9eef5a4879226f6",
"status": "affected",
"version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
"versionType": "git"
},
{
"lessThan": "9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9",
"status": "affected",
"version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
"versionType": "git"
},
{
"lessThan": "d61446dfc9d387775bb1b95b081953201b9222af",
"status": "affected",
"version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
"versionType": "git"
},
{
"lessThan": "390536cc6af4ca5566bc3bf1f8b704700380cd2c",
"status": "affected",
"version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
"versionType": "git"
},
{
"lessThan": "14bf08ab2cdfcdfd3f13e799d06692a1b3e0745f",
"status": "affected",
"version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
"versionType": "git"
},
{
"lessThan": "7f6f127b9bc34bed35f56faf7ecb1561d6b39000",
"status": "affected",
"version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/cdns3/cdns3-gadget.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: gadget: fix NULL pointer dereference in ep_queue\n\nWhen the gadget endpoint is disabled or not yet configured, the ep-\u003edesc\npointer can be NULL. This leads to a NULL pointer dereference when\n__cdns3_gadget_ep_queue() is called, causing a kernel crash.\n\nAdd a check to return -ESHUTDOWN if ep-\u003edesc is NULL, which is the\nstandard return code for unconfigured endpoints.\n\nThis prevents potential crashes when ep_queue is called on endpoints\nthat are not ready."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:50:33.684Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3cf0580a09d417eab41ce914a11f9cde3a121871"
},
{
"url": "https://git.kernel.org/stable/c/3d1433fe34b224b90259e207e5389e95b504ef04"
},
{
"url": "https://git.kernel.org/stable/c/fb2ad0c1334a3eccfe4ed203f9eef5a4879226f6"
},
{
"url": "https://git.kernel.org/stable/c/9ab9b0e5fcdac325f950fc8b6caa08a9e22a0db9"
},
{
"url": "https://git.kernel.org/stable/c/d61446dfc9d387775bb1b95b081953201b9222af"
},
{
"url": "https://git.kernel.org/stable/c/390536cc6af4ca5566bc3bf1f8b704700380cd2c"
},
{
"url": "https://git.kernel.org/stable/c/14bf08ab2cdfcdfd3f13e799d06692a1b3e0745f"
},
{
"url": "https://git.kernel.org/stable/c/7f6f127b9bc34bed35f56faf7ecb1561d6b39000"
}
],
"title": "usb: cdns3: gadget: fix NULL pointer dereference in ep_queue",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31755",
"datePublished": "2026-05-01T14:14:46.288Z",
"dateReserved": "2026-03-09T15:48:24.139Z",
"dateUpdated": "2026-07-04T11:50:33.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43428 (GCVE-0-2026-43428)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-11 22:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: core: Limit the length of unkillable synchronous timeouts
The usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in
usbcore allow unlimited timeout durations. And since they use
uninterruptible waits, this leaves open the possibility of hanging a
task for an indefinitely long time, with no way to kill it short of
unplugging the target device.
To prevent this sort of problem, enforce a maximum limit on the length
of these unkillable timeouts. The limit chosen here, somewhat
arbitrarily, is 60 seconds. On many systems (although not all) this
is short enough to avoid triggering the kernel's hung-task detector.
In addition, clear up the ambiguity of negative timeout values by
treating them the same as 0, i.e., using the maximum allowed timeout.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/core/message.c",
"include/linux/usb.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4e86f5b79e62ded7e3c3ebd688cf5775e618148a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "06d2bbc4c66c6b0e8a43728c4949026026a5be67",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6c62935670acdbb7687ced20494923b66fbb0367",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "659c0c7d50a4b0f6aa197c4c098cfd91daf63862",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "24b31a227f679a942d820840a4dea7f0c09a387f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "64f3d75633aedc12bdff220e9a4337177430bd9d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2d34cb4d1d6283b4be9c78f4a83ed6956d3069ec",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1015c27a5e1a63efae2b18a9901494474b4d1dc3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/core/message.c",
"include/linux/usb.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: core: Limit the length of unkillable synchronous timeouts\n\nThe usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in\nusbcore allow unlimited timeout durations. And since they use\nuninterruptible waits, this leaves open the possibility of hanging a\ntask for an indefinitely long time, with no way to kill it short of\nunplugging the target device.\n\nTo prevent this sort of problem, enforce a maximum limit on the length\nof these unkillable timeouts. The limit chosen here, somewhat\narbitrarily, is 60 seconds. On many systems (although not all) this\nis short enough to avoid triggering the kernel\u0027s hung-task detector.\n\nIn addition, clear up the ambiguity of negative timeout values by\ntreating them the same as 0, i.e., using the maximum allowed timeout."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:24.020Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4e86f5b79e62ded7e3c3ebd688cf5775e618148a"
},
{
"url": "https://git.kernel.org/stable/c/06d2bbc4c66c6b0e8a43728c4949026026a5be67"
},
{
"url": "https://git.kernel.org/stable/c/6c62935670acdbb7687ced20494923b66fbb0367"
},
{
"url": "https://git.kernel.org/stable/c/659c0c7d50a4b0f6aa197c4c098cfd91daf63862"
},
{
"url": "https://git.kernel.org/stable/c/24b31a227f679a942d820840a4dea7f0c09a387f"
},
{
"url": "https://git.kernel.org/stable/c/64f3d75633aedc12bdff220e9a4337177430bd9d"
},
{
"url": "https://git.kernel.org/stable/c/2d34cb4d1d6283b4be9c78f4a83ed6956d3069ec"
},
{
"url": "https://git.kernel.org/stable/c/1015c27a5e1a63efae2b18a9901494474b4d1dc3"
}
],
"title": "USB: core: Limit the length of unkillable synchronous timeouts",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43428",
"datePublished": "2026-05-08T14:22:01.027Z",
"dateReserved": "2026-05-01T14:12:56.009Z",
"dateUpdated": "2026-05-11T22:24:24.020Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43169 (GCVE-0-2026-43169)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/buddy: Prevent BUG_ON by validating rounded allocation
When DRM_BUDDY_CONTIGUOUS_ALLOCATION is set, the requested size is
rounded up to the next power-of-two via roundup_pow_of_two().
Similarly, for non-contiguous allocations with large min_block_size,
the size is aligned up via round_up(). Both operations can produce a
rounded size that exceeds mm->size, which later triggers
BUG_ON(order > mm->max_order).
Example scenarios:
- 9G CONTIGUOUS allocation on 10G VRAM memory:
roundup_pow_of_two(9G) = 16G > 10G
- 9G allocation with 8G min_block_size on 10G VRAM memory:
round_up(9G, 8G) = 16G > 10G
Fix this by checking the rounded size against mm->size. For
non-contiguous or range allocations where size > mm->size is invalid,
return -EINVAL immediately. For contiguous allocations without range
restrictions, allow the request to fall through to the existing
__alloc_contig_try_harder() fallback.
This ensures invalid user input returns an error or uses the fallback
path instead of hitting BUG_ON.
v2: (Matt A)
- Add Fixes, Cc stable, and Closes tags for context
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_buddy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d764b8dd420098a4d253b8a5b27568c897edb2cf",
"status": "affected",
"version": "0a1844bf0b532d84324453374ad6845f64066c28",
"versionType": "git"
},
{
"lessThan": "6236c1cd9fdf433d39ed28b2491ccdfe7ae95061",
"status": "affected",
"version": "0a1844bf0b532d84324453374ad6845f64066c28",
"versionType": "git"
},
{
"lessThan": "ecb32c60d8cbed2ee9ce9f343b6aa2f32babc727",
"status": "affected",
"version": "0a1844bf0b532d84324453374ad6845f64066c28",
"versionType": "git"
},
{
"lessThan": "5488a29596cdba93a60a79398dc9b69d5bdadf92",
"status": "affected",
"version": "0a1844bf0b532d84324453374ad6845f64066c28",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_buddy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/buddy: Prevent BUG_ON by validating rounded allocation\n\nWhen DRM_BUDDY_CONTIGUOUS_ALLOCATION is set, the requested size is\nrounded up to the next power-of-two via roundup_pow_of_two().\nSimilarly, for non-contiguous allocations with large min_block_size,\nthe size is aligned up via round_up(). Both operations can produce a\nrounded size that exceeds mm-\u003esize, which later triggers\nBUG_ON(order \u003e mm-\u003emax_order).\n\nExample scenarios:\n- 9G CONTIGUOUS allocation on 10G VRAM memory:\n roundup_pow_of_two(9G) = 16G \u003e 10G\n- 9G allocation with 8G min_block_size on 10G VRAM memory:\n round_up(9G, 8G) = 16G \u003e 10G\n\nFix this by checking the rounded size against mm-\u003esize. For\nnon-contiguous or range allocations where size \u003e mm-\u003esize is invalid,\nreturn -EINVAL immediately. For contiguous allocations without range\nrestrictions, allow the request to fall through to the existing\n__alloc_contig_try_harder() fallback.\n\nThis ensures invalid user input returns an error or uses the fallback\npath instead of hitting BUG_ON.\n\nv2: (Matt A)\n- Add Fixes, Cc stable, and Closes tags for context"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:19:07.323Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d764b8dd420098a4d253b8a5b27568c897edb2cf"
},
{
"url": "https://git.kernel.org/stable/c/6236c1cd9fdf433d39ed28b2491ccdfe7ae95061"
},
{
"url": "https://git.kernel.org/stable/c/ecb32c60d8cbed2ee9ce9f343b6aa2f32babc727"
},
{
"url": "https://git.kernel.org/stable/c/5488a29596cdba93a60a79398dc9b69d5bdadf92"
}
],
"title": "drm/buddy: Prevent BUG_ON by validating rounded allocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43169",
"datePublished": "2026-05-06T11:27:45.356Z",
"dateReserved": "2026-05-01T14:12:55.990Z",
"dateUpdated": "2026-05-11T22:19:07.323Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46082 (GCVE-0-2026-46082)
Vulnerability from cvelistv5
Published
2026-05-27 12:58
Modified
2026-06-14 17:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0
INVLPGA should cause a #UD when EFER.SVME is not set. Add a check to
properly inject #UD when EFER.SVME=0.
[sean: tag for stable@]
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ff092385e8285c03d8b148f42f46f98c5f4becd5 Version: ff092385e8285c03d8b148f42f46f98c5f4becd5 Version: ff092385e8285c03d8b148f42f46f98c5f4becd5 Version: ff092385e8285c03d8b148f42f46f98c5f4becd5 Version: ff092385e8285c03d8b148f42f46f98c5f4becd5 Version: ff092385e8285c03d8b148f42f46f98c5f4becd5 Version: ff092385e8285c03d8b148f42f46f98c5f4becd5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/svm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ebb63390142c6458fc37758e0892759989cc159f",
"status": "affected",
"version": "ff092385e8285c03d8b148f42f46f98c5f4becd5",
"versionType": "git"
},
{
"lessThan": "491139c17f8ad5773303068411f6ac5eed438b51",
"status": "affected",
"version": "ff092385e8285c03d8b148f42f46f98c5f4becd5",
"versionType": "git"
},
{
"lessThan": "3ac9d4241d205f5d0df06358349ca718ebb0fa12",
"status": "affected",
"version": "ff092385e8285c03d8b148f42f46f98c5f4becd5",
"versionType": "git"
},
{
"lessThan": "643125b66ffc1147c66616b749475ba9efb15971",
"status": "affected",
"version": "ff092385e8285c03d8b148f42f46f98c5f4becd5",
"versionType": "git"
},
{
"lessThan": "c15392ed9e49c1a16b4d3a3ccf1b3bf2318a6c28",
"status": "affected",
"version": "ff092385e8285c03d8b148f42f46f98c5f4becd5",
"versionType": "git"
},
{
"lessThan": "ee24928ecd85db4b68ed111e91fef36af0ca37b0",
"status": "affected",
"version": "ff092385e8285c03d8b148f42f46f98c5f4becd5",
"versionType": "git"
},
{
"lessThan": "d99df02ff427f461102230f9c5b90a6c64ee8e23",
"status": "affected",
"version": "ff092385e8285c03d8b148f42f46f98c5f4becd5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/svm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.32"
},
{
"lessThan": "2.6.32",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0\n\nINVLPGA should cause a #UD when EFER.SVME is not set. Add a check to\nproperly inject #UD when EFER.SVME=0.\n\n[sean: tag for stable@]"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:53:00.593Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ebb63390142c6458fc37758e0892759989cc159f"
},
{
"url": "https://git.kernel.org/stable/c/491139c17f8ad5773303068411f6ac5eed438b51"
},
{
"url": "https://git.kernel.org/stable/c/3ac9d4241d205f5d0df06358349ca718ebb0fa12"
},
{
"url": "https://git.kernel.org/stable/c/643125b66ffc1147c66616b749475ba9efb15971"
},
{
"url": "https://git.kernel.org/stable/c/c15392ed9e49c1a16b4d3a3ccf1b3bf2318a6c28"
},
{
"url": "https://git.kernel.org/stable/c/ee24928ecd85db4b68ed111e91fef36af0ca37b0"
},
{
"url": "https://git.kernel.org/stable/c/d99df02ff427f461102230f9c5b90a6c64ee8e23"
}
],
"title": "KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46082",
"datePublished": "2026-05-27T12:58:21.629Z",
"dateReserved": "2026-05-13T15:03:33.096Z",
"dateUpdated": "2026-06-14T17:53:00.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53022 (GCVE-0-2026-53022)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: dell-wmi-sysman: bound enumeration string aggregation
populate_enum_data() aggregates firmware-provided value-modifier
and possible-value strings into fixed 512-byte struct members.
The current code bounds each individual source string but then
appends every string and separator with raw strcat() and no
remaining-space check.
Switch the aggregation loops to a bounded append helper and
reject enumeration packages whose combined strings do not fit
in the destination buffers.
[ij: add include]
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e8a60aa7404bfef37705da5607c97737073ac38d Version: e8a60aa7404bfef37705da5607c97737073ac38d Version: e8a60aa7404bfef37705da5607c97737073ac38d Version: e8a60aa7404bfef37705da5607c97737073ac38d Version: e8a60aa7404bfef37705da5607c97737073ac38d Version: e8a60aa7404bfef37705da5607c97737073ac38d Version: e8a60aa7404bfef37705da5607c97737073ac38d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7b3dc1f764bf24eb99474a5de8173b0b43a8b071",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "75c738d4f27fa18a2a033de153bd40302bde6a66",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "ba0843c1955864401295f7ba3b420afe19f2266d",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "5a04f9a36930792f6d64e28d43609e158d09b665",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "c5683ca4949a514fbe656c6d0d08c4c126e21db9",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "90b118d264845f7aaf539ac49f7c75f1f29590e2",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
},
{
"lessThan": "3c34471c26abc52a37f5ad90949e2e4b8027eb14",
"status": "affected",
"version": "e8a60aa7404bfef37705da5607c97737073ac38d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: dell-wmi-sysman: bound enumeration string aggregation\n\npopulate_enum_data() aggregates firmware-provided value-modifier\nand possible-value strings into fixed 512-byte struct members.\nThe current code bounds each individual source string but then\nappends every string and separator with raw strcat() and no\nremaining-space check.\n\nSwitch the aggregation loops to a bounded append helper and\nreject enumeration packages whose combined strings do not fit\nin the destination buffers.\n\n[ij: add include]"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:31.552Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7b3dc1f764bf24eb99474a5de8173b0b43a8b071"
},
{
"url": "https://git.kernel.org/stable/c/75c738d4f27fa18a2a033de153bd40302bde6a66"
},
{
"url": "https://git.kernel.org/stable/c/ba0843c1955864401295f7ba3b420afe19f2266d"
},
{
"url": "https://git.kernel.org/stable/c/5a04f9a36930792f6d64e28d43609e158d09b665"
},
{
"url": "https://git.kernel.org/stable/c/c5683ca4949a514fbe656c6d0d08c4c126e21db9"
},
{
"url": "https://git.kernel.org/stable/c/90b118d264845f7aaf539ac49f7c75f1f29590e2"
},
{
"url": "https://git.kernel.org/stable/c/3c34471c26abc52a37f5ad90949e2e4b8027eb14"
}
],
"title": "platform/x86: dell-wmi-sysman: bound enumeration string aggregation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53022",
"datePublished": "2026-06-24T16:29:31.552Z",
"dateReserved": "2026-06-09T07:44:35.379Z",
"dateUpdated": "2026-06-24T16:29:31.552Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46198 (GCVE-0-2026-46198)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: fix integer overflow on buff_pos
Fixing an integer overflow present in batadv_iv_ogm_send_to_if. The size
check is done using the int type in batadv_iv_ogm_aggr_packet whereas the
buff_pos variable uses the s16 type. This could lead to an out-of-bound
read.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 Version: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 Version: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 Version: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 Version: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 Version: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 Version: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 Version: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/bat_iv_ogm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "867cd090760e8f5cd206f387b47ff9c56fac04e9",
"status": "affected",
"version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
"versionType": "git"
},
{
"lessThan": "10bb1f366d884d506c38a947b43026a75d1afe9a",
"status": "affected",
"version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
"versionType": "git"
},
{
"lessThan": "96c9c0ed9a9579a9085765aceaa4556a6666eb82",
"status": "affected",
"version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
"versionType": "git"
},
{
"lessThan": "f61499359fa529f0d45a53bf7c573a49eb6322e6",
"status": "affected",
"version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
"versionType": "git"
},
{
"lessThan": "974542d1efc48b7e9fe16184e647615cba39969b",
"status": "affected",
"version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
"versionType": "git"
},
{
"lessThan": "bf872db54f91ffe70104b98c20068b2d5910e018",
"status": "affected",
"version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
"versionType": "git"
},
{
"lessThan": "b252797bfced986d6d92ec2f4cfcca842ce8aa78",
"status": "affected",
"version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
"versionType": "git"
},
{
"lessThan": "0799e5943611006b346b8813c7daf7dd5aa26bfd",
"status": "affected",
"version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/bat_iv_ogm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix integer overflow on buff_pos\n\nFixing an integer overflow present in batadv_iv_ogm_send_to_if. The size\ncheck is done using the int type in batadv_iv_ogm_aggr_packet whereas the\nbuff_pos variable uses the s16 type. This could lead to an out-of-bound\nread."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - batman-adv OGMs are layer-2 mesh management frames received from neighboring mesh nodes; they are not IP-routable, so an attacker must be on the same mesh/L2 (WiFi/Ethernet) segment.\nAC:L - The attacker fully controls the crafted OGM\u0027s size and tvlv_len, and in a mesh deployed over a large-MTU interface (required for packet_len\u003e32767) can reliably and repeatedly trigger the overflow; the negative-offset check passes for nearly all values.\nPR:N - batman-adv performs no authentication of OGMs; any node on the mesh can broadcast frames that the victim node automatically processes and forwards.\nUI:N - Received OGMs are parsed, forwarded and aggregated entirely by the kernel without any user action.\nS:U - The out-of-bounds read/write corrupts kernel memory within the same kernel security authority; no boundary (VM/IOMMU) is crossed.\nC:H - The wrapped negative buff_pos causes reads of kernel memory before/around the skb buffer (tvlv_len and OGM fields), an out-of-bounds read of attacker-influenced kernel memory.\nI:H - The loop body writes ogm-\u003eflags (set/clear BATADV_DIRECTLINK) at an attacker-influenced negative offset from skb-\u003edata, an out-of-bounds write giving a memory-corruption primitive.\nA:H - Continued iteration over wild pointers dereferences out-of-bounds/unmapped memory, reliably causing a kernel oops/panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:22.970Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/867cd090760e8f5cd206f387b47ff9c56fac04e9"
},
{
"url": "https://git.kernel.org/stable/c/10bb1f366d884d506c38a947b43026a75d1afe9a"
},
{
"url": "https://git.kernel.org/stable/c/96c9c0ed9a9579a9085765aceaa4556a6666eb82"
},
{
"url": "https://git.kernel.org/stable/c/f61499359fa529f0d45a53bf7c573a49eb6322e6"
},
{
"url": "https://git.kernel.org/stable/c/974542d1efc48b7e9fe16184e647615cba39969b"
},
{
"url": "https://git.kernel.org/stable/c/bf872db54f91ffe70104b98c20068b2d5910e018"
},
{
"url": "https://git.kernel.org/stable/c/b252797bfced986d6d92ec2f4cfcca842ce8aa78"
},
{
"url": "https://git.kernel.org/stable/c/0799e5943611006b346b8813c7daf7dd5aa26bfd"
}
],
"title": "batman-adv: fix integer overflow on buff_pos",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46198",
"datePublished": "2026-05-28T09:40:14.558Z",
"dateReserved": "2026-05-13T15:03:33.104Z",
"dateUpdated": "2026-08-05T12:30:22.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45928 (GCVE-0-2026-45928)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-27 12:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: chips-media: wave5: Fix memory leak on codec_info allocation failure
In wave5_vpu_open_enc() and wave5_vpu_open_dec(), a vpu instance is
allocated via kzalloc(). If the subsequent allocation for inst->codec_info
fails, the functions return -ENOMEM without freeing the previously
allocated instance, causing a memory leak.
Fix this by calling kfree() on the instance in this error path to ensure
it is properly released.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c",
"drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "52defdd4034db1a34bb48006f889d66a3629224b",
"status": "affected",
"version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
"versionType": "git"
},
{
"lessThan": "1de71556cbd6e1d0d26fb86b9b3bb8caa0df8495",
"status": "affected",
"version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
"versionType": "git"
},
{
"lessThan": "32e9e45cf7e3422d21fa64535588d3572faf71c3",
"status": "affected",
"version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
"versionType": "git"
},
{
"lessThan": "a519e21e32398459ba357e67b541402f7295ee1b",
"status": "affected",
"version": "9707a6254a8a6b978bde811a44fe07d86c229d1c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c",
"drivers/media/platform/chips-media/wave5/wave5-vpu-enc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Fix memory leak on codec_info allocation failure\n\nIn wave5_vpu_open_enc() and wave5_vpu_open_dec(), a vpu instance is\nallocated via kzalloc(). If the subsequent allocation for inst-\u003ecodec_info\nfails, the functions return -ENOMEM without freeing the previously\nallocated instance, causing a memory leak.\n\nFix this by calling kfree() on the instance in this error path to ensure\nit is properly released."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:17:47.075Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/52defdd4034db1a34bb48006f889d66a3629224b"
},
{
"url": "https://git.kernel.org/stable/c/1de71556cbd6e1d0d26fb86b9b3bb8caa0df8495"
},
{
"url": "https://git.kernel.org/stable/c/32e9e45cf7e3422d21fa64535588d3572faf71c3"
},
{
"url": "https://git.kernel.org/stable/c/a519e21e32398459ba357e67b541402f7295ee1b"
}
],
"title": "media: chips-media: wave5: Fix memory leak on codec_info allocation failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45928",
"datePublished": "2026-05-27T12:17:47.075Z",
"dateReserved": "2026-05-13T15:03:33.086Z",
"dateUpdated": "2026-05-27T12:17:47.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31754 (GCVE-0-2026-31754)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-05-11 22:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: gadget: fix state inconsistency on gadget init failure
When cdns3_gadget_start() fails, the DRD hardware is left in gadget mode
while software state remains INACTIVE, creating hardware/software state
inconsistency.
When switching to host mode via sysfs:
echo host > /sys/class/usb_role/13180000.usb-role-switch/role
The role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error,
so cdns_role_stop() skips cleanup because state is still INACTIVE.
This violates the DRD controller design specification (Figure22),
which requires returning to idle state before switching roles.
This leads to a synchronous external abort in xhci_gen_setup() when
setting up the host controller:
[ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19
[ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget
[ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed
...
[ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP
[ 1301.382485] pc : xhci_gen_setup+0xa4/0x408
[ 1301.393391] backtrace:
...
xhci_gen_setup+0xa4/0x408 <-- CRASH
xhci_plat_setup+0x44/0x58
usb_add_hcd+0x284/0x678
...
cdns_role_set+0x9c/0xbc <-- Role switch
Fix by calling cdns_drd_gadget_off() in the error path to properly
clean up the DRD gadget state.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe Version: 7733f6c32e36ff9d7adadf40001039bf219b1cbe |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/cdns3/cdns3-gadget.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fb7110a052467098967284ef14d306810b354937",
"status": "affected",
"version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
"versionType": "git"
},
{
"lessThan": "9b1d301fbae837bf6979a19030b81d869bb15f7a",
"status": "affected",
"version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
"versionType": "git"
},
{
"lessThan": "cfca84f5986afceb63a3adf39d4a98e915aebbc2",
"status": "affected",
"version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
"versionType": "git"
},
{
"lessThan": "c7e475ae3a5593c5db21b3b7dca4ba8bdac9b47f",
"status": "affected",
"version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
"versionType": "git"
},
{
"lessThan": "5a85599ca4d2584d89dc69f4fc49303b75a42338",
"status": "affected",
"version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
"versionType": "git"
},
{
"lessThan": "b490f0e477d26d29ed51e5dc47e3b9bd31bcb49f",
"status": "affected",
"version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
"versionType": "git"
},
{
"lessThan": "c32f8748d70c8fc77676ad92ed76cede17bf2c48",
"status": "affected",
"version": "7733f6c32e36ff9d7adadf40001039bf219b1cbe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/cdns3/cdns3-gadget.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: gadget: fix state inconsistency on gadget init failure\n\nWhen cdns3_gadget_start() fails, the DRD hardware is left in gadget mode\nwhile software state remains INACTIVE, creating hardware/software state\ninconsistency.\n\nWhen switching to host mode via sysfs:\n echo host \u003e /sys/class/usb_role/13180000.usb-role-switch/role\n\nThe role state is not set to CDNS_ROLE_STATE_ACTIVE due to the error,\nso cdns_role_stop() skips cleanup because state is still INACTIVE.\nThis violates the DRD controller design specification (Figure22),\nwhich requires returning to idle state before switching roles.\n\nThis leads to a synchronous external abort in xhci_gen_setup() when\nsetting up the host controller:\n\n[ 516.440698] configfs-gadget 13180000.usb: failed to start g1: -19\n[ 516.442035] cdns-usb3 13180000.usb: Failed to add gadget\n[ 516.443278] cdns-usb3 13180000.usb: set role 2 has failed\n...\n[ 1301.375722] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller\n[ 1301.377716] Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP\n[ 1301.382485] pc : xhci_gen_setup+0xa4/0x408\n[ 1301.393391] backtrace:\n ...\n xhci_gen_setup+0xa4/0x408 \u003c-- CRASH\n xhci_plat_setup+0x44/0x58\n usb_add_hcd+0x284/0x678\n ...\n cdns_role_set+0x9c/0xbc \u003c-- Role switch\n\nFix by calling cdns_drd_gadget_off() in the error path to properly\nclean up the DRD gadget state."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:15:10.071Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fb7110a052467098967284ef14d306810b354937"
},
{
"url": "https://git.kernel.org/stable/c/9b1d301fbae837bf6979a19030b81d869bb15f7a"
},
{
"url": "https://git.kernel.org/stable/c/cfca84f5986afceb63a3adf39d4a98e915aebbc2"
},
{
"url": "https://git.kernel.org/stable/c/c7e475ae3a5593c5db21b3b7dca4ba8bdac9b47f"
},
{
"url": "https://git.kernel.org/stable/c/5a85599ca4d2584d89dc69f4fc49303b75a42338"
},
{
"url": "https://git.kernel.org/stable/c/b490f0e477d26d29ed51e5dc47e3b9bd31bcb49f"
},
{
"url": "https://git.kernel.org/stable/c/c32f8748d70c8fc77676ad92ed76cede17bf2c48"
}
],
"title": "usb: cdns3: gadget: fix state inconsistency on gadget init failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31754",
"datePublished": "2026-05-01T14:14:45.628Z",
"dateReserved": "2026-03-09T15:48:24.139Z",
"dateUpdated": "2026-05-11T22:15:10.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43466 (GCVE-0-2026-43466)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
In case of a TX error CQE, a recovery flow is triggered,
mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc,
desyncing the DMA FIFO producer and consumer.
After recovery, the producer pushes new DMA entries at the old
dma_fifo_pc, while the consumer reads from position 0.
This causes us to unmap stale DMA addresses from before the recovery.
The DMA FIFO is a purely software construct with no HW counterpart.
At the point of reset, all WQEs have been flushed so dma_fifo_cc is
already equal to dma_fifo_pc. There is no need to reset either counter,
similar to how skb_fifo pc/cc are untouched.
Remove the 'dma_fifo_cc = 0' reset.
This fixes the following WARNING:
WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommu_dma_unmap_page+0x79/0x90
Modules linked in: mlx5_vdpa vringh vdpa bonding mlx5_ib mlx5_vfio_pci ipip mlx5_fwctl tunnel4 mlx5_core ib_ipoib geneve ip6_gre ip_gre gre nf_tables ip6_tunnel rdma_ucm ib_uverbs ib_umad vfio_pci vfio_pci_core act_mirred act_skbedit act_vlan vhost_net vhost tap ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress vhost_iotlb iptable_raw tunnel6 vfio_iommu_type1 vfio openvswitch nsh rpcsec_gss_krb5 auth_rpcgss oid_registry xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter overlay zram zsmalloc rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core fuse [last unloaded: nf_tables]
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5_for_upstream_min_debug_2024_12_30_21_33 #1
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:iommu_dma_unmap_page+0x79/0x90
Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 41 5d 41 5e 41 5f e9 c7 ae 9e ff <0f> 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f 1f 84 00 00 00 00
Call Trace:
<IRQ>
? __warn+0x7d/0x110
? iommu_dma_unmap_page+0x79/0x90
? report_bug+0x16d/0x180
? handle_bug+0x4f/0x90
? exc_invalid_op+0x14/0x70
? asm_exc_invalid_op+0x16/0x20
? iommu_dma_unmap_page+0x79/0x90
? iommu_dma_unmap_page+0x2e/0x90
dma_unmap_page_attrs+0x10d/0x1b0
mlx5e_tx_wi_dma_unmap+0xbe/0x120 [mlx5_core]
mlx5e_poll_tx_cq+0x16d/0x690 [mlx5_core]
mlx5e_napi_poll+0x8b/0xac0 [mlx5_core]
__napi_poll+0x24/0x190
net_rx_action+0x32a/0x3b0
? mlx5_eq_comp_int+0x7e/0x270 [mlx5_core]
? notifier_call_chain+0x35/0xa0
handle_softirqs+0xc9/0x270
irq_exit_rcu+0x71/0xd0
common_interrupt+0x7f/0xa0
</IRQ>
<TASK>
asm_common_interrupt+0x22/0x40
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: db75373c91b0cfb6a68ad6ae88721e4e21ae6261 Version: db75373c91b0cfb6a68ad6ae88721e4e21ae6261 Version: db75373c91b0cfb6a68ad6ae88721e4e21ae6261 Version: db75373c91b0cfb6a68ad6ae88721e4e21ae6261 Version: db75373c91b0cfb6a68ad6ae88721e4e21ae6261 Version: db75373c91b0cfb6a68ad6ae88721e4e21ae6261 Version: db75373c91b0cfb6a68ad6ae88721e4e21ae6261 Version: db75373c91b0cfb6a68ad6ae88721e4e21ae6261 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "821f85d619f7f22cda7b9d7de89cf5eeb1d11544",
"status": "affected",
"version": "db75373c91b0cfb6a68ad6ae88721e4e21ae6261",
"versionType": "git"
},
{
"lessThan": "6eb68ecc5acc3b319986566c595990b8a7265b23",
"status": "affected",
"version": "db75373c91b0cfb6a68ad6ae88721e4e21ae6261",
"versionType": "git"
},
{
"lessThan": "6f41f7812bfa7f991b732a4b45c5c52fc4be3b4e",
"status": "affected",
"version": "db75373c91b0cfb6a68ad6ae88721e4e21ae6261",
"versionType": "git"
},
{
"lessThan": "383b37c04a4827ba60b2bafc1a6cdfd995aed58f",
"status": "affected",
"version": "db75373c91b0cfb6a68ad6ae88721e4e21ae6261",
"versionType": "git"
},
{
"lessThan": "9c5ee9b981ee050b73fdf3f4a2464d6f1a8e10a8",
"status": "affected",
"version": "db75373c91b0cfb6a68ad6ae88721e4e21ae6261",
"versionType": "git"
},
{
"lessThan": "ce1b19dd0684eeb68a124c11085bd611260b36d9",
"status": "affected",
"version": "db75373c91b0cfb6a68ad6ae88721e4e21ae6261",
"versionType": "git"
},
{
"lessThan": "829efcccfa8f69db5dc8332961295587d218cee6",
"status": "affected",
"version": "db75373c91b0cfb6a68ad6ae88721e4e21ae6261",
"versionType": "git"
},
{
"lessThan": "1633111d69053512d099658d4a05fc736fab36b0",
"status": "affected",
"version": "db75373c91b0cfb6a68ad6ae88721e4e21ae6261",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery\n\nIn case of a TX error CQE, a recovery flow is triggered,\nmlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc,\ndesyncing the DMA FIFO producer and consumer.\n\nAfter recovery, the producer pushes new DMA entries at the old\ndma_fifo_pc, while the consumer reads from position 0.\nThis causes us to unmap stale DMA addresses from before the recovery.\n\nThe DMA FIFO is a purely software construct with no HW counterpart.\nAt the point of reset, all WQEs have been flushed so dma_fifo_cc is\nalready equal to dma_fifo_pc. There is no need to reset either counter,\nsimilar to how skb_fifo pc/cc are untouched.\n\nRemove the \u0027dma_fifo_cc = 0\u0027 reset.\n\nThis fixes the following WARNING:\n WARNING: CPU: 0 PID: 0 at drivers/iommu/dma-iommu.c:1240 iommu_dma_unmap_page+0x79/0x90\n Modules linked in: mlx5_vdpa vringh vdpa bonding mlx5_ib mlx5_vfio_pci ipip mlx5_fwctl tunnel4 mlx5_core ib_ipoib geneve ip6_gre ip_gre gre nf_tables ip6_tunnel rdma_ucm ib_uverbs ib_umad vfio_pci vfio_pci_core act_mirred act_skbedit act_vlan vhost_net vhost tap ip6table_mangle ip6table_nat ip6table_filter ip6_tables iptable_mangle cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress vhost_iotlb iptable_raw tunnel6 vfio_iommu_type1 vfio openvswitch nsh rpcsec_gss_krb5 auth_rpcgss oid_registry xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat nf_nat xt_addrtype br_netfilter overlay zram zsmalloc rpcrdma ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_cm ib_core fuse [last unloaded: nf_tables]\n CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.13.0-rc5_for_upstream_min_debug_2024_12_30_21_33 #1\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n RIP: 0010:iommu_dma_unmap_page+0x79/0x90\n Code: 2b 4d 3b 21 72 26 4d 3b 61 08 73 20 49 89 d8 44 89 f9 5b 4c 89 f2 4c 89 e6 48 89 ef 5d 41 5c 41 5d 41 5e 41 5f e9 c7 ae 9e ff \u003c0f\u003e 0b 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f 1f 84 00 00 00 00\n Call Trace:\n \u003cIRQ\u003e\n ? __warn+0x7d/0x110\n ? iommu_dma_unmap_page+0x79/0x90\n ? report_bug+0x16d/0x180\n ? handle_bug+0x4f/0x90\n ? exc_invalid_op+0x14/0x70\n ? asm_exc_invalid_op+0x16/0x20\n ? iommu_dma_unmap_page+0x79/0x90\n ? iommu_dma_unmap_page+0x2e/0x90\n dma_unmap_page_attrs+0x10d/0x1b0\n mlx5e_tx_wi_dma_unmap+0xbe/0x120 [mlx5_core]\n mlx5e_poll_tx_cq+0x16d/0x690 [mlx5_core]\n mlx5e_napi_poll+0x8b/0xac0 [mlx5_core]\n __napi_poll+0x24/0x190\n net_rx_action+0x32a/0x3b0\n ? mlx5_eq_comp_int+0x7e/0x270 [mlx5_core]\n ? notifier_call_chain+0x35/0xa0\n handle_softirqs+0xc9/0x270\n irq_exit_rcu+0x71/0xd0\n common_interrupt+0x7f/0xa0\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n asm_common_interrupt+0x22/0x40"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - In a severe reasonable deployment, mlx5e backs network-facing servers, routers, or cloud forwarding paths where remote packets cause kernel TX through `dev_queue_xmit` and `mlx5e_xmit`; no local device file or ioctl is needed to reach the affected transmit/recovery path.\nAC:L - Once a TX error CQE occurs, the recovery desynchronizes the software DMA FIFO deterministically and later TX completions consume stale FIFO entries. There is no attacker-uncontrolled race in the vulnerable logic, so the higher-severity low complexity value is appropriate.\nPR:N - The reachable data path has no credential or capability check, and a remote peer can make the host transmit packets through exposed services or forwarding workloads. The recovery is automatic through the devlink health reporter rather than gated by an admin action.\nUI:N - No victim user action is required after the affected mlx5e interface is active; packet transmission, CQ polling, and recovery occur asynchronously in kernel/NAPI/workqueue context.\nS:U - The bug affects the host kernel driver\u0027s own DMA bookkeeping and availability within the same security authority. It does not create a demonstrated VM escape or IOMMU/DMA boundary bypass that would justify changed scope.\nC:N - The investigated failure is stale DMA unmapping, not an out-of-bounds read or CPU memory disclosure primitive. I found no evidence that it exposes kernel memory contents to the attacker.\nI:L - Stale DMA unmaps can release or disturb the wrong DMA/IOMMU mappings and corrupt device I/O state for packets, but the code path does not provide an arbitrary write or control-flow primitive. Choosing low integrity impact reflects the higher-severity side of the plausible non-arbitrary data corruption assessment.\nA:H - The observed failure is a WARN in `iommu_dma_unmap_page` from IRQ/NAPI context, and systems with `panic_on_warn` or repeated DMA/IOMMU faults can suffer a kernel panic or persistent network outage. This is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:09.660Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/821f85d619f7f22cda7b9d7de89cf5eeb1d11544"
},
{
"url": "https://git.kernel.org/stable/c/6eb68ecc5acc3b319986566c595990b8a7265b23"
},
{
"url": "https://git.kernel.org/stable/c/6f41f7812bfa7f991b732a4b45c5c52fc4be3b4e"
},
{
"url": "https://git.kernel.org/stable/c/383b37c04a4827ba60b2bafc1a6cdfd995aed58f"
},
{
"url": "https://git.kernel.org/stable/c/9c5ee9b981ee050b73fdf3f4a2464d6f1a8e10a8"
},
{
"url": "https://git.kernel.org/stable/c/ce1b19dd0684eeb68a124c11085bd611260b36d9"
},
{
"url": "https://git.kernel.org/stable/c/829efcccfa8f69db5dc8332961295587d218cee6"
},
{
"url": "https://git.kernel.org/stable/c/1633111d69053512d099658d4a05fc736fab36b0"
}
],
"title": "net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43466",
"datePublished": "2026-05-08T14:22:27.513Z",
"dateReserved": "2026-05-01T14:12:56.011Z",
"dateUpdated": "2026-08-05T12:28:09.660Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43119 (GCVE-0-2026-43119)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-07-24 14:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: annotate data-races around hdev->req_status
__hci_cmd_sync_sk() sets hdev->req_status under hdev->req_lock:
hdev->req_status = HCI_REQ_PEND;
However, several other functions read or write hdev->req_status without
holding any lock:
- hci_send_cmd_sync() reads req_status in hci_cmd_work (workqueue)
- hci_cmd_sync_complete() reads/writes from HCI event completion
- hci_cmd_sync_cancel() / hci_cmd_sync_cancel_sync() read/write
- hci_abort_conn() reads in connection abort path
Since __hci_cmd_sync_sk() runs on hdev->req_workqueue while
hci_send_cmd_sync() runs on hdev->workqueue, these are different
workqueues that can execute concurrently on different CPUs. The plain
C accesses constitute a data race.
Add READ_ONCE()/WRITE_ONCE() annotations on all concurrent accesses
to hdev->req_status to prevent potential compiler optimizations that
could affect correctness (e.g., load fusing in the wait_event
condition or store reordering).
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f80c5dad7b6467b884c445ffea45985793b4b2d0 Version: f80c5dad7b6467b884c445ffea45985793b4b2d0 Version: f80c5dad7b6467b884c445ffea45985793b4b2d0 Version: f80c5dad7b6467b884c445ffea45985793b4b2d0 Version: f80c5dad7b6467b884c445ffea45985793b4b2d0 Version: 8603d49906b231bbcd9141db7d096fa1041bc379 Version: 0e061885bfcd65ef5d09f154f3c3c3491cc7544a Version: a3d50fb7ce931f08a2c6194fdc4c9a56c9ed4153 Version: 4.19.47 ≤ Version: 5.0.20 ≤ Version: 5.1.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_conn.c",
"net/bluetooth/hci_core.c",
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e51042ddc0b20d9bda5eb6dcf85a2668f9c5dae4",
"status": "affected",
"version": "f80c5dad7b6467b884c445ffea45985793b4b2d0",
"versionType": "git"
},
{
"lessThan": "6e539907c0d11f514c5e0b049b27b04dff48a5b1",
"status": "affected",
"version": "f80c5dad7b6467b884c445ffea45985793b4b2d0",
"versionType": "git"
},
{
"lessThan": "a7a1cdb4a64ca74eb95cc46648fccb8cd3f9af27",
"status": "affected",
"version": "f80c5dad7b6467b884c445ffea45985793b4b2d0",
"versionType": "git"
},
{
"lessThan": "40734ce8efc34c4a0d0222855798c0dc14b65f2e",
"status": "affected",
"version": "f80c5dad7b6467b884c445ffea45985793b4b2d0",
"versionType": "git"
},
{
"lessThan": "b6807cfc195ef99e1ac37b2e1e60df40295daa8c",
"status": "affected",
"version": "f80c5dad7b6467b884c445ffea45985793b4b2d0",
"versionType": "git"
},
{
"status": "affected",
"version": "8603d49906b231bbcd9141db7d096fa1041bc379",
"versionType": "git"
},
{
"status": "affected",
"version": "0e061885bfcd65ef5d09f154f3c3c3491cc7544a",
"versionType": "git"
},
{
"status": "affected",
"version": "a3d50fb7ce931f08a2c6194fdc4c9a56c9ed4153",
"versionType": "git"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.47",
"versionType": "semver"
},
{
"lessThan": "5.1",
"status": "affected",
"version": "5.0.20",
"versionType": "semver"
},
{
"lessThan": "5.2",
"status": "affected",
"version": "5.1.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_conn.c",
"net/bluetooth/hci_core.c",
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.47",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.0.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.1.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status\n\n__hci_cmd_sync_sk() sets hdev-\u003ereq_status under hdev-\u003ereq_lock:\n\n hdev-\u003ereq_status = HCI_REQ_PEND;\n\nHowever, several other functions read or write hdev-\u003ereq_status without\nholding any lock:\n\n - hci_send_cmd_sync() reads req_status in hci_cmd_work (workqueue)\n - hci_cmd_sync_complete() reads/writes from HCI event completion\n - hci_cmd_sync_cancel() / hci_cmd_sync_cancel_sync() read/write\n - hci_abort_conn() reads in connection abort path\n\nSince __hci_cmd_sync_sk() runs on hdev-\u003ereq_workqueue while\nhci_send_cmd_sync() runs on hdev-\u003eworkqueue, these are different\nworkqueues that can execute concurrently on different CPUs. The plain\nC accesses constitute a data race.\n\nAdd READ_ONCE()/WRITE_ONCE() annotations on all concurrent accesses\nto hdev-\u003ereq_status to prevent potential compiler optimizations that\ncould affect correctness (e.g., load fusing in the wait_event\ncondition or store reordering)."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:33:34.175Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e51042ddc0b20d9bda5eb6dcf85a2668f9c5dae4"
},
{
"url": "https://git.kernel.org/stable/c/6e539907c0d11f514c5e0b049b27b04dff48a5b1"
},
{
"url": "https://git.kernel.org/stable/c/a7a1cdb4a64ca74eb95cc46648fccb8cd3f9af27"
},
{
"url": "https://git.kernel.org/stable/c/40734ce8efc34c4a0d0222855798c0dc14b65f2e"
},
{
"url": "https://git.kernel.org/stable/c/b6807cfc195ef99e1ac37b2e1e60df40295daa8c"
}
],
"title": "Bluetooth: hci_sync: annotate data-races around hdev-\u003ereq_status",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43119",
"datePublished": "2026-05-06T07:40:43.257Z",
"dateReserved": "2026-05-01T14:12:55.987Z",
"dateUpdated": "2026-07-24T14:33:34.175Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31561 (GCVE-0-2026-31561)
Vulnerability from cvelistv5
Published
2026-04-24 14:35
Modified
2026-05-11 22:11
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask
Commit in Fixes added the FRED CR4 bit to the CR4 pinned bits mask so
that whenever something else modifies CR4, that bit remains set. Which
in itself is a perfectly fine idea.
However, there's an issue when during boot FRED is initialized: first on
the BSP and later on the APs. Thus, there's a window in time when
exceptions cannot be handled.
This becomes particularly nasty when running as SEV-{ES,SNP} or TDX
guests which, when they manage to trigger exceptions during that short
window described above, triple fault due to FRED MSRs not being set up
yet.
See Link tag below for a much more detailed explanation of the
situation.
So, as a result, the commit in that Link URL tried to address this
shortcoming by temporarily disabling CR4 pinning when an AP is not
online yet.
However, that is a problem in itself because in this case, an attack on
the kernel needs to only modify the online bit - a single bit in RW
memory - and then disable CR4 pinning and then disable SM*P, leading to
more and worse things to happen to the system.
So, instead, remove the FRED bit from the CR4 pinning mask, thus
obviating the need to temporarily disable CR4 pinning.
If someone manages to disable FRED when poking at CR4, then
idt_invalidate() would make sure the system would crash'n'burn on the
first exception triggered, which is a much better outcome security-wise.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kernel/cpu/common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d7853d9fe94abf43b46c57b0b7f8418198b7615a",
"status": "affected",
"version": "ff45746fbf005f96e42bea466698e3fdbf926013",
"versionType": "git"
},
{
"lessThan": "a6e14114684d2324e5401617d6d01acb4a4e0e22",
"status": "affected",
"version": "ff45746fbf005f96e42bea466698e3fdbf926013",
"versionType": "git"
},
{
"lessThan": "00d956dafa76f86a73424fe5cce3d604a8be2e4b",
"status": "affected",
"version": "ff45746fbf005f96e42bea466698e3fdbf926013",
"versionType": "git"
},
{
"lessThan": "411df123c017169922cc767affce76282b8e6c85",
"status": "affected",
"version": "ff45746fbf005f96e42bea466698e3fdbf926013",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kernel/cpu/common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask\n\nCommit in Fixes added the FRED CR4 bit to the CR4 pinned bits mask so\nthat whenever something else modifies CR4, that bit remains set. Which\nin itself is a perfectly fine idea.\n\nHowever, there\u0027s an issue when during boot FRED is initialized: first on\nthe BSP and later on the APs. Thus, there\u0027s a window in time when\nexceptions cannot be handled.\n\nThis becomes particularly nasty when running as SEV-{ES,SNP} or TDX\nguests which, when they manage to trigger exceptions during that short\nwindow described above, triple fault due to FRED MSRs not being set up\nyet.\n\nSee Link tag below for a much more detailed explanation of the\nsituation.\n\nSo, as a result, the commit in that Link URL tried to address this\nshortcoming by temporarily disabling CR4 pinning when an AP is not\nonline yet.\n\nHowever, that is a problem in itself because in this case, an attack on\nthe kernel needs to only modify the online bit - a single bit in RW\nmemory - and then disable CR4 pinning and then disable SM*P, leading to\nmore and worse things to happen to the system.\n\nSo, instead, remove the FRED bit from the CR4 pinning mask, thus\nobviating the need to temporarily disable CR4 pinning.\n\nIf someone manages to disable FRED when poking at CR4, then\nidt_invalidate() would make sure the system would crash\u0027n\u0027burn on the\nfirst exception triggered, which is a much better outcome security-wise."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:11:09.941Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d7853d9fe94abf43b46c57b0b7f8418198b7615a"
},
{
"url": "https://git.kernel.org/stable/c/a6e14114684d2324e5401617d6d01acb4a4e0e22"
},
{
"url": "https://git.kernel.org/stable/c/00d956dafa76f86a73424fe5cce3d604a8be2e4b"
},
{
"url": "https://git.kernel.org/stable/c/411df123c017169922cc767affce76282b8e6c85"
}
],
"title": "x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31561",
"datePublished": "2026-04-24T14:35:43.302Z",
"dateReserved": "2026-03-09T15:48:24.116Z",
"dateUpdated": "2026-05-11T22:11:09.941Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52926 (GCVE-0-2026-52926)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-06-24 07:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: clear current gateway during teardown
batadv_gw_node_free() removes the gateway list entries during mesh teardown,
but it does not clear the currently selected gateway. This leaves stale
gateway state behind across cleanup and can break a later mesh recreation.
Clear bat_priv->gw.curr_gw before walking the gateway list so the selected
gateway reference is dropped as part of teardown.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2265c141086474bbae55a5bb3afa1ebb78ccaa7c Version: 2265c141086474bbae55a5bb3afa1ebb78ccaa7c Version: 2265c141086474bbae55a5bb3afa1ebb78ccaa7c Version: 2265c141086474bbae55a5bb3afa1ebb78ccaa7c Version: 2265c141086474bbae55a5bb3afa1ebb78ccaa7c Version: 2265c141086474bbae55a5bb3afa1ebb78ccaa7c Version: 2265c141086474bbae55a5bb3afa1ebb78ccaa7c Version: 2265c141086474bbae55a5bb3afa1ebb78ccaa7c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/gateway_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a3f3f1ec8aad84c5dd386c430b9c61cddd85b18f",
"status": "affected",
"version": "2265c141086474bbae55a5bb3afa1ebb78ccaa7c",
"versionType": "git"
},
{
"lessThan": "e2ec4c712d19141ca7bf7fbbb1d842f73abaa186",
"status": "affected",
"version": "2265c141086474bbae55a5bb3afa1ebb78ccaa7c",
"versionType": "git"
},
{
"lessThan": "9a1a8ed4facfe843bde6fdfcf7af0e9923eb2e17",
"status": "affected",
"version": "2265c141086474bbae55a5bb3afa1ebb78ccaa7c",
"versionType": "git"
},
{
"lessThan": "6de089b545db013433cf934bb4e4433dec2dd65f",
"status": "affected",
"version": "2265c141086474bbae55a5bb3afa1ebb78ccaa7c",
"versionType": "git"
},
{
"lessThan": "30bda3ef4b0cac777f1a7c314cd08b8ff6437365",
"status": "affected",
"version": "2265c141086474bbae55a5bb3afa1ebb78ccaa7c",
"versionType": "git"
},
{
"lessThan": "ae7aeb0ce3c0ebbe357ed525779acac197a18086",
"status": "affected",
"version": "2265c141086474bbae55a5bb3afa1ebb78ccaa7c",
"versionType": "git"
},
{
"lessThan": "17e3a441111cd1a530cd6ee69a22f3161d80d810",
"status": "affected",
"version": "2265c141086474bbae55a5bb3afa1ebb78ccaa7c",
"versionType": "git"
},
{
"lessThan": "a340a51ed801eab7bb454150c226323b865263cc",
"status": "affected",
"version": "2265c141086474bbae55a5bb3afa1ebb78ccaa7c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/gateway_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"lessThan": "3.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: clear current gateway during teardown\n\nbatadv_gw_node_free() removes the gateway list entries during mesh teardown,\nbut it does not clear the currently selected gateway. This leaves stale\ngateway state behind across cleanup and can break a later mesh recreation.\n\nClear bat_priv-\u003egw.curr_gw before walking the gateway list so the selected\ngateway reference is dropped as part of teardown."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T07:14:20.057Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a3f3f1ec8aad84c5dd386c430b9c61cddd85b18f"
},
{
"url": "https://git.kernel.org/stable/c/e2ec4c712d19141ca7bf7fbbb1d842f73abaa186"
},
{
"url": "https://git.kernel.org/stable/c/9a1a8ed4facfe843bde6fdfcf7af0e9923eb2e17"
},
{
"url": "https://git.kernel.org/stable/c/6de089b545db013433cf934bb4e4433dec2dd65f"
},
{
"url": "https://git.kernel.org/stable/c/30bda3ef4b0cac777f1a7c314cd08b8ff6437365"
},
{
"url": "https://git.kernel.org/stable/c/ae7aeb0ce3c0ebbe357ed525779acac197a18086"
},
{
"url": "https://git.kernel.org/stable/c/17e3a441111cd1a530cd6ee69a22f3161d80d810"
},
{
"url": "https://git.kernel.org/stable/c/a340a51ed801eab7bb454150c226323b865263cc"
}
],
"title": "batman-adv: clear current gateway during teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52926",
"datePublished": "2026-06-24T07:14:20.057Z",
"dateReserved": "2026-06-09T07:44:35.368Z",
"dateUpdated": "2026-06-24T07:14:20.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52993 (GCVE-0-2026-52993)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix double-free in tipc_buf_append()
tipc_msg_validate() can potentially reallocate the skb it is validating,
freeing the old one. In tipc_buf_append(), it was being called with a
pointer to a local variable which was a copy of the caller's skb
pointer.
If the skb was reallocated and validation subsequently failed, the error
handling path would free the original skb pointer, which had already
been freed, leading to double-free.
Fix this by checking if head now points to a newly allocated reassembled
skb. If it does, reassign *headbuf for later freeing operations.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d618d09a68e4eed7a435beb2e355250f6f40664a Version: d618d09a68e4eed7a435beb2e355250f6f40664a Version: d618d09a68e4eed7a435beb2e355250f6f40664a Version: d618d09a68e4eed7a435beb2e355250f6f40664a Version: d618d09a68e4eed7a435beb2e355250f6f40664a Version: d618d09a68e4eed7a435beb2e355250f6f40664a Version: d618d09a68e4eed7a435beb2e355250f6f40664a Version: d618d09a68e4eed7a435beb2e355250f6f40664a |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.40.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.147.1.rt7.488.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.147.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.33.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Transparent Inter-Process Communication (TIPC) module. This vulnerability, a double-free, occurs when the `tipc_buf_append()` function incorrectly handles memory after a socket buffer (skb) reallocation. An attacker could potentially exploit this to cause system instability or a denial of service. In some scenarios, this type of memory corruption could also lead to arbitrary code execution."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-763",
"description": "Release of Invalid Pointer or Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T12:05:48.382Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52993"
},
{
"name": "RHBZ#2492437",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492437"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52993.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47017"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49212"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:45115"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:45116"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:47017: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:49212: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:45115: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:45116: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: tipc: fix double-free in tipc_buf_append()",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/msg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a438975a6dcdbd70865978c021650d1485586f0b",
"status": "affected",
"version": "d618d09a68e4eed7a435beb2e355250f6f40664a",
"versionType": "git"
},
{
"lessThan": "4ee4deadaae7cb2e3d53af0fc889cf92a73413c0",
"status": "affected",
"version": "d618d09a68e4eed7a435beb2e355250f6f40664a",
"versionType": "git"
},
{
"lessThan": "d3556656c6daebf8def751c7e71d11dd0a180d24",
"status": "affected",
"version": "d618d09a68e4eed7a435beb2e355250f6f40664a",
"versionType": "git"
},
{
"lessThan": "0274f24485fc38032d4093e463dc3ff5c7a667c9",
"status": "affected",
"version": "d618d09a68e4eed7a435beb2e355250f6f40664a",
"versionType": "git"
},
{
"lessThan": "4d104882bc815d4ec666ace9155f5f52715879a6",
"status": "affected",
"version": "d618d09a68e4eed7a435beb2e355250f6f40664a",
"versionType": "git"
},
{
"lessThan": "1d5e589055880fae229e229e1929e087dbe08cf3",
"status": "affected",
"version": "d618d09a68e4eed7a435beb2e355250f6f40664a",
"versionType": "git"
},
{
"lessThan": "29940fff14110ca48c5ccc168d121665b51bb778",
"status": "affected",
"version": "d618d09a68e4eed7a435beb2e355250f6f40664a",
"versionType": "git"
},
{
"lessThan": "d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a",
"status": "affected",
"version": "d618d09a68e4eed7a435beb2e355250f6f40664a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/msg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix double-free in tipc_buf_append()\n\ntipc_msg_validate() can potentially reallocate the skb it is validating,\nfreeing the old one. In tipc_buf_append(), it was being called with a\npointer to a local variable which was a copy of the caller\u0027s skb\npointer.\n\nIf the skb was reallocated and validation subsequently failed, the error\nhandling path would free the original skb pointer, which had already\nbeen freed, leading to double-free.\n\nFix this by checking if head now points to a newly allocated reassembled\nskb. If it does, reassign *headbuf for later freeing operations."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - TIPC fragment reassembly is reachable from off-node packets via configured TIPC bearers, including the UDP media path over IP. The most severe reasonable deployment is a TIPC UDP cluster service reachable over a network.\nAC:L - A malicious TIPC peer can craft the fragment sequence to inflate the reassembled skb truesize and make the copied inner message fail validation. No attacker-uncontrolled race or rare condition is required.\nPR:N - No target credentials or local account are required to send TIPC packets to an exposed bearer and establish/use the link path. The checks are TIPC discovery/link state checks, not user authentication.\nUI:N - Exploitation is packet-driven and does not require a victim user to open a file, mount anything, or take any other action.\nS:U - The bug corrupts kernel networking memory within the same kernel security authority. It does not cross a separate scope such as guest-to-host or an IOMMU boundary.\nC:H - The double-free of an skb is kernel heap memory corruption and can be leveraged as a use-after-free primitive. Conservatively, this supports high confidentiality impact.\nI:H - The double-free/use-after-free condition can be shaped into kernel memory corruption and potential control-flow or data modification primitives. Conservatively, this supports high integrity impact.\nA:H - Even without full exploitation, double-free of a kernel skb can trigger kernel heap corruption, oops, panic, or networking stack crash. This is high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:27.877Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a438975a6dcdbd70865978c021650d1485586f0b"
},
{
"url": "https://git.kernel.org/stable/c/4ee4deadaae7cb2e3d53af0fc889cf92a73413c0"
},
{
"url": "https://git.kernel.org/stable/c/d3556656c6daebf8def751c7e71d11dd0a180d24"
},
{
"url": "https://git.kernel.org/stable/c/0274f24485fc38032d4093e463dc3ff5c7a667c9"
},
{
"url": "https://git.kernel.org/stable/c/4d104882bc815d4ec666ace9155f5f52715879a6"
},
{
"url": "https://git.kernel.org/stable/c/1d5e589055880fae229e229e1929e087dbe08cf3"
},
{
"url": "https://git.kernel.org/stable/c/29940fff14110ca48c5ccc168d121665b51bb778"
},
{
"url": "https://git.kernel.org/stable/c/d293ca716e7d5dffdaecaf6b9b2f857a33dc3d3a"
}
],
"title": "tipc: fix double-free in tipc_buf_append()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52993",
"datePublished": "2026-06-24T16:29:06.475Z",
"dateReserved": "2026-06-09T07:44:35.377Z",
"dateUpdated": "2026-08-05T12:32:27.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53071 (GCVE-0-2026-53071)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding
l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file
acquires the lock first. A remote BLE device can send a crafted
L2CAP ECRED reconfiguration response to corrupt the channel list
while another thread is iterating it.
Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(),
and l2cap_chan_unlock() and l2cap_chan_put() after, matching the
pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.37.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.146.1.rt7.487.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.146.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.29.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) implementation. A remote Bluetooth Low Energy (BLE) device can exploit this by sending a specially crafted L2CAP ECRED reconfiguration response. This can lead to the corruption of the channel list, potentially causing a Denial of Service (DoS) by making the system unstable or unresponsive. The vulnerability is due to a missing channel lock when a channel is deleted."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-23T12:08:03.785Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53071"
},
{
"name": "RHBZ#2492458",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492458"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53071.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42919"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:43307"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42552"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42550"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:42919: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:43307: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:42552: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:42550: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "96dca51715d86559ed6ed8028e5445cecb80f3ae",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "330b20ec97916961ee0e6c29c06bc0fa7c96e64c",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "0ccd75c51f620374086f359e906917676e699a1c",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "77a853aec710b2fdf41fa298ea3cbc9a4358f917",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "dc89961b76f12aff47124c1df4bdb32a080f4d0c",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "5501d055a1ce3c747141e3955ba8cf034d193f3e",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "42776497cdbc9a665b384a6dcb85f0d4bd927eab",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp\n\nl2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding\nl2cap_chan_lock(). Every other l2cap_chan_del() caller in the file\nacquires the lock first. A remote BLE device can send a crafted\nL2CAP ECRED reconfiguration response to corrupt the channel list\nwhile another thread is iterating it.\n\nAdd l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(),\nand l2cap_chan_unlock() and l2cap_chan_put() after, matching the\npattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - Bluetooth L2CAP LE signaling is reachable over a nearby Bluetooth Low Energy link from a remote BLE peer. This requires adjacent radio proximity rather than IP network access.\nAC:L - The vulnerable path is triggered by a crafted ECRED reconfiguration response after an ECRED channel/reconfiguration exists, and ECRED is enabled by default. The race is between attacker-timed peer signaling and normal channel/socket activity, with no rare external condition required.\nPR:N - The receive path performs no OS privilege or capability check on the remote peer before dispatching the L2CAP_ECRED_RECONF_RSP. A nearby BLE device can send the crafted response as protocol input without local credentials.\nUI:N - In a plausible phone, embedded, or IoT deployment, an ECRED-using service can maintain/reconfigure BLE channels without a victim performing an exploit-time action. The attacker only needs to send the malicious BLE response at the protocol level.\nS:U - The corruption occurs inside the kernel Bluetooth/L2CAP subsystem and impacts the same kernel security authority. It is not a VM escape or other cross-scope boundary bypass.\nC:H - The missing channel lock permits unsynchronized channel deletion and list/lifetime corruption in kernel memory. As memory corruption, it is defensible to treat it as capable of yielding kernel information disclosure primitives.\nI:H - Concurrent `l2cap_chan_del()` without the required channel lock can corrupt kernel list/object state and potentially be shaped beyond a simple disconnect. Under the required conservative scoring rule, this kernel memory corruption supports high integrity impact.\nA:H - At minimum, corrupted L2CAP channel list/lifetime state can cause kernel oops, panic, or hang. The vulnerable code can be reached repeatedly by a malicious nearby BLE peer."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:05.835Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/96dca51715d86559ed6ed8028e5445cecb80f3ae"
},
{
"url": "https://git.kernel.org/stable/c/330b20ec97916961ee0e6c29c06bc0fa7c96e64c"
},
{
"url": "https://git.kernel.org/stable/c/0ccd75c51f620374086f359e906917676e699a1c"
},
{
"url": "https://git.kernel.org/stable/c/77a853aec710b2fdf41fa298ea3cbc9a4358f917"
},
{
"url": "https://git.kernel.org/stable/c/fe1188abdae9b7a8199dcdfcf9244d5e5d61eb14"
},
{
"url": "https://git.kernel.org/stable/c/dc89961b76f12aff47124c1df4bdb32a080f4d0c"
},
{
"url": "https://git.kernel.org/stable/c/5501d055a1ce3c747141e3955ba8cf034d193f3e"
},
{
"url": "https://git.kernel.org/stable/c/42776497cdbc9a665b384a6dcb85f0d4bd927eab"
}
],
"title": "Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53071",
"datePublished": "2026-06-24T16:30:12.694Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-08-05T12:33:05.835Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31768 (GCVE-0-2026-31768)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()
Add a DMA-safe buffer and use it for spi_read() instead of a stack
memory. All SPI buffers must be DMA-safe.
Since we only need up to 3 bytes, we just use a u8[] instead of __be16
and __be32 and change the conversion functions appropriately.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4d671b71beefbfc145b971a11e0c3cabde94b673 Version: 4d671b71beefbfc145b971a11e0c3cabde94b673 Version: 4d671b71beefbfc145b971a11e0c3cabde94b673 Version: 4d671b71beefbfc145b971a11e0c3cabde94b673 Version: 4d671b71beefbfc145b971a11e0c3cabde94b673 Version: 4d671b71beefbfc145b971a11e0c3cabde94b673 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:47.799Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/adc/ti-adc161s626.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b3bb8faeca1a2ef7be95ee8a512b639f9ffce947",
"status": "affected",
"version": "4d671b71beefbfc145b971a11e0c3cabde94b673",
"versionType": "git"
},
{
"lessThan": "fa64aab25aba47296aa8d12bb4c88ec3fecb2054",
"status": "affected",
"version": "4d671b71beefbfc145b971a11e0c3cabde94b673",
"versionType": "git"
},
{
"lessThan": "67b3a91bdc48220bfb67155ab528121b9c822782",
"status": "affected",
"version": "4d671b71beefbfc145b971a11e0c3cabde94b673",
"versionType": "git"
},
{
"lessThan": "014c6d27878d3883f7bb065610768fd021de1a96",
"status": "affected",
"version": "4d671b71beefbfc145b971a11e0c3cabde94b673",
"versionType": "git"
},
{
"lessThan": "d2d031b0786ea66ab0577c9d2d71435068d32199",
"status": "affected",
"version": "4d671b71beefbfc145b971a11e0c3cabde94b673",
"versionType": "git"
},
{
"lessThan": "768461517a28d80fe81ea4d5d03a90cd184ea6ad",
"status": "affected",
"version": "4d671b71beefbfc145b971a11e0c3cabde94b673",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/adc/ti-adc161s626.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: ti-adc161s626: use DMA-safe memory for spi_read()\n\nAdd a DMA-safe buffer and use it for spi_read() instead of a stack\nmemory. All SPI buffers must be DMA-safe.\n\nSince we only need up to 3 bytes, we just use a u8[] instead of __be16\nand __be32 and change the conversion functions appropriately."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable `spi_read()` is reachable by a local user reading the world-readable IIO raw sysfs attribute for the ADC device. There is no network or adjacent protocol path to this hardware-specific SPI ADC driver.\nAC:L - On an affected system with this ADC behind a DMA-capable SPI controller, the attacker can repeatedly trigger the vulnerable read directly; no race or external condition beyond the deployment is required.\nPR:L - Triggering the direct IIO raw read requires only a basic local unprivileged user able to read sysfs device attributes. No real root/admin capability is required for that path.\nUI:N - The attacker can trigger the read themselves by accessing the sysfs attribute. No victim action is needed.\nS:U - The corruption occurs within the kernel context managing the SPI/IIO device. It does not cross a separate security authority such as a guest/host or IOMMU isolation boundary.\nC:H - The bug passes kernel stack memory as a DMA receive buffer, creating kernel stack/cacheline memory corruption on DMA-capable controllers. Kernel stack corruption is reasonably exploitable for broader kernel memory disclosure.\nI:H - DMA into non-DMA-safe stack memory can corrupt adjacent kernel stack state and potentially control data or control flow. Under the required high-severity tie-break, this supports high integrity impact.\nA:H - Kernel stack corruption from repeated ADC reads can cause oopses, panics, or hangs. Availability impact is therefore high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:01.435Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b3bb8faeca1a2ef7be95ee8a512b639f9ffce947"
},
{
"url": "https://git.kernel.org/stable/c/fa64aab25aba47296aa8d12bb4c88ec3fecb2054"
},
{
"url": "https://git.kernel.org/stable/c/67b3a91bdc48220bfb67155ab528121b9c822782"
},
{
"url": "https://git.kernel.org/stable/c/014c6d27878d3883f7bb065610768fd021de1a96"
},
{
"url": "https://git.kernel.org/stable/c/d2d031b0786ea66ab0577c9d2d71435068d32199"
},
{
"url": "https://git.kernel.org/stable/c/768461517a28d80fe81ea4d5d03a90cd184ea6ad"
}
],
"title": "iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31768",
"datePublished": "2026-05-01T14:14:57.971Z",
"dateReserved": "2026-03-09T15:48:24.140Z",
"dateUpdated": "2026-08-05T12:25:01.435Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52918 (GCVE-0-2026-52918)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: serialize accept_q access
bt_sock_poll() walks the accept queue without synchronization, while
child teardown can unlink the same socket and drop its last reference.
The unsynchronized accept queue walk has existed since the initial
Bluetooth import.
Protect accept_q with a dedicated lock for queue updates and polling.
Also rework bt_accept_dequeue() to take temporary child references under
the queue lock before dropping it and locking the child socket.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/bluetooth.h",
"net/bluetooth/af_bluetooth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d9ce4de05df2385c19e2c7d12f529144e1a44af1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "41c8c1c7923e86e0eb59cfb4279349112756a336",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4ec17782fd186f901a7329605d11048b085b945a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "be43e6b4043113c3b3cf887c3c8350f67140274c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "85f8674cae82053f1e6bab295f6a8422cca14db5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8b4c412e001b0c670eb937beab491af974da55b3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a218bf69eb51fefe59a3976fa8925261141f681c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e83f5e24da741fa9405aeeff00b08c5ee7c37b88",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/bluetooth.h",
"net/bluetooth/af_bluetooth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: serialize accept_q access\n\nbt_sock_poll() walks the accept queue without synchronization, while\nchild teardown can unlink the same socket and drop its last reference.\nThe unsynchronized accept queue walk has existed since the initial\nBluetooth import.\n\nProtect accept_q with a dedicated lock for queue updates and polling.\nAlso rework bt_accept_dequeue() to take temporary child references under\nthe queue lock before dropping it and locking the child socket."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable accept queue is in the Bluetooth socket stack and is reachable through nearby Bluetooth peers opening and tearing down L2CAP/RFCOMM-style connections to a listening Bluetooth service.\nAC:L - The race can be exercised repeatedly by driving connection and disconnection activity while the listener polls/accepts, and no rare kernel configuration or condition outside the attacker\u2019s reasonable influence is required.\nPR:N - An adjacent Bluetooth peer can reach the incoming connection and teardown paths without local system privileges or prior authenticated application access in low-security/default Bluetooth service scenarios.\nUI:N - No victim user action is required once the Bluetooth service/socket is listening; the attacker can initiate the relevant Bluetooth protocol traffic.\nS:U - The bug affects kernel Bluetooth socket state within the same host security authority and does not cross a VM, IOMMU, or similar security boundary.\nC:H - The bug is a use-after-free/unsynchronized traversal of freed socket objects; under the required conservative scoring rule, UAF exposure is treated as potentially enabling high-impact kernel information disclosure.\nI:H - The fixed code also pins children during dequeue to prevent references to freed objects, and UAF/refcount operations on reclaimed kernel memory are conservatively treated as potentially enabling memory corruption or control-flow compromise.\nA:H - A failed race or invalid traversal can dereference freed or attacker-influenced kernel memory, producing a kernel oops/panic or repeated Bluetooth service/kernel disruption."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:40.163Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d9ce4de05df2385c19e2c7d12f529144e1a44af1"
},
{
"url": "https://git.kernel.org/stable/c/41c8c1c7923e86e0eb59cfb4279349112756a336"
},
{
"url": "https://git.kernel.org/stable/c/4ec17782fd186f901a7329605d11048b085b945a"
},
{
"url": "https://git.kernel.org/stable/c/be43e6b4043113c3b3cf887c3c8350f67140274c"
},
{
"url": "https://git.kernel.org/stable/c/85f8674cae82053f1e6bab295f6a8422cca14db5"
},
{
"url": "https://git.kernel.org/stable/c/8b4c412e001b0c670eb937beab491af974da55b3"
},
{
"url": "https://git.kernel.org/stable/c/a218bf69eb51fefe59a3976fa8925261141f681c"
},
{
"url": "https://git.kernel.org/stable/c/e83f5e24da741fa9405aeeff00b08c5ee7c37b88"
}
],
"title": "Bluetooth: serialize accept_q access",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52918",
"datePublished": "2026-06-24T07:14:14.539Z",
"dateReserved": "2026-06-09T07:44:35.367Z",
"dateUpdated": "2026-08-05T12:31:40.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31495 (GCVE-0-2026-31495)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-07-14 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ctnetlink: use netlink policy range checks
Replace manual range and mask validations with netlink policy
annotations in ctnetlink code paths, so that the netlink core rejects
invalid values early and can generate extack errors.
- CTA_PROTOINFO_TCP_STATE: reject values > TCP_CONNTRACK_SYN_SENT2 at
policy level, removing the manual >= TCP_CONNTRACK_MAX check.
- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values > TCP_MAX_WSCALE
(14). The normal TCP option parsing path already clamps to this value,
but the ctnetlink path accepted 0-255, causing undefined behavior when
used as a u32 shift count.
- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with
CTA_FILTER_F_ALL, removing the manual mask checks.
- CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding
a new mask define grouping all valid expect flags.
Extracted from a broader nf-next patch by Florian Westphal, scoped to
ctnetlink for the fixes tree.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4 Version: c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4 Version: c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4 Version: c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4 Version: c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4 Version: c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4 Version: c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4 Version: c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:04.690Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/uapi/linux/netfilter/nf_conntrack_common.h",
"net/netfilter/nf_conntrack_netlink.c",
"net/netfilter/nf_conntrack_proto_tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "435b576cd2faa75154777868f8cbb73bf71644d3",
"status": "affected",
"version": "c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4",
"versionType": "git"
},
{
"lessThan": "2ef71307c86a9f866d6e28f1a0c06e2e9d794474",
"status": "affected",
"version": "c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4",
"versionType": "git"
},
{
"lessThan": "4f7d25f3f0786402ba48ff7d13b6241d77d975f5",
"status": "affected",
"version": "c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4",
"versionType": "git"
},
{
"lessThan": "fcec5ce2d73a41668b24e3f18c803541602a59f6",
"status": "affected",
"version": "c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4",
"versionType": "git"
},
{
"lessThan": "675c913b940488a84effdeeac5a1cfb657b59804",
"status": "affected",
"version": "c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4",
"versionType": "git"
},
{
"lessThan": "c6cb41eaae875501eaaa487b8db6539feb092292",
"status": "affected",
"version": "c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4",
"versionType": "git"
},
{
"lessThan": "45c33e79ae705b7af97e3117672b6cd258dd0b1b",
"status": "affected",
"version": "c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4",
"versionType": "git"
},
{
"lessThan": "8f15b5071b4548b0aafc03b366eb45c9c6566704",
"status": "affected",
"version": "c8e2078cfe414a99cf6f2f2f1d78c7e75392e9d4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/uapi/linux/netfilter/nf_conntrack_common.h",
"net/netfilter/nf_conntrack_netlink.c",
"net/netfilter/nf_conntrack_proto_tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.22"
},
{
"lessThan": "2.6.22",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: use netlink policy range checks\n\nReplace manual range and mask validations with netlink policy\nannotations in ctnetlink code paths, so that the netlink core rejects\ninvalid values early and can generate extack errors.\n\n- CTA_PROTOINFO_TCP_STATE: reject values \u003e TCP_CONNTRACK_SYN_SENT2 at\n policy level, removing the manual \u003e= TCP_CONNTRACK_MAX check.\n- CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values \u003e TCP_MAX_WSCALE\n (14). The normal TCP option parsing path already clamps to this value,\n but the ctnetlink path accepted 0-255, causing undefined behavior when\n used as a u32 shift count.\n- CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with\n CTA_FILTER_F_ALL, removing the manual mask checks.\n- CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding\n a new mask define grouping all valid expect flags.\n\nExtracted from a broader nf-next patch by Florian Westphal, scoped to\nctnetlink for the fixes tree."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:09:50.284Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/435b576cd2faa75154777868f8cbb73bf71644d3"
},
{
"url": "https://git.kernel.org/stable/c/2ef71307c86a9f866d6e28f1a0c06e2e9d794474"
},
{
"url": "https://git.kernel.org/stable/c/4f7d25f3f0786402ba48ff7d13b6241d77d975f5"
},
{
"url": "https://git.kernel.org/stable/c/fcec5ce2d73a41668b24e3f18c803541602a59f6"
},
{
"url": "https://git.kernel.org/stable/c/675c913b940488a84effdeeac5a1cfb657b59804"
},
{
"url": "https://git.kernel.org/stable/c/c6cb41eaae875501eaaa487b8db6539feb092292"
},
{
"url": "https://git.kernel.org/stable/c/45c33e79ae705b7af97e3117672b6cd258dd0b1b"
},
{
"url": "https://git.kernel.org/stable/c/8f15b5071b4548b0aafc03b366eb45c9c6566704"
}
],
"title": "netfilter: ctnetlink: use netlink policy range checks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31495",
"datePublished": "2026-04-22T13:54:17.591Z",
"dateReserved": "2026-03-09T15:48:24.102Z",
"dateUpdated": "2026-07-14T12:48:04.690Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31511 (GCVE-0-2026-31511)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-08-05 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
This fixes the condition checking so mgmt_pending_valid is executed
whenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd)
would kfree(cmd) without unlinking it from the list first, leaving a
dangling pointer. Any subsequent list traversal (e.g.,
mgmt_pending_foreach during __mgmt_power_off, or another
mgmt_pending_valid call) would dereference freed memory.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a Version: d71b98f253b079cbadc83266383f26fe7e9e103b Version: 302a1f674c00dd5581ab8e493ef44767c5101aab Version: 302a1f674c00dd5581ab8e493ef44767c5101aab Version: 302a1f674c00dd5581ab8e493ef44767c5101aab Version: 87a1f16f07c6c43771754075e08f45b41d237421 Version: 6.12.59 ≤ Version: 6.16.10 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2074dfffad76981ca451cb7fc98703d04ac562fe",
"status": "affected",
"version": "0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a",
"versionType": "git"
},
{
"lessThan": "340666172cf747de58c283d2eef1f335f050538b",
"status": "affected",
"version": "d71b98f253b079cbadc83266383f26fe7e9e103b",
"versionType": "git"
},
{
"lessThan": "bafec9325d4de26b6c49db75b5d5172de652aae0",
"status": "affected",
"version": "302a1f674c00dd5581ab8e493ef44767c5101aab",
"versionType": "git"
},
{
"lessThan": "3a89c33deffb3cb7877a7ea2e50734cd12b064f2",
"status": "affected",
"version": "302a1f674c00dd5581ab8e493ef44767c5101aab",
"versionType": "git"
},
{
"lessThan": "5f5fa4cd35f707344f65ce9e225b6528691dbbaa",
"status": "affected",
"version": "302a1f674c00dd5581ab8e493ef44767c5101aab",
"versionType": "git"
},
{
"status": "affected",
"version": "87a1f16f07c6c43771754075e08f45b41d237421",
"versionType": "git"
},
{
"lessThan": "6.12.80",
"status": "affected",
"version": "6.12.59",
"versionType": "semver"
},
{
"lessThan": "6.17",
"status": "affected",
"version": "6.16.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "6.12.59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.16.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete\n\nThis fixes the condition checking so mgmt_pending_valid is executed\nwhenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd)\nwould kfree(cmd) without unlinking it from the list first, leaving a\ndangling pointer. Any subsequent list traversal (e.g.,\nmgmt_pending_foreach during __mgmt_power_off, or another\nmgmt_pending_valid call) would dereference freed memory."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached by a local process sending `MGMT_OP_ADD_ADV_PATTERNS_MONITOR` or `_RSSI` over a `PF_BLUETOOTH` HCI management/control socket. Remote Bluetooth peers do not issue MGMT commands into this path.\nAC:L - The bug occurs on normal non-canceled completion: the command is freed without being unlinked, and the attacker can trigger later list traversal with another MGMT command or device power/index removal. No uncontrollable race is required.\nPR:L - The affected handlers are not marked untrusted, so the socket must be trusted via `CAP_NET_ADMIN`. Because the checks use namespace-scoped capability checks and can be satisfied by an unprivileged local user through user namespaces in plausible deployments, this is Low rather than High.\nUI:N - After obtaining the required local privileges, the attacker can send the MGMT command and trigger the follow-up traversal directly. No victim action is required.\nS:U - The vulnerability corrupts kernel Bluetooth/MGMT state within the same kernel security authority. This is standard local kernel memory corruption, not a VM, IOMMU, or cross-authority boundary escape for CVSS scope.\nC:H - This is a use-after-free of `struct mgmt_pending_cmd` left on a kernel list, and freed slab contents can be reclaimed or read during later traversal. Under the required conservative kernel guidance, UAFs are scored as high confidentiality impact.\nI:H - The dangling list entry can lead to attacker-influenced use of freed kernel memory and list operations/callback dereferences, which is defensibly exploitable beyond a crash. Under the required conservative kernel guidance, UAF memory corruption is high integrity impact.\nA:H - Subsequent traversal of the freed pending command can dereference freed memory and cause a kernel oops/panic, as similar MGMT UAF fixes show. The attacker can trigger this repeatedly once the vulnerable state is created."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:23:11.297Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2074dfffad76981ca451cb7fc98703d04ac562fe"
},
{
"url": "https://git.kernel.org/stable/c/340666172cf747de58c283d2eef1f335f050538b"
},
{
"url": "https://git.kernel.org/stable/c/bafec9325d4de26b6c49db75b5d5172de652aae0"
},
{
"url": "https://git.kernel.org/stable/c/3a89c33deffb3cb7877a7ea2e50734cd12b064f2"
},
{
"url": "https://git.kernel.org/stable/c/5f5fa4cd35f707344f65ce9e225b6528691dbbaa"
}
],
"title": "Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31511",
"datePublished": "2026-04-22T13:54:29.420Z",
"dateReserved": "2026-03-09T15:48:24.106Z",
"dateUpdated": "2026-08-05T12:23:11.297Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46053 (GCVE-0-2026-46053)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: rds: fix MR cleanup on copy error
__rds_rdma_map() hands sg/pages ownership to the transport after
get_mr() succeeds. If copying the generated cookie back to user space
fails after that point, the error path must not free those resources
again before dropping the MR reference.
Remove the duplicate unpin/free from the put_user() failure branch so
that MR teardown is handled only through the existing final cleanup
path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0d4597c8c5abdeeaf50774066c16683f30184dc8 Version: 0d4597c8c5abdeeaf50774066c16683f30184dc8 Version: 0d4597c8c5abdeeaf50774066c16683f30184dc8 Version: 0d4597c8c5abdeeaf50774066c16683f30184dc8 Version: 0d4597c8c5abdeeaf50774066c16683f30184dc8 Version: 0d4597c8c5abdeeaf50774066c16683f30184dc8 Version: 0d4597c8c5abdeeaf50774066c16683f30184dc8 Version: 0d4597c8c5abdeeaf50774066c16683f30184dc8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "91a44b406bc1f9e1c5da0cb7d0d5991b43b79147",
"status": "affected",
"version": "0d4597c8c5abdeeaf50774066c16683f30184dc8",
"versionType": "git"
},
{
"lessThan": "106dc689206610cfa2098f593fdd1e020c997835",
"status": "affected",
"version": "0d4597c8c5abdeeaf50774066c16683f30184dc8",
"versionType": "git"
},
{
"lessThan": "ec55a86f7fba7d9111df94b9c11a4755ed492995",
"status": "affected",
"version": "0d4597c8c5abdeeaf50774066c16683f30184dc8",
"versionType": "git"
},
{
"lessThan": "8fdbb6262a4a3ed44a0830a7793903b54bb27bdc",
"status": "affected",
"version": "0d4597c8c5abdeeaf50774066c16683f30184dc8",
"versionType": "git"
},
{
"lessThan": "d95cea9298be1ba8876e3f156be96d3a492085ca",
"status": "affected",
"version": "0d4597c8c5abdeeaf50774066c16683f30184dc8",
"versionType": "git"
},
{
"lessThan": "033370ffb3c9c0264d19f8ba9ef769523266589a",
"status": "affected",
"version": "0d4597c8c5abdeeaf50774066c16683f30184dc8",
"versionType": "git"
},
{
"lessThan": "b3cb8cae530b2727d8245684148bb49425f6765c",
"status": "affected",
"version": "0d4597c8c5abdeeaf50774066c16683f30184dc8",
"versionType": "git"
},
{
"lessThan": "8141a2dc70080eda1aedc0389ed2db2b292af5bd",
"status": "affected",
"version": "0d4597c8c5abdeeaf50774066c16683f30184dc8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: fix MR cleanup on copy error\n\n__rds_rdma_map() hands sg/pages ownership to the transport after\nget_mr() succeeds. If copying the generated cookie back to user space\nfails after that point, the error path must not free those resources\nagain before dropping the MR reference.\n\nRemove the duplicate unpin/free from the put_user() failure branch so\nthat MR teardown is handled only through the existing final cleanup\npath."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is triggered through the local `setsockopt(SOL_RDS, RDS_GET_MR/RDS_GET_MR_FOR_DEST)` syscall on an RDS socket (MR-registration control plane); it is not reachable from a remote peer\u0027s network packets.\nAC:L - Once an RDMA-capable RDS socket is bound, the double-free is 100% deterministic and the attacker fully controls the trigger by supplying a bad `cookie_addr` so `put_user()` faults; there is no race or attacker-uncontrolled condition.\nPR:L - Creating an AF_RDS socket has no capability check (module auto-loads) and `can_do_mlock()` passes for normal users by default, so any unprivileged local user on a host with RDMA hardware can reach the path.\nUI:N - The attacker triggers the entire sequence with its own syscalls; no action by another user or victim is required.\nS:U - The double-free corrupts the kernel slab/page allocator within the kernel\u0027s own security authority and does not cross a virtualization or IOMMU boundary.\nC:H - The double-free of the `sg` slab object and the page-refcount underflow yield use-after-free/cross-object primitives that can be groomed into arbitrary kernel-memory reads, enabling significant information disclosure.\nI:H - A double `kfree()` corrupts the SLUB freelist and the page-refcount underflow allows reuse of an in-use physical page, both classic primitives for arbitrary kernel write and privilege escalation.\nA:H - The double-free and page-refcount underflow readily cause heap corruption, freelist poisoning, and kernel panic/oops."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:21.209Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/91a44b406bc1f9e1c5da0cb7d0d5991b43b79147"
},
{
"url": "https://git.kernel.org/stable/c/106dc689206610cfa2098f593fdd1e020c997835"
},
{
"url": "https://git.kernel.org/stable/c/ec55a86f7fba7d9111df94b9c11a4755ed492995"
},
{
"url": "https://git.kernel.org/stable/c/8fdbb6262a4a3ed44a0830a7793903b54bb27bdc"
},
{
"url": "https://git.kernel.org/stable/c/d95cea9298be1ba8876e3f156be96d3a492085ca"
},
{
"url": "https://git.kernel.org/stable/c/033370ffb3c9c0264d19f8ba9ef769523266589a"
},
{
"url": "https://git.kernel.org/stable/c/b3cb8cae530b2727d8245684148bb49425f6765c"
},
{
"url": "https://git.kernel.org/stable/c/8141a2dc70080eda1aedc0389ed2db2b292af5bd"
}
],
"title": "net: rds: fix MR cleanup on copy error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46053",
"datePublished": "2026-05-27T12:57:11.870Z",
"dateReserved": "2026-05-13T15:03:33.094Z",
"dateUpdated": "2026-08-05T12:29:21.209Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45999 (GCVE-0-2026-45999)
Vulnerability from cvelistv5
Published
2026-05-27 12:55
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()
Some crafted images can have illegal (!partial_decoding &&
m_llen < m_plen) extents, and the LZ4 inplace decompression path
can be wrongly hit, but it cannot handle (outpages < inpages)
properly: "outpages - inpages" wraps to a large value and
the subsequent rq->out[] access reads past the decompressed_pages
array.
However, such crafted cases can correctly result in a corruption
report in the normal LZ4 non-inplace path.
Let's add an additional check to fix this for backporting.
Reproducible image (base64-encoded gzipped blob):
H4sIAJGR12kCA+3SPUoDQRgG4MkmkkZk8QRbRFIIi9hbpEjrHQI5ghfwCN5BLCzTGtLbBI+g
dilSJo1CnIm7GEXFxhT6PDDwfrs73/ywIQD/1ePD4r7Ou6ETsrq4mu7XcWfj++Pb58nJU/9i
PNtbjhan04/9GtX4qVYc814WDqt6FaX5s+ZwXXeq52lndT6IuVvlblytLMvh4Gzwaf90nsvz
2DF/21+20T/ldgp5s1jXRaN4t/8izsy/OUB6e/Qa79r+JwAAAAAAAL52vQVuGQAAAP6+my1w
ywAAAAAAAADwu14ATsEYtgBQAAA=
$ mount -t erofs -o cache_strategy=disabled foo.erofs /mnt
$ dd if=/mnt/data of=/dev/null bs=4096 count=1
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 598162d050801e556750defff4ddab499e5d76ed Version: 598162d050801e556750defff4ddab499e5d76ed Version: 598162d050801e556750defff4ddab499e5d76ed Version: 598162d050801e556750defff4ddab499e5d76ed Version: 598162d050801e556750defff4ddab499e5d76ed Version: 598162d050801e556750defff4ddab499e5d76ed Version: 598162d050801e556750defff4ddab499e5d76ed |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/erofs/decompressor.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "778acd52e9497806fbd2cea7f770c41d6850fc48",
"status": "affected",
"version": "598162d050801e556750defff4ddab499e5d76ed",
"versionType": "git"
},
{
"lessThan": "118ff71ff09ebaf323a09af9e911517321a299f4",
"status": "affected",
"version": "598162d050801e556750defff4ddab499e5d76ed",
"versionType": "git"
},
{
"lessThan": "43a878639b90e9721ffa5eb616a7e6d8454adef3",
"status": "affected",
"version": "598162d050801e556750defff4ddab499e5d76ed",
"versionType": "git"
},
{
"lessThan": "f1374fa6e57fd836623668d782ded9244cfd2938",
"status": "affected",
"version": "598162d050801e556750defff4ddab499e5d76ed",
"versionType": "git"
},
{
"lessThan": "c9ce18e6bb2c467ec85756dc7989b547b7584fee",
"status": "affected",
"version": "598162d050801e556750defff4ddab499e5d76ed",
"versionType": "git"
},
{
"lessThan": "bbbbb3f0d7864238a8da2a94cd6ec013fee06a2e",
"status": "affected",
"version": "598162d050801e556750defff4ddab499e5d76ed",
"versionType": "git"
},
{
"lessThan": "21e161de2dc660b1bb70ef5b156ab8e6e1cca3ab",
"status": "affected",
"version": "598162d050801e556750defff4ddab499e5d76ed",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/erofs/decompressor.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()\n\nSome crafted images can have illegal (!partial_decoding \u0026\u0026\nm_llen \u003c m_plen) extents, and the LZ4 inplace decompression path\ncan be wrongly hit, but it cannot handle (outpages \u003c inpages)\nproperly: \"outpages - inpages\" wraps to a large value and\nthe subsequent rq-\u003eout[] access reads past the decompressed_pages\narray.\n\nHowever, such crafted cases can correctly result in a corruption\nreport in the normal LZ4 non-inplace path.\n\nLet\u0027s add an additional check to fix this for backporting.\n\nReproducible image (base64-encoded gzipped blob):\n\nH4sIAJGR12kCA+3SPUoDQRgG4MkmkkZk8QRbRFIIi9hbpEjrHQI5ghfwCN5BLCzTGtLbBI+g\ndilSJo1CnIm7GEXFxhT6PDDwfrs73/ywIQD/1ePD4r7Ou6ETsrq4mu7XcWfj++Pb58nJU/9i\nPNtbjhan04/9GtX4qVYc814WDqt6FaX5s+ZwXXeq52lndT6IuVvlblytLMvh4Gzwaf90nsvz\n2DF/21+20T/ldgp5s1jXRaN4t/8izsy/OUB6e/Qa79r+JwAAAAAAAL52vQVuGQAAAP6+my1w\nywAAAAAAAADwu14ATsEYtgBQAAA=\n\n$ mount -t erofs -o cache_strategy=disabled foo.erofs /mnt\n$ dd if=/mnt/data of=/dev/null bs=4096 count=1"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - EROFS is mounted from a local block device/image file (FS_REQUIRES_DEV, not userns-mountable); triggering requires locally providing a crafted image and reading from it, with no network path.\nAC:L - The attacker fully controls the crafted image (a working base64 reproducer is in the commit); the illegal extent reliably forces outpages\u003cinpages and the underflow on the first read with no race or uncontrolled condition.\nPR:N - Crafting the malicious image requires no privileges or account on the target system; the attacker merely supplies the image, consistent with the analogous crafted-image CVE-2026-43166 (PR:N).\nUI:R - A victim or automount service must mount the attacker-supplied EROFS image and access the file for the decompression path to be reached.\nS:U - The OOB access and resulting crash stay within the kernel\u0027s own security authority; no VM/IOMMU/sandbox boundary is crossed.\nC:H - The unsigned underflow produces an unbounded out-of-bounds read of the page-pointer array far past its end, and in the matching path wild kernel memory can be fed into the decompressed output read by userspace \u2014 per kernel guidance an unbounded OOB read is High.\nI:N - The flaw is strictly a read underflow (\"reads past the decompressed_pages array\"); it yields no out-of-bounds write or control-flow primitive, matching the analogous OOB-read CVE-2026-43166 (I:N).\nA:H - Indexing the array ~32 GB beyond its base dereferences unmapped kernel memory, reliably causing a kernel oops/panic and denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:04.993Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/778acd52e9497806fbd2cea7f770c41d6850fc48"
},
{
"url": "https://git.kernel.org/stable/c/118ff71ff09ebaf323a09af9e911517321a299f4"
},
{
"url": "https://git.kernel.org/stable/c/43a878639b90e9721ffa5eb616a7e6d8454adef3"
},
{
"url": "https://git.kernel.org/stable/c/f1374fa6e57fd836623668d782ded9244cfd2938"
},
{
"url": "https://git.kernel.org/stable/c/c9ce18e6bb2c467ec85756dc7989b547b7584fee"
},
{
"url": "https://git.kernel.org/stable/c/bbbbb3f0d7864238a8da2a94cd6ec013fee06a2e"
},
{
"url": "https://git.kernel.org/stable/c/21e161de2dc660b1bb70ef5b156ab8e6e1cca3ab"
}
],
"title": "erofs: fix unsigned underflow in z_erofs_lz4_handle_overlap()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45999",
"datePublished": "2026-05-27T12:55:53.846Z",
"dateReserved": "2026-05-13T15:03:33.091Z",
"dateUpdated": "2026-08-05T12:29:04.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71297 (GCVE-0-2025-71297)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-05-11 21:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()
rtw8822b_set_antenna() can be called from userspace when the chip is
powered off. In that case a WARNING is triggered in
rtw8822b_config_trx_mode() because trying to read the RF registers
when the chip is powered off returns an unexpected value.
Call rtw8822b_config_trx_mode() in rtw8822b_set_antenna() only when
the chip is powered on.
------------[ cut here ]------------
write RF mode table fail
WARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]
CPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G W OE 6.17.5-arch1-1 #1 PREEMPT(full) 01c39fc421df2af799dd5e9180b572af860b40c1
Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Hardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021
RIP: 0010:rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]
Call Trace:
<TASK>
rtw8822b_set_antenna+0x57/0x70 [rtw88_8822b 370206f42e5890d8d5f48eb358b759efa37c422b]
rtw_ops_set_antenna+0x50/0x80 [rtw88_core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb]
ieee80211_set_antenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3]
nl80211_set_wiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
? netdev_run_todo+0x63/0x550
genl_family_rcv_msg_doit+0xfc/0x160
genl_rcv_msg+0x1aa/0x2b0
? __pfx_nl80211_pre_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
? __pfx_nl80211_set_wiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
? __pfx_nl80211_post_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]
? __pfx_genl_rcv_msg+0x10/0x10
netlink_rcv_skb+0x59/0x110
genl_rcv+0x28/0x40
netlink_unicast+0x285/0x3c0
? __alloc_skb+0xdb/0x1a0
netlink_sendmsg+0x20d/0x430
____sys_sendmsg+0x39f/0x3d0
? import_iovec+0x2f/0x40
___sys_sendmsg+0x99/0xe0
? refill_obj_stock+0x12e/0x240
__sys_sendmsg+0x8a/0xf0
do_syscall_64+0x81/0x970
? do_syscall_64+0x81/0x970
? ksys_read+0x73/0xf0
? do_syscall_64+0x81/0x970
? count_memcg_events+0xc2/0x190
? handle_mm_fault+0x1d7/0x2d0
? do_user_addr_fault+0x21a/0x690
? exc_page_fault+0x7e/0x1a0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>
---[ end trace 0000000000000000 ]---
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 297bcf8222f222fd7defead862de4b8e3ea0b08a Version: 297bcf8222f222fd7defead862de4b8e3ea0b08a Version: 297bcf8222f222fd7defead862de4b8e3ea0b08a Version: 297bcf8222f222fd7defead862de4b8e3ea0b08a Version: 297bcf8222f222fd7defead862de4b8e3ea0b08a Version: 297bcf8222f222fd7defead862de4b8e3ea0b08a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw88/rtw8822b.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7852ca1cc65ad43fb8b620e6a65d5cb15e4e4487",
"status": "affected",
"version": "297bcf8222f222fd7defead862de4b8e3ea0b08a",
"versionType": "git"
},
{
"lessThan": "a96d161cfdb11cd2c35d5e498b93431164823338",
"status": "affected",
"version": "297bcf8222f222fd7defead862de4b8e3ea0b08a",
"versionType": "git"
},
{
"lessThan": "0d0c2fb80ca4c284c397dd7546743a3b5fdf4020",
"status": "affected",
"version": "297bcf8222f222fd7defead862de4b8e3ea0b08a",
"versionType": "git"
},
{
"lessThan": "509becaee5680a39bde00c2c7d448dfeb39a8e05",
"status": "affected",
"version": "297bcf8222f222fd7defead862de4b8e3ea0b08a",
"versionType": "git"
},
{
"lessThan": "44510ff07b5198e4a835a3074b716cec8357695b",
"status": "affected",
"version": "297bcf8222f222fd7defead862de4b8e3ea0b08a",
"versionType": "git"
},
{
"lessThan": "44d1f624bbdd2d60319374ba85f7195a28d00c90",
"status": "affected",
"version": "297bcf8222f222fd7defead862de4b8e3ea0b08a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw88/rtw8822b.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()\n\nrtw8822b_set_antenna() can be called from userspace when the chip is\npowered off. In that case a WARNING is triggered in\nrtw8822b_config_trx_mode() because trying to read the RF registers\nwhen the chip is powered off returns an unexpected value.\n\nCall rtw8822b_config_trx_mode() in rtw8822b_set_antenna() only when\nthe chip is powered on.\n\n------------[ cut here ]------------\nwrite RF mode table fail\nWARNING: CPU: 0 PID: 7183 at rtw8822b.c:824 rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]\nCPU: 0 UID: 0 PID: 7183 Comm: iw Tainted: G W OE 6.17.5-arch1-1 #1 PREEMPT(full) 01c39fc421df2af799dd5e9180b572af860b40c1\nTainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE\nHardware name: LENOVO 82KR/LNVNB161216, BIOS HBCN18WW 08/27/2021\nRIP: 0010:rtw8822b_config_trx_mode.constprop.0+0x835/0x840 [rtw88_8822b]\nCall Trace:\n \u003cTASK\u003e\n rtw8822b_set_antenna+0x57/0x70 [rtw88_8822b 370206f42e5890d8d5f48eb358b759efa37c422b]\n rtw_ops_set_antenna+0x50/0x80 [rtw88_core 711c8fb4f686162be4625b1d0b8e8c6a5ac850fb]\n ieee80211_set_antenna+0x60/0x100 [mac80211 f1845d85d2ecacf3b71867635a050ece90486cf3]\n nl80211_set_wiphy+0x384/0xe00 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]\n ? netdev_run_todo+0x63/0x550\n genl_family_rcv_msg_doit+0xfc/0x160\n genl_rcv_msg+0x1aa/0x2b0\n ? __pfx_nl80211_pre_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]\n ? __pfx_nl80211_set_wiphy+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]\n ? __pfx_nl80211_post_doit+0x10/0x10 [cfg80211 296485ee85696d2150309a6d21a7fbca83d3dbda]\n ? __pfx_genl_rcv_msg+0x10/0x10\n netlink_rcv_skb+0x59/0x110\n genl_rcv+0x28/0x40\n netlink_unicast+0x285/0x3c0\n ? __alloc_skb+0xdb/0x1a0\n netlink_sendmsg+0x20d/0x430\n ____sys_sendmsg+0x39f/0x3d0\n ? import_iovec+0x2f/0x40\n ___sys_sendmsg+0x99/0xe0\n ? refill_obj_stock+0x12e/0x240\n __sys_sendmsg+0x8a/0xf0\n do_syscall_64+0x81/0x970\n ? do_syscall_64+0x81/0x970\n ? ksys_read+0x73/0xf0\n ? do_syscall_64+0x81/0x970\n ? count_memcg_events+0xc2/0x190\n ? handle_mm_fault+0x1d7/0x2d0\n ? do_user_addr_fault+0x21a/0x690\n ? exc_page_fault+0x7e/0x1a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n \u003c/TASK\u003e\n---[ end trace 0000000000000000 ]---"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T21:57:28.537Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7852ca1cc65ad43fb8b620e6a65d5cb15e4e4487"
},
{
"url": "https://git.kernel.org/stable/c/a96d161cfdb11cd2c35d5e498b93431164823338"
},
{
"url": "https://git.kernel.org/stable/c/0d0c2fb80ca4c284c397dd7546743a3b5fdf4020"
},
{
"url": "https://git.kernel.org/stable/c/509becaee5680a39bde00c2c7d448dfeb39a8e05"
},
{
"url": "https://git.kernel.org/stable/c/44510ff07b5198e4a835a3074b716cec8357695b"
},
{
"url": "https://git.kernel.org/stable/c/44d1f624bbdd2d60319374ba85f7195a28d00c90"
}
],
"title": "wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-71297",
"datePublished": "2026-05-08T13:11:09.120Z",
"dateReserved": "2026-05-06T11:31:45.510Z",
"dateUpdated": "2026-05-11T21:57:28.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52981 (GCVE-0-2026-52981)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
neigh: let neigh_xmit take skb ownership
neigh_xmit always releases the skb, except when no neighbour table is
found. But even the first added user of neigh_xmit (mpls) relied on
neigh_xmit to release the skb (or queue it for tx).
sashiko reported:
If neigh_xmit() is called with an uninitialized neighbor table (for
example, NEIGH_ND_TABLE when IPv6 is disabled), it returns -EAFNOSUPPORT
and bypasses its internal out_kfree_skb error path. Because the return
value of neigh_xmit() is ignored here, does this leak the SKB?
Assume full ownership and remove the last code path that doesn't
xmit or free skb.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62 Version: 4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62 Version: 4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62 Version: 4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62 Version: 4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62 Version: 4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/neighbour.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8a89054a1ec0767aec25ed2bbac933da6ba3cf5a",
"status": "affected",
"version": "4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62",
"versionType": "git"
},
{
"lessThan": "9247d59ca15bf60a57dca08103f055d8a4340877",
"status": "affected",
"version": "4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62",
"versionType": "git"
},
{
"lessThan": "0084712e0bee204b284510cdb63182fd5a30c2b7",
"status": "affected",
"version": "4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62",
"versionType": "git"
},
{
"lessThan": "63063ba60d2dc334e34f1e3f9271d7f3f6f30307",
"status": "affected",
"version": "4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62",
"versionType": "git"
},
{
"lessThan": "445e45a2c3a078316a62d2d331a570cf34ef5079",
"status": "affected",
"version": "4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62",
"versionType": "git"
},
{
"lessThan": "4438113be604ee67a7bf4f81da6e1cca41332ce4",
"status": "affected",
"version": "4fd3d7d9e868ffbdb0e7a67c5c8e9dfdcd846a62",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/neighbour.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nneigh: let neigh_xmit take skb ownership\n\nneigh_xmit always releases the skb, except when no neighbour table is\nfound. But even the first added user of neigh_xmit (mpls) relied on\nneigh_xmit to release the skb (or queue it for tx).\n\nsashiko reported:\n If neigh_xmit() is called with an uninitialized neighbor table (for\n example, NEIGH_ND_TABLE when IPv6 is disabled), it returns -EAFNOSUPPORT\n and bypasses its internal out_kfree_skb error path. Because the return\n value of neigh_xmit() is ignored here, does this leak the SKB?\n\nAssume full ownership and remove the last code path that doesn\u0027t\nxmit or free skb."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - An unauthenticated packet sender can trigger the vulnerable `neigh_xmit()` path through configured network forwarding paths such as nftables netdev forwarding or MPLS forwarding. In the highest reasonable deployment, this is an exposed router/firewall datapath reachable by network traffic.\nAC:L - The bug is deterministic once the forwarding path uses a real neighbor table whose pointer is NULL, such as `NEIGH_ND_TABLE` when IPv6 neighbor discovery is unavailable. No race or heap shaping is required; repeated matching packets repeatedly leak skbs.\nPR:N - The attacker does not need privileges to send packets into an already configured vulnerable forwarding datapath. Although installing such rules/routes requires administrative network privileges, the packet-triggering attack itself is unauthenticated.\nUI:N - No victim user action is required after the affected forwarding configuration exists. The attacker only sends traffic that reaches the vulnerable path.\nS:U - The impact remains within the kernel/networking security authority of the affected system. There is no VM escape, sandbox boundary crossing, or separate security scope involved.\nC:N - The flaw is an skb memory leak caused by failing to free the packet buffer on the missing-table error path. It does not expose leaked memory contents to the attacker.\nI:N - The bug does not provide a memory corruption or data modification primitive. It only loses ownership of allocated skbs.\nA:H - An attacker can repeatedly trigger the leak with packets, consuming kernel memory and plausibly causing OOM, hangs, packet processing failure, or system-wide denial of service. Kernel memory exhaustion is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:19.237Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8a89054a1ec0767aec25ed2bbac933da6ba3cf5a"
},
{
"url": "https://git.kernel.org/stable/c/9247d59ca15bf60a57dca08103f055d8a4340877"
},
{
"url": "https://git.kernel.org/stable/c/0084712e0bee204b284510cdb63182fd5a30c2b7"
},
{
"url": "https://git.kernel.org/stable/c/63063ba60d2dc334e34f1e3f9271d7f3f6f30307"
},
{
"url": "https://git.kernel.org/stable/c/445e45a2c3a078316a62d2d331a570cf34ef5079"
},
{
"url": "https://git.kernel.org/stable/c/4438113be604ee67a7bf4f81da6e1cca41332ce4"
}
],
"title": "neigh: let neigh_xmit take skb ownership",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52981",
"datePublished": "2026-06-24T16:28:57.074Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-08-05T12:32:19.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46314 (GCVE-0-2026-46314)
Vulnerability from cvelistv5
Published
2026-06-08 15:50
Modified
2026-06-19 12:00
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Reject empty multisync extension to prevent infinite loop
v3d_get_extensions() walks a userspace-provided singly-linked list of
ioctl extensions without any bound on the chain length. A local user
can craft a self-referential extension (ext->next == &ext) with zero
in_sync_count and out_sync_count, which bypasses the existing duplicate-
extension guard:
if (se->in_sync_count || se->out_sync_count)
return -EINVAL;
The guard never fires because v3d_get_multisync_post_deps() returns
immediately when count is zero, leaving both fields at zero on every
iteration. The result is an infinite loop in kernel context, blocking
the calling thread and pegging a CPU core indefinitely.
Fix this by rejecting a multisync extension where both in_sync_count
and out_sync_count are zero in v3d_get_multisync_submit_deps(). An
empty multisync carries no synchronization information and serves no
useful purpose, so returning -EINVAL for such an extension is the
correct defense against this attack vector.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/v3d/v3d_submit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "309abbddeca0c12714721928a819ef45e5710998",
"status": "affected",
"version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7",
"versionType": "git"
},
{
"lessThan": "4fa42a249e8cd6ed17aea04e5695b6e9001f2433",
"status": "affected",
"version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7",
"versionType": "git"
},
{
"lessThan": "9c5164781cb388d219d8f49fa0f0b04cf86ad544",
"status": "affected",
"version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7",
"versionType": "git"
},
{
"lessThan": "fb44d589bf3148e13452185a6e772a7efbf2d684",
"status": "affected",
"version": "e4165ae8304e5ea822fbe5909dd3be5445c058b7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/v3d/v3d_submit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Reject empty multisync extension to prevent infinite loop\n\nv3d_get_extensions() walks a userspace-provided singly-linked list of\nioctl extensions without any bound on the chain length. A local user\ncan craft a self-referential extension (ext-\u003enext == \u0026ext) with zero\nin_sync_count and out_sync_count, which bypasses the existing duplicate-\nextension guard:\n\n if (se-\u003ein_sync_count || se-\u003eout_sync_count)\n return -EINVAL;\n\nThe guard never fires because v3d_get_multisync_post_deps() returns\nimmediately when count is zero, leaving both fields at zero on every\niteration. The result is an infinite loop in kernel context, blocking\nthe calling thread and pegging a CPU core indefinitely.\n\nFix this by rejecting a multisync extension where both in_sync_count\nand out_sync_count are zero in v3d_get_multisync_submit_deps(). An\nempty multisync carries no synchronization information and serves no\nuseful purpose, so returning -EINVAL for such an extension is the\ncorrect defense against this attack vector."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-19T12:00:14.686Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/309abbddeca0c12714721928a819ef45e5710998"
},
{
"url": "https://git.kernel.org/stable/c/4fa42a249e8cd6ed17aea04e5695b6e9001f2433"
},
{
"url": "https://git.kernel.org/stable/c/9c5164781cb388d219d8f49fa0f0b04cf86ad544"
},
{
"url": "https://git.kernel.org/stable/c/fb44d589bf3148e13452185a6e772a7efbf2d684"
}
],
"title": "drm/v3d: Reject empty multisync extension to prevent infinite loop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46314",
"datePublished": "2026-06-08T15:50:45.305Z",
"dateReserved": "2026-05-13T15:03:33.111Z",
"dateUpdated": "2026-06-19T12:00:14.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43436 (GCVE-0-2026-43436)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-11 22:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces
The Scarlett2 mixer quirk in USB-audio driver may hit a NULL
dereference when a malformed USB descriptor is passed, since it
assumes the presence of an endpoint in the parsed interface in
scarlett2_find_fc_interface(), as reported by fuzzer.
For avoiding the NULL dereference, just add the sanity check of
bNumEndpoints and skip the invalid interface.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6c0a2078134aba6a77291554035304df9e16b85c Version: 6c0a2078134aba6a77291554035304df9e16b85c Version: 6c0a2078134aba6a77291554035304df9e16b85c Version: 6c0a2078134aba6a77291554035304df9e16b85c Version: 6c0a2078134aba6a77291554035304df9e16b85c Version: 6c0a2078134aba6a77291554035304df9e16b85c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/mixer_scarlett2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b014cc945baba75816cda0cf8934be87c9ed4947",
"status": "affected",
"version": "6c0a2078134aba6a77291554035304df9e16b85c",
"versionType": "git"
},
{
"lessThan": "c5c5a6c53cf3b658f1d4512dfa61f3cd25bc34ba",
"status": "affected",
"version": "6c0a2078134aba6a77291554035304df9e16b85c",
"versionType": "git"
},
{
"lessThan": "b267255c15d2a5b90c4e926146aa155e5161e264",
"status": "affected",
"version": "6c0a2078134aba6a77291554035304df9e16b85c",
"versionType": "git"
},
{
"lessThan": "3d542cf3c4c854cdf5d58049771f68926b9eb2b9",
"status": "affected",
"version": "6c0a2078134aba6a77291554035304df9e16b85c",
"versionType": "git"
},
{
"lessThan": "3d4f23885e4b90347c9a1d779af6e79a99b5172a",
"status": "affected",
"version": "6c0a2078134aba6a77291554035304df9e16b85c",
"versionType": "git"
},
{
"lessThan": "df1d8abf36ca3681c21a6809eaa9a1e01ef897a6",
"status": "affected",
"version": "6c0a2078134aba6a77291554035304df9e16b85c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/mixer_scarlett2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces\n\nThe Scarlett2 mixer quirk in USB-audio driver may hit a NULL\ndereference when a malformed USB descriptor is passed, since it\nassumes the presence of an endpoint in the parsed interface in\nscarlett2_find_fc_interface(), as reported by fuzzer.\n\nFor avoiding the NULL dereference, just add the sanity check of\nbNumEndpoints and skip the invalid interface."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:33.336Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b014cc945baba75816cda0cf8934be87c9ed4947"
},
{
"url": "https://git.kernel.org/stable/c/c5c5a6c53cf3b658f1d4512dfa61f3cd25bc34ba"
},
{
"url": "https://git.kernel.org/stable/c/b267255c15d2a5b90c4e926146aa155e5161e264"
},
{
"url": "https://git.kernel.org/stable/c/3d542cf3c4c854cdf5d58049771f68926b9eb2b9"
},
{
"url": "https://git.kernel.org/stable/c/3d4f23885e4b90347c9a1d779af6e79a99b5172a"
},
{
"url": "https://git.kernel.org/stable/c/df1d8abf36ca3681c21a6809eaa9a1e01ef897a6"
}
],
"title": "ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43436",
"datePublished": "2026-05-08T14:22:06.632Z",
"dateReserved": "2026-05-01T14:12:56.009Z",
"dateUpdated": "2026-05-11T22:24:33.336Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45919 (GCVE-0-2026-45919)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-27 12:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched/rt: Skip currently executing CPU in rto_next_cpu()
CPU0 becomes overloaded when hosting a CPU-bound RT task, a non-CPU-bound
RT task, and a CFS task stuck in kernel space. When other CPUs switch from
RT to non-RT tasks, RT load balancing (LB) is triggered; with
HAVE_RT_PUSH_IPI enabled, they send IPIs to CPU0 to drive the execution
of rto_push_irq_work_func. During push_rt_task on CPU0,
if next_task->prio < rq->donor->prio, resched_curr() sets NEED_RESCHED
and after the push operation completes, CPU0 calls rto_next_cpu().
Since only CPU0 is overloaded in this scenario, rto_next_cpu() should
ideally return -1 (no further IPI needed).
However, multiple CPUs invoking tell_cpu_to_push() during LB increments
rd->rto_loop_next. Even when rd->rto_cpu is set to -1, the mismatch between
rd->rto_loop and rd->rto_loop_next forces rto_next_cpu() to restart its
search from -1. With CPU0 remaining overloaded (satisfying rt_nr_migratory
&& rt_nr_total > 1), it gets reselected, causing CPU0 to queue irq_work to
itself and send self-IPIs repeatedly. As long as CPU0 stays overloaded and
other CPUs run pull_rt_tasks(), it falls into an infinite self-IPI loop,
which triggers a CPU hardlockup due to continuous self-interrupts.
The trigging scenario is as follows:
cpu0 cpu1 cpu2
pull_rt_task
tell_cpu_to_push
<------------irq_work_queue_on
rto_push_irq_work_func
push_rt_task
resched_curr(rq) pull_rt_task
rto_next_cpu tell_cpu_to_push
<-------------------------- atomic_inc(rto_loop_next)
rd->rto_loop != next
rto_next_cpu
irq_work_queue_on
rto_push_irq_work_func
Fix redundant self-IPI by filtering the initiating CPU in rto_next_cpu().
This solution has been verified to effectively eliminate spurious self-IPIs
and prevent CPU hardlockup scenarios.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4bdced5c9a2922521e325896a7bbbf0132c94e56 Version: 4bdced5c9a2922521e325896a7bbbf0132c94e56 Version: 4bdced5c9a2922521e325896a7bbbf0132c94e56 Version: 4bdced5c9a2922521e325896a7bbbf0132c94e56 Version: 4bdced5c9a2922521e325896a7bbbf0132c94e56 Version: 4bdced5c9a2922521e325896a7bbbf0132c94e56 Version: 4bdced5c9a2922521e325896a7bbbf0132c94e56 Version: 4bdced5c9a2922521e325896a7bbbf0132c94e56 Version: cb1831a83e54cd3269a2420fce81c4fd8ae6f667 Version: 1c37ff78298a6b6063649123356a312e1cce12ca Version: f17c786b28a3060a566a170c2cf3bd7441fc30a3 Version: 4.4.103 ≤ Version: 4.9.66 ≤ Version: 4.14.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/rt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d57d0746276a88ea43a2cc62b849fd8a95e32e41",
"status": "affected",
"version": "4bdced5c9a2922521e325896a7bbbf0132c94e56",
"versionType": "git"
},
{
"lessThan": "3b3c672a66db3de3b40f8a7057864bc1f874ede3",
"status": "affected",
"version": "4bdced5c9a2922521e325896a7bbbf0132c94e56",
"versionType": "git"
},
{
"lessThan": "16ca9f3117e9a294646c897daf08a5ab546c711b",
"status": "affected",
"version": "4bdced5c9a2922521e325896a7bbbf0132c94e56",
"versionType": "git"
},
{
"lessThan": "8ad5577b2d4acfd83f03d97a0aece2d18aac5f07",
"status": "affected",
"version": "4bdced5c9a2922521e325896a7bbbf0132c94e56",
"versionType": "git"
},
{
"lessThan": "a6a73403733e86748421f2eeaf028c85683ef896",
"status": "affected",
"version": "4bdced5c9a2922521e325896a7bbbf0132c94e56",
"versionType": "git"
},
{
"lessThan": "52aeb1e07ec223caf212f036817976c98d2aa250",
"status": "affected",
"version": "4bdced5c9a2922521e325896a7bbbf0132c94e56",
"versionType": "git"
},
{
"lessThan": "9f25edc5a20cb52a5abbf25f0724bb4732b81801",
"status": "affected",
"version": "4bdced5c9a2922521e325896a7bbbf0132c94e56",
"versionType": "git"
},
{
"lessThan": "94894c9c477e53bcea052e075c53f89df3d2a33e",
"status": "affected",
"version": "4bdced5c9a2922521e325896a7bbbf0132c94e56",
"versionType": "git"
},
{
"status": "affected",
"version": "cb1831a83e54cd3269a2420fce81c4fd8ae6f667",
"versionType": "git"
},
{
"status": "affected",
"version": "1c37ff78298a6b6063649123356a312e1cce12ca",
"versionType": "git"
},
{
"status": "affected",
"version": "f17c786b28a3060a566a170c2cf3bd7441fc30a3",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.103",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.66",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/rt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/rt: Skip currently executing CPU in rto_next_cpu()\n\nCPU0 becomes overloaded when hosting a CPU-bound RT task, a non-CPU-bound\nRT task, and a CFS task stuck in kernel space. When other CPUs switch from\nRT to non-RT tasks, RT load balancing (LB) is triggered; with\nHAVE_RT_PUSH_IPI enabled, they send IPIs to CPU0 to drive the execution\nof rto_push_irq_work_func. During push_rt_task on CPU0,\nif next_task-\u003eprio \u003c rq-\u003edonor-\u003eprio, resched_curr() sets NEED_RESCHED\nand after the push operation completes, CPU0 calls rto_next_cpu().\nSince only CPU0 is overloaded in this scenario, rto_next_cpu() should\nideally return -1 (no further IPI needed).\n\nHowever, multiple CPUs invoking tell_cpu_to_push() during LB increments\nrd-\u003erto_loop_next. Even when rd-\u003erto_cpu is set to -1, the mismatch between\nrd-\u003erto_loop and rd-\u003erto_loop_next forces rto_next_cpu() to restart its\nsearch from -1. With CPU0 remaining overloaded (satisfying rt_nr_migratory\n\u0026\u0026 rt_nr_total \u003e 1), it gets reselected, causing CPU0 to queue irq_work to\nitself and send self-IPIs repeatedly. As long as CPU0 stays overloaded and\nother CPUs run pull_rt_tasks(), it falls into an infinite self-IPI loop,\nwhich triggers a CPU hardlockup due to continuous self-interrupts.\n\nThe trigging scenario is as follows:\n\n cpu0 cpu1 cpu2\n pull_rt_task\n tell_cpu_to_push\n \u003c------------irq_work_queue_on\nrto_push_irq_work_func\n push_rt_task\n resched_curr(rq) pull_rt_task\n rto_next_cpu tell_cpu_to_push\n \u003c-------------------------- atomic_inc(rto_loop_next)\nrd-\u003erto_loop != next\n rto_next_cpu\n irq_work_queue_on\nrto_push_irq_work_func\n\nFix redundant self-IPI by filtering the initiating CPU in rto_next_cpu().\nThis solution has been verified to effectively eliminate spurious self-IPIs\nand prevent CPU hardlockup scenarios."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:17:37.165Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d57d0746276a88ea43a2cc62b849fd8a95e32e41"
},
{
"url": "https://git.kernel.org/stable/c/3b3c672a66db3de3b40f8a7057864bc1f874ede3"
},
{
"url": "https://git.kernel.org/stable/c/16ca9f3117e9a294646c897daf08a5ab546c711b"
},
{
"url": "https://git.kernel.org/stable/c/8ad5577b2d4acfd83f03d97a0aece2d18aac5f07"
},
{
"url": "https://git.kernel.org/stable/c/a6a73403733e86748421f2eeaf028c85683ef896"
},
{
"url": "https://git.kernel.org/stable/c/52aeb1e07ec223caf212f036817976c98d2aa250"
},
{
"url": "https://git.kernel.org/stable/c/9f25edc5a20cb52a5abbf25f0724bb4732b81801"
},
{
"url": "https://git.kernel.org/stable/c/94894c9c477e53bcea052e075c53f89df3d2a33e"
}
],
"title": "sched/rt: Skip currently executing CPU in rto_next_cpu()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45919",
"datePublished": "2026-05-27T12:17:37.165Z",
"dateReserved": "2026-05-13T15:03:33.085Z",
"dateUpdated": "2026-05-27T12:17:37.165Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53362 (GCVE-0-2026-53362)
Vulnerability from cvelistv5
Published
2026-07-04 11:56
Modified
2026-08-28 16:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: account for fraggap on the paged allocation path
In __ip6_append_data(), when the paged-allocation branch is taken
(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are
computed as
alloclen = fragheaderlen + transhdrlen;
pagedlen = datalen - transhdrlen;
datalen already includes fraggap (datalen = length + fraggap). When
fraggap is non-zero, this is not the first skb and transhdrlen is zero.
The fraggap bytes carried over from the previous skb are copied just past
the fragment headers in the new skb's linear area. The linear area is
therefore undersized by fraggap bytes while pagedlen is overstated by the
same amount, and the copy writes past skb->end into the trailing
skb_shared_info.
An unprivileged user can trigger this via a UDPv6 socket using
MSG_MORE together with MSG_SPLICE_PAGES.
The bad accounting was introduced by commit 773ba4fe9104 ("ipv6:
avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix
__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative
copy value caused -EINVAL to be returned. That later commit allowed
MSG_SPLICE_PAGES to proceed in this case, making the corruption
triggerable.
The non-paged branch sets alloclen to fraglen, which already accounts
for fraggap because datalen does. Bring the paged branch in line by
adding fraggap to alloclen and subtracting it from pagedlen.
After this adjustment, copy no longer collapses to -fraggap on the
paged path, so remove the stale comment describing that old arithmetic.
Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES
case, remove the MSG_SPLICE_PAGES exception from the negative copy check.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 Version: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 Version: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 Version: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 Version: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 Version: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53362",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T03:55:26.491246Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-08-27",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:52:44.062Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "14200d435af9a9eeb444f529fc2f689a236b7962",
"status": "affected",
"version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03",
"versionType": "git"
},
{
"lessThan": "65fb14cbebb0cd0eff903a22d33537ddc8b95769",
"status": "affected",
"version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03",
"versionType": "git"
},
{
"lessThan": "46f201f8b4c39633a1fa3dc12459f506d470993d",
"status": "affected",
"version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03",
"versionType": "git"
},
{
"lessThan": "6374fb9edf72c67a118a2c214a0dddd04c921e0a",
"status": "affected",
"version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03",
"versionType": "git"
},
{
"lessThan": "e9eacf19281ea2498b36291b56c9606118c2d74e",
"status": "affected",
"version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03",
"versionType": "git"
},
{
"lessThan": "736b380e28d0480c7bc3e022f1950f31fe53a7c5",
"status": "affected",
"version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not the first skb and transhdrlen is zero.\nThe fraggap bytes carried over from the previous skb are copied just past\nthe fragment headers in the new skb\u0027s linear area. The linear area is\ntherefore undersized by fraggap bytes while pagedlen is overstated by the\nsame amount, and the copy writes past skb-\u003eend into the trailing\nskb_shared_info.\n\nAn unprivileged user can trigger this via a UDPv6 socket using\nMSG_MORE together with MSG_SPLICE_PAGES.\n\nThe bad accounting was introduced by commit 773ba4fe9104 (\"ipv6:\navoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix\n__ip6_append_data()\u0027s handling of MSG_SPLICE_PAGES\"), the negative\ncopy value caused -EINVAL to be returned. That later commit allowed\nMSG_SPLICE_PAGES to proceed in this case, making the corruption\ntriggerable.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic.\nSince a negative copy is no longer expected for a valid MSG_SPLICE_PAGES\ncase, remove the MSG_SPLICE_PAGES exception from the negative copy check."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is IPv6 transmit skb construction reached by a local process using splice/send operations on an AF_INET6 UDP socket. Received network packets do not enter this path, and a remote peer cannot directly set MSG_SPLICE_PAGES.\nAC:L - No race is required; the attacker controls the UDPv6 socket, MSG_MORE/splice sequence, and send sizes needed to create a nonzero fraggap on the paged allocation path. NETIF_F_SG is common on plausible IPv6 interfaces, so the trigger conditions are not unusually restrictive.\nPR:L - Creating a SOCK_DGRAM IPv6 UDP socket and using splice into it requires only an unprivileged local user. The CAP_NET_RAW check in inet6_create applies to SOCK_RAW, not this UDP datagram path.\nUI:N - The attacker directly invokes the local syscalls and socket operations needed to trigger the bug. No victim user action is required.\nS:U - The corruption occurs within the kernel networking stack and impacts the same kernel security authority. It is not a VM escape, IOMMU/DMA bypass, or cross-scope boundary violation.\nC:H - The bug is an out-of-bounds write into skb_shared_info, which contains fragment metadata and pointers used later by networking code. Such attacker-controlled kernel memory corruption can plausibly be leveraged for information disclosure, so confidentiality is High.\nI:H - The fraggap bytes come from attacker-controlled skb data and are copied past skb-\u003eend into skb_shared_info. This is an out-of-bounds write to kernel metadata and is scored as High integrity impact.\nA:H - Corrupting skb_shared_info can readily crash or panic the kernel during skb handling, checksum, transmit, or cleanup. The vulnerability is therefore a High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:29.351Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962"
},
{
"url": "https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769"
},
{
"url": "https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d"
},
{
"url": "https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a"
},
{
"url": "https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e"
},
{
"url": "https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5"
}
],
"title": "ipv6: account for fraggap on the paged allocation path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53362",
"datePublished": "2026-07-04T11:56:35.864Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-08-28T16:52:44.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45911 (GCVE-0-2026-45911)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-27 12:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: cdns3: fix role switching during resume
If the role change while we are suspended, the cdns3 driver switches to the
new mode during resume. However, switching to host mode in this context
causes a NULL pointer dereference.
The host role's start() operation registers a xhci-hcd device, but its
probe is deferred while we are in the resume path. The host role's resume()
operation assumes the xhci-hcd device is already probed, which is not the
case, leading to the dereference. Since the start() operation of the new
role is already called, the resume operation can be skipped.
So skip the resume operation for the new role if a role switch occurs
during resume. Once the resume sequence is complete, the xhci-hcd device
can be probed in case of host mode.
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000208
Mem abort info:
...
Data abort info:
...
[0000000000000208] pgd=0000000000000000, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1] SMP
Modules linked in:
CPU: 0 UID: 0 PID: 146 Comm: sh Not tainted
6.19.0-rc7-00013-g6e64f4aabfae-dirty #135 PREEMPT
Hardware name: Texas Instruments J7200 EVM (DT)
pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : usb_hcd_is_primary_hcd+0x0/0x1c
lr : cdns_host_resume+0x24/0x5c
...
Call trace:
usb_hcd_is_primary_hcd+0x0/0x1c (P)
cdns_resume+0x6c/0xbc
cdns3_controller_resume.isra.0+0xe8/0x17c
cdns3_plat_resume+0x18/0x24
platform_pm_resume+0x2c/0x68
dpm_run_callback+0x90/0x248
device_resume+0x100/0x24c
dpm_resume+0x190/0x2ec
dpm_resume_end+0x18/0x34
suspend_devices_and_enter+0x2b0/0xa44
pm_suspend+0x16c/0x5fc
state_store+0x80/0xec
kobj_attr_store+0x18/0x2c
sysfs_kf_write+0x7c/0x94
kernfs_fop_write_iter+0x130/0x1dc
vfs_write+0x240/0x370
ksys_write+0x70/0x108
__arm64_sys_write+0x1c/0x28
invoke_syscall+0x48/0x10c
el0_svc_common.constprop.0+0x40/0xe0
do_el0_svc+0x1c/0x28
el0_svc+0x34/0x108
el0t_64_sync_handler+0xa0/0xe4
el0t_64_sync+0x198/0x19c
Code: 52800003 f9407ca5 d63f00a0 17ffffe4 (f9410401)
---[ end trace 0000000000000000 ]---
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2cf2581cd2290ccef674f1be5f7977d66702eedb Version: 2cf2581cd2290ccef674f1be5f7977d66702eedb Version: 2cf2581cd2290ccef674f1be5f7977d66702eedb Version: 2cf2581cd2290ccef674f1be5f7977d66702eedb Version: 2cf2581cd2290ccef674f1be5f7977d66702eedb Version: 2cf2581cd2290ccef674f1be5f7977d66702eedb Version: 2cf2581cd2290ccef674f1be5f7977d66702eedb |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/cdns3/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ff02bd303d2d78051771db51119d66c0cf442f47",
"status": "affected",
"version": "2cf2581cd2290ccef674f1be5f7977d66702eedb",
"versionType": "git"
},
{
"lessThan": "94c742614899ff18a6b3e6f3cfbe7b9f36c865f3",
"status": "affected",
"version": "2cf2581cd2290ccef674f1be5f7977d66702eedb",
"versionType": "git"
},
{
"lessThan": "d637f6ec149ffd2f8257bcc261561dc2e44dbb8c",
"status": "affected",
"version": "2cf2581cd2290ccef674f1be5f7977d66702eedb",
"versionType": "git"
},
{
"lessThan": "56289298431ed76700b9aac27a3b1d929fe61b8d",
"status": "affected",
"version": "2cf2581cd2290ccef674f1be5f7977d66702eedb",
"versionType": "git"
},
{
"lessThan": "fc086c0ce3db0eefbbeb66a5b1e626296336e33a",
"status": "affected",
"version": "2cf2581cd2290ccef674f1be5f7977d66702eedb",
"versionType": "git"
},
{
"lessThan": "49c99dc247ebf7361db9dbdade3dcebfffaf2c22",
"status": "affected",
"version": "2cf2581cd2290ccef674f1be5f7977d66702eedb",
"versionType": "git"
},
{
"lessThan": "87e4b043b98a1d269be0b812f383881abee0ca45",
"status": "affected",
"version": "2cf2581cd2290ccef674f1be5f7977d66702eedb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/cdns3/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: cdns3: fix role switching during resume\n\nIf the role change while we are suspended, the cdns3 driver switches to the\nnew mode during resume. However, switching to host mode in this context\ncauses a NULL pointer dereference.\n\nThe host role\u0027s start() operation registers a xhci-hcd device, but its\nprobe is deferred while we are in the resume path. The host role\u0027s resume()\noperation assumes the xhci-hcd device is already probed, which is not the\ncase, leading to the dereference. Since the start() operation of the new\nrole is already called, the resume operation can be skipped.\n\nSo skip the resume operation for the new role if a role switch occurs\nduring resume. Once the resume sequence is complete, the xhci-hcd device\ncan be probed in case of host mode.\n\nUnable to handle kernel NULL pointer dereference at virtual address 0000000000000208\nMem abort info:\n...\nData abort info:\n...\n[0000000000000208] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 0000000096000004 [#1] SMP\nModules linked in:\nCPU: 0 UID: 0 PID: 146 Comm: sh Not tainted\n6.19.0-rc7-00013-g6e64f4aabfae-dirty #135 PREEMPT\nHardware name: Texas Instruments J7200 EVM (DT)\npstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\npc : usb_hcd_is_primary_hcd+0x0/0x1c\nlr : cdns_host_resume+0x24/0x5c\n...\nCall trace:\n usb_hcd_is_primary_hcd+0x0/0x1c (P)\n cdns_resume+0x6c/0xbc\n cdns3_controller_resume.isra.0+0xe8/0x17c\n cdns3_plat_resume+0x18/0x24\n platform_pm_resume+0x2c/0x68\n dpm_run_callback+0x90/0x248\n device_resume+0x100/0x24c\n dpm_resume+0x190/0x2ec\n dpm_resume_end+0x18/0x34\n suspend_devices_and_enter+0x2b0/0xa44\n pm_suspend+0x16c/0x5fc\n state_store+0x80/0xec\n kobj_attr_store+0x18/0x2c\n sysfs_kf_write+0x7c/0x94\n kernfs_fop_write_iter+0x130/0x1dc\n vfs_write+0x240/0x370\n ksys_write+0x70/0x108\n __arm64_sys_write+0x1c/0x28\n invoke_syscall+0x48/0x10c\n el0_svc_common.constprop.0+0x40/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x34/0x108\n el0t_64_sync_handler+0xa0/0xe4\n el0t_64_sync+0x198/0x19c\nCode: 52800003 f9407ca5 d63f00a0 17ffffe4 (f9410401)\n---[ end trace 0000000000000000 ]---"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:17:26.924Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ff02bd303d2d78051771db51119d66c0cf442f47"
},
{
"url": "https://git.kernel.org/stable/c/94c742614899ff18a6b3e6f3cfbe7b9f36c865f3"
},
{
"url": "https://git.kernel.org/stable/c/d637f6ec149ffd2f8257bcc261561dc2e44dbb8c"
},
{
"url": "https://git.kernel.org/stable/c/56289298431ed76700b9aac27a3b1d929fe61b8d"
},
{
"url": "https://git.kernel.org/stable/c/fc086c0ce3db0eefbbeb66a5b1e626296336e33a"
},
{
"url": "https://git.kernel.org/stable/c/49c99dc247ebf7361db9dbdade3dcebfffaf2c22"
},
{
"url": "https://git.kernel.org/stable/c/87e4b043b98a1d269be0b812f383881abee0ca45"
}
],
"title": "usb: cdns3: fix role switching during resume",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45911",
"datePublished": "2026-05-27T12:17:26.924Z",
"dateReserved": "2026-05-13T15:03:33.084Z",
"dateUpdated": "2026-05-27T12:17:26.924Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46232 (GCVE-0-2026-46232)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: playstation: Clamp num_touch_reports
A device would never lie about the number of touch reports would it?
If it does the loop in dualshock4_parse_report will read off the end of
the touch_reports array, up to about 2 KiB for the maximum number of 256
loop iteraions. The data that is read is emitted via evdev if the
DS4_TOUCH_POINT_INACTIVE bit happens to be set. Protect against this by
clamping the num_touch_reports value provided by the device to the
maximum size of the touch_reports array.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-playstation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0bc4cf1a6ba00fb8c074531b179bc7b97502fbc4",
"status": "affected",
"version": "752038248808a7ff176bbdb668f19ae7d2a9816b",
"versionType": "git"
},
{
"lessThan": "9c031b24aed6733b6dcc5d98527875b8654a04e9",
"status": "affected",
"version": "752038248808a7ff176bbdb668f19ae7d2a9816b",
"versionType": "git"
},
{
"lessThan": "7812694752a5f295eaa05a093b90a2c332666051",
"status": "affected",
"version": "752038248808a7ff176bbdb668f19ae7d2a9816b",
"versionType": "git"
},
{
"lessThan": "208f6d5b1dfd6399bc6af9e11f27f1f496243ed0",
"status": "affected",
"version": "752038248808a7ff176bbdb668f19ae7d2a9816b",
"versionType": "git"
},
{
"lessThan": "cac61b58a3b6340c52afa06bb15eac033158db2f",
"status": "affected",
"version": "752038248808a7ff176bbdb668f19ae7d2a9816b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-playstation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: playstation: Clamp num_touch_reports\n\nA device would never lie about the number of touch reports would it?\n\nIf it does the loop in dualshock4_parse_report will read off the end of\nthe touch_reports array, up to about 2 KiB for the maximum number of 256\nloop iteraions. The data that is read is emitted via evdev if the\nDS4_TOUCH_POINT_INACTIVE bit happens to be set. Protect against this by\nclamping the num_touch_reports value provided by the device to the\nmaximum size of the touch_reports array."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The DualShock4 binds over both Bluetooth (HID_BLUETOOTH_DEVICE) and USB; a malicious/compromised controller within Bluetooth radio range delivers the crafted report, making Adjacent the most severe reasonable transport (higher than the USB/Physical path).\nAC:L - The device fully controls num_touch_reports and can deterministically set it to 255; the BT CRC32 uses a fixed, known seed the attacker computes. No race or attacker-uncontrolled condition is involved.\nPR:N - No privileges on the target are needed \u2014 the malicious HID device itself is the attacker, supplying crafted input reports that the kernel parses automatically.\nUI:N - A bonded controller (or a device emulating one) auto-reconnects and autonomously streams the malicious reports; no victim action triggers the out-of-bounds read.\nS:U - The impact is confined to the kernel\u0027s own memory and the input subsystem; no security boundary (VM, IOMMU, sandbox) is crossed.\nC:H - Up to ~2 KiB of adjacent kernel heap is read out of bounds, and the X/Y coordinates derived from that memory are emitted to userspace through the touchpad evdev device \u2014 a substantial kernel-memory disclosure, not bounded to a few bytes.\nI:N - The flaw is purely an out-of-bounds read; no kernel memory is written, modified, or corrupted.\nA:H - Reading up to ~2 KiB past the heap allocation can reach an unmapped page and trigger a kernel oops/panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:38.317Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0bc4cf1a6ba00fb8c074531b179bc7b97502fbc4"
},
{
"url": "https://git.kernel.org/stable/c/9c031b24aed6733b6dcc5d98527875b8654a04e9"
},
{
"url": "https://git.kernel.org/stable/c/7812694752a5f295eaa05a093b90a2c332666051"
},
{
"url": "https://git.kernel.org/stable/c/208f6d5b1dfd6399bc6af9e11f27f1f496243ed0"
},
{
"url": "https://git.kernel.org/stable/c/cac61b58a3b6340c52afa06bb15eac033158db2f"
}
],
"title": "HID: playstation: Clamp num_touch_reports",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46232",
"datePublished": "2026-05-28T09:40:54.248Z",
"dateReserved": "2026-05-13T15:03:33.106Z",
"dateUpdated": "2026-08-05T12:30:38.317Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31749 (GCVE-0-2026-31749)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-05-11 22:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
comedi: ni_atmio16d: Fix invalid clean-up after failed attach
If the driver's COMEDI "attach" handler function (`atmio16d_attach()`)
returns an error, the COMEDI core will call the driver's "detach"
handler function (`atmio16d_detach()`) to clean up. This calls
`reset_atmio16d()` unconditionally, but depending on where the error
occurred in the attach handler, the device may not have been
sufficiently initialized to call `reset_atmio16d()`. It uses
`dev->iobase` as the I/O port base address and `dev->private` as the
pointer to the COMEDI device's private data structure. `dev->iobase`
may still be set to its initial value of 0, which would result in
undesired writes to low I/O port addresses. `dev->private` may still be
`NULL`, which would result in null pointer dereferences.
Fix `atmio16d_detach()` by checking that `dev->private` is valid
(non-null) before calling `reset_atmio16d()`. This implies that
`dev->iobase` was set correctly since that is set up before
`dev->private`.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2323b276308a5da5774b778f39c7fd94b2a3022a Version: 2323b276308a5da5774b778f39c7fd94b2a3022a Version: 2323b276308a5da5774b778f39c7fd94b2a3022a Version: 2323b276308a5da5774b778f39c7fd94b2a3022a Version: 2323b276308a5da5774b778f39c7fd94b2a3022a Version: 2323b276308a5da5774b778f39c7fd94b2a3022a Version: 2323b276308a5da5774b778f39c7fd94b2a3022a Version: 2323b276308a5da5774b778f39c7fd94b2a3022a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/comedi/drivers/ni_atmio16d.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a01dd339ea6ac58b0967a50085622a6017351140",
"status": "affected",
"version": "2323b276308a5da5774b778f39c7fd94b2a3022a",
"versionType": "git"
},
{
"lessThan": "933a2d6a95f9bfb203e562c9be1dd990c735535c",
"status": "affected",
"version": "2323b276308a5da5774b778f39c7fd94b2a3022a",
"versionType": "git"
},
{
"lessThan": "5d8d88c8c0eec230de8f1f60e0920a4337939a88",
"status": "affected",
"version": "2323b276308a5da5774b778f39c7fd94b2a3022a",
"versionType": "git"
},
{
"lessThan": "f517646e008fe99ca1800601cd011b110f8684ae",
"status": "affected",
"version": "2323b276308a5da5774b778f39c7fd94b2a3022a",
"versionType": "git"
},
{
"lessThan": "3848ae00b1642e2c98ff8cbfd2d3b38c6f53b5c3",
"status": "affected",
"version": "2323b276308a5da5774b778f39c7fd94b2a3022a",
"versionType": "git"
},
{
"lessThan": "43c68a2c7cc35b7c2a83c285cb4ad3d472b8caa2",
"status": "affected",
"version": "2323b276308a5da5774b778f39c7fd94b2a3022a",
"versionType": "git"
},
{
"lessThan": "d07d97ca4f7fac467cdcf4a012690853958b7e89",
"status": "affected",
"version": "2323b276308a5da5774b778f39c7fd94b2a3022a",
"versionType": "git"
},
{
"lessThan": "101ab946b79ad83b36d5cfd47de587492a80acf0",
"status": "affected",
"version": "2323b276308a5da5774b778f39c7fd94b2a3022a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/comedi/drivers/ni_atmio16d.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: ni_atmio16d: Fix invalid clean-up after failed attach\n\nIf the driver\u0027s COMEDI \"attach\" handler function (`atmio16d_attach()`)\nreturns an error, the COMEDI core will call the driver\u0027s \"detach\"\nhandler function (`atmio16d_detach()`) to clean up. This calls\n`reset_atmio16d()` unconditionally, but depending on where the error\noccurred in the attach handler, the device may not have been\nsufficiently initialized to call `reset_atmio16d()`. It uses\n`dev-\u003eiobase` as the I/O port base address and `dev-\u003eprivate` as the\npointer to the COMEDI device\u0027s private data structure. `dev-\u003eiobase`\nmay still be set to its initial value of 0, which would result in\nundesired writes to low I/O port addresses. `dev-\u003eprivate` may still be\n`NULL`, which would result in null pointer dereferences.\n\nFix `atmio16d_detach()` by checking that `dev-\u003eprivate` is valid\n(non-null) before calling `reset_atmio16d()`. This implies that\n`dev-\u003eiobase` was set correctly since that is set up before\n`dev-\u003eprivate`."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:15:02.951Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a01dd339ea6ac58b0967a50085622a6017351140"
},
{
"url": "https://git.kernel.org/stable/c/933a2d6a95f9bfb203e562c9be1dd990c735535c"
},
{
"url": "https://git.kernel.org/stable/c/5d8d88c8c0eec230de8f1f60e0920a4337939a88"
},
{
"url": "https://git.kernel.org/stable/c/f517646e008fe99ca1800601cd011b110f8684ae"
},
{
"url": "https://git.kernel.org/stable/c/3848ae00b1642e2c98ff8cbfd2d3b38c6f53b5c3"
},
{
"url": "https://git.kernel.org/stable/c/43c68a2c7cc35b7c2a83c285cb4ad3d472b8caa2"
},
{
"url": "https://git.kernel.org/stable/c/d07d97ca4f7fac467cdcf4a012690853958b7e89"
},
{
"url": "https://git.kernel.org/stable/c/101ab946b79ad83b36d5cfd47de587492a80acf0"
}
],
"title": "comedi: ni_atmio16d: Fix invalid clean-up after failed attach",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31749",
"datePublished": "2026-05-01T14:14:42.227Z",
"dateReserved": "2026-03-09T15:48:24.139Z",
"dateUpdated": "2026-05-11T22:15:02.951Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31771 (GCVE-0-2026-31771)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: move wake reason storage into validated event handlers
hci_store_wake_reason() is called from hci_event_packet() immediately
after stripping the HCI event header but before hci_event_func()
enforces the per-event minimum payload length from hci_ev_table.
This means a short HCI event frame can reach bacpy() before any bounds
check runs.
Rather than duplicating skb parsing and per-event length checks inside
hci_store_wake_reason(), move wake-address storage into the individual
event handlers after their existing event-length validation has
succeeded. Convert hci_store_wake_reason() into a small helper that only
stores an already-validated bdaddr while the caller holds hci_dev_lock().
Use the same helper after hci_event_func() with a NULL address to
preserve the existing unexpected-wake fallback semantics when no
validated event handler records a wake address.
Annotate the helper with __must_hold(&hdev->lock) and add
lockdep_assert_held(&hdev->lock) so future call paths keep the lock
contract explicit.
Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(),
hci_sync_conn_complete_evt(), le_conn_complete_evt(),
hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),
hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and
hci_le_past_received_evt().
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "86c8d07a64d553c41e213b52650020010f9ef23e",
"status": "affected",
"version": "2f20216c1d6fe17c1a224f658be0dc6fab2269c7",
"versionType": "git"
},
{
"lessThan": "2b2bf47cd75518c36fa2d41380e4a40641cc89cd",
"status": "affected",
"version": "2f20216c1d6fe17c1a224f658be0dc6fab2269c7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: move wake reason storage into validated event handlers\n\nhci_store_wake_reason() is called from hci_event_packet() immediately\nafter stripping the HCI event header but before hci_event_func()\nenforces the per-event minimum payload length from hci_ev_table.\nThis means a short HCI event frame can reach bacpy() before any bounds\ncheck runs.\n\nRather than duplicating skb parsing and per-event length checks inside\nhci_store_wake_reason(), move wake-address storage into the individual\nevent handlers after their existing event-length validation has\nsucceeded. Convert hci_store_wake_reason() into a small helper that only\nstores an already-validated bdaddr while the caller holds hci_dev_lock().\nUse the same helper after hci_event_func() with a NULL address to\npreserve the existing unexpected-wake fallback semantics when no\nvalidated event handler records a wake address.\n\nAnnotate the helper with __must_hold(\u0026hdev-\u003elock) and add\nlockdep_assert_held(\u0026hdev-\u003elock) so future call paths keep the lock\ncontract explicit.\n\nCall the helper from hci_conn_request_evt(), hci_conn_complete_evt(),\nhci_sync_conn_complete_evt(), le_conn_complete_evt(),\nhci_le_adv_report_evt(), hci_le_ext_adv_report_evt(),\nhci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and\nhci_le_past_received_evt()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable parser is in Bluetooth HCI event handling, reached from controller events generated by nearby Bluetooth activity such as connection or advertising wake events. Bluetooth attacks require radio adjacency rather than IP network reachability.\nAC:L - No race is required; a short HCI event reaches wake-reason parsing before the normal per-event length checks. The suspended/wake-reason state is a normal Bluetooth remote-wake deployment condition, so under the higher-severity rule this is low complexity.\nPR:N - An adjacent Bluetooth peer does not need privileges on the vulnerable host, and affected events can occur before any Bluetooth authentication or pairing decision in the host stack. Local HCI injection paths may require privileges, but the adjacent radio scenario requires none.\nUI:N - No victim action is required once Bluetooth remote wake/scanning is enabled and the system is in the affected state. The attacker only needs to deliver the triggering Bluetooth activity/event.\nS:U - The impact remains within the same kernel/host security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is an out-of-bounds kernel heap read from an skb before validation, copied into wake-address state that is later reported through management resume events. Although each copy is small, repeated malformed wake events and multiple event layouts make kernel memory disclosure plausible, so the higher severity option is selected.\nI:N - The vulnerable operation copies out-of-bounds source bytes into intended hci_dev wake-reason fields, but does not provide an out-of-bounds write or control over unrelated kernel memory. I found no path from this state corruption to arbitrary modification or code execution.\nA:H - The malformed short event can drive invalid kernel memory reads before bounds checks; depending on allocator layout or hardening, this can cause an oops/panic. As a kernel fault from attacker-supplied malformed Bluetooth input is plausible, availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:03.550Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/86c8d07a64d553c41e213b52650020010f9ef23e"
},
{
"url": "https://git.kernel.org/stable/c/2b2bf47cd75518c36fa2d41380e4a40641cc89cd"
}
],
"title": "Bluetooth: hci_event: move wake reason storage into validated event handlers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31771",
"datePublished": "2026-05-01T14:14:59.918Z",
"dateReserved": "2026-03-09T15:48:24.140Z",
"dateUpdated": "2026-08-05T12:25:03.550Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71305 (GCVE-0-2025-71305)
Vulnerability from cvelistv5
Published
2026-05-27 12:14
Modified
2026-05-30 10:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/display/dp_mst: Add protection against 0 vcpi
When releasing a timeslot there is a slight chance we may end up
with the wrong payload mask due to overflow if the delayed_destroy_work
ends up coming into play after a DP 2.1 monitor gets disconnected
which causes vcpi to become 0 then we try to make the payload =
~BIT(vcpi - 1) which is a negative shift. VCPI id should never
really be 0 hence skip changing the payload mask if VCPI is 0.
Otherwise it leads to
<7> [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc
[drm_display_helper]] port ffff888126ce9000 (3)
<4> [515.287267] -----------[ cut here ]-----------
<3> [515.287268] UBSAN: shift-out-of-bounds in
../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36
<3> [515.287271] shift exponent -1 is negative
<4> [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G
S U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary)
<4> [515.287279] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
<4> [515.287279] Hardware name: ASUS System Product Name/PRIME Z790-P
WIFI, BIOS 1645 03/15/2024
<4> [515.287281] Workqueue: drm_dp_mst_wq drm_dp_delayed_destroy_work
[drm_display_helper]
<4> [515.287303] Call Trace:
<4> [515.287304] <TASK>
<4> [515.287306] dump_stack_lvl+0xc1/0xf0
<4> [515.287313] dump_stack+0x10/0x20
<4> [515.287316] __ubsan_handle_shift_out_of_bounds+0x133/0x2e0
<4> [515.287324] ? drm_atomic_get_private_obj_state+0x186/0x1d0
<4> [515.287333] drm_dp_atomic_release_time_slots.cold+0x17/0x3d
[drm_display_helper]
<4> [515.287355] mst_connector_atomic_check+0x159/0x180 [xe]
<4> [515.287546] drm_atomic_helper_check_modeset+0x4d9/0xfa0
<4> [515.287550] ? __ww_mutex_lock.constprop.0+0x6f/0x1a60
<4> [515.287562] intel_atomic_check+0x119/0x2b80 [xe]
<4> [515.287740] ? find_held_lock+0x31/0x90
<4> [515.287747] ? lock_release+0xce/0x2a0
<4> [515.287754] drm_atomic_check_only+0x6a2/0xb40
<4> [515.287758] ? drm_atomic_add_affected_connectors+0x12b/0x140
<4> [515.287765] drm_atomic_commit+0x6e/0xf0
<4> [515.287766] ? _pfx__drm_printfn_info+0x10/0x10
<4> [515.287774] drm_client_modeset_commit_atomic+0x25c/0x2b0
<4> [515.287794] drm_client_modeset_commit_locked+0x60/0x1b0
<4> [515.287795] ? mutex_lock_nested+0x1b/0x30
<4> [515.287801] drm_client_modeset_commit+0x26/0x50
<4> [515.287804] __drm_fb_helper_restore_fbdev_mode_unlocked+0xdc/0x110
<4> [515.287810] drm_fb_helper_hotplug_event+0x120/0x140
<4> [515.287814] drm_fbdev_client_hotplug+0x28/0xd0
<4> [515.287819] drm_client_hotplug+0x6c/0xf0
<4> [515.287824] drm_client_dev_hotplug+0x9e/0xd0
<4> [515.287829] drm_kms_helper_hotplug_event+0x1a/0x30
<4> [515.287834] drm_dp_delayed_destroy_work+0x3df/0x410
[drm_display_helper]
<4> [515.287861] process_one_work+0x22b/0x6f0
<4> [515.287874] worker_thread+0x1e8/0x3d0
<4> [515.287879] ? __pfx_worker_thread+0x10/0x10
<4> [515.287882] kthread+0x11c/0x250
<4> [515.287886] ? __pfx_kthread+0x10/0x10
<4> [515.287890] ret_from_fork+0x2d7/0x310
<4> [515.287894] ? __pfx_kthread+0x10/0x10
<4> [515.287897] ret_from_fork_asm+0x1a/0x30
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4d07b0bc403403438d9cf88450506240c5faf92f Version: 4d07b0bc403403438d9cf88450506240c5faf92f Version: 4d07b0bc403403438d9cf88450506240c5faf92f Version: 4d07b0bc403403438d9cf88450506240c5faf92f Version: 4d07b0bc403403438d9cf88450506240c5faf92f Version: 4d07b0bc403403438d9cf88450506240c5faf92f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/display/drm_dp_mst_topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "95dbd525efce2a9e9e1c50ad15213de644c85ad0",
"status": "affected",
"version": "4d07b0bc403403438d9cf88450506240c5faf92f",
"versionType": "git"
},
{
"lessThan": "ac9a7c329a5610051fc476644c9b9145a5965ecb",
"status": "affected",
"version": "4d07b0bc403403438d9cf88450506240c5faf92f",
"versionType": "git"
},
{
"lessThan": "3f44cdb5371faf225af37d5caba8f21ec0572469",
"status": "affected",
"version": "4d07b0bc403403438d9cf88450506240c5faf92f",
"versionType": "git"
},
{
"lessThan": "4d2ccdea18b564e3f73e3e543854acea64e6277d",
"status": "affected",
"version": "4d07b0bc403403438d9cf88450506240c5faf92f",
"versionType": "git"
},
{
"lessThan": "d6afc7539ce06dadfa5b4787b3cfe79b95d8f67a",
"status": "affected",
"version": "4d07b0bc403403438d9cf88450506240c5faf92f",
"versionType": "git"
},
{
"lessThan": "342ccffd9f77fc29fe1c05fd145e4d842bd2feaa",
"status": "affected",
"version": "4d07b0bc403403438d9cf88450506240c5faf92f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/display/drm_dp_mst_topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/display/dp_mst: Add protection against 0 vcpi\n\nWhen releasing a timeslot there is a slight chance we may end up\nwith the wrong payload mask due to overflow if the delayed_destroy_work\nends up coming into play after a DP 2.1 monitor gets disconnected\nwhich causes vcpi to become 0 then we try to make the payload =\n~BIT(vcpi - 1) which is a negative shift. VCPI id should never\nreally be 0 hence skip changing the payload mask if VCPI is 0.\n\nOtherwise it leads to\n\u003c7\u003e [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc\n[drm_display_helper]] port ffff888126ce9000 (3)\n\u003c4\u003e [515.287267] -----------[ cut here ]-----------\n\u003c3\u003e [515.287268] UBSAN: shift-out-of-bounds in\n../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36\n\u003c3\u003e [515.287271] shift exponent -1 is negative\n\u003c4\u003e [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G\nS U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary)\n\u003c4\u003e [515.287279] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER\n\u003c4\u003e [515.287279] Hardware name: ASUS System Product Name/PRIME Z790-P\nWIFI, BIOS 1645 03/15/2024\n\u003c4\u003e [515.287281] Workqueue: drm_dp_mst_wq drm_dp_delayed_destroy_work\n[drm_display_helper]\n\u003c4\u003e [515.287303] Call Trace:\n\u003c4\u003e [515.287304] \u003cTASK\u003e\n\u003c4\u003e [515.287306] dump_stack_lvl+0xc1/0xf0\n\u003c4\u003e [515.287313] dump_stack+0x10/0x20\n\u003c4\u003e [515.287316] __ubsan_handle_shift_out_of_bounds+0x133/0x2e0\n\u003c4\u003e [515.287324] ? drm_atomic_get_private_obj_state+0x186/0x1d0\n\u003c4\u003e [515.287333] drm_dp_atomic_release_time_slots.cold+0x17/0x3d\n[drm_display_helper]\n\u003c4\u003e [515.287355] mst_connector_atomic_check+0x159/0x180 [xe]\n\u003c4\u003e [515.287546] drm_atomic_helper_check_modeset+0x4d9/0xfa0\n\u003c4\u003e [515.287550] ? __ww_mutex_lock.constprop.0+0x6f/0x1a60\n\u003c4\u003e [515.287562] intel_atomic_check+0x119/0x2b80 [xe]\n\u003c4\u003e [515.287740] ? find_held_lock+0x31/0x90\n\u003c4\u003e [515.287747] ? lock_release+0xce/0x2a0\n\u003c4\u003e [515.287754] drm_atomic_check_only+0x6a2/0xb40\n\u003c4\u003e [515.287758] ? drm_atomic_add_affected_connectors+0x12b/0x140\n\u003c4\u003e [515.287765] drm_atomic_commit+0x6e/0xf0\n\u003c4\u003e [515.287766] ? _pfx__drm_printfn_info+0x10/0x10\n\u003c4\u003e [515.287774] drm_client_modeset_commit_atomic+0x25c/0x2b0\n\u003c4\u003e [515.287794] drm_client_modeset_commit_locked+0x60/0x1b0\n\u003c4\u003e [515.287795] ? mutex_lock_nested+0x1b/0x30\n\u003c4\u003e [515.287801] drm_client_modeset_commit+0x26/0x50\n\u003c4\u003e [515.287804] __drm_fb_helper_restore_fbdev_mode_unlocked+0xdc/0x110\n\u003c4\u003e [515.287810] drm_fb_helper_hotplug_event+0x120/0x140\n\u003c4\u003e [515.287814] drm_fbdev_client_hotplug+0x28/0xd0\n\u003c4\u003e [515.287819] drm_client_hotplug+0x6c/0xf0\n\u003c4\u003e [515.287824] drm_client_dev_hotplug+0x9e/0xd0\n\u003c4\u003e [515.287829] drm_kms_helper_hotplug_event+0x1a/0x30\n\u003c4\u003e [515.287834] drm_dp_delayed_destroy_work+0x3df/0x410\n[drm_display_helper]\n\u003c4\u003e [515.287861] process_one_work+0x22b/0x6f0\n\u003c4\u003e [515.287874] worker_thread+0x1e8/0x3d0\n\u003c4\u003e [515.287879] ? __pfx_worker_thread+0x10/0x10\n\u003c4\u003e [515.287882] kthread+0x11c/0x250\n\u003c4\u003e [515.287886] ? __pfx_kthread+0x10/0x10\n\u003c4\u003e [515.287890] ret_from_fork+0x2d7/0x310\n\u003c4\u003e [515.287894] ? __pfx_kthread+0x10/0x10\n\u003c4\u003e [515.287897] ret_from_fork_asm+0x1a/0x30"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-30T10:41:38.273Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/95dbd525efce2a9e9e1c50ad15213de644c85ad0"
},
{
"url": "https://git.kernel.org/stable/c/ac9a7c329a5610051fc476644c9b9145a5965ecb"
},
{
"url": "https://git.kernel.org/stable/c/3f44cdb5371faf225af37d5caba8f21ec0572469"
},
{
"url": "https://git.kernel.org/stable/c/4d2ccdea18b564e3f73e3e543854acea64e6277d"
},
{
"url": "https://git.kernel.org/stable/c/d6afc7539ce06dadfa5b4787b3cfe79b95d8f67a"
},
{
"url": "https://git.kernel.org/stable/c/342ccffd9f77fc29fe1c05fd145e4d842bd2feaa"
}
],
"title": "drm/display/dp_mst: Add protection against 0 vcpi",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-71305",
"datePublished": "2026-05-27T12:14:55.722Z",
"dateReserved": "2026-05-08T13:14:33.087Z",
"dateUpdated": "2026-05-30T10:41:38.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52931 (GCVE-0-2026-52931)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: tp_meter: avoid use of uninit sender vars
batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the
BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it
proceeds to read sender-only members that were never initialized, leading
to undefined behavior.
This can be triggered when a node that is currently acting as a receiver in
an ongoing tp_meter session receives a malicious ACK packet.
Guard against this by checking tp_vars->role immediately after the
lookup and bailing out if it is not BATADV_TP_SENDER, before any of
those members are accessed.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/tp_meter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0e388af04b3958b178a1b979527f93eb46ea1fee",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "1a21c055f66e78973712a4a1be2a554f1ee2e4f4",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "9884c9c02d3c90e9215db3c5128f59045d20ae91",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "53f931e0146ae5bdab4cba302646827d06b3794b",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "ecdaa3e4d91040206afe21bc8a0d1198a0971ff3",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "dc2ae5fbd2dadc26735092f140b246841d969a11",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "85397e48afe6be83ffca5ad3f4792296bfc81d3d",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "6c65cf23d4c6170fcf5714c32aa64689718cb142",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/tp_meter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: tp_meter: avoid use of uninit sender vars\n\nbatadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the\nBATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it\nproceeds to read sender-only members that were never initialized, leading\nto undefined behavior.\n\nThis can be triggered when a node that is currently acting as a receiver in\nan ongoing tp_meter session receives a malicious ACK packet.\n\nGuard against this by checking tp_vars-\u003erole immediately after the\nlookup and bailing out if it is not BATADV_TP_SENDER, before any of\nthose members are accessed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is reached by crafted BATMAN-adv ICMP TP packets received on an active batman-adv mesh interface and can be delivered by a remote mesh peer over the network. It is not a local-only netlink path and does not require physical access.\nAC:L - No race or victim timing is required; the attacker controls the TP session creation packet and the follow-up malicious ACK. The requirement that batman-adv is active is an environmental precondition for the affected subsystem.\nPR:N - The packet receive path has no credential or authentication check before `batadv_tp_meter_recv()` and `batadv_tp_recv_ack()`. A malicious peer can create the receiver-side tp_meter session with a TP MSG and then send a matching TP ACK.\nUI:N - Exploitation is driven entirely by attacker-sent network packets. No victim user action is required once the target batman-adv interface is active.\nS:U - The impact is within the vulnerable kernel instance and its batman-adv networking context. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The ACK path can operate on uninitialized sender-only state, including waitqueue/list/lock and counter fields, creating kernel memory corruption potential. Under conservative scoring, successful exploitation of that corruption can expose arbitrary kernel memory.\nI:H - The same uninitialized sender state can drive writes through corrupted kernel synchronization/list structures and sender counters. With heap grooming, this is defensible as a kernel memory corruption primitive capable of arbitrary modification or code execution.\nA:H - At minimum, forged ACKs can dereference or manipulate uninitialized lock, list, timer, and waitqueue state, leading to kernel oops, panic, hang, or sustained denial of service. The trigger can be repeated by sending additional crafted packets."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:48.973Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0e388af04b3958b178a1b979527f93eb46ea1fee"
},
{
"url": "https://git.kernel.org/stable/c/1a21c055f66e78973712a4a1be2a554f1ee2e4f4"
},
{
"url": "https://git.kernel.org/stable/c/9884c9c02d3c90e9215db3c5128f59045d20ae91"
},
{
"url": "https://git.kernel.org/stable/c/53f931e0146ae5bdab4cba302646827d06b3794b"
},
{
"url": "https://git.kernel.org/stable/c/ecdaa3e4d91040206afe21bc8a0d1198a0971ff3"
},
{
"url": "https://git.kernel.org/stable/c/dc2ae5fbd2dadc26735092f140b246841d969a11"
},
{
"url": "https://git.kernel.org/stable/c/85397e48afe6be83ffca5ad3f4792296bfc81d3d"
},
{
"url": "https://git.kernel.org/stable/c/6c65cf23d4c6170fcf5714c32aa64689718cb142"
}
],
"title": "batman-adv: tp_meter: avoid use of uninit sender vars",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52931",
"datePublished": "2026-06-24T07:14:23.349Z",
"dateReserved": "2026-06-09T07:44:35.369Z",
"dateUpdated": "2026-08-05T12:31:48.973Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46163 (GCVE-0-2026-46163)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-06-14 17:59
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: b43legacy: enforce bounds check on firmware key index in RX path
Same fix as b43: the firmware-controlled key index in b43legacy_rx()
can exceed dev->max_nr_keys. The existing B43legacy_WARN_ON is
non-enforcing in production builds, allowing an out-of-bounds read of
dev->key[].
Make the check enforcing by dropping the frame for invalid indices.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 75388acd0cd827dc1498043daa7d1c760902cd67 Version: 75388acd0cd827dc1498043daa7d1c760902cd67 Version: 75388acd0cd827dc1498043daa7d1c760902cd67 Version: 75388acd0cd827dc1498043daa7d1c760902cd67 Version: 75388acd0cd827dc1498043daa7d1c760902cd67 Version: 75388acd0cd827dc1498043daa7d1c760902cd67 Version: 75388acd0cd827dc1498043daa7d1c760902cd67 Version: 75388acd0cd827dc1498043daa7d1c760902cd67 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/b43legacy/xmit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a92bd0503df2488f2cc040f329ebccff1c1934cb",
"status": "affected",
"version": "75388acd0cd827dc1498043daa7d1c760902cd67",
"versionType": "git"
},
{
"lessThan": "df805c1d085b7a96077f0964185764c87060950d",
"status": "affected",
"version": "75388acd0cd827dc1498043daa7d1c760902cd67",
"versionType": "git"
},
{
"lessThan": "4242db36de99de734cc1f60e5edd86cda7e598c6",
"status": "affected",
"version": "75388acd0cd827dc1498043daa7d1c760902cd67",
"versionType": "git"
},
{
"lessThan": "1baaeb6adecb9691748c0253dab6ddd19a2b4e9e",
"status": "affected",
"version": "75388acd0cd827dc1498043daa7d1c760902cd67",
"versionType": "git"
},
{
"lessThan": "6ee946077607d7783ae6709a899213fc4fe08f35",
"status": "affected",
"version": "75388acd0cd827dc1498043daa7d1c760902cd67",
"versionType": "git"
},
{
"lessThan": "9d1bc155802943e92c57a5fb923d23edfbf0b525",
"status": "affected",
"version": "75388acd0cd827dc1498043daa7d1c760902cd67",
"versionType": "git"
},
{
"lessThan": "fdd4e51979f42ca8b1ab7e6176b607e1caabf2a5",
"status": "affected",
"version": "75388acd0cd827dc1498043daa7d1c760902cd67",
"versionType": "git"
},
{
"lessThan": "a035766f970bde2d4298346a31a80685be5c0205",
"status": "affected",
"version": "75388acd0cd827dc1498043daa7d1c760902cd67",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/b43legacy/xmit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: b43legacy: enforce bounds check on firmware key index in RX path\n\nSame fix as b43: the firmware-controlled key index in b43legacy_rx()\ncan exceed dev-\u003emax_nr_keys. The existing B43legacy_WARN_ON is\nnon-enforcing in production builds, allowing an out-of-bounds read of\ndev-\u003ekey[].\n\nMake the check enforcing by dropping the frame for invalid indices."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:59:18.913Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a92bd0503df2488f2cc040f329ebccff1c1934cb"
},
{
"url": "https://git.kernel.org/stable/c/df805c1d085b7a96077f0964185764c87060950d"
},
{
"url": "https://git.kernel.org/stable/c/4242db36de99de734cc1f60e5edd86cda7e598c6"
},
{
"url": "https://git.kernel.org/stable/c/1baaeb6adecb9691748c0253dab6ddd19a2b4e9e"
},
{
"url": "https://git.kernel.org/stable/c/6ee946077607d7783ae6709a899213fc4fe08f35"
},
{
"url": "https://git.kernel.org/stable/c/9d1bc155802943e92c57a5fb923d23edfbf0b525"
},
{
"url": "https://git.kernel.org/stable/c/fdd4e51979f42ca8b1ab7e6176b607e1caabf2a5"
},
{
"url": "https://git.kernel.org/stable/c/a035766f970bde2d4298346a31a80685be5c0205"
}
],
"title": "wifi: b43legacy: enforce bounds check on firmware key index in RX path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46163",
"datePublished": "2026-05-28T09:36:18.946Z",
"dateReserved": "2026-05-13T15:03:33.102Z",
"dateUpdated": "2026-06-14T17:59:18.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45858 (GCVE-0-2026-45858)
Vulnerability from cvelistv5
Published
2026-05-27 12:15
Modified
2026-05-30 10:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1
When allocating initialized blocks from a large unwritten extent, or
when splitting an unwritten extent during end I/O and converting it to
initialized, there is currently a potential issue of stale data if the
extent needs to be split in the middle.
0 A B N
[UUUUUUUUUUUU] U: unwritten extent
[--DDDDDDDD--] D: valid data
|<- ->| ----> this range needs to be initialized
ext4_split_extent() first try to split this extent at B with
EXT4_EXT_DATA_ENTIRE_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but
ext4_split_extent_at() failed to split this extent due to temporary lack
of space. It zeroout B to N and mark the entire extent from 0 to N
as written.
0 A B N
[WWWWWWWWWWWW] W: written extent
[SSDDDDDDDDZZ] Z: zeroed, S: stale data
ext4_split_extent() then try to split this extent at A with
EXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and left
a stale written extent from 0 to A.
0 A B N
[WW|WWWWWWWWWW]
[SS|DDDDDDDDZZ]
Fix this by pass EXT4_EXT_DATA_PARTIAL_VALID1 to ext4_split_extent_at()
when splitting at B, don't convert the entire extent to written and left
it as unwritten after zeroing out B to N. The remaining work is just
like the standard two-part split. ext4_split_extent() will pass the
EXT4_EXT_DATA_VALID2 flag when it calls ext4_split_extent_at() for the
second time, allowing it to properly handle the split. If the split is
successful, it will keep extent from 0 to A as unwritten.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: dee1f973ca341c266229faa5a1a5bb268bed3531 Version: dee1f973ca341c266229faa5a1a5bb268bed3531 Version: dee1f973ca341c266229faa5a1a5bb268bed3531 Version: dee1f973ca341c266229faa5a1a5bb268bed3531 Version: dee1f973ca341c266229faa5a1a5bb268bed3531 Version: 814a7833df19e1de7447f870ae890adb12561627 Version: 4319fd00002630a761fa5559a086f11ed7623006 Version: e28b27be06c5e6a5236c0c0b370ca0768ab086bb Version: 3.2.33 ≤ Version: 3.4.16 ≤ Version: 3.6.4 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/extents.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "58ddae5d77b1db3a27b891c75a8fa120239ac092",
"status": "affected",
"version": "dee1f973ca341c266229faa5a1a5bb268bed3531",
"versionType": "git"
},
{
"lessThan": "d17857b4fb9ba5745b59be0ef38fd532991fccbf",
"status": "affected",
"version": "dee1f973ca341c266229faa5a1a5bb268bed3531",
"versionType": "git"
},
{
"lessThan": "d67c8ecf3d8fda9b8ef80e6f665d84b6d6ac9d88",
"status": "affected",
"version": "dee1f973ca341c266229faa5a1a5bb268bed3531",
"versionType": "git"
},
{
"lessThan": "7015fcf473796e1d2d876f241bd9e0c36f3d4eef",
"status": "affected",
"version": "dee1f973ca341c266229faa5a1a5bb268bed3531",
"versionType": "git"
},
{
"lessThan": "1bf6974822d1dba86cf11b5f05498581cf3488a2",
"status": "affected",
"version": "dee1f973ca341c266229faa5a1a5bb268bed3531",
"versionType": "git"
},
{
"status": "affected",
"version": "814a7833df19e1de7447f870ae890adb12561627",
"versionType": "git"
},
{
"status": "affected",
"version": "4319fd00002630a761fa5559a086f11ed7623006",
"versionType": "git"
},
{
"status": "affected",
"version": "e28b27be06c5e6a5236c0c0b370ca0768ab086bb",
"versionType": "git"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.33",
"versionType": "semver"
},
{
"lessThan": "3.5",
"status": "affected",
"version": "3.4.16",
"versionType": "semver"
},
{
"lessThan": "3.7",
"status": "affected",
"version": "3.6.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/extents.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: don\u0027t zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1\n\nWhen allocating initialized blocks from a large unwritten extent, or\nwhen splitting an unwritten extent during end I/O and converting it to\ninitialized, there is currently a potential issue of stale data if the\nextent needs to be split in the middle.\n\n 0 A B N\n [UUUUUUUUUUUU] U: unwritten extent\n [--DDDDDDDD--] D: valid data\n |\u003c- -\u003e| ----\u003e this range needs to be initialized\n\next4_split_extent() first try to split this extent at B with\nEXT4_EXT_DATA_ENTIRE_VALID1 and EXT4_EXT_MAY_ZEROOUT flag set, but\next4_split_extent_at() failed to split this extent due to temporary lack\nof space. It zeroout B to N and mark the entire extent from 0 to N\nas written.\n\n 0 A B N\n [WWWWWWWWWWWW] W: written extent\n [SSDDDDDDDDZZ] Z: zeroed, S: stale data\n\next4_split_extent() then try to split this extent at A with\nEXT4_EXT_DATA_VALID2 flag set. This time, it split successfully and left\na stale written extent from 0 to A.\n\n 0 A B N\n [WW|WWWWWWWWWW]\n [SS|DDDDDDDDZZ]\n\nFix this by pass EXT4_EXT_DATA_PARTIAL_VALID1 to ext4_split_extent_at()\nwhen splitting at B, don\u0027t convert the entire extent to written and left\nit as unwritten after zeroing out B to N. The remaining work is just\nlike the standard two-part split. ext4_split_extent() will pass the\nEXT4_EXT_DATA_VALID2 flag when it calls ext4_split_extent_at() for the\nsecond time, allowing it to properly handle the split. If the split is\nsuccessful, it will keep extent from 0 to A as unwritten."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-30T10:41:40.719Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/58ddae5d77b1db3a27b891c75a8fa120239ac092"
},
{
"url": "https://git.kernel.org/stable/c/d17857b4fb9ba5745b59be0ef38fd532991fccbf"
},
{
"url": "https://git.kernel.org/stable/c/d67c8ecf3d8fda9b8ef80e6f665d84b6d6ac9d88"
},
{
"url": "https://git.kernel.org/stable/c/7015fcf473796e1d2d876f241bd9e0c36f3d4eef"
},
{
"url": "https://git.kernel.org/stable/c/1bf6974822d1dba86cf11b5f05498581cf3488a2"
}
],
"title": "ext4: don\u0027t zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45858",
"datePublished": "2026-05-27T12:15:37.738Z",
"dateReserved": "2026-05-13T15:03:33.079Z",
"dateUpdated": "2026-05-30T10:41:40.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52904 (GCVE-0-2026-52904)
Vulnerability from cvelistv5
Published
2026-06-09 12:36
Modified
2026-06-14 18:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: fix nvkm_device leak on aperture removal failure
When aperture_remove_conflicting_pci_devices() fails during probe, the
error path returns directly without unwinding the nvkm_device that was
just allocated by nvkm_device_pci_new(). This leaks both the device
wrapper and the pci_enable_device() reference taken inside it.
Jump to the existing fail_nvkm label so nvkm_device_del() runs and
balances both. The leak was introduced when the intermediate
nvkm_device_del() between detection and aperture removal was dropped
in favor of creating the pci device once.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/nouveau/nouveau_drm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5edd564ccb002ffc830e7818c1c4a992db774678",
"status": "affected",
"version": "c0bfe34330b5fafdbbc63a7124841711651b96b9",
"versionType": "git"
},
{
"lessThan": "4404d7d2dda4f3cc84a8fb6ac5417a2afc3b22d6",
"status": "affected",
"version": "c0bfe34330b5fafdbbc63a7124841711651b96b9",
"versionType": "git"
},
{
"lessThan": "843c0247cf21364e33bb5a8ffc9af57107d04d05",
"status": "affected",
"version": "c0bfe34330b5fafdbbc63a7124841711651b96b9",
"versionType": "git"
},
{
"lessThan": "6597ff1d8de3f583be169587efeafd8af134e138",
"status": "affected",
"version": "c0bfe34330b5fafdbbc63a7124841711651b96b9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/nouveau/nouveau_drm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix nvkm_device leak on aperture removal failure\n\nWhen aperture_remove_conflicting_pci_devices() fails during probe, the\nerror path returns directly without unwinding the nvkm_device that was\njust allocated by nvkm_device_pci_new(). This leaks both the device\nwrapper and the pci_enable_device() reference taken inside it.\n\nJump to the existing fail_nvkm label so nvkm_device_del() runs and\nbalances both. The leak was introduced when the intermediate\nnvkm_device_del() between detection and aperture removal was dropped\nin favor of creating the pci device once."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:09:32.591Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5edd564ccb002ffc830e7818c1c4a992db774678"
},
{
"url": "https://git.kernel.org/stable/c/4404d7d2dda4f3cc84a8fb6ac5417a2afc3b22d6"
},
{
"url": "https://git.kernel.org/stable/c/843c0247cf21364e33bb5a8ffc9af57107d04d05"
},
{
"url": "https://git.kernel.org/stable/c/6597ff1d8de3f583be169587efeafd8af134e138"
}
],
"title": "drm/nouveau: fix nvkm_device leak on aperture removal failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52904",
"datePublished": "2026-06-09T12:36:01.237Z",
"dateReserved": "2026-06-09T07:44:35.366Z",
"dateUpdated": "2026-06-14T18:09:32.591Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46076 (GCVE-0-2026-46076)
Vulnerability from cvelistv5
Published
2026-05-27 12:58
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
Explicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want
to intercept VMMCALL, nested_svm_l2_tlb_flush_enabled() is true, and the
hypercall is something other than one of the supported Hyper-V hypercalls.
When all of the above conditions are met, KVM will intercept VMMCALL but
never forward it to L1, i.e. will let L2 make hypercalls as if it were L1.
The TLFS says a whole lot of nothing about this scenario, so go with the
architectural behavior, which says that VMMCALL #UDs if it's not
intercepted.
Opportunistically do a 2-for-1 stub trade by stub-ifying the new API
instead of the helpers it uses. The last remaining "single" stub will
soon be dropped as well.
[sean: rewrite changelog and comment, tag for stable, remove defunct stubs]
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/hyperv.h",
"arch/x86/kvm/svm/hyperv.h",
"arch/x86/kvm/svm/nested.c",
"arch/x86/kvm/svm/svm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "924d721fae95687acedbaf624a094ed0e8b67104",
"status": "affected",
"version": "3f4a812edf5cb0a50e65fbdfafdb3e688da18f16",
"versionType": "git"
},
{
"lessThan": "009c0f726abeaa67aad1d96b883bdce01d405ce2",
"status": "affected",
"version": "3f4a812edf5cb0a50e65fbdfafdb3e688da18f16",
"versionType": "git"
},
{
"lessThan": "5fb4a5f361565f5b629d8a8fe5288ce8463c5727",
"status": "affected",
"version": "3f4a812edf5cb0a50e65fbdfafdb3e688da18f16",
"versionType": "git"
},
{
"lessThan": "c36991c6f8d2ab56ee67aff04e3c357f45cfc76c",
"status": "affected",
"version": "3f4a812edf5cb0a50e65fbdfafdb3e688da18f16",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/hyperv.h",
"arch/x86/kvm/svm/hyperv.h",
"arch/x86/kvm/svm/nested.c",
"arch/x86/kvm/svm/svm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Raise #UD if unhandled VMMCALL isn\u0027t intercepted by L1\n\nExplicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want\nto intercept VMMCALL, nested_svm_l2_tlb_flush_enabled() is true, and the\nhypercall is something other than one of the supported Hyper-V hypercalls.\nWhen all of the above conditions are met, KVM will intercept VMMCALL but\nnever forward it to L1, i.e. will let L2 make hypercalls as if it were L1.\n\nThe TLFS says a whole lot of nothing about this scenario, so go with the\narchitectural behavior, which says that VMMCALL #UDs if it\u0027s not\nintercepted.\n\nOpportunistically do a 2-for-1 stub trade by stub-ifying the new API\ninstead of the helpers it uses. The last remaining \"single\" stub will\nsoon be dropped as well.\n\n[sean: rewrite changelog and comment, tag for stable, remove defunct stubs]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The path is reached by executing a VMMCALL instruction from within a nested (L2) guest running under KVM on AMD SVM; this is local execution against the hypervisor, not reachable via network, adjacent network, or physical interface.\nAC:L - Triggering is deterministic \u2014 once the nested setup exists (L1 does not intercept VMMCALL, e.g. relying on L0\u0027s Hyper-V direct L2 TLB-flush handling), a single VMMCALL in L2 reliably reaches L0\u0027s hypercall handler with no race or attacker-uncontrolled timing, mirroring sibling CVE-2026-43133.\nPR:L - The attacker must control a guest and run guest kernel-level (CPL0) code in the nested guest to set up and issue the hypercall; this is low privilege relative to the host and requires no real init-namespace root.\nUI:N - Exploitation is triggered solely by guest instruction execution (VMMCALL); no host-side or victim user action is required.\nS:C - The bug is in KVM\u0027s enforcement of the nested-virtualization boundary: L2\u0027s VMMCALL is serviced by L0 as if it were L1 instead of #UD\u0027ing, so an L2 guest\u0027s action reaches and affects L1/L0-maintained state outside the L2 guest\u0027s own security authority.\nC:L - The improperly-handled hypercalls cause L0 to read L1-context memory (guest-physical addresses supplied by L2 are interpreted in the L1/host-maintained address space) and inspect the vCPU\u0027s Hyper-V state \u2014 a bounded cross-domain exposure, not an arbitrary host read primitive.\nI:L - L2 can drive L0 hypercalls that modify L1/host-maintained state (inject IPIs into the VM\u0027s vCPUs, post SynIC messages/signal events, request GPA-range operations), a bounded cross-domain state modification rather than an arbitrary write or code-execution primitive.\nA:H - L2 can repeatedly issue these hypercalls to force TLB flushes, inject IPIs, and corrupt the L1 hypervisor\u0027s Hyper-V messaging state, destabilizing or hanging the affected nested-virtualization workload at will \u2014 a complete loss of availability for that workload."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:29.930Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/924d721fae95687acedbaf624a094ed0e8b67104"
},
{
"url": "https://git.kernel.org/stable/c/009c0f726abeaa67aad1d96b883bdce01d405ce2"
},
{
"url": "https://git.kernel.org/stable/c/5fb4a5f361565f5b629d8a8fe5288ce8463c5727"
},
{
"url": "https://git.kernel.org/stable/c/c36991c6f8d2ab56ee67aff04e3c357f45cfc76c"
}
],
"title": "KVM: nSVM: Raise #UD if unhandled VMMCALL isn\u0027t intercepted by L1",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46076",
"datePublished": "2026-05-27T12:58:09.169Z",
"dateReserved": "2026-05-13T15:03:33.096Z",
"dateUpdated": "2026-08-05T12:29:29.930Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31502 (GCVE-0-2026-31502)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-08-05 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
team: fix header_ops type confusion with non-Ethernet ports
Similar to commit 950803f72547 ("bonding: fix type confusion in
bond_setup_by_slave()") team has the same class of header_ops type
confusion.
For non-Ethernet ports, team_setup_by_port() copies port_dev->header_ops
directly. When the team device later calls dev_hard_header() or
dev_parse_header(), these callbacks can run with the team net_device
instead of the real lower device, so netdev_priv(dev) is interpreted as
the wrong private type and can crash.
The syzbot report shows a crash in bond_header_create(), but the root
cause is in team: the topology is gre -> bond -> team, and team calls
the inherited header_ops with its own net_device instead of the lower
device, so bond_header_create() receives a team device and interprets
netdev_priv() as bonding private data, causing a type confusion crash.
Fix this by introducing team header_ops wrappers for create/parse,
selecting a team port under RCU, and calling the lower device callbacks
with port->dev, so each callback always sees the correct net_device
context.
Also pass the selected lower device to the lower parse callback, so
recursion is bounded in stacked non-Ethernet topologies and parse
callbacks always run with the correct device context.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/team/team_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53",
"status": "affected",
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"versionType": "git"
},
{
"lessThan": "6d3161fa3eee64d46b766fb0db33ec7f300ef52d",
"status": "affected",
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"versionType": "git"
},
{
"lessThan": "0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0",
"status": "affected",
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"versionType": "git"
},
{
"lessThan": "20491d384d973a63fbdaf7a71e38d69b0659ea55",
"status": "affected",
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"versionType": "git"
},
{
"lessThan": "425000dbf17373a4ab8be9428f5dc055ef870a56",
"status": "affected",
"version": "1d76efe1577b4323609b1bcbfafa8b731eda071a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/team/team_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nteam: fix header_ops type confusion with non-Ethernet ports\n\nSimilar to commit 950803f72547 (\"bonding: fix type confusion in\nbond_setup_by_slave()\") team has the same class of header_ops type\nconfusion.\n\nFor non-Ethernet ports, team_setup_by_port() copies port_dev-\u003eheader_ops\ndirectly. When the team device later calls dev_hard_header() or\ndev_parse_header(), these callbacks can run with the team net_device\ninstead of the real lower device, so netdev_priv(dev) is interpreted as\nthe wrong private type and can crash.\n\nThe syzbot report shows a crash in bond_header_create(), but the root\ncause is in team: the topology is gre -\u003e bond -\u003e team, and team calls\nthe inherited header_ops with its own net_device instead of the lower\ndevice, so bond_header_create() receives a team device and interprets\nnetdev_priv() as bonding private data, causing a type confusion crash.\n\nFix this by introducing team header_ops wrappers for create/parse,\nselecting a team port under RCU, and calling the lower device callbacks\nwith port-\u003edev, so each callback always sees the correct net_device\ncontext.\n\nAlso pass the selected lower device to the lower parse callback, so\nrecursion is bounded in stacked non-Ethernet topologies and parse\ncallbacks always run with the correct device context."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An attacker reaches the vulnerable team header_ops path by locally creating/enslaving network devices through rtnetlink and then triggering dev_hard_header()/dev_parse_header() via local packet/socket or network-stack activity on the malformed team device. The required setup is a local kernel networking configuration path rather than an unauthenticated packet-processing path.\nAC:L - The vulnerable topology, such as GRE -\u003e bond -\u003e team, is fully attacker-controlled once the required namespace capabilities are available, and triggering the bad callback is deterministic. There is no race or external timing condition required.\nPR:L - Creating team/bond/GRE devices and enslaving them requires CAP_NET_ADMIN, and packet sockets require CAP_NET_RAW, but both are available to an unprivileged user inside a user and network namespace on systems permitting unprivileged user namespaces. This is therefore low privileges, not real init-namespace root.\nUI:N - No victim interaction is required after the attacker has local access and namespace capabilities. The attacker can configure the devices and trigger the callback directly.\nS:U - The impact is within the same kernel security authority. This is a kernel crash/type-confusion or privilege-impact issue, not a VM escape or cross-scope boundary violation.\nC:H - The bug is a header_ops type confusion where callbacks interpret team private data as another subsystem\u0027s private structure, causing attacker-influenced kernel pointer dereferences and potential kernel memory exposure. Following the higher-severity rule for type confusion, confidentiality impact is high.\nI:H - Type confusion in kernel callback dispatch can lead to misinterpreted object pointers and potentially control-flow or write-primitive exploitation beyond the observed crash. Kernel type confusion is scored as high integrity impact.\nA:H - The reported and expected failure mode is a kernel oops/BUG/crash when the inherited callback uses the wrong net_device private layout. This gives high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:23:05.931Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/420e5aad7ba89e8f79e2dc8327b0c0c24c1c1d53"
},
{
"url": "https://git.kernel.org/stable/c/6d3161fa3eee64d46b766fb0db33ec7f300ef52d"
},
{
"url": "https://git.kernel.org/stable/c/0a7468ed49a6b65d34abcc6eb60e15f7f6d34da0"
},
{
"url": "https://git.kernel.org/stable/c/20491d384d973a63fbdaf7a71e38d69b0659ea55"
},
{
"url": "https://git.kernel.org/stable/c/425000dbf17373a4ab8be9428f5dc055ef870a56"
}
],
"title": "team: fix header_ops type confusion with non-Ethernet ports",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31502",
"datePublished": "2026-04-22T13:54:22.481Z",
"dateReserved": "2026-03-09T15:48:24.104Z",
"dateUpdated": "2026-08-05T12:23:05.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43061 (GCVE-0-2026-43061)
Vulnerability from cvelistv5
Published
2026-05-05 15:17
Modified
2026-05-23 16:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
serial: 8250: Fix TX deadlock when using DMA
`dmaengine_terminate_async` does not guarantee that the
`__dma_tx_complete` callback will run. The callback is currently the
only place where `dma->tx_running` gets cleared. If the transaction is
canceled and the callback never runs, then `dma->tx_running` will never
get cleared and we will never schedule new TX DMA transactions again.
This change makes it so we clear `dma->tx_running` after we terminate
the DMA transaction. This is "safe" because `serial8250_tx_dma_flush`
is holding the UART port lock. The first thing the callback does is also
grab the UART port lock, so access to `dma->tx_running` is serialized.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7c47e637dfadfbc691dd297b91d81ef939ca2080 Version: bf3f395b9c37956eca866c9e1679769ed7dcce68 Version: d470522c597b73e63cca04f3012aec28185113b7 Version: 5e00346deb7bf40a4cf70e3716ac8e9a2409eb55 Version: c8a52c772c7c6de72257a435bcad03d3bb914a70 Version: 9e512eaaf8f4008c44ede3dfc0fbc9d9c5118583 Version: 9e512eaaf8f4008c44ede3dfc0fbc9d9c5118583 Version: 9e512eaaf8f4008c44ede3dfc0fbc9d9c5118583 Version: bbec5998d7bd349730f59c959a8b00cfff816e34 Version: 59f751db7f392fa7a58cbd972205982f7f4f5854 Version: 5.10.235 ≤ Version: 5.15.179 ≤ Version: 6.1.129 ≤ Version: 6.6.79 ≤ Version: 6.12.16 ≤ Version: 5.4.291 ≤ Version: 6.13.4 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/8250/8250_dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8190f9ab6ad90cb97652adbebd238b874a4ef70d",
"status": "affected",
"version": "7c47e637dfadfbc691dd297b91d81ef939ca2080",
"versionType": "git"
},
{
"lessThan": "79a19bd936bb35f56ef0ccab1b3b59ebce8c762d",
"status": "affected",
"version": "bf3f395b9c37956eca866c9e1679769ed7dcce68",
"versionType": "git"
},
{
"lessThan": "f76d91271bcacbd759a2e4ee3ea61faa6a727ccf",
"status": "affected",
"version": "d470522c597b73e63cca04f3012aec28185113b7",
"versionType": "git"
},
{
"lessThan": "d2719a0a9c3439abf67843a5504b7afccd9ded93",
"status": "affected",
"version": "5e00346deb7bf40a4cf70e3716ac8e9a2409eb55",
"versionType": "git"
},
{
"lessThan": "2a72403b985aea6b4aac3171830492f9a387f9e1",
"status": "affected",
"version": "c8a52c772c7c6de72257a435bcad03d3bb914a70",
"versionType": "git"
},
{
"lessThan": "5f6b17562f03fc65c7d3474ef8f1959b19d1ca41",
"status": "affected",
"version": "9e512eaaf8f4008c44ede3dfc0fbc9d9c5118583",
"versionType": "git"
},
{
"lessThan": "b5ad887339503103d0fbe9827b16ad287597c275",
"status": "affected",
"version": "9e512eaaf8f4008c44ede3dfc0fbc9d9c5118583",
"versionType": "git"
},
{
"lessThan": "a424a34b8faddf97b5af41689087e7a230f79ba7",
"status": "affected",
"version": "9e512eaaf8f4008c44ede3dfc0fbc9d9c5118583",
"versionType": "git"
},
{
"status": "affected",
"version": "bbec5998d7bd349730f59c959a8b00cfff816e34",
"versionType": "git"
},
{
"status": "affected",
"version": "59f751db7f392fa7a58cbd972205982f7f4f5854",
"versionType": "git"
},
{
"lessThan": "5.10.253",
"status": "affected",
"version": "5.10.235",
"versionType": "semver"
},
{
"lessThan": "5.15.203",
"status": "affected",
"version": "5.15.179",
"versionType": "semver"
},
{
"lessThan": "6.1.167",
"status": "affected",
"version": "6.1.129",
"versionType": "semver"
},
{
"lessThan": "6.6.130",
"status": "affected",
"version": "6.6.79",
"versionType": "semver"
},
{
"lessThan": "6.12.78",
"status": "affected",
"version": "6.12.16",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.291",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/8250/8250_dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.10.235",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.15.179",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "6.1.129",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.6.79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.12.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.291",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250: Fix TX deadlock when using DMA\n\n`dmaengine_terminate_async` does not guarantee that the\n`__dma_tx_complete` callback will run. The callback is currently the\nonly place where `dma-\u003etx_running` gets cleared. If the transaction is\ncanceled and the callback never runs, then `dma-\u003etx_running` will never\nget cleared and we will never schedule new TX DMA transactions again.\n\nThis change makes it so we clear `dma-\u003etx_running` after we terminate\nthe DMA transaction. This is \"safe\" because `serial8250_tx_dma_flush`\nis holding the UART port lock. The first thing the callback does is also\ngrab the UART port lock, so access to `dma-\u003etx_running` is serialized."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:06:10.956Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8190f9ab6ad90cb97652adbebd238b874a4ef70d"
},
{
"url": "https://git.kernel.org/stable/c/79a19bd936bb35f56ef0ccab1b3b59ebce8c762d"
},
{
"url": "https://git.kernel.org/stable/c/f76d91271bcacbd759a2e4ee3ea61faa6a727ccf"
},
{
"url": "https://git.kernel.org/stable/c/d2719a0a9c3439abf67843a5504b7afccd9ded93"
},
{
"url": "https://git.kernel.org/stable/c/2a72403b985aea6b4aac3171830492f9a387f9e1"
},
{
"url": "https://git.kernel.org/stable/c/5f6b17562f03fc65c7d3474ef8f1959b19d1ca41"
},
{
"url": "https://git.kernel.org/stable/c/b5ad887339503103d0fbe9827b16ad287597c275"
},
{
"url": "https://git.kernel.org/stable/c/a424a34b8faddf97b5af41689087e7a230f79ba7"
}
],
"title": "serial: 8250: Fix TX deadlock when using DMA",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43061",
"datePublished": "2026-05-05T15:17:27.079Z",
"dateReserved": "2026-05-01T14:12:55.981Z",
"dateUpdated": "2026-05-23T16:06:10.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46227 (GCVE-0-2026-46227)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-08-25 12:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with
list_for_each_entry_safe(), which caches the next entry in @tmp before
the loop body runs. The body calls sctp_sendmsg_to_asoc(), which may
drop the socket lock inside sctp_wait_for_sndbuf().
While the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the
association cached in @tmp, migrating it to a new endpoint via
sctp_sock_migrate() (list_del_init() + list_add_tail() to
newep->asocs), and optionally close the new socket which frees the
association via kfree_rcu(). The cached @tmp can also be freed by a
network ABORT for that association, processed in softirq while the
lock is dropped.
sctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock
via the "sk != asoc->base.sk" and "asoc->base.dead" checks, but nothing
revalidates @tmp. After a successful return, the iterator advances to
the stale @tmp, yielding either a use-after-free (if the peeled socket
was closed) or a list-walk onto the new endpoint's list head (type
confusion of &newep->asocs as a struct sctp_association *).
Both are reachable from CapEff=0; the type-confusion path gives
controlled indirect call via the outqueue.sched->init_sid pointer.
Fix by re-deriving @tmp from @asoc after sctp_sendmsg_to_asoc()
returns. @asoc is known to still be on ep->asocs at that point: the
only callers that list_del an association from ep->asocs are
sctp_association_free() (which sets asoc->base.dead) and
sctp_assoc_migrate() (which changes asoc->base.sk), and
sctp_wait_for_sndbuf() checks both under the lock before any
successful return; a tripped check propagates as err < 0 and the loop
bails before the re-derive.
The SCTP_ABORT path in sctp_sendmsg_check_sflags() returns 0 and the
loop hits 'continue' before sctp_sendmsg_to_asoc() is ever called, so
the @tmp cached by list_for_each_entry_safe() still covers the
lock-held free that ba59fb027307 ("sctp: walk the list of asoc
safely") was added for.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4910280503f3af2857d5aa77e35b22d93a8960a8 Version: 4910280503f3af2857d5aa77e35b22d93a8960a8 Version: 4910280503f3af2857d5aa77e35b22d93a8960a8 Version: 4910280503f3af2857d5aa77e35b22d93a8960a8 Version: 4910280503f3af2857d5aa77e35b22d93a8960a8 Version: 4910280503f3af2857d5aa77e35b22d93a8960a8 Version: 4910280503f3af2857d5aa77e35b22d93a8960a8 Version: 4910280503f3af2857d5aa77e35b22d93a8960a8 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.32.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.82.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.140.1.rt7.481.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.140.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.194.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.194.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.198.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.198.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.147.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.147.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.22.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.176.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.176.1.rt14.461.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.132.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.125.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Stream Control Transmission Protocol (SCTP) implementation. A race condition exists in the `SCTP_SENDALL` path where a cached list entry is not properly revalidated after the socket lock is temporarily released. This allows a local attacker or a remote attacker (via a network abort) to trigger a use-after-free or type confusion vulnerability. Successful exploitation can lead to a controlled indirect call, potentially resulting in arbitrary code execution."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T12:05:41.607Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-46227"
},
{
"name": "RHBZ#2482564",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482564"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46227.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27731"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36956"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26515"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27735"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34094"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36018"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59143"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36349"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59146"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26535"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33899"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26563"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59142"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59147"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59145"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59148"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59149"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36348"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26462"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:27731: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:36956: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:26515: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:27735: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:34094: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:36018: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:59143: Red Hat Enterprise Linux BaseOS (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:36349: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:59146: Red Hat Enterprise Linux BaseOS (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:26535: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:33899: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:26563: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:59142: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:59147: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:59145: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:59148: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:59149: Red Hat Enterprise Linux BaseOS (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:36348: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:26462: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-28T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-28T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, prevent module sctp from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f3a3f0b406b4b7eb3cea35a23fa2bf170848b104",
"status": "affected",
"version": "4910280503f3af2857d5aa77e35b22d93a8960a8",
"versionType": "git"
},
{
"lessThan": "0dbc8cde64280fc37cdd678cced34eaf96cfb197",
"status": "affected",
"version": "4910280503f3af2857d5aa77e35b22d93a8960a8",
"versionType": "git"
},
{
"lessThan": "0c7b55974f97b78d1109025eadf084e74cbf330f",
"status": "affected",
"version": "4910280503f3af2857d5aa77e35b22d93a8960a8",
"versionType": "git"
},
{
"lessThan": "1bfb06ecb00f7fdf35dba8e8f2877346cbe5e078",
"status": "affected",
"version": "4910280503f3af2857d5aa77e35b22d93a8960a8",
"versionType": "git"
},
{
"lessThan": "6187a172d6ed57d6b2c327836e4407c6456e639d",
"status": "affected",
"version": "4910280503f3af2857d5aa77e35b22d93a8960a8",
"versionType": "git"
},
{
"lessThan": "c9dadb31f36045a8cb65df4bd75e7237ef21a4b5",
"status": "affected",
"version": "4910280503f3af2857d5aa77e35b22d93a8960a8",
"versionType": "git"
},
{
"lessThan": "bf0f40d8107e2ce827521968dc6926f3e13728ae",
"status": "affected",
"version": "4910280503f3af2857d5aa77e35b22d93a8960a8",
"versionType": "git"
},
{
"lessThan": "abb5f36771cc4c05899b34000829a787572a8817",
"status": "affected",
"version": "4910280503f3af2857d5aa77e35b22d93a8960a8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL\n\nThe SCTP_SENDALL path in sctp_sendmsg() iterates ep-\u003easocs with\nlist_for_each_entry_safe(), which caches the next entry in @tmp before\nthe loop body runs. The body calls sctp_sendmsg_to_asoc(), which may\ndrop the socket lock inside sctp_wait_for_sndbuf().\n\nWhile the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the\nassociation cached in @tmp, migrating it to a new endpoint via\nsctp_sock_migrate() (list_del_init() + list_add_tail() to\nnewep-\u003easocs), and optionally close the new socket which frees the\nassociation via kfree_rcu(). The cached @tmp can also be freed by a\nnetwork ABORT for that association, processed in softirq while the\nlock is dropped.\n\nsctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock\nvia the \"sk != asoc-\u003ebase.sk\" and \"asoc-\u003ebase.dead\" checks, but nothing\nrevalidates @tmp. After a successful return, the iterator advances to\nthe stale @tmp, yielding either a use-after-free (if the peeled socket\nwas closed) or a list-walk onto the new endpoint\u0027s list head (type\nconfusion of \u0026newep-\u003easocs as a struct sctp_association *).\n\nBoth are reachable from CapEff=0; the type-confusion path gives\ncontrolled indirect call via the outqueue.sched-\u003einit_sid pointer.\n\nFix by re-deriving @tmp from @asoc after sctp_sendmsg_to_asoc()\nreturns. @asoc is known to still be on ep-\u003easocs at that point: the\nonly callers that list_del an association from ep-\u003easocs are\nsctp_association_free() (which sets asoc-\u003ebase.dead) and\nsctp_assoc_migrate() (which changes asoc-\u003ebase.sk), and\nsctp_wait_for_sndbuf() checks both under the lock before any\nsuccessful return; a tripped check propagates as err \u003c 0 and the loop\nbails before the re-derive.\n\nThe SCTP_ABORT path in sctp_sendmsg_check_sflags() returns 0 and the\nloop hits \u0027continue\u0027 before sctp_sendmsg_to_asoc() is ever called, so\nthe @tmp cached by list_for_each_entry_safe() still covers the\nlock-held free that ba59fb027307 (\"sctp: walk the list of asoc\nsafely\") was added for."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached via the sendmsg() syscall on a local SCTP socket, and the racing operation (SCTP_SOCKOPT_PEELOFF + close) is likewise a local syscall; no remote packet directly reaches the bug, so local access is required.\nAC:L - The attacker controls both sides of the race \u2014 shrinking SO_SNDBUF on its own socket reliably forces sctp_wait_for_sndbuf() to drop the lock and sleep, while a second thread peels off and closes the cached next association; per guidance an attacker-controlled race is Low.\nPR:L - The commit states both the UAF and type-confusion paths are \"reachable from CapEff=0\"; creating SCTP sockets and using sendmsg/PEELOFF requires no privileges, only a basic unprivileged local user.\nUI:N - The attacker performs all sendmsg, peeloff, and close operations itself; no victim action is required.\nS:U - The corruption (UAF / type confusion) stays within the kernel\u0027s own security authority and does not cross into a separate domain such as a VM host or IOMMU boundary.\nC:H - The use-after-free gives the attacker control over freed object contents and the type confusion reinterprets a list head as an association, both of which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The type-confusion path yields a controlled indirect call via the outqueue.sched-\u003einit_sid function pointer, providing a control-flow hijack / arbitrary-write-grade primitive for privilege escalation.\nA:H - Both the use-after-free and the type-confusion list walk readily cause kernel oops/panic, giving full availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:36.059Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f3a3f0b406b4b7eb3cea35a23fa2bf170848b104"
},
{
"url": "https://git.kernel.org/stable/c/0dbc8cde64280fc37cdd678cced34eaf96cfb197"
},
{
"url": "https://git.kernel.org/stable/c/0c7b55974f97b78d1109025eadf084e74cbf330f"
},
{
"url": "https://git.kernel.org/stable/c/1bfb06ecb00f7fdf35dba8e8f2877346cbe5e078"
},
{
"url": "https://git.kernel.org/stable/c/6187a172d6ed57d6b2c327836e4407c6456e639d"
},
{
"url": "https://git.kernel.org/stable/c/c9dadb31f36045a8cb65df4bd75e7237ef21a4b5"
},
{
"url": "https://git.kernel.org/stable/c/bf0f40d8107e2ce827521968dc6926f3e13728ae"
},
{
"url": "https://git.kernel.org/stable/c/abb5f36771cc4c05899b34000829a787572a8817"
}
],
"title": "sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46227",
"datePublished": "2026-05-28T09:40:47.518Z",
"dateReserved": "2026-05-13T15:03:33.106Z",
"dateUpdated": "2026-08-25T12:05:41.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43406 (GCVE-0-2026-43406)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: prevent potential out-of-bounds reads in process_message_header()
If the message frame is (maliciously) corrupted in a way that the
length of the control segment ends up being less than the size of the
message header or a different frame is made to look like a message
frame, out-of-bounds reads may ensue in process_message_header().
Perform an explicit bounds check before decoding the message header.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cd1a677cad994021b19665ed476aea63f5d54f31 Version: cd1a677cad994021b19665ed476aea63f5d54f31 Version: cd1a677cad994021b19665ed476aea63f5d54f31 Version: cd1a677cad994021b19665ed476aea63f5d54f31 Version: cd1a677cad994021b19665ed476aea63f5d54f31 Version: cd1a677cad994021b19665ed476aea63f5d54f31 Version: cd1a677cad994021b19665ed476aea63f5d54f31 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/messenger_v2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "76ccf21a12c5f6d6790bc32c7da82446d877b2f4",
"status": "affected",
"version": "cd1a677cad994021b19665ed476aea63f5d54f31",
"versionType": "git"
},
{
"lessThan": "75582aaa580c11aed4c7731cad6b068b700e7efb",
"status": "affected",
"version": "cd1a677cad994021b19665ed476aea63f5d54f31",
"versionType": "git"
},
{
"lessThan": "50156622eb0888e62541d715a98584480a1bc7cb",
"status": "affected",
"version": "cd1a677cad994021b19665ed476aea63f5d54f31",
"versionType": "git"
},
{
"lessThan": "dbd857a9e1e33ea71eaf3e211877027e533770d1",
"status": "affected",
"version": "cd1a677cad994021b19665ed476aea63f5d54f31",
"versionType": "git"
},
{
"lessThan": "69fe5af33fa3806f398d21c081d73c66e5523bc2",
"status": "affected",
"version": "cd1a677cad994021b19665ed476aea63f5d54f31",
"versionType": "git"
},
{
"lessThan": "035867ae6f18df0aeedb2a57a5b74091bd4e3fe8",
"status": "affected",
"version": "cd1a677cad994021b19665ed476aea63f5d54f31",
"versionType": "git"
},
{
"lessThan": "69fb5d91bba44ecf7eb80530b85fa4fb028921d5",
"status": "affected",
"version": "cd1a677cad994021b19665ed476aea63f5d54f31",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/messenger_v2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: prevent potential out-of-bounds reads in process_message_header()\n\nIf the message frame is (maliciously) corrupted in a way that the\nlength of the control segment ends up being less than the size of the\nmessage header or a different frame is made to look like a message\nframe, out-of-bounds reads may ensue in process_message_header().\n\nPerform an explicit bounds check before decoding the message header."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable libceph messenger v2 path is reached by TCP data received from a Ceph peer, and the reproducer triggers it over the network against a kernel Ceph client.\nAC:L - The bug is deterministic: a peer sends a FRAME_TAG_MESSAGE frame with a control segment shorter than struct ceph_msg_header2 in msgr2 crc/non-secure mode. No race or attacker-uncontrolled timing condition is required.\nPR:N - The vulnerable read can occur during CEPH_CON_S_V2_HELLO or CEPH_CON_S_V2_AUTH before credentials are verified, so the network peer does not need authenticated privileges.\nUI:N - In a reasonable deployment with an already configured or reconnecting Ceph client, a malicious or spoofed Ceph peer can send the frame without further victim action.\nS:U - The impact is within the kernel/libceph client security scope and does not cross a VM, IOMMU, or other separate security authority boundary.\nC:H - The flaw is a slab out-of-bounds read of attacker-triggered kernel memory beyond a too-small control buffer. Following the required guidance, an out-of-bounds read that is not strictly limited to only a few bytes is scored High for confidentiality.\nI:N - The defect is an out-of-bounds read, and the investigated path does not provide an out-of-bounds write, memory corruption, or authenticated message dispatch that would directly modify data.\nA:H - The malformed network frame deterministically triggers a KASAN-detected slab out-of-bounds access in the ceph-msgr workqueue and can fault/disrupt the Ceph client connection. Repeated unauthenticated triggering can deny availability of kernel Ceph storage access."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:49.364Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/76ccf21a12c5f6d6790bc32c7da82446d877b2f4"
},
{
"url": "https://git.kernel.org/stable/c/75582aaa580c11aed4c7731cad6b068b700e7efb"
},
{
"url": "https://git.kernel.org/stable/c/50156622eb0888e62541d715a98584480a1bc7cb"
},
{
"url": "https://git.kernel.org/stable/c/dbd857a9e1e33ea71eaf3e211877027e533770d1"
},
{
"url": "https://git.kernel.org/stable/c/69fe5af33fa3806f398d21c081d73c66e5523bc2"
},
{
"url": "https://git.kernel.org/stable/c/035867ae6f18df0aeedb2a57a5b74091bd4e3fe8"
},
{
"url": "https://git.kernel.org/stable/c/69fb5d91bba44ecf7eb80530b85fa4fb028921d5"
}
],
"title": "libceph: prevent potential out-of-bounds reads in process_message_header()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43406",
"datePublished": "2026-05-08T14:21:46.246Z",
"dateReserved": "2026-05-01T14:12:56.007Z",
"dateUpdated": "2026-08-05T12:27:49.364Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43492 (GCVE-0-2026-43492)
Vulnerability from cvelistv5
Published
2026-05-19 10:44
Modified
2026-06-19 11:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()
Yiming reports an integer underflow in mpi_read_raw_from_sgl() when
subtracting "lzeros" from the unsigned "nbytes".
For this to happen, the scatterlist "sgl" needs to occupy more bytes
than the "nbytes" parameter and the first "nbytes + 1" bytes of the
scatterlist must be zero. Under these conditions, the while loop
iterating over the scatterlist will count more zeroes than "nbytes",
subtract the number of zeroes from "nbytes" and cause the underflow.
When commit 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers") originally
introduced the bug, it couldn't be triggered because all callers of
mpi_read_raw_from_sgl() passed a scatterlist whose length was equal to
"nbytes".
However since commit 63ba4d67594a ("KEYS: asymmetric: Use new crypto
interface without scatterlists"), the underflow can now actually be
triggered. When invoking a KEYCTL_PKEY_ENCRYPT system call with a
larger "out_len" than "in_len" and filling the "in" buffer with zeroes,
crypto_akcipher_sync_prep() will create an all-zero scatterlist used for
both the "src" and "dst" member of struct akcipher_request and thereby
fulfil the conditions to trigger the bug:
sys_keyctl()
keyctl_pkey_e_d_s()
asymmetric_key_eds_op()
software_key_eds_op()
crypto_akcipher_sync_encrypt()
crypto_akcipher_sync_prep()
crypto_akcipher_encrypt()
rsa_enc()
mpi_read_raw_from_sgl()
To the user this will be visible as a DoS as the kernel spins forever,
causing soft lockup splats as a side effect.
Fix it.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2d4d1eea540b27c72488fd1914674c42473d53df Version: 2d4d1eea540b27c72488fd1914674c42473d53df Version: 2d4d1eea540b27c72488fd1914674c42473d53df Version: 2d4d1eea540b27c72488fd1914674c42473d53df Version: 2d4d1eea540b27c72488fd1914674c42473d53df Version: 2d4d1eea540b27c72488fd1914674c42473d53df Version: 2d4d1eea540b27c72488fd1914674c42473d53df Version: 2d4d1eea540b27c72488fd1914674c42473d53df |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"lib/crypto/mpi/mpicoder.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a1793a48881ec8d26e9c79b0ee65753f1c6846a4",
"status": "affected",
"version": "2d4d1eea540b27c72488fd1914674c42473d53df",
"versionType": "git"
},
{
"lessThan": "1abd50fc3cfa16fc2074a3c8c2729c50fd9d7043",
"status": "affected",
"version": "2d4d1eea540b27c72488fd1914674c42473d53df",
"versionType": "git"
},
{
"lessThan": "6d63615c796c085b4984e3031b9fa77fffb47360",
"status": "affected",
"version": "2d4d1eea540b27c72488fd1914674c42473d53df",
"versionType": "git"
},
{
"lessThan": "2aa77a18dc7f2670497fe3ee5acbeda0b57659e5",
"status": "affected",
"version": "2d4d1eea540b27c72488fd1914674c42473d53df",
"versionType": "git"
},
{
"lessThan": "26d3a97ad46c7a9226ec04d4bf35bd4998a97d16",
"status": "affected",
"version": "2d4d1eea540b27c72488fd1914674c42473d53df",
"versionType": "git"
},
{
"lessThan": "8637dfb4c1d8a7026ef681f2477c6de8b71c4003",
"status": "affected",
"version": "2d4d1eea540b27c72488fd1914674c42473d53df",
"versionType": "git"
},
{
"lessThan": "30e513e755bb381afce6fb57cdc8694136193f22",
"status": "affected",
"version": "2d4d1eea540b27c72488fd1914674c42473d53df",
"versionType": "git"
},
{
"lessThan": "8c2f1288250a90a4b5cabed5d888d7e3aeed4035",
"status": "affected",
"version": "2d4d1eea540b27c72488fd1914674c42473d53df",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"lib/crypto/mpi/mpicoder.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()\n\nYiming reports an integer underflow in mpi_read_raw_from_sgl() when\nsubtracting \"lzeros\" from the unsigned \"nbytes\".\n\nFor this to happen, the scatterlist \"sgl\" needs to occupy more bytes\nthan the \"nbytes\" parameter and the first \"nbytes + 1\" bytes of the\nscatterlist must be zero. Under these conditions, the while loop\niterating over the scatterlist will count more zeroes than \"nbytes\",\nsubtract the number of zeroes from \"nbytes\" and cause the underflow.\n\nWhen commit 2d4d1eea540b (\"lib/mpi: Add mpi sgl helpers\") originally\nintroduced the bug, it couldn\u0027t be triggered because all callers of\nmpi_read_raw_from_sgl() passed a scatterlist whose length was equal to\n\"nbytes\".\n\nHowever since commit 63ba4d67594a (\"KEYS: asymmetric: Use new crypto\ninterface without scatterlists\"), the underflow can now actually be\ntriggered. When invoking a KEYCTL_PKEY_ENCRYPT system call with a\nlarger \"out_len\" than \"in_len\" and filling the \"in\" buffer with zeroes,\ncrypto_akcipher_sync_prep() will create an all-zero scatterlist used for\nboth the \"src\" and \"dst\" member of struct akcipher_request and thereby\nfulfil the conditions to trigger the bug:\n\n sys_keyctl()\n keyctl_pkey_e_d_s()\n asymmetric_key_eds_op()\n software_key_eds_op()\n crypto_akcipher_sync_encrypt()\n crypto_akcipher_sync_prep()\n crypto_akcipher_encrypt()\n rsa_enc()\n mpi_read_raw_from_sgl()\n\nTo the user this will be visible as a DoS as the kernel spins forever,\ncausing soft lockup splats as a side effect.\n\nFix it."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-19T11:58:38.782Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a1793a48881ec8d26e9c79b0ee65753f1c6846a4"
},
{
"url": "https://git.kernel.org/stable/c/1abd50fc3cfa16fc2074a3c8c2729c50fd9d7043"
},
{
"url": "https://git.kernel.org/stable/c/6d63615c796c085b4984e3031b9fa77fffb47360"
},
{
"url": "https://git.kernel.org/stable/c/2aa77a18dc7f2670497fe3ee5acbeda0b57659e5"
},
{
"url": "https://git.kernel.org/stable/c/26d3a97ad46c7a9226ec04d4bf35bd4998a97d16"
},
{
"url": "https://git.kernel.org/stable/c/8637dfb4c1d8a7026ef681f2477c6de8b71c4003"
},
{
"url": "https://git.kernel.org/stable/c/30e513e755bb381afce6fb57cdc8694136193f22"
},
{
"url": "https://git.kernel.org/stable/c/8c2f1288250a90a4b5cabed5d888d7e3aeed4035"
}
],
"title": "lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43492",
"datePublished": "2026-05-19T10:44:24.719Z",
"dateReserved": "2026-05-01T14:12:56.013Z",
"dateUpdated": "2026-06-19T11:58:38.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31670 (GCVE-0-2026-31670)
Vulnerability from cvelistv5
Published
2026-04-24 14:45
Modified
2026-07-14 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: rfkill: prevent unlimited numbers of rfkill events from being created
Userspace can create an unlimited number of rfkill events if the system
is so configured, while not consuming them from the rfkill file
descriptor, causing a potential out of memory situation. Prevent this
from bounding the number of pending rfkill events at a "large" number
(i.e. 1000) to prevent abuses like this.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c64fb01627e24725d1f9d535e4426475a4415753 Version: c64fb01627e24725d1f9d535e4426475a4415753 Version: c64fb01627e24725d1f9d535e4426475a4415753 Version: c64fb01627e24725d1f9d535e4426475a4415753 Version: c64fb01627e24725d1f9d535e4426475a4415753 Version: c64fb01627e24725d1f9d535e4426475a4415753 Version: c64fb01627e24725d1f9d535e4426475a4415753 Version: c64fb01627e24725d1f9d535e4426475a4415753 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:36.456Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rfkill/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4bcd1615a4e2a185ae9edd27b4143d7dfa7134f4",
"status": "affected",
"version": "c64fb01627e24725d1f9d535e4426475a4415753",
"versionType": "git"
},
{
"lessThan": "b1e0c8d3ab58a0161db487bf5fc47adfcaf5d5ca",
"status": "affected",
"version": "c64fb01627e24725d1f9d535e4426475a4415753",
"versionType": "git"
},
{
"lessThan": "e3842779547c83150569071d9980517cc9029fc0",
"status": "affected",
"version": "c64fb01627e24725d1f9d535e4426475a4415753",
"versionType": "git"
},
{
"lessThan": "673d2a3eef6e0ee9736501a150c9e4024a4e60a6",
"status": "affected",
"version": "c64fb01627e24725d1f9d535e4426475a4415753",
"versionType": "git"
},
{
"lessThan": "82843afc19012a29ba863961ef494165aa1a88f4",
"status": "affected",
"version": "c64fb01627e24725d1f9d535e4426475a4415753",
"versionType": "git"
},
{
"lessThan": "a8c26800e0220e1550af012f5a20e50f5c78864d",
"status": "affected",
"version": "c64fb01627e24725d1f9d535e4426475a4415753",
"versionType": "git"
},
{
"lessThan": "80ce4cb026f0a4c4532b6cad827b44debda6256a",
"status": "affected",
"version": "c64fb01627e24725d1f9d535e4426475a4415753",
"versionType": "git"
},
{
"lessThan": "ea245d78dec594372e27d8c79616baf49e98a4a1",
"status": "affected",
"version": "c64fb01627e24725d1f9d535e4426475a4415753",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rfkill/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.169",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.135",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.169",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.135",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.82",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rfkill: prevent unlimited numbers of rfkill events from being created\n\nUserspace can create an unlimited number of rfkill events if the system\nis so configured, while not consuming them from the rfkill file\ndescriptor, causing a potential out of memory situation. Prevent this\nfrom bounding the number of pending rfkill events at a \"large\" number\n(i.e. 1000) to prevent abuses like this."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:13:22.249Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4bcd1615a4e2a185ae9edd27b4143d7dfa7134f4"
},
{
"url": "https://git.kernel.org/stable/c/b1e0c8d3ab58a0161db487bf5fc47adfcaf5d5ca"
},
{
"url": "https://git.kernel.org/stable/c/e3842779547c83150569071d9980517cc9029fc0"
},
{
"url": "https://git.kernel.org/stable/c/673d2a3eef6e0ee9736501a150c9e4024a4e60a6"
},
{
"url": "https://git.kernel.org/stable/c/82843afc19012a29ba863961ef494165aa1a88f4"
},
{
"url": "https://git.kernel.org/stable/c/a8c26800e0220e1550af012f5a20e50f5c78864d"
},
{
"url": "https://git.kernel.org/stable/c/80ce4cb026f0a4c4532b6cad827b44debda6256a"
},
{
"url": "https://git.kernel.org/stable/c/ea245d78dec594372e27d8c79616baf49e98a4a1"
}
],
"title": "net: rfkill: prevent unlimited numbers of rfkill events from being created",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31670",
"datePublished": "2026-04-24T14:45:17.958Z",
"dateReserved": "2026-03-09T15:48:24.130Z",
"dateUpdated": "2026-07-14T12:48:36.456Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43373 (GCVE-0-2026-43373)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ncsi: fix skb leak in error paths
Early return paths in NCSI RX and AEN handlers fail to release
the received skb, resulting in a memory leak.
Specifically, ncsi_aen_handler() returns on invalid AEN packets
without consuming the skb. Similarly, ncsi_rcv_rsp() exits early
when failing to resolve the NCSI device, response handler, or
request, leaving the skb unfreed.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 138635cc27c9737f940c3aa80912ff7a61c825af Version: 138635cc27c9737f940c3aa80912ff7a61c825af Version: 138635cc27c9737f940c3aa80912ff7a61c825af Version: 138635cc27c9737f940c3aa80912ff7a61c825af Version: 138635cc27c9737f940c3aa80912ff7a61c825af Version: 138635cc27c9737f940c3aa80912ff7a61c825af Version: 138635cc27c9737f940c3aa80912ff7a61c825af Version: 138635cc27c9737f940c3aa80912ff7a61c825af |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ncsi/ncsi-aen.c",
"net/ncsi/ncsi-rsp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9891d7f4f1ede473c54b49776ae07755083eef06",
"status": "affected",
"version": "138635cc27c9737f940c3aa80912ff7a61c825af",
"versionType": "git"
},
{
"lessThan": "fef5aa6e3bcf3c8053307642663a63b7362d7552",
"status": "affected",
"version": "138635cc27c9737f940c3aa80912ff7a61c825af",
"versionType": "git"
},
{
"lessThan": "81d6aee32f8f7bbc175c05dbf61f4430bfb88c4a",
"status": "affected",
"version": "138635cc27c9737f940c3aa80912ff7a61c825af",
"versionType": "git"
},
{
"lessThan": "59962588197863d0d746879f193905c0c6b3df49",
"status": "affected",
"version": "138635cc27c9737f940c3aa80912ff7a61c825af",
"versionType": "git"
},
{
"lessThan": "553366c271479c0d571dd1bb5d1bcde4747fb82e",
"status": "affected",
"version": "138635cc27c9737f940c3aa80912ff7a61c825af",
"versionType": "git"
},
{
"lessThan": "b70c4e5e711931cdd56e6e905737b72f1e649189",
"status": "affected",
"version": "138635cc27c9737f940c3aa80912ff7a61c825af",
"versionType": "git"
},
{
"lessThan": "87138dde2d6937b12b967f28fe598a7d59000ae4",
"status": "affected",
"version": "138635cc27c9737f940c3aa80912ff7a61c825af",
"versionType": "git"
},
{
"lessThan": "5c3398a54266541610c8d0a7082e654e9ff3e259",
"status": "affected",
"version": "138635cc27c9737f940c3aa80912ff7a61c825af",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ncsi/ncsi-aen.c",
"net/ncsi/ncsi-rsp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ncsi: fix skb leak in error paths\n\nEarly return paths in NCSI RX and AEN handlers fail to release\nthe received skb, resulting in a memory leak.\n\nSpecifically, ncsi_aen_handler() returns on invalid AEN packets\nwithout consuming the skb. Similarly, ncsi_rcv_rsp() exits early\nwhen failing to resolve the NCSI device, response handler, or\nrequest, leaving the skb unfreed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable handlers are reached through the kernel Ethernet receive path for ETH_P_NCSI frames on an NCSI-enabled network device. A remote peer capable of delivering NCSI frames to the management interface can trigger the bug with network packets.\nAC:L - Triggering only requires malformed or unmatched NCSI response/AEN packets that take deterministic early error paths. No race, timing, or hard-to-control system state is required.\nPR:N - The packet receive path performs no credential, capability, or authentication checks before entering ncsi_rcv_rsp() or ncsi_aen_handler(). Local NCSI netlink operations may require admin permission, but the vulnerable receive path does not.\nUI:N - No victim user action is needed. Packets are processed automatically by the network receive stack.\nS:U - The impact remains within the kernel and the affected NCSI/network device security authority. There is no VM, sandbox, IOMMU, or other cross-scope boundary crossing.\nC:N - The fixed bug is a missing kfree_skb()/consume_skb() on error paths, not an information disclosure. The leaked skb is not exposed back to the attacker.\nI:N - The bug does not corrupt memory or provide a write primitive. It only retains references to received skb objects that should have been freed.\nA:H - Each trigger leaks a received skb, and the attacker can repeat this indefinitely with malformed or unmatched NCSI packets. On plausible BMC/management-controller deployments this can exhaust kernel memory and deny service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:33.592Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9891d7f4f1ede473c54b49776ae07755083eef06"
},
{
"url": "https://git.kernel.org/stable/c/fef5aa6e3bcf3c8053307642663a63b7362d7552"
},
{
"url": "https://git.kernel.org/stable/c/81d6aee32f8f7bbc175c05dbf61f4430bfb88c4a"
},
{
"url": "https://git.kernel.org/stable/c/59962588197863d0d746879f193905c0c6b3df49"
},
{
"url": "https://git.kernel.org/stable/c/553366c271479c0d571dd1bb5d1bcde4747fb82e"
},
{
"url": "https://git.kernel.org/stable/c/b70c4e5e711931cdd56e6e905737b72f1e649189"
},
{
"url": "https://git.kernel.org/stable/c/87138dde2d6937b12b967f28fe598a7d59000ae4"
},
{
"url": "https://git.kernel.org/stable/c/5c3398a54266541610c8d0a7082e654e9ff3e259"
}
],
"title": "net: ncsi: fix skb leak in error paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43373",
"datePublished": "2026-05-08T14:21:23.875Z",
"dateReserved": "2026-05-01T14:12:56.006Z",
"dateUpdated": "2026-08-05T12:27:33.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46068 (GCVE-0-2026-46068)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-06-14 17:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx
The bounce buffers are allocated with __get_free_pages() using
BOUNCE_BUFFER_ORDER (order 2 = 4 pages), but both the allocation error
path and nx842_crypto_free_ctx() release the buffers with free_page().
Use free_pages() with the matching order instead.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/nx/nx-842.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f17a4850d1ce7c11cba8b1830b9bfedfede878bb",
"status": "affected",
"version": "ed70b479c2c0b6e1319f0cb2de19f1051be219a4",
"versionType": "git"
},
{
"lessThan": "910bb34b801d39794e656f7d48414844b2bd354e",
"status": "affected",
"version": "ed70b479c2c0b6e1319f0cb2de19f1051be219a4",
"versionType": "git"
},
{
"lessThan": "5c07962fed66e1238fad7635fa150570bd38b4c5",
"status": "affected",
"version": "ed70b479c2c0b6e1319f0cb2de19f1051be219a4",
"versionType": "git"
},
{
"lessThan": "80fd99d7c30ea889662d21f1b44d8fea4c83138d",
"status": "affected",
"version": "ed70b479c2c0b6e1319f0cb2de19f1051be219a4",
"versionType": "git"
},
{
"lessThan": "adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c",
"status": "affected",
"version": "ed70b479c2c0b6e1319f0cb2de19f1051be219a4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/nx/nx-842.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx\n\nThe bounce buffers are allocated with __get_free_pages() using\nBOUNCE_BUFFER_ORDER (order 2 = 4 pages), but both the allocation error\npath and nx842_crypto_free_ctx() release the buffers with free_page().\nUse free_pages() with the matching order instead."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:51:58.785Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f17a4850d1ce7c11cba8b1830b9bfedfede878bb"
},
{
"url": "https://git.kernel.org/stable/c/910bb34b801d39794e656f7d48414844b2bd354e"
},
{
"url": "https://git.kernel.org/stable/c/5c07962fed66e1238fad7635fa150570bd38b4c5"
},
{
"url": "https://git.kernel.org/stable/c/80fd99d7c30ea889662d21f1b44d8fea4c83138d"
},
{
"url": "https://git.kernel.org/stable/c/adb3faf2db1a66d0f015b44ac909a32dfc7f2f9c"
}
],
"title": "crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46068",
"datePublished": "2026-05-27T12:57:48.457Z",
"dateReserved": "2026-05-13T15:03:33.095Z",
"dateUpdated": "2026-06-14T17:51:58.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31660 (GCVE-0-2026-31660)
Vulnerability from cvelistv5
Published
2026-04-24 14:45
Modified
2026-05-11 22:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfc: pn533: allocate rx skb before consuming bytes
pn532_receive_buf() reports the number of accepted bytes to the serdev
core. The current code consumes bytes into recv_skb and may already hand
a complete frame to pn533_recv_frame() before allocating a fresh receive
buffer.
If that alloc_skb() fails, the callback returns 0 even though it has
already consumed bytes, and it leaves recv_skb as NULL for the next
receive callback. That breaks the receive_buf() accounting contract and
can also lead to a NULL dereference on the next skb_put_u8().
Allocate the receive skb lazily before consuming the next byte instead.
If allocation fails, return the number of bytes already accepted.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c656aa4c27b17a8c70da223ed5ab42145800d6b5 Version: c656aa4c27b17a8c70da223ed5ab42145800d6b5 Version: c656aa4c27b17a8c70da223ed5ab42145800d6b5 Version: c656aa4c27b17a8c70da223ed5ab42145800d6b5 Version: c656aa4c27b17a8c70da223ed5ab42145800d6b5 Version: c656aa4c27b17a8c70da223ed5ab42145800d6b5 Version: c656aa4c27b17a8c70da223ed5ab42145800d6b5 Version: c656aa4c27b17a8c70da223ed5ab42145800d6b5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nfc/pn533/uart.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2ca64fb7e2d2ae14619dd204d4f2f0a601f421fb",
"status": "affected",
"version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
"versionType": "git"
},
{
"lessThan": "8b71299d587d9e4c830c18afb884c80ddb30ad28",
"status": "affected",
"version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
"versionType": "git"
},
{
"lessThan": "16649adc2e19509104245ea1f349b629d858f11f",
"status": "affected",
"version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
"versionType": "git"
},
{
"lessThan": "07cb6c72e66ba548679f22ac29ad588da8999279",
"status": "affected",
"version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
"versionType": "git"
},
{
"lessThan": "a9495069b43b8634c1ae0042e888766c34f66637",
"status": "affected",
"version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
"versionType": "git"
},
{
"lessThan": "21ae2cda66a55c759607bbf1d23cbaa42019d2de",
"status": "affected",
"version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
"versionType": "git"
},
{
"lessThan": "7e37da42eda45d7859d9273fc7e225d8df458038",
"status": "affected",
"version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
"versionType": "git"
},
{
"lessThan": "c71ba669b570c7b3f86ec875be222ea11dacb352",
"status": "affected",
"version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nfc/pn533/uart.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.169",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.135",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.169",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.135",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.82",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: pn533: allocate rx skb before consuming bytes\n\npn532_receive_buf() reports the number of accepted bytes to the serdev\ncore. The current code consumes bytes into recv_skb and may already hand\na complete frame to pn533_recv_frame() before allocating a fresh receive\nbuffer.\n\nIf that alloc_skb() fails, the callback returns 0 even though it has\nalready consumed bytes, and it leaves recv_skb as NULL for the next\nreceive callback. That breaks the receive_buf() accounting contract and\ncan also lead to a NULL dereference on the next skb_put_u8().\n\nAllocate the receive skb lazily before consuming the next byte instead.\nIf allocation fails, return the number of bytes already accepted."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:13:07.366Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2ca64fb7e2d2ae14619dd204d4f2f0a601f421fb"
},
{
"url": "https://git.kernel.org/stable/c/8b71299d587d9e4c830c18afb884c80ddb30ad28"
},
{
"url": "https://git.kernel.org/stable/c/16649adc2e19509104245ea1f349b629d858f11f"
},
{
"url": "https://git.kernel.org/stable/c/07cb6c72e66ba548679f22ac29ad588da8999279"
},
{
"url": "https://git.kernel.org/stable/c/a9495069b43b8634c1ae0042e888766c34f66637"
},
{
"url": "https://git.kernel.org/stable/c/21ae2cda66a55c759607bbf1d23cbaa42019d2de"
},
{
"url": "https://git.kernel.org/stable/c/7e37da42eda45d7859d9273fc7e225d8df458038"
},
{
"url": "https://git.kernel.org/stable/c/c71ba669b570c7b3f86ec875be222ea11dacb352"
}
],
"title": "nfc: pn533: allocate rx skb before consuming bytes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31660",
"datePublished": "2026-04-24T14:45:11.039Z",
"dateReserved": "2026-03-09T15:48:24.129Z",
"dateUpdated": "2026-05-11T22:13:07.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43111 (GCVE-0-2026-43111)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: roccat: fix use-after-free in roccat_report_event
roccat_report_event() iterates over the device->readers list without
holding the readers_lock. This allows a concurrent roccat_release() to
remove and free a reader while it's still being accessed, leading to a
use-after-free.
Protect the readers list traversal with the readers_lock mutex.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 Version: 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 Version: 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 Version: 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 Version: 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 Version: 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 Version: 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 Version: 206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-roccat.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "20dca865460f7943cf70afca274b60dac371f546",
"status": "affected",
"version": "206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378",
"versionType": "git"
},
{
"lessThan": "441689e3103694caa3e2d62b7d57c7bccefa5e37",
"status": "affected",
"version": "206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378",
"versionType": "git"
},
{
"lessThan": "181ea51ab0f6370842c5b49cfb86824253a1189e",
"status": "affected",
"version": "206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378",
"versionType": "git"
},
{
"lessThan": "e6a445513fbc6a0329d2d5ff375b6725750ec5a6",
"status": "affected",
"version": "206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378",
"versionType": "git"
},
{
"lessThan": "e16a6d11bd77b81632165f02cf0d5946df74b3b7",
"status": "affected",
"version": "206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378",
"versionType": "git"
},
{
"lessThan": "36bb2d0b915014bbdc5044982b31b57b78045b93",
"status": "affected",
"version": "206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378",
"versionType": "git"
},
{
"lessThan": "bca0b595e15450dd66b1153c76c4ef1087ee011b",
"status": "affected",
"version": "206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378",
"versionType": "git"
},
{
"lessThan": "d802d848308b35220f21a8025352f0c0aba15c12",
"status": "affected",
"version": "206f5f2fcb5ff5bb0c60f9e9189937f3ca03e378",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-roccat.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: roccat: fix use-after-free in roccat_report_event\n\nroccat_report_event() iterates over the device-\u003ereaders list without\nholding the readers_lock. This allows a concurrent roccat_release() to\nremove and free a reader while it\u0027s still being accessed, leading to a\nuse-after-free.\n\nProtect the readers list traversal with the readers_lock mutex."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Roccat-specific sysfs/HID event paths feed roccat_report_event(), and exploitation of the vulnerable reader-list race requires local control of /dev/roccat* open/release activity on a system with an affected Roccat USB HID device. There is no network or adjacent protocol path.\nAC:L - The bug is a missing readers_lock around list traversal, and an attacker with device-node access can repeatedly open/close readers while generating reports through the Roccat device/sysfs path. The race is attacker-influenced rather than dependent on rare external conditions.\nPR:L - The relevant roccat char-device operations do not perform capability checks, but the attacker needs local DAC/udev access to the Roccat device/sysfs nodes. In a reasonable desktop or workstation deployment this is low-privileged user access, not real init-namespace root.\nUI:N - Once the affected device and driver are present, exploitation does not require a victim to perform an action. The attacker can drive the racing file operations and report generation directly.\nS:U - The vulnerability corrupts kernel memory within the same kernel security authority. It does not cross a VM, IOMMU, or other separate security scope boundary.\nC:H - This is a kernel use-after-free of struct roccat_reader during list traversal, allowing freed heap memory to be dereferenced after attacker-influenced reallocation. Following the required conservative UAF guidance, this can support high confidentiality impact.\nI:H - The stale reader object is not only read but can have cbuf_start updated and its list pointers traversed after free, giving a plausible kernel heap corruption primitive. Following the required conservative UAF guidance, this supports high integrity impact.\nA:H - Even without full exploitation, dereferencing or walking a freed list element can produce a kernel oops, panic, or hang. Repeated triggering can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:58.562Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/20dca865460f7943cf70afca274b60dac371f546"
},
{
"url": "https://git.kernel.org/stable/c/441689e3103694caa3e2d62b7d57c7bccefa5e37"
},
{
"url": "https://git.kernel.org/stable/c/181ea51ab0f6370842c5b49cfb86824253a1189e"
},
{
"url": "https://git.kernel.org/stable/c/e6a445513fbc6a0329d2d5ff375b6725750ec5a6"
},
{
"url": "https://git.kernel.org/stable/c/e16a6d11bd77b81632165f02cf0d5946df74b3b7"
},
{
"url": "https://git.kernel.org/stable/c/36bb2d0b915014bbdc5044982b31b57b78045b93"
},
{
"url": "https://git.kernel.org/stable/c/bca0b595e15450dd66b1153c76c4ef1087ee011b"
},
{
"url": "https://git.kernel.org/stable/c/d802d848308b35220f21a8025352f0c0aba15c12"
}
],
"title": "HID: roccat: fix use-after-free in roccat_report_event",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43111",
"datePublished": "2026-05-06T07:40:37.916Z",
"dateReserved": "2026-05-01T14:12:55.986Z",
"dateUpdated": "2026-08-05T12:25:58.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43222 (GCVE-0-2026-43222)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: verisilicon: AV1: Fix tile info buffer size
Each tile info is composed of: row_sb, col_sb, start_pos
and end_pos (4 bytes each). So the total required memory
is AV1_MAX_TILES * 16 bytes.
Use the correct #define to allocate the buffer and avoid
writing tile info in non-allocated memory.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a5b1ddbe31f49b4da78642157589970e9b60a231",
"status": "affected",
"version": "727a400686a2c0d25015c9e44916a59b72882f83",
"versionType": "git"
},
{
"lessThan": "34f36f9c6114af781a5a4f7a7c99334c85b73fc7",
"status": "affected",
"version": "727a400686a2c0d25015c9e44916a59b72882f83",
"versionType": "git"
},
{
"lessThan": "f122f2b3ce9dbde60bf7ab0b180fe4a01f9d9bc4",
"status": "affected",
"version": "727a400686a2c0d25015c9e44916a59b72882f83",
"versionType": "git"
},
{
"lessThan": "74abfadd7ef5ac9f3a6111d550cc651d1457c641",
"status": "affected",
"version": "727a400686a2c0d25015c9e44916a59b72882f83",
"versionType": "git"
},
{
"lessThan": "a505ca2db89ad92a8d8d27fa68ebafb12e04a679",
"status": "affected",
"version": "727a400686a2c0d25015c9e44916a59b72882f83",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: verisilicon: AV1: Fix tile info buffer size\n\nEach tile info is composed of: row_sb, col_sb, start_pos\nand end_pos (4 bytes each). So the total required memory\nis AV1_MAX_TILES * 16 bytes.\nUse the correct #define to allocate the buffer and avoid\nwriting tile info in non-allocated memory."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through local V4L2 mem2mem decoder device operations and media request/ioctl submission to the Rockchip Verisilicon AV1 decoder, not directly by packets in an in-kernel network protocol.\nAC:L - An attacker can reliably submit AV1 frame and tile group controls with enough tiles to drive the undersized tile info buffer write; no race or uncontrollable timing condition is required.\nPR:L - The driver open and decode path has no capability check, but exploitation requires local access to the decoder device node or an equivalent low-privileged local media client context.\nUI:N - A local attacker with access to the V4L2 decoder can trigger the overflow directly by issuing ioctls and queueing a decode request; no separate victim action is needed.\nS:U - The corruption occurs within the kernel driver and impacts the same kernel security authority; there is no VM, IOMMU, or cross-scope boundary involved.\nC:H - This is an out-of-bounds write from kernel context into DMA-coherent memory, and kernel memory corruption is reasonably exploitable for disclosure primitives in severe cases.\nI:H - The bug writes attacker-influenced tile metadata past an undersized allocation, so it is a kernel out-of-bounds write with potential for arbitrary memory corruption or code execution.\nA:H - Even without full exploitation, writing beyond the allocated coherent buffer can corrupt adjacent memory or allocator state and plausibly crash or hang the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:41.823Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a5b1ddbe31f49b4da78642157589970e9b60a231"
},
{
"url": "https://git.kernel.org/stable/c/34f36f9c6114af781a5a4f7a7c99334c85b73fc7"
},
{
"url": "https://git.kernel.org/stable/c/f122f2b3ce9dbde60bf7ab0b180fe4a01f9d9bc4"
},
{
"url": "https://git.kernel.org/stable/c/74abfadd7ef5ac9f3a6111d550cc651d1457c641"
},
{
"url": "https://git.kernel.org/stable/c/a505ca2db89ad92a8d8d27fa68ebafb12e04a679"
}
],
"title": "media: verisilicon: AV1: Fix tile info buffer size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43222",
"datePublished": "2026-05-06T11:28:22.291Z",
"dateReserved": "2026-05-01T14:12:55.994Z",
"dateUpdated": "2026-08-05T12:26:41.823Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53256 (GCVE-0-2026-53256)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()
rfcomm_get_sock_by_channel() scans rfcomm_sk_list under the list lock,
but returns the selected listener after dropping that lock without
taking a reference. rfcomm_connect_ind() then locks the listener,
queues a child socket on it, and may notify it after unlocking it.
The buggy scenario involves two paths, with each column showing the
order within that path:
rfcomm_connect_ind(): listener close:
1. Find parent in 1. close() enters
rfcomm_get_sock_by_channel() rfcomm_sock_release().
2. Drop rfcomm_sk_list.lock 2. rfcomm_sock_shutdown()
without pinning parent. closes the listener.
3. Call lock_sock(parent) and 3. rfcomm_sock_kill()
bt_accept_enqueue(parent, unlinks and puts parent.
sk, true).
4. Read parent flags and may 4. parent can be freed.
call sk_state_change().
If close wins the race, parent can be freed before
rfcomm_connect_ind() reaches lock_sock(), bt_accept_enqueue(), or the
deferred-setup callback.
Take a reference on the listener before leaving rfcomm_sk_list.lock.
After lock_sock() succeeds, recheck that it is still in BT_LISTEN
before queueing a child, cache the deferred-setup bit while the parent
is locked, and drop the reference after the last parent use.
KASAN reported a slab-use-after-free in lock_sock_nested() from
rfcomm_connect_ind(), with the freeing stack going through
rfcomm_sock_kill() and rfcomm_sock_release().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/rfcomm/sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f5ec76bdbeb80f75ad0be204371afffee0f8fac8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a07d741c077d4e34b16458241a94d29039386553",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1f73f92f66251065a5f39b09a47cf05ea14d3107",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "de31973ef00e5aa55496f84cf6a44bb157a34e02",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b0e33e409715c617e2a20f46f99aa5403a14dfda",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8802413ce63175fb522a2bd609fb043a3550c720",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6f4462d12133106460d7c046b95aad2491e3fddf",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "43c441edacf953b39517a44f5e5e10a93618b226",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/rfcomm/sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()\n\nrfcomm_get_sock_by_channel() scans rfcomm_sk_list under the list lock,\nbut returns the selected listener after dropping that lock without\ntaking a reference. rfcomm_connect_ind() then locks the listener,\nqueues a child socket on it, and may notify it after unlocking it.\n\nThe buggy scenario involves two paths, with each column showing the\norder within that path:\n\nrfcomm_connect_ind(): listener close:\n 1. Find parent in 1. close() enters\n rfcomm_get_sock_by_channel() rfcomm_sock_release().\n 2. Drop rfcomm_sk_list.lock 2. rfcomm_sock_shutdown()\n without pinning parent. closes the listener.\n 3. Call lock_sock(parent) and 3. rfcomm_sock_kill()\n bt_accept_enqueue(parent, unlinks and puts parent.\n sk, true).\n 4. Read parent flags and may 4. parent can be freed.\n call sk_state_change().\n\nIf close wins the race, parent can be freed before\nrfcomm_connect_ind() reaches lock_sock(), bt_accept_enqueue(), or the\ndeferred-setup callback.\n\nTake a reference on the listener before leaving rfcomm_sk_list.lock.\nAfter lock_sock() succeeds, recheck that it is still in BT_LISTEN\nbefore queueing a child, cache the deferred-setup bit while the parent\nis locked, and drop the reference after the last parent use.\n\nKASAN reported a slab-use-after-free in lock_sock_nested() from\nrfcomm_connect_ind(), with the freeing stack going through\nrfcomm_sock_kill() and rfcomm_sock_release()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable path is reached by Bluetooth RFCOMM/L2CAP traffic from a nearby peer, so the attacker must be within Bluetooth radio range rather than merely local or internet-routable.\nAC:L - The race is between an inbound RFCOMM connect indication and listener close; an attacker with an unprivileged local RFCOMM listener plus a controlled adjacent Bluetooth peer can drive both sides repeatedly.\nPR:L - Creating, binding, listening on, and closing an RFCOMM stream socket has no CAP_NET_ADMIN gate, so only low local privileges are needed to control the listener side of the race.\nUI:N - No victim user action is required once the vulnerable listener/race setup exists; the attacker drives the RFCOMM connection attempts and close timing.\nS:U - The corruption is within the kernel networking/Bluetooth socket lifetime domain and does not cross a separate security authority such as a VM or IOMMU boundary.\nC:H - This is a slab use-after-free of a kernel struct sock, and the stale pointer is reused for locking, queueing, state checks, and callback-related state, making high confidentiality impact defensible.\nI:H - The stale listener socket can be operated on after free, including accept-queue manipulation and potential callback use, so kernel memory corruption/control-flow exploitation is defensible.\nA:H - KASAN reported a slab-use-after-free in this path, and even non-exploited triggering can crash or oops the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:36.875Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f5ec76bdbeb80f75ad0be204371afffee0f8fac8"
},
{
"url": "https://git.kernel.org/stable/c/a07d741c077d4e34b16458241a94d29039386553"
},
{
"url": "https://git.kernel.org/stable/c/1f73f92f66251065a5f39b09a47cf05ea14d3107"
},
{
"url": "https://git.kernel.org/stable/c/de31973ef00e5aa55496f84cf6a44bb157a34e02"
},
{
"url": "https://git.kernel.org/stable/c/b0e33e409715c617e2a20f46f99aa5403a14dfda"
},
{
"url": "https://git.kernel.org/stable/c/8802413ce63175fb522a2bd609fb043a3550c720"
},
{
"url": "https://git.kernel.org/stable/c/6f4462d12133106460d7c046b95aad2491e3fddf"
},
{
"url": "https://git.kernel.org/stable/c/43c441edacf953b39517a44f5e5e10a93618b226"
}
],
"title": "Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53256",
"datePublished": "2026-06-25T08:39:46.591Z",
"dateReserved": "2026-06-09T07:44:35.394Z",
"dateUpdated": "2026-08-05T12:34:36.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53003 (GCVE-0-2026-53003)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
pppoe: drop PFC frames
RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT
RECOMMENDED for PPPoE. In practice, pppd does not support negotiating
PFC for PPPoE sessions, and the current PPPoE driver assumes an
uncompressed (2-byte) protocol field. However, the generic PPP layer
function ppp_input() is not aware of the negotiation result, and still
accepts PFC frames.
If a peer with a broken implementation or an attacker sends a frame with
a compressed (1-byte) protocol field, the subsequent PPP payload is
shifted by one byte. This causes the network header to be 4-byte
misaligned, which may trigger unaligned access exceptions on some
architectures.
To reduce the attack surface, drop PPPoE PFC frames. Introduce
ppp_skb_is_compressed_proto() helper function to be used in both
ppp_generic.c and pppoe.c to avoid open-coding.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 Version: 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 Version: 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 Version: 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 Version: 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 Version: 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 Version: 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 Version: 7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/ppp_generic.c",
"drivers/net/ppp/pppoe.c",
"include/linux/ppp_defs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cb3beef35ab5e0c1afca9fd7648c6ae499786377",
"status": "affected",
"version": "7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6",
"versionType": "git"
},
{
"lessThan": "ba758fdf1399f310b30098b6faa3fd043de47dd2",
"status": "affected",
"version": "7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6",
"versionType": "git"
},
{
"lessThan": "fcca1df05322bb04e344dd1178b54b76a08eb7c3",
"status": "affected",
"version": "7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6",
"versionType": "git"
},
{
"lessThan": "8a5e840babc5c0fbd10c73728a13192347771ec6",
"status": "affected",
"version": "7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6",
"versionType": "git"
},
{
"lessThan": "49e41b60ccd1bdbe9e218420f716dd5f9a2f9c71",
"status": "affected",
"version": "7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6",
"versionType": "git"
},
{
"lessThan": "0cab5d077dd1efd2bd1a47271acc35894f945b4f",
"status": "affected",
"version": "7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6",
"versionType": "git"
},
{
"lessThan": "2b5c3c040d020e3ab3b9a8887031202d96843b1e",
"status": "affected",
"version": "7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6",
"versionType": "git"
},
{
"lessThan": "cc1ff87bce1ccd38410ab10960f576dcd17db679",
"status": "affected",
"version": "7fb1b8ca8fa1ee34ffc328f17f78da68c7cc04e6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/ppp_generic.c",
"drivers/net/ppp/pppoe.c",
"include/linux/ppp_defs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npppoe: drop PFC frames\n\nRFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT\nRECOMMENDED for PPPoE. In practice, pppd does not support negotiating\nPFC for PPPoE sessions, and the current PPPoE driver assumes an\nuncompressed (2-byte) protocol field. However, the generic PPP layer\nfunction ppp_input() is not aware of the negotiation result, and still\naccepts PFC frames.\n\nIf a peer with a broken implementation or an attacker sends a frame with\na compressed (1-byte) protocol field, the subsequent PPP payload is\nshifted by one byte. This causes the network header to be 4-byte\nmisaligned, which may trigger unaligned access exceptions on some\narchitectures.\n\nTo reduce the attack surface, drop PPPoE PFC frames. Introduce\nppp_skb_is_compressed_proto() helper function to be used in both\nppp_generic.c and pppoe.c to avoid open-coding."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Crafted PPPoE session frames reach the vulnerable path through the kernel receive path for ETH_P_PPP_SES network packets. A malicious PPPoE peer or network attacker able to send matching session frames can trigger it remotely over the network interface.\nAC:L - The trigger is a single compressed PPP protocol field in an otherwise valid PPPoE session frame, with no race or attacker-uncontrolled timing. On strict-alignment architectures used in plausible PPPoE deployments, the resulting misalignment deterministically reaches fault-prone network-header parsing.\nPR:N - The attacker only needs to transmit crafted PPPoE frames to an existing session and does not need local privileges or authenticated access on the victim. Local CAP_NET_ADMIN may be needed to configure PPPoE, but that is not a privilege required by the packet sender.\nUI:N - No victim interaction is required once the target is running a PPPoE session. The malicious frame is processed asynchronously by the network receive path.\nS:U - The impact is within the kernel/network stack security authority of the vulnerable system. There is no VM, sandbox, or other separate security scope crossed.\nC:N - The bug shifts packet alignment and can cause unaligned access exceptions, but it does not expose kernel memory or provide an information disclosure primitive. The skb push writes within packet headroom and is not an arbitrary read condition.\nI:N - The issue does not provide attacker-controlled modification of kernel memory or data structures. Its demonstrated and intended impact is malformed alignment leading to faulting packet processing, not integrity compromise.\nA:H - Misaligned network headers can trigger unaligned access exceptions and kernel oops/panic on strict-alignment architectures. The crafted frame can be sent repeatedly, making system availability impact high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:33.280Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cb3beef35ab5e0c1afca9fd7648c6ae499786377"
},
{
"url": "https://git.kernel.org/stable/c/ba758fdf1399f310b30098b6faa3fd043de47dd2"
},
{
"url": "https://git.kernel.org/stable/c/fcca1df05322bb04e344dd1178b54b76a08eb7c3"
},
{
"url": "https://git.kernel.org/stable/c/8a5e840babc5c0fbd10c73728a13192347771ec6"
},
{
"url": "https://git.kernel.org/stable/c/49e41b60ccd1bdbe9e218420f716dd5f9a2f9c71"
},
{
"url": "https://git.kernel.org/stable/c/0cab5d077dd1efd2bd1a47271acc35894f945b4f"
},
{
"url": "https://git.kernel.org/stable/c/2b5c3c040d020e3ab3b9a8887031202d96843b1e"
},
{
"url": "https://git.kernel.org/stable/c/cc1ff87bce1ccd38410ab10960f576dcd17db679"
}
],
"title": "pppoe: drop PFC frames",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53003",
"datePublished": "2026-06-24T16:29:15.268Z",
"dateReserved": "2026-06-09T07:44:35.377Z",
"dateUpdated": "2026-08-05T12:32:33.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52972 (GCVE-0-2026-52972)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-17 04:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: af_alg - Cap AEAD AD length to 0x80000000
In order to prevent arithmetic overflows when checking the TX
buffer size, cap the associated data length to 0x80000000.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef Version: 400c40cf78da00c16e561a3a253ca272455c42ef |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s `af_alg` cryptography module. This vulnerability involves an arithmetic overflow when processing associated data lengths during the transmit buffer size check. A remote attacker could exploit this flaw by providing a specially crafted associated data length, potentially leading to a denial of service (DoS) due to system instability."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T02:46:50.271Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52972"
},
{
"name": "RHBZ#2492364",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492364"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52972.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: crypto: af_alg - Cap AEAD AD length to 0x80000000",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/af_alg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f8a5203596797f394ff3f9aa4005597a92249802",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "a9f68d9ed38dd6e5a6c6d75b03d25c1c133e321d",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "a4fe4eb580bbc7439f649a496d4cf38415a4021c",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "e4c4a5074532eaaa14951994a3aad0d479aa7431",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "265ac26d1c5e17b34d497cbda1f754a1ec8552bc",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "a1c5672faf8e93e38c2deac3979cc767ca5cf918",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "97948906dc8e0ea84775e03e35b60a2063c70193",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "0b3a57d218618cb1cc78ddc9ba02c07de84b46f4",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
},
{
"lessThan": "e4c06479d7059888adf2f22bc1ebcf053bf691a2",
"status": "affected",
"version": "400c40cf78da00c16e561a3a253ca272455c42ef",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/af_alg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Cap AEAD AD length to 0x80000000\n\nIn order to prevent arithmetic overflows when checking the TX\nbuffer size, cap the associated data length to 0x80000000."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:24.931Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f8a5203596797f394ff3f9aa4005597a92249802"
},
{
"url": "https://git.kernel.org/stable/c/a9f68d9ed38dd6e5a6c6d75b03d25c1c133e321d"
},
{
"url": "https://git.kernel.org/stable/c/a4fe4eb580bbc7439f649a496d4cf38415a4021c"
},
{
"url": "https://git.kernel.org/stable/c/e4c4a5074532eaaa14951994a3aad0d479aa7431"
},
{
"url": "https://git.kernel.org/stable/c/265ac26d1c5e17b34d497cbda1f754a1ec8552bc"
},
{
"url": "https://git.kernel.org/stable/c/a1c5672faf8e93e38c2deac3979cc767ca5cf918"
},
{
"url": "https://git.kernel.org/stable/c/97948906dc8e0ea84775e03e35b60a2063c70193"
},
{
"url": "https://git.kernel.org/stable/c/0b3a57d218618cb1cc78ddc9ba02c07de84b46f4"
},
{
"url": "https://git.kernel.org/stable/c/e4c06479d7059888adf2f22bc1ebcf053bf691a2"
}
],
"title": "crypto: af_alg - Cap AEAD AD length to 0x80000000",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52972",
"datePublished": "2026-06-24T16:28:50.425Z",
"dateReserved": "2026-06-09T07:44:35.375Z",
"dateUpdated": "2026-08-17T04:50:24.931Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31756 (GCVE-0-2026-31756)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-05-23 16:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()
dwc2_gadget_exit_clock_gating() internally calls call_gadget() macro,
which expects hsotg->lock to be held since it does spin_unlock/spin_lock
around the gadget driver callback invocation.
However, dwc2_hsotg_udc_stop() calls dwc2_gadget_exit_clock_gating()
without holding the lock. This leads to:
- spin_unlock on a lock that is not held (undefined behavior)
- The lock remaining held after dwc2_gadget_exit_clock_gating() returns,
causing a deadlock when spin_lock_irqsave() is called later in the
same function.
Fix this by acquiring hsotg->lock before calling
dwc2_gadget_exit_clock_gating() and releasing it afterwards, which
satisfies the locking requirement of the call_gadget() macro.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5cb3cb3db317c58d50b68f3ca3bb8343ea9d1acd Version: 1ac826cebc2776f91569f2aa9c9c3da2375d2096 Version: 41732f9febdccb4f9b87c13cb915d717d68ccafd Version: ba78c2b3254c4a458c01776612e8a573e12f8d26 Version: af076a41f8a28faf9ceb9dd2d88aef2c202ef39a Version: af076a41f8a28faf9ceb9dd2d88aef2c202ef39a Version: af076a41f8a28faf9ceb9dd2d88aef2c202ef39a Version: b39c203690fa1678daecc60f347e43c8b593b969 Version: 5.15.187 ≤ Version: 6.1.143 ≤ Version: 6.6.96 ≤ Version: 6.12.36 ≤ Version: 6.15.5 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/dwc2/gadget.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e9fcca3e87463013d595c65c2189ffaa32ad3b50",
"status": "affected",
"version": "5cb3cb3db317c58d50b68f3ca3bb8343ea9d1acd",
"versionType": "git"
},
{
"lessThan": "8ffe31acb3b77a30ae34d01719a269881569fb7f",
"status": "affected",
"version": "1ac826cebc2776f91569f2aa9c9c3da2375d2096",
"versionType": "git"
},
{
"lessThan": "beab10429439e20708036a66fb0d97ffb79da6a1",
"status": "affected",
"version": "41732f9febdccb4f9b87c13cb915d717d68ccafd",
"versionType": "git"
},
{
"lessThan": "4ed9d2dd9f29828c311db6ec4b8e0d34bfd6d6a4",
"status": "affected",
"version": "ba78c2b3254c4a458c01776612e8a573e12f8d26",
"versionType": "git"
},
{
"lessThan": "61937f686290494998236c680ce0836b8dd63a3f",
"status": "affected",
"version": "af076a41f8a28faf9ceb9dd2d88aef2c202ef39a",
"versionType": "git"
},
{
"lessThan": "51b62286fc668c6eb74dee7624ec0beec3c5a0ed",
"status": "affected",
"version": "af076a41f8a28faf9ceb9dd2d88aef2c202ef39a",
"versionType": "git"
},
{
"lessThan": "9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a",
"status": "affected",
"version": "af076a41f8a28faf9ceb9dd2d88aef2c202ef39a",
"versionType": "git"
},
{
"status": "affected",
"version": "b39c203690fa1678daecc60f347e43c8b593b969",
"versionType": "git"
},
{
"lessThan": "5.15.203",
"status": "affected",
"version": "5.15.187",
"versionType": "semver"
},
{
"lessThan": "6.1.168",
"status": "affected",
"version": "6.1.143",
"versionType": "semver"
},
{
"lessThan": "6.6.134",
"status": "affected",
"version": "6.6.96",
"versionType": "semver"
},
{
"lessThan": "6.12.81",
"status": "affected",
"version": "6.12.36",
"versionType": "semver"
},
{
"lessThan": "6.16",
"status": "affected",
"version": "6.15.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/dwc2/gadget.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.15.187",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "6.1.143",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "6.6.96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "6.12.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()\n\ndwc2_gadget_exit_clock_gating() internally calls call_gadget() macro,\nwhich expects hsotg-\u003elock to be held since it does spin_unlock/spin_lock\naround the gadget driver callback invocation.\n\nHowever, dwc2_hsotg_udc_stop() calls dwc2_gadget_exit_clock_gating()\nwithout holding the lock. This leads to:\n - spin_unlock on a lock that is not held (undefined behavior)\n - The lock remaining held after dwc2_gadget_exit_clock_gating() returns,\n causing a deadlock when spin_lock_irqsave() is called later in the\n same function.\n\nFix this by acquiring hsotg-\u003elock before calling\ndwc2_gadget_exit_clock_gating() and releasing it afterwards, which\nsatisfies the locking requirement of the call_gadget() macro."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:05:53.039Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e9fcca3e87463013d595c65c2189ffaa32ad3b50"
},
{
"url": "https://git.kernel.org/stable/c/8ffe31acb3b77a30ae34d01719a269881569fb7f"
},
{
"url": "https://git.kernel.org/stable/c/beab10429439e20708036a66fb0d97ffb79da6a1"
},
{
"url": "https://git.kernel.org/stable/c/4ed9d2dd9f29828c311db6ec4b8e0d34bfd6d6a4"
},
{
"url": "https://git.kernel.org/stable/c/61937f686290494998236c680ce0836b8dd63a3f"
},
{
"url": "https://git.kernel.org/stable/c/51b62286fc668c6eb74dee7624ec0beec3c5a0ed"
},
{
"url": "https://git.kernel.org/stable/c/9bb4b5ed7f8c4f95cc556bdf042b0ba2fa13557a"
}
],
"title": "usb: dwc2: gadget: Fix spin_lock/unlock mismatch in dwc2_hsotg_udc_stop()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31756",
"datePublished": "2026-05-01T14:14:47.000Z",
"dateReserved": "2026-03-09T15:48:24.139Z",
"dateUpdated": "2026-05-23T16:05:53.039Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43432 (GCVE-0-2026-43432)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-23 16:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: xhci: Fix memory leak in xhci_disable_slot()
xhci_alloc_command() allocates a command structure and, when the
second argument is true, also allocates a completion structure.
Currently, the error handling path in xhci_disable_slot() only frees
the command structure using kfree(), causing the completion structure
to leak.
Use xhci_free_command() instead of kfree(). xhci_free_command() correctly
frees both the command structure and the associated completion structure.
Since the command structure is allocated with zero-initialization,
command->in_ctx is NULL and will not be erroneously freed by
xhci_free_command().
This bug was found using an experimental static analysis tool we are
developing. The tool is based on the LLVM framework and is specifically
designed to detect memory management issues. It is currently under
active development and not yet publicly available, but we plan to
open-source it after our research is published.
The bug was originally detected on v6.13-rc1 using our static analysis
tool, and we have verified that the issue persists in the latest mainline
kernel.
We performed build testing on x86_64 with allyesconfig using GCC=11.4.0.
Since triggering these error paths in xhci_disable_slot() requires specific
hardware conditions or abnormal state, we were unable to construct a test
case to reliably trigger these specific error paths at runtime.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fee8be5bde562d4f5f9a100ca80c6d7072ed34c8 Version: 02d5a2a48bb44e7404b794df87e57588b2fd604e Version: 7faac1953ed1f658f719cdf7bb7303fa5eef822c Version: 7faac1953ed1f658f719cdf7bb7303fa5eef822c Version: 7faac1953ed1f658f719cdf7bb7303fa5eef822c Version: 7faac1953ed1f658f719cdf7bb7303fa5eef822c Version: 7faac1953ed1f658f719cdf7bb7303fa5eef822c Version: 7faac1953ed1f658f719cdf7bb7303fa5eef822c Version: cc7c2818c71ebace207df40cc586c8c74e3d1a59 Version: ec0cddcc2454ab08193beb473978f8f8889b7e24 Version: 5.10.85 ≤ Version: 5.15.8 ≤ Version: 4.19.221 ≤ Version: 5.4.165 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/host/xhci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1e800e26d54ccf2ddf2ea6d6cbe021c804d8aa62",
"status": "affected",
"version": "fee8be5bde562d4f5f9a100ca80c6d7072ed34c8",
"versionType": "git"
},
{
"lessThan": "6288baf0c8c4dcfbf206773aede9c1f2269cec28",
"status": "affected",
"version": "02d5a2a48bb44e7404b794df87e57588b2fd604e",
"versionType": "git"
},
{
"lessThan": "46aea90763832cd6e9b0c2e1c00e6a9512156d4b",
"status": "affected",
"version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c",
"versionType": "git"
},
{
"lessThan": "2e2baa8fb5aa4d080cbfeb84c51eff797529f413",
"status": "affected",
"version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c",
"versionType": "git"
},
{
"lessThan": "807e4fb5140c73eb5dba1e399a990db5c1f3cdf8",
"status": "affected",
"version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c",
"versionType": "git"
},
{
"lessThan": "c65f1b840ab8ce72ba68f1b63bab7960f8fdfa89",
"status": "affected",
"version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c",
"versionType": "git"
},
{
"lessThan": "078b446efc0f5e496c31bccb72b98af979963a83",
"status": "affected",
"version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c",
"versionType": "git"
},
{
"lessThan": "c1c8550e70401159184130a1afc6261db01fc0ce",
"status": "affected",
"version": "7faac1953ed1f658f719cdf7bb7303fa5eef822c",
"versionType": "git"
},
{
"status": "affected",
"version": "cc7c2818c71ebace207df40cc586c8c74e3d1a59",
"versionType": "git"
},
{
"status": "affected",
"version": "ec0cddcc2454ab08193beb473978f8f8889b7e24",
"versionType": "git"
},
{
"lessThan": "5.10.253",
"status": "affected",
"version": "5.10.85",
"versionType": "semver"
},
{
"lessThan": "5.15.203",
"status": "affected",
"version": "5.15.8",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.221",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.165",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/host/xhci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.10.85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.15.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.221",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.165",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Fix memory leak in xhci_disable_slot()\n\nxhci_alloc_command() allocates a command structure and, when the\nsecond argument is true, also allocates a completion structure.\nCurrently, the error handling path in xhci_disable_slot() only frees\nthe command structure using kfree(), causing the completion structure\nto leak.\n\nUse xhci_free_command() instead of kfree(). xhci_free_command() correctly\nfrees both the command structure and the associated completion structure.\nSince the command structure is allocated with zero-initialization,\ncommand-\u003ein_ctx is NULL and will not be erroneously freed by\nxhci_free_command().\n\nThis bug was found using an experimental static analysis tool we are\ndeveloping. The tool is based on the LLVM framework and is specifically\ndesigned to detect memory management issues. It is currently under\nactive development and not yet publicly available, but we plan to\nopen-source it after our research is published.\n\nThe bug was originally detected on v6.13-rc1 using our static analysis\ntool, and we have verified that the issue persists in the latest mainline\nkernel.\n\nWe performed build testing on x86_64 with allyesconfig using GCC=11.4.0.\nSince triggering these error paths in xhci_disable_slot() requires specific\nhardware conditions or abnormal state, we were unable to construct a test\ncase to reliably trigger these specific error paths at runtime."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:06:59.368Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1e800e26d54ccf2ddf2ea6d6cbe021c804d8aa62"
},
{
"url": "https://git.kernel.org/stable/c/6288baf0c8c4dcfbf206773aede9c1f2269cec28"
},
{
"url": "https://git.kernel.org/stable/c/46aea90763832cd6e9b0c2e1c00e6a9512156d4b"
},
{
"url": "https://git.kernel.org/stable/c/2e2baa8fb5aa4d080cbfeb84c51eff797529f413"
},
{
"url": "https://git.kernel.org/stable/c/807e4fb5140c73eb5dba1e399a990db5c1f3cdf8"
},
{
"url": "https://git.kernel.org/stable/c/c65f1b840ab8ce72ba68f1b63bab7960f8fdfa89"
},
{
"url": "https://git.kernel.org/stable/c/078b446efc0f5e496c31bccb72b98af979963a83"
},
{
"url": "https://git.kernel.org/stable/c/c1c8550e70401159184130a1afc6261db01fc0ce"
}
],
"title": "usb: xhci: Fix memory leak in xhci_disable_slot()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43432",
"datePublished": "2026-05-08T14:22:03.985Z",
"dateReserved": "2026-05-01T14:12:56.009Z",
"dateUpdated": "2026-05-23T16:06:59.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46261 (GCVE-0-2026-46261)
Vulnerability from cvelistv5
Published
2026-06-03 15:49
Modified
2026-06-03 15:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()
platform_get_resource_byname() can return NULL, which would cause a crash
when passed the pointer to resource_size().
Move the fiu->memory_size assignment after the error check for
devm_ioremap_resource() to prevent the potential NULL pointer dereference.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-wpcm-fiu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9e5cb7e67fbdb8320d68d87db882a92b36f6a1d9",
"status": "affected",
"version": "9838c182471ee5532824bae7f2669d3539719f78",
"versionType": "git"
},
{
"lessThan": "2c538a0b3472e99c892c26f4940da38b7d87f632",
"status": "affected",
"version": "9838c182471ee5532824bae7f2669d3539719f78",
"versionType": "git"
},
{
"lessThan": "0f93a80eb3fd596ddc5730d05e0e8c88e1aa2891",
"status": "affected",
"version": "9838c182471ee5532824bae7f2669d3539719f78",
"versionType": "git"
},
{
"lessThan": "cb9b2dc34a9eef0855edb00ae9c9b7f72394281b",
"status": "affected",
"version": "9838c182471ee5532824bae7f2669d3539719f78",
"versionType": "git"
},
{
"lessThan": "888a0a802c467bbe34a42167bdf9d7331333440a",
"status": "affected",
"version": "9838c182471ee5532824bae7f2669d3539719f78",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-wpcm-fiu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()\n\nplatform_get_resource_byname() can return NULL, which would cause a crash\nwhen passed the pointer to resource_size().\n\nMove the fiu-\u003ememory_size assignment after the error check for\ndevm_ioremap_resource() to prevent the potential NULL pointer dereference."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T15:49:58.684Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9e5cb7e67fbdb8320d68d87db882a92b36f6a1d9"
},
{
"url": "https://git.kernel.org/stable/c/2c538a0b3472e99c892c26f4940da38b7d87f632"
},
{
"url": "https://git.kernel.org/stable/c/0f93a80eb3fd596ddc5730d05e0e8c88e1aa2891"
},
{
"url": "https://git.kernel.org/stable/c/cb9b2dc34a9eef0855edb00ae9c9b7f72394281b"
},
{
"url": "https://git.kernel.org/stable/c/888a0a802c467bbe34a42167bdf9d7331333440a"
}
],
"title": "spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46261",
"datePublished": "2026-06-03T15:49:58.684Z",
"dateReserved": "2026-05-13T15:03:33.108Z",
"dateUpdated": "2026-06-03T15:49:58.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43196 (GCVE-0-2026-43196)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
soc: ti: pruss: Fix double free in pruss_clk_mux_setup()
In the pruss_clk_mux_setup(), the devm_add_action_or_reset() indirectly
calls pruss_of_free_clk_provider(), which calls of_node_put(clk_mux_np)
on the error path. However, after the devm_add_action_or_reset()
returns, the of_node_put(clk_mux_np) is called again, causing a double
free.
Fix by returning directly, to avoid the duplicate of_node_put().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ba59c9b43c86b2c2396acac94e41d946cbaec9fe Version: ba59c9b43c86b2c2396acac94e41d946cbaec9fe Version: ba59c9b43c86b2c2396acac94e41d946cbaec9fe Version: ba59c9b43c86b2c2396acac94e41d946cbaec9fe Version: ba59c9b43c86b2c2396acac94e41d946cbaec9fe Version: ba59c9b43c86b2c2396acac94e41d946cbaec9fe Version: ba59c9b43c86b2c2396acac94e41d946cbaec9fe Version: ba59c9b43c86b2c2396acac94e41d946cbaec9fe |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/soc/ti/pruss.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dbda01bf2dfe5af33163e1e5fca1b82b619c2803",
"status": "affected",
"version": "ba59c9b43c86b2c2396acac94e41d946cbaec9fe",
"versionType": "git"
},
{
"lessThan": "24c40076e3bc3d73c839c886d6bda1da6c4d9b93",
"status": "affected",
"version": "ba59c9b43c86b2c2396acac94e41d946cbaec9fe",
"versionType": "git"
},
{
"lessThan": "818cf66d91c8ef09b01664a12d5f4ea786d64396",
"status": "affected",
"version": "ba59c9b43c86b2c2396acac94e41d946cbaec9fe",
"versionType": "git"
},
{
"lessThan": "e113339cc7d23be4948891f3a702e9dce5b47035",
"status": "affected",
"version": "ba59c9b43c86b2c2396acac94e41d946cbaec9fe",
"versionType": "git"
},
{
"lessThan": "69aa67c1e22d13e9aad4b08c86304ad8e743dcab",
"status": "affected",
"version": "ba59c9b43c86b2c2396acac94e41d946cbaec9fe",
"versionType": "git"
},
{
"lessThan": "b7db9953c2f8da37de498198623b05b46f8e2ca0",
"status": "affected",
"version": "ba59c9b43c86b2c2396acac94e41d946cbaec9fe",
"versionType": "git"
},
{
"lessThan": "04dbbb18cc9c8795c9ff47d8994bc03ebfef9d68",
"status": "affected",
"version": "ba59c9b43c86b2c2396acac94e41d946cbaec9fe",
"versionType": "git"
},
{
"lessThan": "80db65d4acfb9ff12d00172aed39ea8b98261aad",
"status": "affected",
"version": "ba59c9b43c86b2c2396acac94e41d946cbaec9fe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/soc/ti/pruss.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: ti: pruss: Fix double free in pruss_clk_mux_setup()\n\nIn the pruss_clk_mux_setup(), the devm_add_action_or_reset() indirectly\ncalls pruss_of_free_clk_provider(), which calls of_node_put(clk_mux_np)\non the error path. However, after the devm_add_action_or_reset()\nreturns, the of_node_put(clk_mux_np) is called again, causing a double\nfree.\n\nFix by returning directly, to avoid the duplicate of_node_put()."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:19:42.186Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dbda01bf2dfe5af33163e1e5fca1b82b619c2803"
},
{
"url": "https://git.kernel.org/stable/c/24c40076e3bc3d73c839c886d6bda1da6c4d9b93"
},
{
"url": "https://git.kernel.org/stable/c/818cf66d91c8ef09b01664a12d5f4ea786d64396"
},
{
"url": "https://git.kernel.org/stable/c/e113339cc7d23be4948891f3a702e9dce5b47035"
},
{
"url": "https://git.kernel.org/stable/c/69aa67c1e22d13e9aad4b08c86304ad8e743dcab"
},
{
"url": "https://git.kernel.org/stable/c/b7db9953c2f8da37de498198623b05b46f8e2ca0"
},
{
"url": "https://git.kernel.org/stable/c/04dbbb18cc9c8795c9ff47d8994bc03ebfef9d68"
},
{
"url": "https://git.kernel.org/stable/c/80db65d4acfb9ff12d00172aed39ea8b98261aad"
}
],
"title": "soc: ti: pruss: Fix double free in pruss_clk_mux_setup()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43196",
"datePublished": "2026-05-06T11:28:04.132Z",
"dateReserved": "2026-05-01T14:12:55.992Z",
"dateUpdated": "2026-05-11T22:19:42.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52924 (GCVE-0-2026-52924)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-08-26 12:04
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: purge outqueue on stale COOKIE-ECHO handling
sctp_stream_update() is only invoked when the association is moved into
COOKIE_WAIT during association setup/reconfiguration. In this path, the
outbound stream scheduler state (stream->out_curr) is expected to be
clean, since no user data should have been transmitted yet unless the
state machine has already partially progressed.
However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a
Stale Cookie ERROR is received, the association is rolled back from
COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already
have been queued and even bundled with the COOKIE-ECHO chunk.
During the rollback, sctp_stream_update() frees the old stream table
and installs a new one, but it does not invalidate stream->out_curr.
As a result, out_curr may still point to a freed sctp_stream_out
entry from the previous stream state.
Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on
stream->out_curr->ext, which can lead to use-after-free once the old
stream state has been released via sctp_stream_free().
This results in crashes such as (reported by Yuqi):
BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140
Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312
CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted
7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)
sctp_sched_fcfs_dequeue+0x13a/0x140
sctp_outq_flush+0x1603/0x33e0
sctp_do_sm+0x31c9/0x5d30
sctp_assoc_bh_rcv+0x392/0x6f0
sctp_inq_push+0x1db/0x270
sctp_rcv+0x138d/0x3c10
Fix this by fully purging the association outqueue when handling the
Stale Cookie case. This ensures all pending transmit and retransmit
state is dropped, and any scheduler cached pointers are invalidated,
making it safe to rebuild stream state during COOKIE_WAIT restart.
Updating only stream->out_curr would be insufficient, since queued
and retransmittable data would still reference the old stream state and
trigger later use-after-free in dequeue paths.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 Version: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 Version: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 Version: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 Version: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 Version: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 Version: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 Version: 5bbbbe32a43199c2b9ea5ea66fab6241c64beb51 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.158.1.rt7.499.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.158.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.42.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Stream Control Transmission Protocol (SCTP) implementation. This vulnerability, a use-after-free, occurs when the system processes a Stale Cookie ERROR during the setup or reconfiguration of an SCTP association. A remote attacker could exploit this by sending specially crafted SCTP packets. This could lead to a system crash, causing a Denial of Service (DoS)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-825",
"description": "Expired Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:04:46.663Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52924"
},
{
"name": "RHBZ#2492095",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492095"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52924.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59723"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59821"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59737"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:59723: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:59821: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:59737: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: sctp: purge outqueue on stale COOKIE-ECHO handling",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_statefuns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "84b7a319105db2f917ccdcf502bdc866082b1285",
"status": "affected",
"version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
"versionType": "git"
},
{
"lessThan": "f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8",
"status": "affected",
"version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
"versionType": "git"
},
{
"lessThan": "3c0741a441a7df7099d7ca6a64a6a0de09c677c8",
"status": "affected",
"version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
"versionType": "git"
},
{
"lessThan": "2afc9e684dc7fecf73db1edc937ebbc47b4b68dc",
"status": "affected",
"version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
"versionType": "git"
},
{
"lessThan": "1d4652f677906a64487c13f9ace54b0eb263b5d0",
"status": "affected",
"version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
"versionType": "git"
},
{
"lessThan": "a6207349e703cfc04756a4d16dec9176135813a5",
"status": "affected",
"version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
"versionType": "git"
},
{
"lessThan": "83ade59e5da365f4bf8bce72c5a38774202b442f",
"status": "affected",
"version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
"versionType": "git"
},
{
"lessThan": "e374b22e9b07b72a25909621464ff74096151bfb",
"status": "affected",
"version": "5bbbbe32a43199c2b9ea5ea66fab6241c64beb51",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_statefuns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: purge outqueue on stale COOKIE-ECHO handling\n\nsctp_stream_update() is only invoked when the association is moved into\nCOOKIE_WAIT during association setup/reconfiguration. In this path, the\noutbound stream scheduler state (stream-\u003eout_curr) is expected to be\nclean, since no user data should have been transmitted yet unless the\nstate machine has already partially progressed.\n\nHowever, a corner case exists in sctp_sf_do_5_2_6_stale(): when a\nStale Cookie ERROR is received, the association is rolled back from\nCOOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already\nhave been queued and even bundled with the COOKIE-ECHO chunk.\n\nDuring the rollback, sctp_stream_update() frees the old stream table\nand installs a new one, but it does not invalidate stream-\u003eout_curr.\nAs a result, out_curr may still point to a freed sctp_stream_out\nentry from the previous stream state.\n\nLater, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on\nstream-\u003eout_curr-\u003eext, which can lead to use-after-free once the old\nstream state has been released via sctp_stream_free().\n\nThis results in crashes such as (reported by Yuqi):\n\n BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140\n Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312\n CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted\n 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)\n sctp_sched_fcfs_dequeue+0x13a/0x140\n sctp_outq_flush+0x1603/0x33e0\n sctp_do_sm+0x31c9/0x5d30\n sctp_assoc_bh_rcv+0x392/0x6f0\n sctp_inq_push+0x1db/0x270\n sctp_rcv+0x138d/0x3c10\n\nFix this by fully purging the association outqueue when handling the\nStale Cookie case. This ensures all pending transmit and retransmit\nstate is dropped, and any scheduler cached pointers are invalidated,\nmaking it safe to rebuild stream state during COOKIE_WAIT restart.\n\nUpdating only stream-\u003eout_curr would be insufficient, since queued\nand retransmittable data would still reference the old stream state and\ntrigger later use-after-free in dequeue paths."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable SCTP state-machine path is reached by received SCTP packets, specifically an ERROR chunk with a Stale Cookie cause sent by the remote SCTP peer during COOKIE_ECHOED handling.\nAC:L - A malicious SCTP peer can drive the required handshake state and send the stale-cookie ERROR; no race or hard-to-control kernel condition is required once data has been queued for COOKIE-ECHO bundling.\nPR:N - The triggering packet is accepted from the network after SCTP verification-tag checks, but those are protocol state checks rather than authentication or privileges. No local account or administrative capability is required for a remote peer.\nUI:N - Exploitation does not require a human user action; it can occur during normal SCTP association setup and data transmission with a malicious peer.\nS:U - The impact is within the Linux kernel networking stack on the same system and does not cross a separate security authority such as a hypervisor or sandbox boundary.\nC:H - The bug leaves stream-\u003eout_curr pointing at freed stream state, creating a use-after-free in scheduler dequeue paths. Per kernel CVSS guidance, use-after-free memory corruption can be leveraged for high confidentiality impact.\nI:H - The stale pointer use-after-free is kernel heap memory corruption and may be exploitable beyond a crash via heap manipulation. Per the required guidance, UAFs warrant high integrity impact.\nA:H - The reported failure is a KASAN slab-use-after-free in SCTP dequeue leading to a kernel crash/oops. This provides high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:45.688Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/84b7a319105db2f917ccdcf502bdc866082b1285"
},
{
"url": "https://git.kernel.org/stable/c/f46e1d1a758878f0d22c4fbbd1bf42bb7165d1e8"
},
{
"url": "https://git.kernel.org/stable/c/3c0741a441a7df7099d7ca6a64a6a0de09c677c8"
},
{
"url": "https://git.kernel.org/stable/c/2afc9e684dc7fecf73db1edc937ebbc47b4b68dc"
},
{
"url": "https://git.kernel.org/stable/c/1d4652f677906a64487c13f9ace54b0eb263b5d0"
},
{
"url": "https://git.kernel.org/stable/c/a6207349e703cfc04756a4d16dec9176135813a5"
},
{
"url": "https://git.kernel.org/stable/c/83ade59e5da365f4bf8bce72c5a38774202b442f"
},
{
"url": "https://git.kernel.org/stable/c/e374b22e9b07b72a25909621464ff74096151bfb"
}
],
"title": "sctp: purge outqueue on stale COOKIE-ECHO handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52924",
"datePublished": "2026-06-24T07:14:18.646Z",
"dateReserved": "2026-06-09T07:44:35.368Z",
"dateUpdated": "2026-08-26T12:04:46.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45994 (GCVE-0-2026-45994)
Vulnerability from cvelistv5
Published
2026-05-27 12:55
Modified
2026-06-14 17:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ibmasm: fix OOB reads in command_file_write due to missing size checks
The command_file_write() handler allocates a kernel buffer of exactly
count bytes and copies user data into it, but does not validate the
buffer against the dot command protocol before passing it to
get_dot_command_size() and get_dot_command_timeout().
Since both the allocation size (count) and the header fields (command_size,
data_size) are independently user-controlled, an attacker can cause
get_dot_command_size() to return a value exceeding the allocation,
triggering OOB reads in get_dot_command_timeout() and an out-of-bounds
memcpy_toio() that leaks kernel heap memory to the service processor.
Fix with two guards: reject writes smaller than sizeof(struct
dot_command_header) before allocation, then after copying user data
reject commands where the buffer is smaller than the total size declared
by the header (sizeof(header) + command_size + data_size). This ensures
all subsequent header and payload field accesses stay within the buffer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/misc/ibmasm/ibmasmfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "44ee19422aa82a6847594866de7e5a31e4ef98b3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7b8a574da5d7ea99b943f7a3458a17a1d95e8838",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d50e2019c9d7c433f56d9dff65703eb904aa1fb1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a672682d39dd34e2b5ba4feb436723bed65125ff",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "aefc1a97da17d8309974690c8a03e439a91ebb1c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ee5737891464030a189837467df3b81a273718ad",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d0fb4d1dc43f8d5179917a2daaa82680993d4cdf",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0eb09f737428e482a32a2e31e5e223f2b35a71d3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/misc/ibmasm/ibmasmfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmasm: fix OOB reads in command_file_write due to missing size checks\n\nThe command_file_write() handler allocates a kernel buffer of exactly\ncount bytes and copies user data into it, but does not validate the\nbuffer against the dot command protocol before passing it to\nget_dot_command_size() and get_dot_command_timeout().\n\nSince both the allocation size (count) and the header fields (command_size,\ndata_size) are independently user-controlled, an attacker can cause\nget_dot_command_size() to return a value exceeding the allocation,\ntriggering OOB reads in get_dot_command_timeout() and an out-of-bounds\nmemcpy_toio() that leaks kernel heap memory to the service processor.\n\nFix with two guards: reject writes smaller than sizeof(struct\ndot_command_header) before allocation, then after copying user data\nreject commands where the buffer is smaller than the total size declared\nby the header (sizeof(header) + command_size + data_size). This ensures\nall subsequent header and payload field accesses stay within the buffer."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:46:55.731Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/44ee19422aa82a6847594866de7e5a31e4ef98b3"
},
{
"url": "https://git.kernel.org/stable/c/7b8a574da5d7ea99b943f7a3458a17a1d95e8838"
},
{
"url": "https://git.kernel.org/stable/c/d50e2019c9d7c433f56d9dff65703eb904aa1fb1"
},
{
"url": "https://git.kernel.org/stable/c/a672682d39dd34e2b5ba4feb436723bed65125ff"
},
{
"url": "https://git.kernel.org/stable/c/aefc1a97da17d8309974690c8a03e439a91ebb1c"
},
{
"url": "https://git.kernel.org/stable/c/ee5737891464030a189837467df3b81a273718ad"
},
{
"url": "https://git.kernel.org/stable/c/d0fb4d1dc43f8d5179917a2daaa82680993d4cdf"
},
{
"url": "https://git.kernel.org/stable/c/0eb09f737428e482a32a2e31e5e223f2b35a71d3"
}
],
"title": "ibmasm: fix OOB reads in command_file_write due to missing size checks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45994",
"datePublished": "2026-05-27T12:55:47.612Z",
"dateReserved": "2026-05-13T15:03:33.091Z",
"dateUpdated": "2026-06-14T17:46:55.731Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31651 (GCVE-0-2026-31651)
Vulnerability from cvelistv5
Published
2026-04-24 14:45
Modified
2026-07-14 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mmc: vub300: fix NULL-deref on disconnect
Make sure to deregister the controller before dropping the reference to
the driver data on disconnect to avoid NULL-pointer dereferences or
use-after-free.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 88095e7b473a3d9ec3b9c60429576e9cbd327c89 Version: 88095e7b473a3d9ec3b9c60429576e9cbd327c89 Version: 88095e7b473a3d9ec3b9c60429576e9cbd327c89 Version: 88095e7b473a3d9ec3b9c60429576e9cbd327c89 Version: 88095e7b473a3d9ec3b9c60429576e9cbd327c89 Version: 88095e7b473a3d9ec3b9c60429576e9cbd327c89 Version: 88095e7b473a3d9ec3b9c60429576e9cbd327c89 Version: 88095e7b473a3d9ec3b9c60429576e9cbd327c89 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:29.192Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/vub300.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6446516e626ce7c44bdadbcbb3d7677a2c52ce93",
"status": "affected",
"version": "88095e7b473a3d9ec3b9c60429576e9cbd327c89",
"versionType": "git"
},
{
"lessThan": "ba3b9429de94958dc0060d9816a915dd75c34919",
"status": "affected",
"version": "88095e7b473a3d9ec3b9c60429576e9cbd327c89",
"versionType": "git"
},
{
"lessThan": "517b58e1d067115f80d198feee10192da4c424d0",
"status": "affected",
"version": "88095e7b473a3d9ec3b9c60429576e9cbd327c89",
"versionType": "git"
},
{
"lessThan": "6468cab1173f44f7a4b7a05ce8abfdfd1ce1557a",
"status": "affected",
"version": "88095e7b473a3d9ec3b9c60429576e9cbd327c89",
"versionType": "git"
},
{
"lessThan": "53f2642d77ab5f1f303388bff5500363c6cf962c",
"status": "affected",
"version": "88095e7b473a3d9ec3b9c60429576e9cbd327c89",
"versionType": "git"
},
{
"lessThan": "c83a282615d8f7ba28cebddd54600b419d562d82",
"status": "affected",
"version": "88095e7b473a3d9ec3b9c60429576e9cbd327c89",
"versionType": "git"
},
{
"lessThan": "8d09e75759cb2afc0732acfb5a14a93c03805a61",
"status": "affected",
"version": "88095e7b473a3d9ec3b9c60429576e9cbd327c89",
"versionType": "git"
},
{
"lessThan": "dff34ef879c5e73298443956a8b391311ba78d57",
"status": "affected",
"version": "88095e7b473a3d9ec3b9c60429576e9cbd327c89",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mmc/host/vub300.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.169",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.135",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.169",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.135",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.82",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: vub300: fix NULL-deref on disconnect\n\nMake sure to deregister the controller before dropping the reference to\nthe driver data on disconnect to avoid NULL-pointer dereferences or\nuse-after-free."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:12:56.346Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6446516e626ce7c44bdadbcbb3d7677a2c52ce93"
},
{
"url": "https://git.kernel.org/stable/c/ba3b9429de94958dc0060d9816a915dd75c34919"
},
{
"url": "https://git.kernel.org/stable/c/517b58e1d067115f80d198feee10192da4c424d0"
},
{
"url": "https://git.kernel.org/stable/c/6468cab1173f44f7a4b7a05ce8abfdfd1ce1557a"
},
{
"url": "https://git.kernel.org/stable/c/53f2642d77ab5f1f303388bff5500363c6cf962c"
},
{
"url": "https://git.kernel.org/stable/c/c83a282615d8f7ba28cebddd54600b419d562d82"
},
{
"url": "https://git.kernel.org/stable/c/8d09e75759cb2afc0732acfb5a14a93c03805a61"
},
{
"url": "https://git.kernel.org/stable/c/dff34ef879c5e73298443956a8b391311ba78d57"
}
],
"title": "mmc: vub300: fix NULL-deref on disconnect",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31651",
"datePublished": "2026-04-24T14:45:03.905Z",
"dateReserved": "2026-03-09T15:48:24.128Z",
"dateUpdated": "2026-07-14T12:48:29.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31615 (GCVE-0-2026-31615)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: renesas_usb3: validate endpoint index in standard request handlers
The GET_STATUS and SET/CLEAR_FEATURE handlers extract the endpoint
number from the host-supplied wIndex without any sort of validation.
Fix this up by validating the number of endpoints actually match up with
the number the device has before attempting to dereference a pointer
based on this math.
This is just like what was done in commit ee0d382feb44 ("usb: gadget:
aspeed_udc: validate endpoint index for ast udc") for the aspeed driver.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 746bfe63bba37ad55956b7377c9af494e7e28929 Version: 746bfe63bba37ad55956b7377c9af494e7e28929 Version: 746bfe63bba37ad55956b7377c9af494e7e28929 Version: 746bfe63bba37ad55956b7377c9af494e7e28929 Version: 746bfe63bba37ad55956b7377c9af494e7e28929 Version: 746bfe63bba37ad55956b7377c9af494e7e28929 Version: 746bfe63bba37ad55956b7377c9af494e7e28929 Version: 746bfe63bba37ad55956b7377c9af494e7e28929 Version: 746bfe63bba37ad55956b7377c9af494e7e28929 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/udc/renesas_usb3.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7caaf76207f50c77abfd788380e19b2c23a94415",
"status": "affected",
"version": "746bfe63bba37ad55956b7377c9af494e7e28929",
"versionType": "git"
},
{
"lessThan": "c4e5ae6db2328d2d9ed55d3005a36c13faab0752",
"status": "affected",
"version": "746bfe63bba37ad55956b7377c9af494e7e28929",
"versionType": "git"
},
{
"lessThan": "360aa6e71870a175a6d86af905be2ca171639eb3",
"status": "affected",
"version": "746bfe63bba37ad55956b7377c9af494e7e28929",
"versionType": "git"
},
{
"lessThan": "1b2bfedccc4fb8c9572e1ea464f905424c91de2a",
"status": "affected",
"version": "746bfe63bba37ad55956b7377c9af494e7e28929",
"versionType": "git"
},
{
"lessThan": "adb8014599fdf0818d3d93f1f74e06cd0bdec08d",
"status": "affected",
"version": "746bfe63bba37ad55956b7377c9af494e7e28929",
"versionType": "git"
},
{
"lessThan": "44216e3dd4455b798899b50eedb0ec3831dff8e0",
"status": "affected",
"version": "746bfe63bba37ad55956b7377c9af494e7e28929",
"versionType": "git"
},
{
"lessThan": "37f430b2240655e6b0199a92aa1057e4d621be51",
"status": "affected",
"version": "746bfe63bba37ad55956b7377c9af494e7e28929",
"versionType": "git"
},
{
"lessThan": "e3d42598f2995cdc07b7779874e7c5f8a1b773db",
"status": "affected",
"version": "746bfe63bba37ad55956b7377c9af494e7e28929",
"versionType": "git"
},
{
"lessThan": "f880aac8a57ebd92abfa685d45424b2998ac1059",
"status": "affected",
"version": "746bfe63bba37ad55956b7377c9af494e7e28929",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/udc/renesas_usb3.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: renesas_usb3: validate endpoint index in standard request handlers\n\nThe GET_STATUS and SET/CLEAR_FEATURE handlers extract the endpoint\nnumber from the host-supplied wIndex without any sort of validation.\nFix this up by validating the number of endpoints actually match up with\nthe number the device has before attempting to dereference a pointer\nbased on this math.\n\nThis is just like what was done in commit ee0d382feb44 (\"usb: gadget:\naspeed_udc: validate endpoint index for ast udc\") for the aspeed driver."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:42:59.822Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7caaf76207f50c77abfd788380e19b2c23a94415"
},
{
"url": "https://git.kernel.org/stable/c/c4e5ae6db2328d2d9ed55d3005a36c13faab0752"
},
{
"url": "https://git.kernel.org/stable/c/360aa6e71870a175a6d86af905be2ca171639eb3"
},
{
"url": "https://git.kernel.org/stable/c/1b2bfedccc4fb8c9572e1ea464f905424c91de2a"
},
{
"url": "https://git.kernel.org/stable/c/adb8014599fdf0818d3d93f1f74e06cd0bdec08d"
},
{
"url": "https://git.kernel.org/stable/c/44216e3dd4455b798899b50eedb0ec3831dff8e0"
},
{
"url": "https://git.kernel.org/stable/c/37f430b2240655e6b0199a92aa1057e4d621be51"
},
{
"url": "https://git.kernel.org/stable/c/e3d42598f2995cdc07b7779874e7c5f8a1b773db"
},
{
"url": "https://git.kernel.org/stable/c/f880aac8a57ebd92abfa685d45424b2998ac1059"
}
],
"title": "usb: gadget: renesas_usb3: validate endpoint index in standard request handlers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31615",
"datePublished": "2026-04-24T14:42:34.806Z",
"dateReserved": "2026-03-09T15:48:24.123Z",
"dateUpdated": "2026-06-14T17:42:59.822Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53093 (GCVE-0-2026-53093)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: Fix error pointer dereference
The function brcmf_chip_add_core() can return an error pointer and is
not checked. Add checks for error pointer.
Detected by Smatch:
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1010 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1013 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1016 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1019 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1022 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()
[add missing wifi: prefix]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cb7cf7be9eba76f3cd6258906074c72084570c84 Version: cb7cf7be9eba76f3cd6258906074c72084570c84 Version: cb7cf7be9eba76f3cd6258906074c72084570c84 Version: cb7cf7be9eba76f3cd6258906074c72084570c84 Version: cb7cf7be9eba76f3cd6258906074c72084570c84 Version: cb7cf7be9eba76f3cd6258906074c72084570c84 Version: cb7cf7be9eba76f3cd6258906074c72084570c84 Version: cb7cf7be9eba76f3cd6258906074c72084570c84 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a3b45090a91e2f0b9715870d8f8d9ca2fdfbc1af",
"status": "affected",
"version": "cb7cf7be9eba76f3cd6258906074c72084570c84",
"versionType": "git"
},
{
"lessThan": "99ef547659178eef6d6ba4738a9d989ce90cf909",
"status": "affected",
"version": "cb7cf7be9eba76f3cd6258906074c72084570c84",
"versionType": "git"
},
{
"lessThan": "bd6c906e0c4af6d5d0c49c3c4ee090b4913da17d",
"status": "affected",
"version": "cb7cf7be9eba76f3cd6258906074c72084570c84",
"versionType": "git"
},
{
"lessThan": "d3f280be48f1c672cb10e8026c236d0cca60048a",
"status": "affected",
"version": "cb7cf7be9eba76f3cd6258906074c72084570c84",
"versionType": "git"
},
{
"lessThan": "2e0e5a43ed126f896a4ad31ade66c90270601bae",
"status": "affected",
"version": "cb7cf7be9eba76f3cd6258906074c72084570c84",
"versionType": "git"
},
{
"lessThan": "cbea71b4480394708f9a6e007a0385acfe5e1ec8",
"status": "affected",
"version": "cb7cf7be9eba76f3cd6258906074c72084570c84",
"versionType": "git"
},
{
"lessThan": "334c68750eee84c2327db1d152be83ff5ad8e20b",
"status": "affected",
"version": "cb7cf7be9eba76f3cd6258906074c72084570c84",
"versionType": "git"
},
{
"lessThan": "dd8592fc6007a451c3e4b9025de365e39de8178a",
"status": "affected",
"version": "cb7cf7be9eba76f3cd6258906074c72084570c84",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Fix error pointer dereference\n\nThe function brcmf_chip_add_core() can return an error pointer and is\nnot checked. Add checks for error pointer.\n\nDetected by Smatch:\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1010 brcmf_chip_recognition() error:\n\u0027core\u0027 dereferencing possible ERR_PTR()\n\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1013 brcmf_chip_recognition() error:\n\u0027core\u0027 dereferencing possible ERR_PTR()\n\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1016 brcmf_chip_recognition() error:\n\u0027core\u0027 dereferencing possible ERR_PTR()\n\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1019 brcmf_chip_recognition() error:\n\u0027core\u0027 dereferencing possible ERR_PTR()\n\ndrivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1022 brcmf_chip_recognition() error:\n\u0027core\u0027 dereferencing possible ERR_PTR()\n\n[add missing wifi: prefix]"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:32.053Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a3b45090a91e2f0b9715870d8f8d9ca2fdfbc1af"
},
{
"url": "https://git.kernel.org/stable/c/99ef547659178eef6d6ba4738a9d989ce90cf909"
},
{
"url": "https://git.kernel.org/stable/c/bd6c906e0c4af6d5d0c49c3c4ee090b4913da17d"
},
{
"url": "https://git.kernel.org/stable/c/d3f280be48f1c672cb10e8026c236d0cca60048a"
},
{
"url": "https://git.kernel.org/stable/c/2e0e5a43ed126f896a4ad31ade66c90270601bae"
},
{
"url": "https://git.kernel.org/stable/c/cbea71b4480394708f9a6e007a0385acfe5e1ec8"
},
{
"url": "https://git.kernel.org/stable/c/334c68750eee84c2327db1d152be83ff5ad8e20b"
},
{
"url": "https://git.kernel.org/stable/c/dd8592fc6007a451c3e4b9025de365e39de8178a"
}
],
"title": "wifi: brcmfmac: Fix error pointer dereference",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53093",
"datePublished": "2026-06-24T16:30:32.053Z",
"dateReserved": "2026-06-09T07:44:35.384Z",
"dateUpdated": "2026-06-24T16:30:32.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46116 (GCVE-0-2026-46116)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-08-25 12:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s
hlist_del_rcu calls under syzkaller load on linux-6.12.y stable
(reproduced on 6.12.47, also reachable via the same code path on
torvalds/master and on the ipsec tree). Nine unique signatures cluster
in the xfrm_state lifecycle, the load-bearing one being:
BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline]
BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline]
BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c
Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435
Workqueue: netns cleanup_net
Call Trace:
__hlist_del / hlist_del_rcu
__xfrm_state_delete
xfrm_state_delete
xfrm_state_flush
xfrm_state_fini
ops_exit_list
cleanup_net
The other observed signatures hit the same slab object from
__xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB
write variant of __xfrm_state_delete, all on the byseq/byspi
hash chains.
__xfrm_state_delete() guards its byseq and byspi unhashes with
value-based predicates:
if (x->km.seq)
hlist_del_rcu(&x->byseq);
if (x->id.spi)
hlist_del_rcu(&x->byspi);
while everywhere else in the file (e.g. state_cache, state_cache_input)
the safer hlist_unhashed() check is used. xfrm_alloc_spi() sets
x->id.spi = newspi inside xfrm_state_lock and then immediately inserts
into byspi, but a path that observes x->id.spi != 0 outside of
xfrm_state_lock can still skip-or-hit the byspi unhash inconsistently
with whether x is actually on the list. The same holds for x->km.seq
versus byseq, and the bydst/bysrc unhashes have no predicate at all,
so a second __xfrm_state_delete() on the same object writes through
LIST_POISON pprev.
The defensive change here:
- Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst,
bysrc, byseq and byspi so a second deletion is a no-op rather
than a write through LIST_POISON pprev. The byseq/byspi nodes
are already initialised in xfrm_state_alloc().
- Test hlist_unhashed() rather than the value predicate for
byseq/byspi, so the unhash decision tracks list state rather than
mutable scalar fields.
Empirical verification: applied this patch on top of v6.12.47, rebuilt,
and re-ran the same syzkaller harness for 1h16m on a previously-crashy
configuration that produced ~100 hits each of slab-use-after-free
Read in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in
__xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at
~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo
confirms the xfrm_state slab is actively allocated and freed during
the run (~143 KiB resident), so the fuzzer is still exercising those
code paths -- they just no longer crash.
Reproduction:
- Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV
- syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db
- 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal
- 9 unique signatures collected in ~9h, all within xfrm_state
lifecycle
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 Version: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 Version: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 Version: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 Version: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 Version: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 Version: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 Version: 7b4dc3600e4877178ba94c7fbf7e520421378aa6 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.37.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.88.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_extras_rt_els:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.10.0-1160.156.1.rt56.1308.el7",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.10.0-1160.156.1.el7",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.144.1.rt7.485.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.144.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.199.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.199.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.204.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.204.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.156.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.156.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.22.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.183.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.183.1.rt14.468.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.139.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.129.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s `xfrm` (IPSec framework) subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of `xfrm_state` lists. An attacker with local access could exploit this flaw by triggering specific operations, leading to memory corruption. This could cause the system to become unstable, resulting in crashes or a Denial of Service (DoS), and potentially allow for unauthorized access to sensitive information or increased privileges."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-763",
"description": "Release of Invalid Pointer or Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T12:05:58.654Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-46116"
},
{
"name": "RHBZ#2482523",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482523"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46116.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41235"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41234"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:39371"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42919"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47739"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:43231"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:44385"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36018"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59143"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:39179"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59146"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47633"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49033"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47869"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59142"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59147"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59145"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59148"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59149"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:39180"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47632"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:41235: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:41234: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:39371: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:42919: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:47739: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:43231: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:44385: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:36018: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:59143: Red Hat Enterprise Linux BaseOS (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:39179: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:59146: Red Hat Enterprise Linux BaseOS (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:47633: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:49033: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:47869: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:59142: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:59147: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:59145: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:59148: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:59149: Red Hat Enterprise Linux BaseOS (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:39180: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:47632: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-28T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-28T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6",
"status": "affected",
"version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
"versionType": "git"
},
{
"lessThan": "3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8",
"status": "affected",
"version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
"versionType": "git"
},
{
"lessThan": "2c617848ae6e4f07a3e397f604208c293bbecacc",
"status": "affected",
"version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
"versionType": "git"
},
{
"lessThan": "b4a53add2fa8f1b5aa17d4c5686c320785fab182",
"status": "affected",
"version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
"versionType": "git"
},
{
"lessThan": "26edb0a3c99f9d958c212be68b21f1221614dcf0",
"status": "affected",
"version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
"versionType": "git"
},
{
"lessThan": "4980162de555cb838f1a189ce7d2cbf5d2e7b050",
"status": "affected",
"version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
"versionType": "git"
},
{
"lessThan": "a2e2d08fb070fab4947447171f1c4e3ca5a188e5",
"status": "affected",
"version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
"versionType": "git"
},
{
"lessThan": "14acf9652e5690de3c7486c6db5fb8dafd0a32a3",
"status": "affected",
"version": "7b4dc3600e4877178ba94c7fbf7e520421378aa6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.19"
},
{
"lessThan": "2.6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: defensively unhash xfrm_state lists in __xfrm_state_delete\n\nKASAN reproduces a slab-use-after-free in __xfrm_state_delete()\u0027s\nhlist_del_rcu calls under syzkaller load on linux-6.12.y stable\n(reproduced on 6.12.47, also reachable via the same code path on\ntorvalds/master and on the ipsec tree). Nine unique signatures cluster\nin the xfrm_state lifecycle, the load-bearing one being:\n\n BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline]\n BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline]\n BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c\n Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435\n\n Workqueue: netns cleanup_net\n Call Trace:\n __hlist_del / hlist_del_rcu\n __xfrm_state_delete\n xfrm_state_delete\n xfrm_state_flush\n xfrm_state_fini\n ops_exit_list\n cleanup_net\n\nThe other observed signatures hit the same slab object from\n__xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB\nwrite variant of __xfrm_state_delete, all on the byseq/byspi\nhash chains.\n\n__xfrm_state_delete() guards its byseq and byspi unhashes with\nvalue-based predicates:\n\n\tif (x-\u003ekm.seq)\n\t\thlist_del_rcu(\u0026x-\u003ebyseq);\n\tif (x-\u003eid.spi)\n\t\thlist_del_rcu(\u0026x-\u003ebyspi);\n\nwhile everywhere else in the file (e.g. state_cache, state_cache_input)\nthe safer hlist_unhashed() check is used. xfrm_alloc_spi() sets\nx-\u003eid.spi = newspi inside xfrm_state_lock and then immediately inserts\ninto byspi, but a path that observes x-\u003eid.spi != 0 outside of\nxfrm_state_lock can still skip-or-hit the byspi unhash inconsistently\nwith whether x is actually on the list. The same holds for x-\u003ekm.seq\nversus byseq, and the bydst/bysrc unhashes have no predicate at all,\nso a second __xfrm_state_delete() on the same object writes through\nLIST_POISON pprev.\n\nThe defensive change here:\n\n - Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst,\n bysrc, byseq and byspi so a second deletion is a no-op rather\n than a write through LIST_POISON pprev. The byseq/byspi nodes\n are already initialised in xfrm_state_alloc().\n - Test hlist_unhashed() rather than the value predicate for\n byseq/byspi, so the unhash decision tracks list state rather than\n mutable scalar fields.\n\nEmpirical verification: applied this patch on top of v6.12.47, rebuilt,\nand re-ran the same syzkaller harness for 1h16m on a previously-crashy\nconfiguration that produced ~100 hits each of slab-use-after-free\nRead in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in\n__xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at\n~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo\nconfirms the xfrm_state slab is actively allocated and freed during\nthe run (~143 KiB resident), so the fuzzer is still exercising those\ncode paths -- they just no longer crash.\n\nReproduction:\n\n - Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV\n - syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db\n - 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal\n - 9 unique signatures collected in ~9h, all within xfrm_state\n lifecycle"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The xfrm_state lifecycle is reached through the NETLINK_XFRM and PF_KEY socket interfaces (local syscalls); the freed object and the race are set up by the attacker\u0027s local state-management operations, not by remote packets.\nAC:L - Although it is a race/double-free, the attacker controls all racing actors (concurrent DELSA/ALLOCSPI/FLUSHSA threads plus namespace teardown they trigger) and can repeat indefinitely; syzkaller hit it ~100 times per hour, so a targeted trigger is reliable.\nPR:L - All xfrm operations require CAP_NET_ADMIN, but the check is against the netns user namespace, so an unprivileged user obtains it via `unshare -Urn` and exercises the per-netns xfrm_state path.\nUI:N - The attacker performs all state creation, deletion and namespace teardown itself; no victim action is required.\nS:U - The corruption is confined to the kernel\u0027s own slab memory within the same security authority; it is not a hypervisor or IOMMU boundary crossing.\nC:H - The slab-use-after-free gives the attacker control over freed xfrm_state contents and read-UAF sites (xfrm_alloc_spi/__xfrm_state_lookup), enabling arbitrary kernel memory disclosure.\nI:H - The UAF/OOB writes an attacker-influenced 8-byte list pointer into freed/adjacent slab memory, providing a heap write primitive leveragable for arbitrary write and control-flow hijack.\nA:H - The slab-use-after-free and out-of-bounds writes corrupt kernel hash chains, reliably causing oops/panic and bringing the kernel down."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:48.359Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6"
},
{
"url": "https://git.kernel.org/stable/c/3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8"
},
{
"url": "https://git.kernel.org/stable/c/2c617848ae6e4f07a3e397f604208c293bbecacc"
},
{
"url": "https://git.kernel.org/stable/c/b4a53add2fa8f1b5aa17d4c5686c320785fab182"
},
{
"url": "https://git.kernel.org/stable/c/26edb0a3c99f9d958c212be68b21f1221614dcf0"
},
{
"url": "https://git.kernel.org/stable/c/4980162de555cb838f1a189ce7d2cbf5d2e7b050"
},
{
"url": "https://git.kernel.org/stable/c/a2e2d08fb070fab4947447171f1c4e3ca5a188e5"
},
{
"url": "https://git.kernel.org/stable/c/14acf9652e5690de3c7486c6db5fb8dafd0a32a3"
}
],
"title": "xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46116",
"datePublished": "2026-05-28T09:35:30.689Z",
"dateReserved": "2026-05-13T15:03:33.098Z",
"dateUpdated": "2026-08-25T12:05:58.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53293 (GCVE-0-2026-53293)
Vulnerability from cvelistv5
Published
2026-06-26 19:40
Modified
2026-06-26 19:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG
There were multiple issues in that code.
First of all the order between the reset semaphore and the mm_lock was
wrong (e.g. copy_to_user) was called while holding the lock.
Then we allocated memory while holding the reset semaphore which is also
a pretty big bug and can deadlock.
Then we used down_read_trylock() instead of waiting for the reset to
finish.
(cherry picked from commit 361b6e6b303d4b691f6c5974d3eaab67ca6dd90e)
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8361e3f7882876d98ba98cae0d3149450dd80912 Version: 9e823f307074c0f82b5f6044943b0086e3079bed Version: 9e823f307074c0f82b5f6044943b0086e3079bed Version: 9e823f307074c0f82b5f6044943b0086e3079bed Version: 9e823f307074c0f82b5f6044943b0086e3079bed Version: 17a98c942cb106ec08564e8f43b5470a4dd5d3f6 Version: 9a98563345697bdb1d3410ff428473b2e781f4db Version: 6.6.55 ≤ Version: 6.10.14 ≤ Version: 6.11.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8c4254c8f5836e77ae83e7fc037f02b69f7a0977",
"status": "affected",
"version": "8361e3f7882876d98ba98cae0d3149450dd80912",
"versionType": "git"
},
{
"lessThan": "61957c2e467b39b528a290016367d32a433fa846",
"status": "affected",
"version": "9e823f307074c0f82b5f6044943b0086e3079bed",
"versionType": "git"
},
{
"lessThan": "a31c3feb54b15a90232e497ad0e27e8a82052d8d",
"status": "affected",
"version": "9e823f307074c0f82b5f6044943b0086e3079bed",
"versionType": "git"
},
{
"lessThan": "5c29d20470d4566d1b68df57097d642d01f8b427",
"status": "affected",
"version": "9e823f307074c0f82b5f6044943b0086e3079bed",
"versionType": "git"
},
{
"lessThan": "0ef196a208385b7d7da79f411c161b04e97283e2",
"status": "affected",
"version": "9e823f307074c0f82b5f6044943b0086e3079bed",
"versionType": "git"
},
{
"status": "affected",
"version": "17a98c942cb106ec08564e8f43b5470a4dd5d3f6",
"versionType": "git"
},
{
"status": "affected",
"version": "9a98563345697bdb1d3410ff428473b2e781f4db",
"versionType": "git"
},
{
"lessThan": "6.6.141",
"status": "affected",
"version": "6.6.55",
"versionType": "semver"
},
{
"lessThan": "6.11",
"status": "affected",
"version": "6.10.14",
"versionType": "semver"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.6.55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG\n\nThere were multiple issues in that code.\n\nFirst of all the order between the reset semaphore and the mm_lock was\nwrong (e.g. copy_to_user) was called while holding the lock.\n\nThen we allocated memory while holding the reset semaphore which is also\na pretty big bug and can deadlock.\n\nThen we used down_read_trylock() instead of waiting for the reset to\nfinish.\n\n(cherry picked from commit 361b6e6b303d4b691f6c5974d3eaab67ca6dd90e)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T19:40:52.132Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8c4254c8f5836e77ae83e7fc037f02b69f7a0977"
},
{
"url": "https://git.kernel.org/stable/c/61957c2e467b39b528a290016367d32a433fa846"
},
{
"url": "https://git.kernel.org/stable/c/a31c3feb54b15a90232e497ad0e27e8a82052d8d"
},
{
"url": "https://git.kernel.org/stable/c/5c29d20470d4566d1b68df57097d642d01f8b427"
},
{
"url": "https://git.kernel.org/stable/c/0ef196a208385b7d7da79f411c161b04e97283e2"
}
],
"title": "drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53293",
"datePublished": "2026-06-26T19:40:52.132Z",
"dateReserved": "2026-06-09T07:44:35.396Z",
"dateUpdated": "2026-06-26T19:40:52.132Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53150 (GCVE-0-2026-53150)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-06-25 08:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Reject zero-length property entries in validator
tb_property_entry_valid() accepts entries with length == 0 for
DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes
validation but causes an underflow in the null-termination logic:
property->value.text[property->length * 4 - 1] = '\0';
When property->length is 0 this writes to offset -1 relative to
the allocation.
Reject zero-length entries early in the validator since they have no
valid representation in the XDomain property protocol.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/property.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "581c2053ab4dbe27e83c9e62deb4c73aa8dc0c3a",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "35d6c9252a152e756768a26dbf216b9dd9dd8e92",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "99d9dbad1463afb510d42c9714f846361d1b726d",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "5f56bc6bddffe8710ba0ba8844023b5a44ca90e4",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "ca11e7da4fba4b394f69e16448f4463c44c84de6",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "2e0ddac549ebd713eb9f4a15b6496e3440a17d8b",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "3b6e68cb97f725385010264a873e14a3921b6b8a",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "cff8eb65d1eafe7793e54b4d0cf6bf831644630b",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/property.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Reject zero-length property entries in validator\n\ntb_property_entry_valid() accepts entries with length == 0 for\nDIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes\nvalidation but causes an underflow in the null-termination logic:\n\n property-\u003evalue.text[property-\u003elength * 4 - 1] = \u0027\\0\u0027;\n\nWhen property-\u003elength is 0 this writes to offset -1 relative to\nthe allocation.\n\nReject zero-length entries early in the validator since they have no\nvalid representation in the XDomain property protocol."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:38:35.531Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/581c2053ab4dbe27e83c9e62deb4c73aa8dc0c3a"
},
{
"url": "https://git.kernel.org/stable/c/35d6c9252a152e756768a26dbf216b9dd9dd8e92"
},
{
"url": "https://git.kernel.org/stable/c/99d9dbad1463afb510d42c9714f846361d1b726d"
},
{
"url": "https://git.kernel.org/stable/c/5f56bc6bddffe8710ba0ba8844023b5a44ca90e4"
},
{
"url": "https://git.kernel.org/stable/c/ca11e7da4fba4b394f69e16448f4463c44c84de6"
},
{
"url": "https://git.kernel.org/stable/c/2e0ddac549ebd713eb9f4a15b6496e3440a17d8b"
},
{
"url": "https://git.kernel.org/stable/c/3b6e68cb97f725385010264a873e14a3921b6b8a"
},
{
"url": "https://git.kernel.org/stable/c/cff8eb65d1eafe7793e54b4d0cf6bf831644630b"
}
],
"title": "thunderbolt: Reject zero-length property entries in validator",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53150",
"datePublished": "2026-06-25T08:38:35.531Z",
"dateReserved": "2026-06-09T07:44:35.387Z",
"dateUpdated": "2026-06-25T08:38:35.531Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53004 (GCVE-0-2026-53004)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
sctp_getsockopt_peer_auth_chunks() checks that the caller's optval
buffer is large enough for the peer AUTH chunk list with
if (len < num_chunks)
return -EINVAL;
but then writes num_chunks bytes to p->gauth_chunks, which lives
at offset offsetof(struct sctp_authchunks, gauth_chunks) == 8
inside optval. The check is missing the sizeof(struct
sctp_authchunks) = 8-byte header. When the caller supplies
len == num_chunks (for any num_chunks > 0) the test passes but
copy_to_user() writes sizeof(struct sctp_authchunks) = 8 bytes
past the declared buffer.
The sibling function sctp_getsockopt_local_auth_chunks() at the
next line already has the correct check:
if (len < sizeof(struct sctp_authchunks) + num_chunks)
return -EINVAL;
Align the peer variant with its sibling.
Reproducer confirms on v7.0-13-generic: an unprivileged userspace
caller that opens a loopback SCTP association with AUTH enabled,
queries num_chunks with a short optval, then issues the real
getsockopt with len == num_chunks and sentinel bytes painted past
the buffer observes those sentinel bytes overwritten with the
peer's AUTH chunk type. The bytes written are under the peer's
control but land in the caller's own userspace; this is not a
kernel memory corruption, but it is a kernel-side contract
violation that can silently corrupt adjacent userspace data.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 65b07e5d0d09c77e98050b5f0146ead29e5add32 Version: 65b07e5d0d09c77e98050b5f0146ead29e5add32 Version: 65b07e5d0d09c77e98050b5f0146ead29e5add32 Version: 65b07e5d0d09c77e98050b5f0146ead29e5add32 Version: 65b07e5d0d09c77e98050b5f0146ead29e5add32 Version: 65b07e5d0d09c77e98050b5f0146ead29e5add32 Version: 65b07e5d0d09c77e98050b5f0146ead29e5add32 Version: 65b07e5d0d09c77e98050b5f0146ead29e5add32 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a132e199de69e2a45628aa8534df1bf5d44e1b6e",
"status": "affected",
"version": "65b07e5d0d09c77e98050b5f0146ead29e5add32",
"versionType": "git"
},
{
"lessThan": "2b5a2c957c7769d40110f725cf23987fcef50d75",
"status": "affected",
"version": "65b07e5d0d09c77e98050b5f0146ead29e5add32",
"versionType": "git"
},
{
"lessThan": "d45c7e99caf915b0f6c716bd8ffe9d45b9685761",
"status": "affected",
"version": "65b07e5d0d09c77e98050b5f0146ead29e5add32",
"versionType": "git"
},
{
"lessThan": "d67fbc6dea5dbf7f46c618ebf65910a276078e20",
"status": "affected",
"version": "65b07e5d0d09c77e98050b5f0146ead29e5add32",
"versionType": "git"
},
{
"lessThan": "6849b995cda88a677bf08a05765d1db7905974fc",
"status": "affected",
"version": "65b07e5d0d09c77e98050b5f0146ead29e5add32",
"versionType": "git"
},
{
"lessThan": "70a089cc9590aa347a61e84434116ab74619e3c3",
"status": "affected",
"version": "65b07e5d0d09c77e98050b5f0146ead29e5add32",
"versionType": "git"
},
{
"lessThan": "6bcf8fe4ef7967b22b814cbae9a57bbd3c853410",
"status": "affected",
"version": "65b07e5d0d09c77e98050b5f0146ead29e5add32",
"versionType": "git"
},
{
"lessThan": "0cf004ffb61cd32d140531c3a84afe975f9fc7ea",
"status": "affected",
"version": "65b07e5d0d09c77e98050b5f0146ead29e5add32",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/socket.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks\n\nsctp_getsockopt_peer_auth_chunks() checks that the caller\u0027s optval\nbuffer is large enough for the peer AUTH chunk list with\n\n if (len \u003c num_chunks)\n return -EINVAL;\n\nbut then writes num_chunks bytes to p-\u003egauth_chunks, which lives\nat offset offsetof(struct sctp_authchunks, gauth_chunks) == 8\ninside optval. The check is missing the sizeof(struct\nsctp_authchunks) = 8-byte header. When the caller supplies\nlen == num_chunks (for any num_chunks \u003e 0) the test passes but\ncopy_to_user() writes sizeof(struct sctp_authchunks) = 8 bytes\npast the declared buffer.\n\nThe sibling function sctp_getsockopt_local_auth_chunks() at the\nnext line already has the correct check:\n\n if (len \u003c sizeof(struct sctp_authchunks) + num_chunks)\n return -EINVAL;\n\nAlign the peer variant with its sibling.\n\nReproducer confirms on v7.0-13-generic: an unprivileged userspace\ncaller that opens a loopback SCTP association with AUTH enabled,\nqueries num_chunks with a short optval, then issues the real\ngetsockopt with len == num_chunks and sentinel bytes painted past\nthe buffer observes those sentinel bytes overwritten with the\npeer\u0027s AUTH chunk type. The bytes written are under the peer\u0027s\ncontrol but land in the caller\u0027s own userspace; this is not a\nkernel memory corruption, but it is a kernel-side contract\nviolation that can silently corrupt adjacent userspace data."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:16.151Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a132e199de69e2a45628aa8534df1bf5d44e1b6e"
},
{
"url": "https://git.kernel.org/stable/c/2b5a2c957c7769d40110f725cf23987fcef50d75"
},
{
"url": "https://git.kernel.org/stable/c/d45c7e99caf915b0f6c716bd8ffe9d45b9685761"
},
{
"url": "https://git.kernel.org/stable/c/d67fbc6dea5dbf7f46c618ebf65910a276078e20"
},
{
"url": "https://git.kernel.org/stable/c/6849b995cda88a677bf08a05765d1db7905974fc"
},
{
"url": "https://git.kernel.org/stable/c/70a089cc9590aa347a61e84434116ab74619e3c3"
},
{
"url": "https://git.kernel.org/stable/c/6bcf8fe4ef7967b22b814cbae9a57bbd3c853410"
},
{
"url": "https://git.kernel.org/stable/c/0cf004ffb61cd32d140531c3a84afe975f9fc7ea"
}
],
"title": "sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53004",
"datePublished": "2026-06-24T16:29:16.151Z",
"dateReserved": "2026-06-09T07:44:35.377Z",
"dateUpdated": "2026-06-24T16:29:16.151Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31578 (GCVE-0-2026-31578)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: as102: fix to not free memory after the device is registered in as102_usb_probe()
In as102_usb driver, the following race condition occurs:
```
CPU0 CPU1
as102_usb_probe()
kzalloc(); // alloc as102_dev_t
....
usb_register_dev();
fd = sys_open("/path/to/dev"); // open as102 fd
....
usb_deregister_dev();
....
kfree(); // free as102_dev_t
....
sys_close(fd);
as102_release() // UAF!!
as102_usb_release()
kfree(); // DFB!!
```
When a USB character device registered with usb_register_dev() is later
unregistered (via usb_deregister_dev() or disconnect), the device node is
removed so new open() calls fail. However, file descriptors that are
already open do not go away immediately: they remain valid until the last
reference is dropped and the driver's .release() is invoked.
In as102, as102_usb_probe() calls usb_register_dev() and then, on an
error path, does usb_deregister_dev() and frees as102_dev_t right away.
If userspace raced a successful open() before the deregistration, that
open FD will later hit as102_release() --> as102_usb_release() and access
or free as102_dev_t again, occur a race to use-after-free and
double-free vuln.
The fix is to never kfree(as102_dev_t) directly once usb_register_dev()
has succeeded. After deregistration, defer freeing memory to .release().
In other words, let release() perform the last kfree when the final open
FD is closed.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c Version: cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c Version: cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c Version: cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c Version: cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c Version: cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c Version: cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c Version: cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c Version: cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/usb/as102/as102_usb_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0d36653a3a821e5a974798adb347b3ea09332914",
"status": "affected",
"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c",
"versionType": "git"
},
{
"lessThan": "25d500cf391e384356a612b85cf60b353ad3cd0c",
"status": "affected",
"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c",
"versionType": "git"
},
{
"lessThan": "07ceb444c8f627cf863864d4274b5a77769725ed",
"status": "affected",
"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c",
"versionType": "git"
},
{
"lessThan": "cb8092038e95dc1113a68e63762de40fff61ba71",
"status": "affected",
"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c",
"versionType": "git"
},
{
"lessThan": "582fbecb3756330006fe1950762412a68c2cacd2",
"status": "affected",
"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c",
"versionType": "git"
},
{
"lessThan": "09e9206008b887aa553733bd915d73131071a086",
"status": "affected",
"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c",
"versionType": "git"
},
{
"lessThan": "2eeae47a438694408189138048a786be99954032",
"status": "affected",
"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c",
"versionType": "git"
},
{
"lessThan": "7e5aedf6059cba2a669d86caeaf5a51f33ec85a1",
"status": "affected",
"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c",
"versionType": "git"
},
{
"lessThan": "8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c",
"status": "affected",
"version": "cd19f7d3e39b3160595d56bb3e3a2bf4f7f4669c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/usb/as102/as102_usb_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.14"
},
{
"lessThan": "3.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: as102: fix to not free memory after the device is registered in as102_usb_probe()\n\nIn as102_usb driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nas102_usb_probe()\n kzalloc(); // alloc as102_dev_t\n ....\n usb_register_dev();\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open as102 fd\n\t\t\t\t\t\t....\n usb_deregister_dev();\n ....\n kfree(); // free as102_dev_t\n ....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t as102_release() // UAF!!\n\t\t\t\t\t\t as102_usb_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n```\n\nWhen a USB character device registered with usb_register_dev() is later\nunregistered (via usb_deregister_dev() or disconnect), the device node is\nremoved so new open() calls fail. However, file descriptors that are\nalready open do not go away immediately: they remain valid until the last\nreference is dropped and the driver\u0027s .release() is invoked.\n\nIn as102, as102_usb_probe() calls usb_register_dev() and then, on an\nerror path, does usb_deregister_dev() and frees as102_dev_t right away.\nIf userspace raced a successful open() before the deregistration, that\nopen FD will later hit as102_release() --\u003e as102_usb_release() and access\nor free as102_dev_t again, occur a race to use-after-free and\ndouble-free vuln.\n\nThe fix is to never kfree(as102_dev_t) directly once usb_register_dev()\nhas succeeded. After deregistration, defer freeing memory to .release().\n\nIn other words, let release() perform the last kfree when the final open\nFD is closed."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:42:03.244Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0d36653a3a821e5a974798adb347b3ea09332914"
},
{
"url": "https://git.kernel.org/stable/c/25d500cf391e384356a612b85cf60b353ad3cd0c"
},
{
"url": "https://git.kernel.org/stable/c/07ceb444c8f627cf863864d4274b5a77769725ed"
},
{
"url": "https://git.kernel.org/stable/c/cb8092038e95dc1113a68e63762de40fff61ba71"
},
{
"url": "https://git.kernel.org/stable/c/582fbecb3756330006fe1950762412a68c2cacd2"
},
{
"url": "https://git.kernel.org/stable/c/09e9206008b887aa553733bd915d73131071a086"
},
{
"url": "https://git.kernel.org/stable/c/2eeae47a438694408189138048a786be99954032"
},
{
"url": "https://git.kernel.org/stable/c/7e5aedf6059cba2a669d86caeaf5a51f33ec85a1"
},
{
"url": "https://git.kernel.org/stable/c/8bd29dbe03fc5b0f039ab2395ff37b64236d2f0c"
}
],
"title": "media: as102: fix to not free memory after the device is registered in as102_usb_probe()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31578",
"datePublished": "2026-04-24T14:42:09.519Z",
"dateReserved": "2026-03-09T15:48:24.119Z",
"dateUpdated": "2026-06-14T17:42:03.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43129 (GCVE-0-2026-43129)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-06-19 11:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ima: verify the previous kernel's IMA buffer lies in addressable RAM
Patch series "Address page fault in ima_restore_measurement_list()", v3.
When the second-stage kernel is booted via kexec with a limiting command
line such as "mem=<size>" we observe a pafe fault that happens.
BUG: unable to handle page fault for address: ffff97793ff47000
RIP: ima_restore_measurement_list+0xdc/0x45a
#PF: error_code(0x0000) not-present page
This happens on x86_64 only, as this is already fixed in aarch64 in
commit: cbf9c4b9617b ("of: check previous kernel's ima-kexec-buffer
against memory bounds")
This patch (of 3):
When the second-stage kernel is booted with a limiting command line (e.g.
"mem=<size>"), the IMA measurement buffer handed over from the previous
kernel may fall outside the addressable RAM of the new kernel. Accessing
such a buffer can fault during early restore.
Introduce a small generic helper, ima_validate_range(), which verifies
that a physical [start, end] range for the previous-kernel IMA buffer lies
within addressable memory:
- On x86, use pfn_range_is_mapped().
- On OF based architectures, use page_is_ram().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/ima.h",
"security/integrity/ima/ima_kexec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "43308106a1762b72f3b20a44b75b2df5cb25b77b",
"status": "affected",
"version": "b69a2afd5afce9bf6d56e349d6ab592c916e20f2",
"versionType": "git"
},
{
"lessThan": "f11d7d088f5ed54b31c6735854c12845eb60eb4a",
"status": "affected",
"version": "b69a2afd5afce9bf6d56e349d6ab592c916e20f2",
"versionType": "git"
},
{
"lessThan": "9e1f51c1ad57cc76a0e8b5eb27038f8973fff4fa",
"status": "affected",
"version": "b69a2afd5afce9bf6d56e349d6ab592c916e20f2",
"versionType": "git"
},
{
"lessThan": "5366ec7d2f793ce703c403d7fd4c25a3db365b9d",
"status": "affected",
"version": "b69a2afd5afce9bf6d56e349d6ab592c916e20f2",
"versionType": "git"
},
{
"lessThan": "10d1c75ed4382a8e79874379caa2ead8952734f9",
"status": "affected",
"version": "b69a2afd5afce9bf6d56e349d6ab592c916e20f2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/ima.h",
"security/integrity/ima/ima_kexec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: verify the previous kernel\u0027s IMA buffer lies in addressable RAM\n\nPatch series \"Address page fault in ima_restore_measurement_list()\", v3.\n\nWhen the second-stage kernel is booted via kexec with a limiting command\nline such as \"mem=\u003csize\u003e\" we observe a pafe fault that happens.\n\n BUG: unable to handle page fault for address: ffff97793ff47000\n RIP: ima_restore_measurement_list+0xdc/0x45a\n #PF: error_code(0x0000) not-present page\n\nThis happens on x86_64 only, as this is already fixed in aarch64 in\ncommit: cbf9c4b9617b (\"of: check previous kernel\u0027s ima-kexec-buffer\nagainst memory bounds\")\n\n\nThis patch (of 3):\n\nWhen the second-stage kernel is booted with a limiting command line (e.g. \n\"mem=\u003csize\u003e\"), the IMA measurement buffer handed over from the previous\nkernel may fall outside the addressable RAM of the new kernel. Accessing\nsuch a buffer can fault during early restore.\n\nIntroduce a small generic helper, ima_validate_range(), which verifies\nthat a physical [start, end] range for the previous-kernel IMA buffer lies\nwithin addressable memory:\n\t- On x86, use pfn_range_is_mapped().\n\t- On OF based architectures, use page_is_ram()."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-19T11:58:16.640Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/43308106a1762b72f3b20a44b75b2df5cb25b77b"
},
{
"url": "https://git.kernel.org/stable/c/f11d7d088f5ed54b31c6735854c12845eb60eb4a"
},
{
"url": "https://git.kernel.org/stable/c/9e1f51c1ad57cc76a0e8b5eb27038f8973fff4fa"
},
{
"url": "https://git.kernel.org/stable/c/5366ec7d2f793ce703c403d7fd4c25a3db365b9d"
},
{
"url": "https://git.kernel.org/stable/c/10d1c75ed4382a8e79874379caa2ead8952734f9"
}
],
"title": "ima: verify the previous kernel\u0027s IMA buffer lies in addressable RAM",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43129",
"datePublished": "2026-05-06T11:27:18.180Z",
"dateReserved": "2026-05-01T14:12:55.988Z",
"dateUpdated": "2026-06-19T11:58:16.640Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43240 (GCVE-0-2026-43240)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-06-19 11:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/kexec: add a sanity check on previous kernel's ima kexec buffer
When the second-stage kernel is booted via kexec with a limiting command
line such as "mem=<size>", the physical range that contains the carried
over IMA measurement list may fall outside the truncated RAM leading to a
kernel panic.
BUG: unable to handle page fault for address: ffff97793ff47000
RIP: ima_restore_measurement_list+0xdc/0x45a
#PF: error_code(0x0000) – not-present page
Other architectures already validate the range with page_is_ram(), as done
in commit cbf9c4b9617b ("of: check previous kernel's ima-kexec-buffer
against memory bounds") do a similar check on x86.
Without carrying the measurement list across kexec, the attestation
would fail.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b69a2afd5afce9bf6d56e349d6ab592c916e20f2 Version: b69a2afd5afce9bf6d56e349d6ab592c916e20f2 Version: b69a2afd5afce9bf6d56e349d6ab592c916e20f2 Version: b69a2afd5afce9bf6d56e349d6ab592c916e20f2 Version: b69a2afd5afce9bf6d56e349d6ab592c916e20f2 Version: b69a2afd5afce9bf6d56e349d6ab592c916e20f2 Version: b69a2afd5afce9bf6d56e349d6ab592c916e20f2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kernel/setup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "37f18915a261afe84dab462624ed829cddb77a9b",
"status": "affected",
"version": "b69a2afd5afce9bf6d56e349d6ab592c916e20f2",
"versionType": "git"
},
{
"lessThan": "22e460b6333a5f818b042ac89201f8e735556f4a",
"status": "affected",
"version": "b69a2afd5afce9bf6d56e349d6ab592c916e20f2",
"versionType": "git"
},
{
"lessThan": "7e2476057950c174c7b2c2802246707bbfb497e4",
"status": "affected",
"version": "b69a2afd5afce9bf6d56e349d6ab592c916e20f2",
"versionType": "git"
},
{
"lessThan": "f8f73bf0f8a57ee9b86792456bd42079bc98c6b7",
"status": "affected",
"version": "b69a2afd5afce9bf6d56e349d6ab592c916e20f2",
"versionType": "git"
},
{
"lessThan": "d4a132f121c591b60dbaf57ea91f1faf11631fbc",
"status": "affected",
"version": "b69a2afd5afce9bf6d56e349d6ab592c916e20f2",
"versionType": "git"
},
{
"lessThan": "4d7a8f5f28187e3d2958b2a134473da2665207e7",
"status": "affected",
"version": "b69a2afd5afce9bf6d56e349d6ab592c916e20f2",
"versionType": "git"
},
{
"lessThan": "c5489d04337b47e93c0623e8145fcba3f5739efd",
"status": "affected",
"version": "b69a2afd5afce9bf6d56e349d6ab592c916e20f2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kernel/setup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/kexec: add a sanity check on previous kernel\u0027s ima kexec buffer\n\nWhen the second-stage kernel is booted via kexec with a limiting command\nline such as \"mem=\u003csize\u003e\", the physical range that contains the carried\nover IMA measurement list may fall outside the truncated RAM leading to a\nkernel panic.\n\n BUG: unable to handle page fault for address: ffff97793ff47000\n RIP: ima_restore_measurement_list+0xdc/0x45a\n #PF: error_code(0x0000) \u2013 not-present page\n\nOther architectures already validate the range with page_is_ram(), as done\nin commit cbf9c4b9617b (\"of: check previous kernel\u0027s ima-kexec-buffer\nagainst memory bounds\") do a similar check on x86.\n\nWithout carrying the measurement list across kexec, the attestation\nwould fail."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-19T11:58:23.596Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/37f18915a261afe84dab462624ed829cddb77a9b"
},
{
"url": "https://git.kernel.org/stable/c/22e460b6333a5f818b042ac89201f8e735556f4a"
},
{
"url": "https://git.kernel.org/stable/c/7e2476057950c174c7b2c2802246707bbfb497e4"
},
{
"url": "https://git.kernel.org/stable/c/f8f73bf0f8a57ee9b86792456bd42079bc98c6b7"
},
{
"url": "https://git.kernel.org/stable/c/d4a132f121c591b60dbaf57ea91f1faf11631fbc"
},
{
"url": "https://git.kernel.org/stable/c/4d7a8f5f28187e3d2958b2a134473da2665207e7"
},
{
"url": "https://git.kernel.org/stable/c/c5489d04337b47e93c0623e8145fcba3f5739efd"
}
],
"title": "x86/kexec: add a sanity check on previous kernel\u0027s ima kexec buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43240",
"datePublished": "2026-05-06T11:28:34.269Z",
"dateReserved": "2026-05-01T14:12:55.995Z",
"dateUpdated": "2026-06-19T11:58:23.596Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-10263 (GCVE-0-2025-10263)
Vulnerability from cvelistv5
Published
2026-06-09 09:23
Modified
2026-08-27 12:04
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Summary
Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Arm | C1-Ultra |
Version: 0 |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-06-09T16:53:49.813Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-493.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/06/09/13"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-10263",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-09T14:11:21.775441Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T14:11:48.257Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.30.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.98.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.140.1.rt7.481.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.140.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.200.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.200.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.204.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.204.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.158.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.158.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.22.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.186.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.186.1.rt14.471.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.143.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.131.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.12::el8"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "412.86.202608080425-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.13::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.13",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "413.92.202608111330-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.18::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "418.94.202608111829-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.19::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.19.9.6.202608120446-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.20::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.20",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.20.9.6.202608121719-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.21::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.21",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.21.9.6.202608122143-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.22.9.8.202607152026-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "libkrun",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_nvidia:"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux for NVIDIA 26",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-09T09:23:18.802Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation (TLBI) operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local attacker to gain kernel privileges or a guest VM to escape to the hypervisor, resulting in complete system compromise."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:04:41.369Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2025-10263"
},
{
"name": "RHBZ#2486958",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486958"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-10263.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54205"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54187"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54544"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54553"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54581"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54599"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:40764"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55445"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34911"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:51603"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:51746"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49031"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36018"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36349"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47248"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49033"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:52649"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36348"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:51604"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:54205: Red Hat OpenShift Container Platform 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:54187: Red Hat OpenShift Container Platform 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:54544: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:54553: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:54581: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:54599: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:40764: Red Hat OpenShift Container Platform 4.22"
},
{
"lang": "en",
"value": "RHSA-2026:55445: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:34911: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:51603: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:51746: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:49031: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:36018: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:36349: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:47248: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:49033: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:52649: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:36348: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:51604: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-09T11:01:37.157Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-09T09:23:18.802Z",
"value": "Made public."
}
],
"title": "kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "C1-Ultra",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "C1-Premium",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neoverse V3",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neoverse V3AE",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neoverse V1",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neoverse N2",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Neoverse N1",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cortex-X925",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cortex-X4",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cortex-X3",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cortex-X2",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cortex-X1",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cortex-X1C",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cortex-A710",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cortex-A78",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cortex-A78AE",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cortex-A78C",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cortex-A77",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cortex-A76",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Cortex-A76AE",
"vendor": "Arm",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Arm C1-Ultra, C1-Premium, Neoverse V3 \u0026amp; V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 \u0026amp; X1C, Cortex-A710, Cortex-A78, A78AE \u0026amp; A78C, Cortex-A77, Cortex-A76 \u0026amp; A76A may allow writes to resources owned by a higher exception level."
}
],
"value": "Arm C1-Ultra, C1-Premium, Neoverse V3 \u0026 V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 \u0026 X1C, Cortex-A710, Cortex-A78, A78AE \u0026 A78C, Cortex-A77, Cortex-A76 \u0026 A76A may allow writes to resources owned by a higher exception level."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-09T09:23:18.802Z",
"orgId": "56a131ea-b967-4a0d-a41e-5f3549952846",
"shortName": "Arm"
},
"references": [
{
"url": "https://developer.arm.com/documentation/112137"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "56a131ea-b967-4a0d-a41e-5f3549952846",
"assignerShortName": "Arm",
"cveId": "CVE-2025-10263",
"datePublished": "2026-06-09T09:23:18.802Z",
"dateReserved": "2025-09-11T08:50:36.018Z",
"dateUpdated": "2026-08-27T12:04:41.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43081 (GCVE-0-2026-43081)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-05-11 22:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
Fix the field masks to match the hardware layout documented in
downstream GSI (GSI_V3_0_EE_n_GSI_EE_GENERIC_CMD_*).
Notably this fixes a WARN I was seeing when I tried to send "stop"
to the MPSS remoteproc while IPA was up.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ipa/reg/gsi_reg-v5.0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a7d326dfb13b5a0763eccfd78836fe15199fc499",
"status": "affected",
"version": "faf0678ec8a0aa9039d8b188d012206abd67dd5c",
"versionType": "git"
},
{
"lessThan": "d1c66396796f23f7201b1addf06f62515035354d",
"status": "affected",
"version": "faf0678ec8a0aa9039d8b188d012206abd67dd5c",
"versionType": "git"
},
{
"lessThan": "bafc45ea30d297002750396d5f10e3018bf2cd60",
"status": "affected",
"version": "faf0678ec8a0aa9039d8b188d012206abd67dd5c",
"versionType": "git"
},
{
"lessThan": "2aa50d2c1f631b405849da246043c6f683af7489",
"status": "affected",
"version": "faf0678ec8a0aa9039d8b188d012206abd67dd5c",
"versionType": "git"
},
{
"lessThan": "9709b56d908acc120fe8b4ae250b3c9d749ea832",
"status": "affected",
"version": "faf0678ec8a0aa9039d8b188d012206abd67dd5c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ipa/reg/gsi_reg-v5.0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipa: fix GENERIC_CMD register field masks for IPA v5.0+\n\nFix the field masks to match the hardware layout documented in\ndownstream GSI (GSI_V3_0_EE_n_GSI_EE_GENERIC_CMD_*).\n\nNotably this fixes a WARN I was seeing when I tried to send \"stop\"\nto the MPSS remoteproc while IPA was up."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:17:21.426Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a7d326dfb13b5a0763eccfd78836fe15199fc499"
},
{
"url": "https://git.kernel.org/stable/c/d1c66396796f23f7201b1addf06f62515035354d"
},
{
"url": "https://git.kernel.org/stable/c/bafc45ea30d297002750396d5f10e3018bf2cd60"
},
{
"url": "https://git.kernel.org/stable/c/2aa50d2c1f631b405849da246043c6f683af7489"
},
{
"url": "https://git.kernel.org/stable/c/9709b56d908acc120fe8b4ae250b3c9d749ea832"
}
],
"title": "net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43081",
"datePublished": "2026-05-06T07:40:17.159Z",
"dateReserved": "2026-05-01T14:12:55.983Z",
"dateUpdated": "2026-05-11T22:17:21.426Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43191 (GCVE-0-2026-43191)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35
[Why]
A backport of the change made for DCN401 that addresses an issue where
we turn off the PHY PLL when disabling TMDS output, which causes the
OTG to remain stuck.
The OTG being stuck can lead to a hang in the DCHVM's ability to ACK
invalidations when it thinks the HUBP is still on but it's not receiving
global sync.
The transition to PLL_ON needs to be atomic as there's no guarantee
that the thread isn't pre-empted or is able to complete before the
IOMMU watchdog times out.
[How]
Backport the implementation from dcn401 back to dcn35.
There's a functional difference in when the eDP output is disabled in
dcn401 code so we don't want to utilize it directly.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c",
"drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h",
"drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51",
"status": "affected",
"version": "ec129fa356bea5411cb16833cc5dab32689ea389",
"versionType": "git"
},
{
"lessThan": "75372d75a4e23783583998ed99d5009d555850da",
"status": "affected",
"version": "ec129fa356bea5411cb16833cc5dab32689ea389",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.c",
"drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_hwseq.h",
"drivers/gpu/drm/amd/display/dc/hwss/dcn35/dcn35_init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35\n\n[Why]\nA backport of the change made for DCN401 that addresses an issue where\nwe turn off the PHY PLL when disabling TMDS output, which causes the\nOTG to remain stuck.\n\nThe OTG being stuck can lead to a hang in the DCHVM\u0027s ability to ACK\ninvalidations when it thinks the HUBP is still on but it\u0027s not receiving\nglobal sync.\n\nThe transition to PLL_ON needs to be atomic as there\u0027s no guarantee\nthat the thread isn\u0027t pre-empted or is able to complete before the\nIOMMU watchdog times out.\n\n[How]\nBackport the implementation from dcn401 back to dcn35.\n\nThere\u0027s a functional difference in when the eDP output is disabled in\ndcn401 code so we don\u0027t want to utilize it directly."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:19:36.402Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d1f7ceb00e8956ff6d183b7b45ef4e73c96f4c51"
},
{
"url": "https://git.kernel.org/stable/c/75372d75a4e23783583998ed99d5009d555850da"
}
],
"title": "drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43191",
"datePublished": "2026-05-06T11:28:00.470Z",
"dateReserved": "2026-05-01T14:12:55.992Z",
"dateUpdated": "2026-05-11T22:19:36.402Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43034 (GCVE-0-2026-43034)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-05-11 22:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: set backing store type from query type
bnxt_hwrm_func_backing_store_qcaps_v2() stores resp->type from the
firmware response in ctxm->type and later uses that value to index
fixed backing-store metadata arrays such as ctx_arr[] and
bnxt_bstore_to_trace[].
ctxm->type is fixed by the current backing-store query type and matches
the array index of ctx->ctx_arr. Set ctxm->type from the current loop
variable instead of depending on resp->type.
Also update the loop to advance type from next_valid_type in the for
statement, which keeps the control flow simpler for non-valid and
unchanged entries.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c8d53b70166d1dc463ef42adb7293e1a770822c7",
"status": "affected",
"version": "6a4d0774f02d61f8c75ffe2e38a8553410fe52e9",
"versionType": "git"
},
{
"lessThan": "29732b68a6816a815d58e9ab229844c23617e1e0",
"status": "affected",
"version": "6a4d0774f02d61f8c75ffe2e38a8553410fe52e9",
"versionType": "git"
},
{
"lessThan": "4ee937107d52f9e5c350e4b5e629760e328b3d9f",
"status": "affected",
"version": "6a4d0774f02d61f8c75ffe2e38a8553410fe52e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: set backing store type from query type\n\nbnxt_hwrm_func_backing_store_qcaps_v2() stores resp-\u003etype from the\nfirmware response in ctxm-\u003etype and later uses that value to index\nfixed backing-store metadata arrays such as ctx_arr[] and\nbnxt_bstore_to_trace[].\n\nctxm-\u003etype is fixed by the current backing-store query type and matches\nthe array index of ctx-\u003ectx_arr. Set ctxm-\u003etype from the current loop\nvariable instead of depending on resp-\u003etype.\n\nAlso update the loop to advance type from next_valid_type in the for\nstatement, which keeps the control flow simpler for non-valid and\nunchanged entries."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:16:26.338Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c8d53b70166d1dc463ef42adb7293e1a770822c7"
},
{
"url": "https://git.kernel.org/stable/c/29732b68a6816a815d58e9ab229844c23617e1e0"
},
{
"url": "https://git.kernel.org/stable/c/4ee937107d52f9e5c350e4b5e629760e328b3d9f"
}
],
"title": "bnxt_en: set backing store type from query type",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43034",
"datePublished": "2026-05-01T14:15:33.260Z",
"dateReserved": "2026-05-01T14:12:55.977Z",
"dateUpdated": "2026-05-11T22:16:26.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46011 (GCVE-0-2026-46011)
Vulnerability from cvelistv5
Published
2026-05-27 12:56
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: mtk-jpeg: fix use-after-free in release path due to uncancelled work
The mtk_jpeg_release() function frees the context structure (ctx) without
first cancelling any pending or running work in ctx->jpeg_work. This
creates a race window where the workqueue callback may still be accessing
the context memory after it has been freed.
Race condition:
CPU 0 (release) CPU 1 (workqueue)
---------------- ------------------
close()
mtk_jpeg_release()
mtk_jpegenc_worker()
ctx = work->data
// accessing ctx
kfree(ctx) // freed!
access ctx // UAF!
The work is queued via queue_work() during JPEG encode/decode operations
(via mtk_jpeg_device_run). If the device is closed while work is pending
or running, the work handler will access freed memory.
Fix this by calling cancel_work_sync() BEFORE acquiring the mutex. This
ordering is critical: if cancel_work_sync() is called after mutex_lock(),
and the work handler also tries to acquire the same mutex, it would cause
a deadlock.
Note: The open error path does NOT need cancel_work_sync() because
INIT_WORK() only initializes the work structure - it does not schedule
it. Work is only scheduled later during ioctl operations.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2209fdae5c2f615930c9af1379c1cfca199ec5d8",
"status": "affected",
"version": "5fb1c2361e5630491d2a2f9359654eb022601bc0",
"versionType": "git"
},
{
"lessThan": "0498b27a1542021d90269d58347501d4c3ccd84e",
"status": "affected",
"version": "5fb1c2361e5630491d2a2f9359654eb022601bc0",
"versionType": "git"
},
{
"lessThan": "26506a30e0e26d612f82a7bf0e395626968a44e6",
"status": "affected",
"version": "5fb1c2361e5630491d2a2f9359654eb022601bc0",
"versionType": "git"
},
{
"lessThan": "e78c39f720679fcf3a2eacd82725ec3ea2648301",
"status": "affected",
"version": "5fb1c2361e5630491d2a2f9359654eb022601bc0",
"versionType": "git"
},
{
"lessThan": "34c519feef3e4fcff1078dc8bdb25fbbbd10303f",
"status": "affected",
"version": "5fb1c2361e5630491d2a2f9359654eb022601bc0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mtk-jpeg: fix use-after-free in release path due to uncancelled work\n\nThe mtk_jpeg_release() function frees the context structure (ctx) without\nfirst cancelling any pending or running work in ctx-\u003ejpeg_work. This\ncreates a race window where the workqueue callback may still be accessing\nthe context memory after it has been freed.\n\nRace condition:\n\n CPU 0 (release) CPU 1 (workqueue)\n ---------------- ------------------\n close()\n mtk_jpeg_release()\n mtk_jpegenc_worker()\n ctx = work-\u003edata\n // accessing ctx\n\n kfree(ctx) // freed!\n access ctx // UAF!\n\nThe work is queued via queue_work() during JPEG encode/decode operations\n(via mtk_jpeg_device_run). If the device is closed while work is pending\nor running, the work handler will access freed memory.\n\nFix this by calling cancel_work_sync() BEFORE acquiring the mutex. This\nordering is critical: if cancel_work_sync() is called after mutex_lock(),\nand the work handler also tries to acquire the same mutex, it would cause\na deadlock.\n\nNote: The open error path does NOT need cancel_work_sync() because\nINIT_WORK() only initializes the work structure - it does not schedule\nit. Work is only scheduled later during ioctl operations."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached through the V4L2 video device node (/dev/videoN, VFL_TYPE_VIDEO) via ioctls and close(), which requires local system access rather than any network or adjacent reachability.\nAC:L - This is a use-after-free race, but the attacker controls both sides \u2014 they queue the encode/decode work via STREAMON/qbuf and then close the fd \u2014 and can retry the open/queue/close sequence indefinitely until they win, so success does not depend on conditions outside their control.\nPR:L - Triggering the path requires opening the JPEG codec video node and issuing m2m ioctls, which needs local access at unprivileged (e.g. video-group / media process) level but not real root.\nUI:N - The attacker performs the entire open, queue-work, and close sequence themselves; no victim action is required.\nS:U - The UAF corrupts kernel heap memory within the kernel\u0027s own security authority with no crossing of a VM/IOMMU/sandbox boundary.\nC:H - After ctx is freed and reclaimed, the worker dereferences attacker-influenceable freed memory (pointers, m2m context), enabling disclosure of kernel memory contents.\nI:H - The worker writes to the freed object (e.g. ctx-\u003etotal_frame_num++) and programs hardware from freed-object fields, providing a write primitive amenable to heap spraying and control-flow corruption.\nA:H - Use-after-free on the freed context reliably causes kernel oops/panic, a clear high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:08.321Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2209fdae5c2f615930c9af1379c1cfca199ec5d8"
},
{
"url": "https://git.kernel.org/stable/c/0498b27a1542021d90269d58347501d4c3ccd84e"
},
{
"url": "https://git.kernel.org/stable/c/26506a30e0e26d612f82a7bf0e395626968a44e6"
},
{
"url": "https://git.kernel.org/stable/c/e78c39f720679fcf3a2eacd82725ec3ea2648301"
},
{
"url": "https://git.kernel.org/stable/c/34c519feef3e4fcff1078dc8bdb25fbbbd10303f"
}
],
"title": "media: mtk-jpeg: fix use-after-free in release path due to uncancelled work",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46011",
"datePublished": "2026-05-27T12:56:13.198Z",
"dateReserved": "2026-05-13T15:03:33.092Z",
"dateUpdated": "2026-08-05T12:29:08.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53241 (GCVE-0-2026-53241)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: dummy: fix UMP event stack overread
The dummy sequencer port forwards events by copying an incoming
struct snd_seq_event into a stack temporary, rewriting source and
destination, and dispatching the temporary to subscribers. That legacy
event storage is smaller than struct snd_seq_ump_event.
When a UMP event reaches the dummy client, the copy leaves the UMP flag
set but only provides legacy-sized stack storage. The subscriber
delivery path then uses snd_seq_event_packet_size() and copies a
UMP-sized packet from that stack object, reading past the end of the
temporary.
Use the existing union __snd_seq_event storage and copy the packet size
reported for the incoming event before rewriting the common routing
fields. This preserves the full UMP packet for UMP events while keeping
legacy event handling unchanged.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/seq/seq_dummy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a7ef78a2c536242ccb7a4429da01580b2409bb24",
"status": "affected",
"version": "32cb23a0f911317cdb5030035e49a204aa86fef5",
"versionType": "git"
},
{
"lessThan": "6671a46144f880c5a167930ebb14c12f3d059fe9",
"status": "affected",
"version": "32cb23a0f911317cdb5030035e49a204aa86fef5",
"versionType": "git"
},
{
"lessThan": "6676b6063440561db600494049ce7ffb695c8cc4",
"status": "affected",
"version": "32cb23a0f911317cdb5030035e49a204aa86fef5",
"versionType": "git"
},
{
"lessThan": "2b5ff4db5d7aa5b981d966df02e687f79ad7b311",
"status": "affected",
"version": "32cb23a0f911317cdb5030035e49a204aa86fef5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/seq/seq_dummy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: seq: dummy: fix UMP event stack overread\n\nThe dummy sequencer port forwards events by copying an incoming\nstruct snd_seq_event into a stack temporary, rewriting source and\ndestination, and dispatching the temporary to subscribers. That legacy\nevent storage is smaller than struct snd_seq_ump_event.\n\nWhen a UMP event reaches the dummy client, the copy leaves the UMP flag\nset but only provides legacy-sized stack storage. The subscriber\ndelivery path then uses snd_seq_event_packet_size() and copies a\nUMP-sized packet from that stack object, reading past the end of the\ntemporary.\n\nUse the existing union __snd_seq_event storage and copy the packet size\nreported for the incoming event before rewriting the common routing\nfields. This preserves the full UMP packet for UMP events while keeping\nlegacy event handling unchanged."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:36.482Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a7ef78a2c536242ccb7a4429da01580b2409bb24"
},
{
"url": "https://git.kernel.org/stable/c/6671a46144f880c5a167930ebb14c12f3d059fe9"
},
{
"url": "https://git.kernel.org/stable/c/6676b6063440561db600494049ce7ffb695c8cc4"
},
{
"url": "https://git.kernel.org/stable/c/2b5ff4db5d7aa5b981d966df02e687f79ad7b311"
}
],
"title": "ALSA: seq: dummy: fix UMP event stack overread",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53241",
"datePublished": "2026-06-25T08:39:36.482Z",
"dateReserved": "2026-06-09T07:44:35.393Z",
"dateUpdated": "2026-06-25T08:39:36.482Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31761 (GCVE-0-2026-31761)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-08-05 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: gyro: mpu3050: Move iio_device_register() to correct location
iio_device_register() should be at the end of the probe function to
prevent race conditions.
Place iio_device_register() at the end of the probe function and place
iio_device_unregister() accordingly.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:46.375Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/gyro/mpu3050-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "22487ef85f6dd9499ddf49b85a08afc50a3f1992",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "caec338f91469f0a70b68165185afa3abc994545",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "051ca43b0e0e4b66bfd349cd53ccf231ad1d69b7",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "2a4537653d200fda2a8516083459f8ff6194f8fc",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "92f18aa86302fe83e0726a1191015f427d4ff056",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "cc3de12a5612ee25df7fb549cb7b3e4cc8bfaf9c",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "59a317f8215674c8330817770497301bfb2c1b99",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "4c05799449108fb0e0a6bd30e65fffc71e60db4d",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/gyro/mpu3050-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: mpu3050: Move iio_device_register() to correct location\n\niio_device_register() should be at the end of the probe function to\nprevent race conditions.\n\nPlace iio_device_register() at the end of the probe function and place\niio_device_unregister() accordingly."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable paths are exposed through local IIO sysfs attributes and the IIO character device for the MPU3050 sensor, not through a network protocol.\nAC:L - Although this is a probe/remove ordering race, a local attacker can hammer the published IIO interfaces while the device is being registered or torn down; no special heap layout or condition beyond the device being present is required for the vulnerable callbacks to be reached.\nPR:L - A basic local user can reach world-readable IIO sysfs attributes, and typical IIO device deployments expose these sensor interfaces to local users or services. No real init-namespace administrative capability is required for the read-side race.\nUI:N - Exploitation does not require a victim user to open a file or perform another action; the attacker directly accesses the local IIO interfaces.\nS:U - The issue corrupts or misuses kernel objects within the same kernel security authority. It does not cross a VM, IOMMU, or other separate security scope boundary.\nC:H - The old ordering can leave userspace-visible IIO attributes and file operations pointing at freed or partially initialized buffer/trigger state. This use-after-free class can be leveraged for kernel memory disclosure, so confidentiality impact is High.\nI:H - The dangling IIO buffer state includes function-pointer-bearing access structures and kernel object pointers reachable from callbacks. A use-after-free in this context is defensibly exploitable for control-flow hijack or arbitrary kernel memory modification.\nA:H - Even without full exploitation, racing these callbacks against probe or removal can dereference invalid or freed kernel objects and crash or hang the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:59.277Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/22487ef85f6dd9499ddf49b85a08afc50a3f1992"
},
{
"url": "https://git.kernel.org/stable/c/caec338f91469f0a70b68165185afa3abc994545"
},
{
"url": "https://git.kernel.org/stable/c/051ca43b0e0e4b66bfd349cd53ccf231ad1d69b7"
},
{
"url": "https://git.kernel.org/stable/c/2a4537653d200fda2a8516083459f8ff6194f8fc"
},
{
"url": "https://git.kernel.org/stable/c/92f18aa86302fe83e0726a1191015f427d4ff056"
},
{
"url": "https://git.kernel.org/stable/c/cc3de12a5612ee25df7fb549cb7b3e4cc8bfaf9c"
},
{
"url": "https://git.kernel.org/stable/c/59a317f8215674c8330817770497301bfb2c1b99"
},
{
"url": "https://git.kernel.org/stable/c/4c05799449108fb0e0a6bd30e65fffc71e60db4d"
}
],
"title": "iio: gyro: mpu3050: Move iio_device_register() to correct location",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31761",
"datePublished": "2026-05-01T14:14:53.223Z",
"dateReserved": "2026-03-09T15:48:24.139Z",
"dateUpdated": "2026-08-05T12:24:59.277Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46204 (GCVE-0-2026-46204)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
Rewrite the IB parsing to use amdgpu_ib_get_value() which handles the
bounds checks.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1dc005775fb5b3f86464406452b17364f85581d3",
"status": "affected",
"version": "0b15205c7325dc20b7da0068307670d222d66949",
"versionType": "git"
},
{
"lessThan": "d0802a8877d730260d4af4dd4e0b6cde7e0e593f",
"status": "affected",
"version": "0b15205c7325dc20b7da0068307670d222d66949",
"versionType": "git"
},
{
"lessThan": "a6d5563ba1f03a049561cd347574613167294e8d",
"status": "affected",
"version": "0b15205c7325dc20b7da0068307670d222d66949",
"versionType": "git"
},
{
"lessThan": "5c3e8ebad0c9e2354ddfa8f2148dc4f70a3b4bd1",
"status": "affected",
"version": "0b15205c7325dc20b7da0068307670d222d66949",
"versionType": "git"
},
{
"lessThan": "2444eb0ec8283f4a3845eb7febad378476e1ba3c",
"status": "affected",
"version": "0b15205c7325dc20b7da0068307670d222d66949",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn4: Prevent OOB reads when parsing IB\n\nRewrite the IB parsing to use amdgpu_ib_get_value() which handles the\nbounds checks."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Reached only via the local amdgpu command-submission ioctl (DRM_IOCTL_AMDGPU_CS) on a DRM render node; no network or adjacent vector is involved.\nAC:L - The attacker fully controls the IB contents, length_dw, and the backing BO size/layout, so positioning the parser so that idx+6..+8 reads cross the BO\u0027s last mapped page is reliably reproducible.\nPR:L - Requires the ability to open the DRM render node and submit command buffers, i.e. an unprivileged local user with GPU/graphics-session access; no elevated capability is needed.\nUI:N - The malicious command buffer is submitted directly by the attacker; no action by another user is required.\nS:U - Parsing runs on the CPU in kernel context and the OOB access stays within the kernel\u0027s own memory; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unchecked indexing reads kernel memory beyond the IB buffer object (decode_buffer fields and loop words), an out-of-bounds read of kernel memory that is not strictly limited to a couple of bytes.\nI:N - The flaw is purely an out-of-bounds read; the parser performs no OOB write and the OOB-derived address is re-validated before use, so no kernel data is modifiable.\nA:H - Reading past the BO into an unmapped kernel page faults during command submission, producing a kernel oops/crash that the attacker can trigger on demand."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:26.200Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1dc005775fb5b3f86464406452b17364f85581d3"
},
{
"url": "https://git.kernel.org/stable/c/d0802a8877d730260d4af4dd4e0b6cde7e0e593f"
},
{
"url": "https://git.kernel.org/stable/c/a6d5563ba1f03a049561cd347574613167294e8d"
},
{
"url": "https://git.kernel.org/stable/c/5c3e8ebad0c9e2354ddfa8f2148dc4f70a3b4bd1"
},
{
"url": "https://git.kernel.org/stable/c/2444eb0ec8283f4a3845eb7febad378476e1ba3c"
}
],
"title": "drm/amdgpu/vcn4: Prevent OOB reads when parsing IB",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46204",
"datePublished": "2026-05-28T09:40:21.933Z",
"dateReserved": "2026-05-13T15:03:33.104Z",
"dateUpdated": "2026-08-05T12:30:26.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43072 (GCVE-0-2026-43072)
Vulnerability from cvelistv5
Published
2026-05-05 15:29
Modified
2026-06-14 17:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: platform_get_irq_byname() returns an int
platform_get_irq_byname() will return a negative value if an error
happens, so it should be checked and not just passed directly into
devm_request_threaded_irq() hoping all will be ok.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f4790083c7c23b419f6a15170556950fd6a884a2 Version: f4790083c7c23b419f6a15170556950fd6a884a2 Version: f4790083c7c23b419f6a15170556950fd6a884a2 Version: f4790083c7c23b419f6a15170556950fd6a884a2 Version: f4790083c7c23b419f6a15170556950fd6a884a2 Version: f4790083c7c23b419f6a15170556950fd6a884a2 Version: f4790083c7c23b419f6a15170556950fd6a884a2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_hdmi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "59ece0d4d1db0cf483c4c51a58691f50ff81d3a2",
"status": "affected",
"version": "f4790083c7c23b419f6a15170556950fd6a884a2",
"versionType": "git"
},
{
"lessThan": "63c11b19cdc154fa848a6c3b535bfb1dc7b60378",
"status": "affected",
"version": "f4790083c7c23b419f6a15170556950fd6a884a2",
"versionType": "git"
},
{
"lessThan": "ef2ee9db13b68c5e332b77c0a7108a2d4d56e114",
"status": "affected",
"version": "f4790083c7c23b419f6a15170556950fd6a884a2",
"versionType": "git"
},
{
"lessThan": "0185e0494a561edfc482507f9de89c2ad798b33d",
"status": "affected",
"version": "f4790083c7c23b419f6a15170556950fd6a884a2",
"versionType": "git"
},
{
"lessThan": "9c10b83a004442c93d7a484c3d221a06a45821e1",
"status": "affected",
"version": "f4790083c7c23b419f6a15170556950fd6a884a2",
"versionType": "git"
},
{
"lessThan": "0c1b117f7ba46fb8f6ebc5e0bfe5b58568c301ba",
"status": "affected",
"version": "f4790083c7c23b419f6a15170556950fd6a884a2",
"versionType": "git"
},
{
"lessThan": "e597a809a2b97e927060ba182f58eb3e6101bc70",
"status": "affected",
"version": "f4790083c7c23b419f6a15170556950fd6a884a2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_hdmi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: platform_get_irq_byname() returns an int\n\nplatform_get_irq_byname() will return a negative value if an error\nhappens, so it should be checked and not just passed directly into\ndevm_request_threaded_irq() hoping all will be ok."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:44:50.409Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/59ece0d4d1db0cf483c4c51a58691f50ff81d3a2"
},
{
"url": "https://git.kernel.org/stable/c/63c11b19cdc154fa848a6c3b535bfb1dc7b60378"
},
{
"url": "https://git.kernel.org/stable/c/ef2ee9db13b68c5e332b77c0a7108a2d4d56e114"
},
{
"url": "https://git.kernel.org/stable/c/0185e0494a561edfc482507f9de89c2ad798b33d"
},
{
"url": "https://git.kernel.org/stable/c/9c10b83a004442c93d7a484c3d221a06a45821e1"
},
{
"url": "https://git.kernel.org/stable/c/0c1b117f7ba46fb8f6ebc5e0bfe5b58568c301ba"
},
{
"url": "https://git.kernel.org/stable/c/e597a809a2b97e927060ba182f58eb3e6101bc70"
}
],
"title": "drm/vc4: platform_get_irq_byname() returns an int",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43072",
"datePublished": "2026-05-05T15:29:28.795Z",
"dateReserved": "2026-05-01T14:12:55.982Z",
"dateUpdated": "2026-06-14T17:44:50.409Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43304 (GCVE-0-2026-43304)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: define and enforce CEPH_MAX_KEY_LEN
When decoding the key, verify that the key material would fit into
a fixed-size buffer in process_auth_done() and generally has a sane
length.
The new CEPH_MAX_KEY_LEN check replaces the existing check for a key
with no key material which is a) not universal since CEPH_CRYPTO_NONE
has to be excluded and b) doesn't provide much value since a smaller
than needed key is just as invalid as no key -- this has to be handled
elsewhere anyway.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cd1a677cad994021b19665ed476aea63f5d54f31 Version: cd1a677cad994021b19665ed476aea63f5d54f31 Version: cd1a677cad994021b19665ed476aea63f5d54f31 Version: cd1a677cad994021b19665ed476aea63f5d54f31 Version: cd1a677cad994021b19665ed476aea63f5d54f31 Version: cd1a677cad994021b19665ed476aea63f5d54f31 Version: cd1a677cad994021b19665ed476aea63f5d54f31 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/crypto.c",
"net/ceph/crypto.h",
"net/ceph/messenger_v2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6405e8c680974bb74e2c98d5249fb52c7b12a6c6",
"status": "affected",
"version": "cd1a677cad994021b19665ed476aea63f5d54f31",
"versionType": "git"
},
{
"lessThan": "8d745d38c88ecbed95f6b2b39857bf89f35a3244",
"status": "affected",
"version": "cd1a677cad994021b19665ed476aea63f5d54f31",
"versionType": "git"
},
{
"lessThan": "e1dc45d97975f9db65694d234fbddf1915176e16",
"status": "affected",
"version": "cd1a677cad994021b19665ed476aea63f5d54f31",
"versionType": "git"
},
{
"lessThan": "1b275bd49e58752efb83767a5d1aed41356c5e64",
"status": "affected",
"version": "cd1a677cad994021b19665ed476aea63f5d54f31",
"versionType": "git"
},
{
"lessThan": "c1a0f5f1e5e7e98c36a362ec3d1fcfd9932931ed",
"status": "affected",
"version": "cd1a677cad994021b19665ed476aea63f5d54f31",
"versionType": "git"
},
{
"lessThan": "d82467c07b03a27c3c5469b62bb3b726305a80bb",
"status": "affected",
"version": "cd1a677cad994021b19665ed476aea63f5d54f31",
"versionType": "git"
},
{
"lessThan": "ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf",
"status": "affected",
"version": "cd1a677cad994021b19665ed476aea63f5d54f31",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/crypto.c",
"net/ceph/crypto.h",
"net/ceph/messenger_v2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: define and enforce CEPH_MAX_KEY_LEN\n\nWhen decoding the key, verify that the key material would fit into\na fixed-size buffer in process_auth_done() and generally has a sane\nlength.\n\nThe new CEPH_MAX_KEY_LEN check replaces the existing check for a key\nwith no key material which is a) not universal since CEPH_CRYPTO_NONE\nhas to be excluded and b) doesn\u0027t provide much value since a smaller\nthan needed key is just as invalid as no key -- this has to be handled\nelsewhere anyway."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable path is reached by TCP data received from a Ceph msgr2 peer during monitor/OSD authentication, through sock_recvmsg() to process_auth_done(). A malicious or compromised Ceph endpoint can supply the crafted AUTH_DONE payload over the network.\nAC:L - Once the attacker can act as the responding Ceph peer, the oversized decoded session key is a deterministic protocol field and no race or hard-to-control condition is required. The stack overwrite follows directly from the key length accepted before the fix.\nPR:N - The attacker needs no local privileges on the victim kernel; the code is reached during the network authentication handshake before the connection is fully established. Even though CephX payloads are cryptographic, a malicious configured/compromised peer can trigger the path remotely.\nUI:N - No interactive victim action is required once the vulnerable client connects to the Ceph peer as part of normal operation. The malicious AUTH_DONE response is processed automatically by the kernel client.\nS:U - The impact is compromise or crash of the same kernel/client security authority that contains the vulnerable libceph code. This is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The bug is attacker-controlled kernel stack memory corruption from copying an unchecked session key into a fixed-size stack buffer. Such memory corruption can reasonably be leveraged for sensitive kernel memory disclosure.\nI:H - The unchecked memcpy can overwrite adjacent kernel stack state with attacker-controlled key bytes. This is an out-of-bounds write with plausible control-flow or data corruption impact.\nA:H - The stack overflow can corrupt kernel execution state and cause an oops or panic. Even without full exploitation, a malicious peer can crash the client kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:09.910Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6405e8c680974bb74e2c98d5249fb52c7b12a6c6"
},
{
"url": "https://git.kernel.org/stable/c/8d745d38c88ecbed95f6b2b39857bf89f35a3244"
},
{
"url": "https://git.kernel.org/stable/c/e1dc45d97975f9db65694d234fbddf1915176e16"
},
{
"url": "https://git.kernel.org/stable/c/1b275bd49e58752efb83767a5d1aed41356c5e64"
},
{
"url": "https://git.kernel.org/stable/c/c1a0f5f1e5e7e98c36a362ec3d1fcfd9932931ed"
},
{
"url": "https://git.kernel.org/stable/c/d82467c07b03a27c3c5469b62bb3b726305a80bb"
},
{
"url": "https://git.kernel.org/stable/c/ac431d597a9bdfc2ba6b314813f29a6ef2b4a3bf"
}
],
"title": "libceph: define and enforce CEPH_MAX_KEY_LEN",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43304",
"datePublished": "2026-05-08T13:11:24.264Z",
"dateReserved": "2026-05-01T14:12:56.000Z",
"dateUpdated": "2026-08-05T12:27:09.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53356 (GCVE-0-2026-53356)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-08-05 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/gem: Fix phys BO pread/pwrite with offset
sg_page() returns struct page pointer not (void *) so the scaling
of pread/pwrite is wrong for phys BO and wrong parts of BO would be
accessed if non-zero offset is used.
Last impacted platform with overlay or cursor planes using phys
mapping was Gen3/945G/Lakeport.
(cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c6790dc22312f592c1434577258b31c48c72d52a Version: c6790dc22312f592c1434577258b31c48c72d52a Version: c6790dc22312f592c1434577258b31c48c72d52a Version: c6790dc22312f592c1434577258b31c48c72d52a Version: c6790dc22312f592c1434577258b31c48c72d52a Version: c6790dc22312f592c1434577258b31c48c72d52a Version: c6790dc22312f592c1434577258b31c48c72d52a Version: c6790dc22312f592c1434577258b31c48c72d52a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/gem/i915_gem_phys.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "40f738991058eb3e3530c3006a5bd6fd5e29f035",
"status": "affected",
"version": "c6790dc22312f592c1434577258b31c48c72d52a",
"versionType": "git"
},
{
"lessThan": "1ec8fc63e9cdb22da54e48e536c9204020416fc6",
"status": "affected",
"version": "c6790dc22312f592c1434577258b31c48c72d52a",
"versionType": "git"
},
{
"lessThan": "14469860e2e39b7095dcd658d2bad38a11110a68",
"status": "affected",
"version": "c6790dc22312f592c1434577258b31c48c72d52a",
"versionType": "git"
},
{
"lessThan": "07c33be968d9e0cab6cba38c81850a09942fcb2e",
"status": "affected",
"version": "c6790dc22312f592c1434577258b31c48c72d52a",
"versionType": "git"
},
{
"lessThan": "3bd168dd835b93a3862cd05b0d13c432b115f9d6",
"status": "affected",
"version": "c6790dc22312f592c1434577258b31c48c72d52a",
"versionType": "git"
},
{
"lessThan": "32d4c5d328a3ff995420f4f85163e1e403f43628",
"status": "affected",
"version": "c6790dc22312f592c1434577258b31c48c72d52a",
"versionType": "git"
},
{
"lessThan": "dd51a2eeb93bc6faa892ff9083911dd23f82c187",
"status": "affected",
"version": "c6790dc22312f592c1434577258b31c48c72d52a",
"versionType": "git"
},
{
"lessThan": "d21ad938398bca695a511307de38a65889e3b354",
"status": "affected",
"version": "c6790dc22312f592c1434577258b31c48c72d52a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/gem/i915_gem_phys.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gem: Fix phys BO pread/pwrite with offset\n\nsg_page() returns struct page pointer not (void *) so the scaling\nof pread/pwrite is wrong for phys BO and wrong parts of BO would be\naccessed if non-zero offset is used.\n\nLast impacted platform with overlay or cursor planes using phys\nmapping was Gen3/945G/Lakeport.\n\n(cherry picked from commit 3e49a2f85070b2fb672c1e0fdba281a4ea3aebe6)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local DRM/i915 ioctls, specifically GEM pread/pwrite on a phys-backed buffer object. It is not reachable from network, adjacent, or physical device input.\nAC:L - Once on an affected legacy i915 platform with a phys-backed cursor/overlay BO, a nonzero offset reliably triggers the bad scaled pointer arithmetic. There is no race or attacker-external timing condition.\nPR:L - The attacker needs local access to the DRM device and enough ordinary DRM/KMS access to create and pin a framebuffer-backed GEM object, but not real root or CAP_SYS_ADMIN. The pread/pwrite ioctls themselves are render-allowed.\nUI:N - No victim action is required after the attacker has local DRM access. The attacker can issue the needed ioctls directly.\nS:U - The vulnerability is a kernel memory access bug reachable from a kernel driver ioctl path. It does not cross a separate security authority such as a VM host boundary.\nC:H - The faulty phys BO pread path can copy out-of-bounds kernel memory back to userspace. This is a high confidentiality impact because it can disclose kernel memory beyond the intended buffer.\nI:H - The faulty phys BO pwrite path can copy attacker-controlled data out of bounds into kernel memory relative to the coherent allocation. This is kernel memory corruption and can plausibly be leveraged for privilege escalation.\nA:H - The out-of-bounds read/write can corrupt or access invalid kernel memory and cause an oops, panic, or hang. Repeated triggering is possible through local ioctls on the affected object."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:35:05.605Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/40f738991058eb3e3530c3006a5bd6fd5e29f035"
},
{
"url": "https://git.kernel.org/stable/c/1ec8fc63e9cdb22da54e48e536c9204020416fc6"
},
{
"url": "https://git.kernel.org/stable/c/14469860e2e39b7095dcd658d2bad38a11110a68"
},
{
"url": "https://git.kernel.org/stable/c/07c33be968d9e0cab6cba38c81850a09942fcb2e"
},
{
"url": "https://git.kernel.org/stable/c/3bd168dd835b93a3862cd05b0d13c432b115f9d6"
},
{
"url": "https://git.kernel.org/stable/c/32d4c5d328a3ff995420f4f85163e1e403f43628"
},
{
"url": "https://git.kernel.org/stable/c/dd51a2eeb93bc6faa892ff9083911dd23f82c187"
},
{
"url": "https://git.kernel.org/stable/c/d21ad938398bca695a511307de38a65889e3b354"
}
],
"title": "drm/i915/gem: Fix phys BO pread/pwrite with offset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53356",
"datePublished": "2026-07-01T13:32:31.428Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-08-05T12:35:05.605Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53357 (GCVE-0-2026-53357)
Vulnerability from cvelistv5
Published
2026-07-02 13:43
Modified
2026-08-05 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
bt_accept_dequeue() unlinks a not-yet-accepted child from the parent
accept queue and release_sock()s it before returning, so the returned
sk has no caller reference and is unlocked.
l2cap_sock_cleanup_listen() walks these children on listening-socket
close. A concurrent HCI disconnect drives hci_rx_work ->
l2cap_conn_del() which runs l2cap_chan_del() + l2cap_sock_kill() and
frees the child sk and its l2cap_chan; cleanup_listen() then uses both:
BUG: KASAN: slab-use-after-free in l2cap_sock_kill
l2cap_sock_kill / l2cap_sock_cleanup_listen / __x64_sys_close
Freed by: l2cap_conn_del -> l2cap_sock_close_cb -> l2cap_sock_kill
This is distinct from the two fixes already in this area: commit
e83f5e24da741 ("Bluetooth: serialize accept_q access") serialises the
accept_q list/poll and takes temporary refs inside bt_accept_dequeue(),
and CVE-2025-39860 serialises the userspace close()/accept() race by
calling cleanup_listen() under lock_sock() in l2cap_sock_release().
Neither covers l2cap_conn_del() running from hci_rx_work, so this UAF
still reproduces on current bluetooth/master.
Take the reference at the source: bt_accept_dequeue() does sock_hold()
while sk is still locked, before release_sock(); callers sock_put().
cleanup_listen() pins the chan with l2cap_chan_hold_unless_zero() under
a brief child sk lock (serialising vs l2cap_sock_teardown_cb()), drops
it before l2cap_chan_lock(), and skips a duplicate l2cap_sock_kill() on
SOCK_DEAD. conn->lock is not taken here: cleanup_listen() runs under
the parent sk lock and that would invert
conn->lock -> chan->lock -> sk_lock (lockdep).
KASAN/SMP: an unprivileged listen/close vs HCI-disconnect race produced
12 use-after-free reports per run before this change; 0, and no lockdep
report, over 1600+ raced iterations after it on bluetooth/master.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/af_bluetooth.c",
"net/bluetooth/iso.c",
"net/bluetooth/l2cap_sock.c",
"net/bluetooth/rfcomm/sock.c",
"net/bluetooth/sco.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "751de6ec671fe75ad9cf65a0638d2a06b6a5984d",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "407217734835d21d4e0105ebf347860dc1806f88",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "7eebd4c2c86f573af87ff165d08a83432eb0b919",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "5d86d2f1b4d9a508c441d3e45277ae1a73cfed57",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "87c543e2f78d0871f271df92dab98901bbd5b6f5",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "added1213395071470a900cc845a042fb51882a6",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "a5ca86a6097a8b030ca3226cd300b17ed330f966",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "ab1513597c6cf17cd1ad2a21e3b045421b48e022",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/af_bluetooth.c",
"net/bluetooth/iso.c",
"net/bluetooth/l2cap_sock.c",
"net/bluetooth/rfcomm/sock.c",
"net/bluetooth/sco.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()\n\nbt_accept_dequeue() unlinks a not-yet-accepted child from the parent\naccept queue and release_sock()s it before returning, so the returned\nsk has no caller reference and is unlocked.\n\nl2cap_sock_cleanup_listen() walks these children on listening-socket\nclose. A concurrent HCI disconnect drives hci_rx_work -\u003e\nl2cap_conn_del() which runs l2cap_chan_del() + l2cap_sock_kill() and\nfrees the child sk and its l2cap_chan; cleanup_listen() then uses both:\n\n BUG: KASAN: slab-use-after-free in l2cap_sock_kill\n l2cap_sock_kill / l2cap_sock_cleanup_listen / __x64_sys_close\n Freed by: l2cap_conn_del -\u003e l2cap_sock_close_cb -\u003e l2cap_sock_kill\n\nThis is distinct from the two fixes already in this area: commit\ne83f5e24da741 (\"Bluetooth: serialize accept_q access\") serialises the\naccept_q list/poll and takes temporary refs inside bt_accept_dequeue(),\nand CVE-2025-39860 serialises the userspace close()/accept() race by\ncalling cleanup_listen() under lock_sock() in l2cap_sock_release().\nNeither covers l2cap_conn_del() running from hci_rx_work, so this UAF\nstill reproduces on current bluetooth/master.\n\nTake the reference at the source: bt_accept_dequeue() does sock_hold()\nwhile sk is still locked, before release_sock(); callers sock_put().\ncleanup_listen() pins the chan with l2cap_chan_hold_unless_zero() under\na brief child sk lock (serialising vs l2cap_sock_teardown_cb()), drops\nit before l2cap_chan_lock(), and skips a duplicate l2cap_sock_kill() on\nSOCK_DEAD. conn-\u003elock is not taken here: cleanup_listen() runs under\nthe parent sk lock and that would invert\nconn-\u003elock -\u003e chan-\u003elock -\u003e sk_lock (lockdep).\n\nKASAN/SMP: an unprivileged listen/close vs HCI-disconnect race produced\n12 use-after-free reports per run before this change; 0, and no lockdep\nreport, over 1600+ raced iterations after it on bluetooth/master."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The race is driven through Bluetooth L2CAP/HCI connection and disconnect handling from a nearby peer, so it is limited to Bluetooth-adjacent reachability rather than routable network access. The local listener/close side is accounted for in PR.\nAC:L - This is a race, but the attacker can reasonably control the listener close timing and the Bluetooth peer disconnect timing. The commit reports reliable unprivileged raced iterations, so no uncontrollable condition is required.\nPR:L - Creating, binding to a dynamic PSM, listening on, and closing non-raw L2CAP sockets does not require capabilities; only raw sockets or reserved PSMs need privileges. A basic unprivileged local user on the target can set up the vulnerable listener.\nUI:N - No victim user action is required once the attacker can run the unprivileged local setup and control the Bluetooth peer. The trigger is socket close racing HCI disconnect processing.\nS:U - The corruption is within the Linux kernel Bluetooth/socket subsystem and impacts the same kernel security authority. It is not a VM escape or cross-scope boundary bypass.\nC:H - The bug is a use-after-free of both the child sock and its l2cap_chan, and freed kernel heap objects can be reclaimed and used for disclosure primitives. Per kernel CVSS guidance, UAF memory corruption supports high confidentiality impact.\nI:H - The stale sock/channel pointers are used after l2cap_conn_del frees them, including through cleanup and kill paths, making heap grooming and control-flow or write-primitive exploitation plausible. Per guidance, UAF memory corruption supports high integrity impact.\nA:H - The observed failure is a KASAN slab-use-after-free in kernel Bluetooth cleanup, which can crash or oops the kernel. Repeated triggering can deny availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:35:06.665Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/751de6ec671fe75ad9cf65a0638d2a06b6a5984d"
},
{
"url": "https://git.kernel.org/stable/c/407217734835d21d4e0105ebf347860dc1806f88"
},
{
"url": "https://git.kernel.org/stable/c/7eebd4c2c86f573af87ff165d08a83432eb0b919"
},
{
"url": "https://git.kernel.org/stable/c/5d86d2f1b4d9a508c441d3e45277ae1a73cfed57"
},
{
"url": "https://git.kernel.org/stable/c/87c543e2f78d0871f271df92dab98901bbd5b6f5"
},
{
"url": "https://git.kernel.org/stable/c/added1213395071470a900cc845a042fb51882a6"
},
{
"url": "https://git.kernel.org/stable/c/a5ca86a6097a8b030ca3226cd300b17ed330f966"
},
{
"url": "https://git.kernel.org/stable/c/ab1513597c6cf17cd1ad2a21e3b045421b48e022"
}
],
"title": "Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53357",
"datePublished": "2026-07-02T13:43:17.077Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-08-05T12:35:06.665Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43069 (GCVE-0-2026-43069)
Vulnerability from cvelistv5
Published
2026-05-05 15:23
Modified
2026-05-11 22:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_ll: Fix firmware leak on error path
Smatch reports:
drivers/bluetooth/hci_ll.c:587 download_firmware() warn:
'fw' from request_firmware() not released on lines: 544.
In download_firmware(), if request_firmware() succeeds but the returned
firmware content is invalid (no data or zero size), the function returns
without releasing the firmware, resulting in a resource leak.
Fix this by calling release_firmware() before returning when
request_firmware() succeeded but the firmware content is invalid.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 371805522f870986144fcd88727a47858e364a2c Version: 371805522f870986144fcd88727a47858e364a2c Version: 371805522f870986144fcd88727a47858e364a2c Version: 371805522f870986144fcd88727a47858e364a2c Version: 371805522f870986144fcd88727a47858e364a2c Version: 371805522f870986144fcd88727a47858e364a2c Version: 371805522f870986144fcd88727a47858e364a2c Version: 371805522f870986144fcd88727a47858e364a2c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/hci_ll.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "95e8601af227b2b4390eecf8db6abdb9f6a91f17",
"status": "affected",
"version": "371805522f870986144fcd88727a47858e364a2c",
"versionType": "git"
},
{
"lessThan": "e6d95488c8c964d1df0d3e1db44c958706311e86",
"status": "affected",
"version": "371805522f870986144fcd88727a47858e364a2c",
"versionType": "git"
},
{
"lessThan": "b2dfbf1b5ff192cefd49574b951a4af9ddd32213",
"status": "affected",
"version": "371805522f870986144fcd88727a47858e364a2c",
"versionType": "git"
},
{
"lessThan": "28904375d54b436a757641fb0331537778c0de5a",
"status": "affected",
"version": "371805522f870986144fcd88727a47858e364a2c",
"versionType": "git"
},
{
"lessThan": "5213ef54528dd1ac79b846e30d8f72ce092794aa",
"status": "affected",
"version": "371805522f870986144fcd88727a47858e364a2c",
"versionType": "git"
},
{
"lessThan": "9ecbfd93cd6de6c78cb7fd51fe079e36c7ff074b",
"status": "affected",
"version": "371805522f870986144fcd88727a47858e364a2c",
"versionType": "git"
},
{
"lessThan": "a7803df606a7d22e896b030f619e1d9d20ae0c6b",
"status": "affected",
"version": "371805522f870986144fcd88727a47858e364a2c",
"versionType": "git"
},
{
"lessThan": "31148a7be723aa9f2e8fbd62424825ab8d577973",
"status": "affected",
"version": "371805522f870986144fcd88727a47858e364a2c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/hci_ll.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_ll: Fix firmware leak on error path\n\nSmatch reports:\n\ndrivers/bluetooth/hci_ll.c:587 download_firmware() warn:\n\u0027fw\u0027 from request_firmware() not released on lines: 544.\n\nIn download_firmware(), if request_firmware() succeeds but the returned\nfirmware content is invalid (no data or zero size), the function returns\nwithout releasing the firmware, resulting in a resource leak.\n\nFix this by calling release_firmware() before returning when\nrequest_firmware() succeeded but the firmware content is invalid."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:17:07.130Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/95e8601af227b2b4390eecf8db6abdb9f6a91f17"
},
{
"url": "https://git.kernel.org/stable/c/e6d95488c8c964d1df0d3e1db44c958706311e86"
},
{
"url": "https://git.kernel.org/stable/c/b2dfbf1b5ff192cefd49574b951a4af9ddd32213"
},
{
"url": "https://git.kernel.org/stable/c/28904375d54b436a757641fb0331537778c0de5a"
},
{
"url": "https://git.kernel.org/stable/c/5213ef54528dd1ac79b846e30d8f72ce092794aa"
},
{
"url": "https://git.kernel.org/stable/c/9ecbfd93cd6de6c78cb7fd51fe079e36c7ff074b"
},
{
"url": "https://git.kernel.org/stable/c/a7803df606a7d22e896b030f619e1d9d20ae0c6b"
},
{
"url": "https://git.kernel.org/stable/c/31148a7be723aa9f2e8fbd62424825ab8d577973"
}
],
"title": "Bluetooth: hci_ll: Fix firmware leak on error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43069",
"datePublished": "2026-05-05T15:23:28.120Z",
"dateReserved": "2026-05-01T14:12:55.982Z",
"dateUpdated": "2026-05-11T22:17:07.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53254 (GCVE-0-2026-53254)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: RFCOMM: validate skb length in MCC handlers
The RFCOMM MCC handlers cast skb->data to protocol-specific structs
without validating skb->len first. A malicious remote device can send
truncated MCC frames and trigger out-of-bounds reads in these handlers.
Fix this by using skb_pull_data() to validate and access the required
data before dereferencing it.
rfcomm_recv_rpn() requires special handling since ETSI TS 07.10 allows
1-byte RPN requests. Handle this by validating only the DLCI byte first,
and validating the full struct only when len > 1.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/rfcomm/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7c15c7c2878957cbfed93bcc29c13fdace464254",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0d637136ce89f9a2309b2c3502402ce400dab0ef",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "98377e6b1a1a56561ec66a181573ea2b61b2079e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1b070ac9e99c2c2c3a8112943ca98ab6fca7f10c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3eabc6d47a0ad22b053329997aaf0ec1e581e392",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "08b9c1fbe78f4ad3f6250c6541cfaabdbeb81997",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "23882b828c3c8c51d0c946446a396b10abb3b16b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/rfcomm/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: validate skb length in MCC handlers\n\nThe RFCOMM MCC handlers cast skb-\u003edata to protocol-specific structs\nwithout validating skb-\u003elen first. A malicious remote device can send\ntruncated MCC frames and trigger out-of-bounds reads in these handlers.\n\nFix this by using skb_pull_data() to validate and access the required\ndata before dereferencing it.\n\nrfcomm_recv_rpn() requires special handling since ETSI TS 07.10 allows\n1-byte RPN requests. Handle this by validating only the DLCI byte first,\nand validating the full struct only when len \u003e 1."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - An attacker reaches the vulnerable RFCOMM MCC parsing code by sending malformed Bluetooth RFCOMM frames over a BR/EDR L2CAP connection. Bluetooth requires radio adjacency rather than ordinary IP network reachability.\nAC:L - The attacker controls the RFCOMM frame contents and can send truncated MCC frames directly after establishing the Bluetooth/L2CAP connection. No race or condition outside the attacker\u2019s control is required.\nPR:N - The RFCOMM L2CAP listener uses the SDP/low-security path, and the vulnerable control-channel parsing occurs before RFCOMM DLC/service-level authentication. A malicious nearby Bluetooth device does not need local privileges or authenticated credentials.\nUI:N - No victim action is needed once the target Bluetooth stack is reachable and accepting RFCOMM/L2CAP traffic. The attacker sends the malformed frames directly.\nS:U - The impact is within the Linux kernel Bluetooth/RFCOMM security authority. There is no VM escape, IOMMU bypass, or separate security scope crossed.\nC:H - The bug is an out-of-bounds read from kernel skb memory, and some handler paths can reflect values derived from parsed control fields back to the peer. Under the required higher-severity rule, this is scored as high confidentiality impact.\nI:N - The fix and code review show bounded out-of-bounds reads, not an out-of-bounds write, use-after-free, or control-flow corruption primitive. Any state changes are limited to RFCOMM negotiation for the attacker-controlled connection.\nA:H - Malformed short Bluetooth frames can trigger kernel out-of-bounds reads in the RFCOMM receive thread, with related Bluetooth short-frame bugs producing KASAN slab-out-of-bounds reports. Under kernel scoring guidance, such remotely triggerable kernel fault conditions are high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:35.807Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7c15c7c2878957cbfed93bcc29c13fdace464254"
},
{
"url": "https://git.kernel.org/stable/c/0d637136ce89f9a2309b2c3502402ce400dab0ef"
},
{
"url": "https://git.kernel.org/stable/c/98377e6b1a1a56561ec66a181573ea2b61b2079e"
},
{
"url": "https://git.kernel.org/stable/c/1b070ac9e99c2c2c3a8112943ca98ab6fca7f10c"
},
{
"url": "https://git.kernel.org/stable/c/3eabc6d47a0ad22b053329997aaf0ec1e581e392"
},
{
"url": "https://git.kernel.org/stable/c/08b9c1fbe78f4ad3f6250c6541cfaabdbeb81997"
},
{
"url": "https://git.kernel.org/stable/c/23882b828c3c8c51d0c946446a396b10abb3b16b"
}
],
"title": "Bluetooth: RFCOMM: validate skb length in MCC handlers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53254",
"datePublished": "2026-06-25T08:39:45.273Z",
"dateReserved": "2026-06-09T07:44:35.394Z",
"dateUpdated": "2026-08-05T12:34:35.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46291 (GCVE-0-2026-46291)
Vulnerability from cvelistv5
Published
2026-06-08 15:46
Modified
2026-06-19 12:00
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: caam - guard HMAC key hex dumps in hash_digest_key
Use print_hex_dump_devel() for dumping sensitive HMAC key bytes in
hash_digest_key() to avoid leaking secrets at runtime when
CONFIG_DYNAMIC_DEBUG is enabled.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 045e36780f11523e26d1e4a8c78bdc57f4003bd0 Version: 045e36780f11523e26d1e4a8c78bdc57f4003bd0 Version: 045e36780f11523e26d1e4a8c78bdc57f4003bd0 Version: 045e36780f11523e26d1e4a8c78bdc57f4003bd0 Version: 045e36780f11523e26d1e4a8c78bdc57f4003bd0 Version: 045e36780f11523e26d1e4a8c78bdc57f4003bd0 Version: 045e36780f11523e26d1e4a8c78bdc57f4003bd0 Version: 045e36780f11523e26d1e4a8c78bdc57f4003bd0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/caam/caamalg_qi2.c",
"drivers/crypto/caam/caamhash.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e8e72fdf47bd5ef7abe642b034c6178a61a8580a",
"status": "affected",
"version": "045e36780f11523e26d1e4a8c78bdc57f4003bd0",
"versionType": "git"
},
{
"lessThan": "cd849c07b8d706425e60a4dfcef54b7b67c967ce",
"status": "affected",
"version": "045e36780f11523e26d1e4a8c78bdc57f4003bd0",
"versionType": "git"
},
{
"lessThan": "a9207798fe619cbc85c8744a9b9e2af1db2b6e1a",
"status": "affected",
"version": "045e36780f11523e26d1e4a8c78bdc57f4003bd0",
"versionType": "git"
},
{
"lessThan": "2adbfca7452eeac45117b8e803288a2767f7075f",
"status": "affected",
"version": "045e36780f11523e26d1e4a8c78bdc57f4003bd0",
"versionType": "git"
},
{
"lessThan": "c7e52fe3f7901ccb9cd29b3f7c683d809ba87e48",
"status": "affected",
"version": "045e36780f11523e26d1e4a8c78bdc57f4003bd0",
"versionType": "git"
},
{
"lessThan": "5cffe3c136891aa4d579bf5c079a68f7cb371b0c",
"status": "affected",
"version": "045e36780f11523e26d1e4a8c78bdc57f4003bd0",
"versionType": "git"
},
{
"lessThan": "b8f12d9b00c1950779e5679b9c13908584682bb6",
"status": "affected",
"version": "045e36780f11523e26d1e4a8c78bdc57f4003bd0",
"versionType": "git"
},
{
"lessThan": "177730a273b18e195263ed953853273e901b5064",
"status": "affected",
"version": "045e36780f11523e26d1e4a8c78bdc57f4003bd0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/caam/caamalg_qi2.c",
"drivers/crypto/caam/caamhash.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: caam - guard HMAC key hex dumps in hash_digest_key\n\nUse print_hex_dump_devel() for dumping sensitive HMAC key bytes in\nhash_digest_key() to avoid leaking secrets at runtime when\nCONFIG_DYNAMIC_DEBUG is enabled."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-19T12:00:06.481Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e8e72fdf47bd5ef7abe642b034c6178a61a8580a"
},
{
"url": "https://git.kernel.org/stable/c/cd849c07b8d706425e60a4dfcef54b7b67c967ce"
},
{
"url": "https://git.kernel.org/stable/c/a9207798fe619cbc85c8744a9b9e2af1db2b6e1a"
},
{
"url": "https://git.kernel.org/stable/c/2adbfca7452eeac45117b8e803288a2767f7075f"
},
{
"url": "https://git.kernel.org/stable/c/c7e52fe3f7901ccb9cd29b3f7c683d809ba87e48"
},
{
"url": "https://git.kernel.org/stable/c/5cffe3c136891aa4d579bf5c079a68f7cb371b0c"
},
{
"url": "https://git.kernel.org/stable/c/b8f12d9b00c1950779e5679b9c13908584682bb6"
},
{
"url": "https://git.kernel.org/stable/c/177730a273b18e195263ed953853273e901b5064"
}
],
"title": "crypto: caam - guard HMAC key hex dumps in hash_digest_key",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46291",
"datePublished": "2026-06-08T15:46:18.317Z",
"dateReserved": "2026-05-13T15:03:33.110Z",
"dateUpdated": "2026-06-19T12:00:06.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43458 (GCVE-0-2026-43458)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-11 22:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
serial: caif: hold tty->link reference in ldisc_open and ser_release
A reproducer triggers a KASAN slab-use-after-free in pty_write_room()
when caif_serial's TX path calls tty_write_room(). The faulting access
is on tty->link->port.
Hold an extra kref on tty->link for the lifetime of the caif_serial line
discipline: get it in ldisc_open() and drop it in ser_release(), and
also drop it on the ldisc_open() error path.
With this change applied, the reproducer no longer triggers the UAF in
my testing.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e31d5a05948e4478ba8396063d1e1f39880928e2 Version: e31d5a05948e4478ba8396063d1e1f39880928e2 Version: e31d5a05948e4478ba8396063d1e1f39880928e2 Version: e31d5a05948e4478ba8396063d1e1f39880928e2 Version: e31d5a05948e4478ba8396063d1e1f39880928e2 Version: e31d5a05948e4478ba8396063d1e1f39880928e2 Version: e31d5a05948e4478ba8396063d1e1f39880928e2 Version: e31d5a05948e4478ba8396063d1e1f39880928e2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/caif/caif_serial.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "23a3ac2e2262a291498567418227b99e1f3606b1",
"status": "affected",
"version": "e31d5a05948e4478ba8396063d1e1f39880928e2",
"versionType": "git"
},
{
"lessThan": "52135420e9f75853ea0c6cea7b736e3e98495f7d",
"status": "affected",
"version": "e31d5a05948e4478ba8396063d1e1f39880928e2",
"versionType": "git"
},
{
"lessThan": "ca2ceba983bb23ea0202c2882d963253416654a3",
"status": "affected",
"version": "e31d5a05948e4478ba8396063d1e1f39880928e2",
"versionType": "git"
},
{
"lessThan": "8460187b4852fd00bd1c76394358053f3fa4d089",
"status": "affected",
"version": "e31d5a05948e4478ba8396063d1e1f39880928e2",
"versionType": "git"
},
{
"lessThan": "27e43356d0defb9fc7fa25265219a3ffeb7b3e98",
"status": "affected",
"version": "e31d5a05948e4478ba8396063d1e1f39880928e2",
"versionType": "git"
},
{
"lessThan": "35b58d3bc716ebb9ebd10fe1cac8c1177242511c",
"status": "affected",
"version": "e31d5a05948e4478ba8396063d1e1f39880928e2",
"versionType": "git"
},
{
"lessThan": "97a0bb491cae39478c6225381f14e9ac67b7bba7",
"status": "affected",
"version": "e31d5a05948e4478ba8396063d1e1f39880928e2",
"versionType": "git"
},
{
"lessThan": "288598d80a068a0e9281de35bcb4ce495f189e2a",
"status": "affected",
"version": "e31d5a05948e4478ba8396063d1e1f39880928e2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/caif/caif_serial.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: caif: hold tty-\u003elink reference in ldisc_open and ser_release\n\nA reproducer triggers a KASAN slab-use-after-free in pty_write_room()\nwhen caif_serial\u0027s TX path calls tty_write_room(). The faulting access\nis on tty-\u003elink-\u003eport.\n\nHold an extra kref on tty-\u003elink for the lifetime of the caif_serial line\ndiscipline: get it in ldisc_open() and drop it in ser_release(), and\nalso drop it on the ldisc_open() error path.\n\nWith this change applied, the reproducer no longer triggers the UAF in\nmy testing."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:58.635Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/23a3ac2e2262a291498567418227b99e1f3606b1"
},
{
"url": "https://git.kernel.org/stable/c/52135420e9f75853ea0c6cea7b736e3e98495f7d"
},
{
"url": "https://git.kernel.org/stable/c/ca2ceba983bb23ea0202c2882d963253416654a3"
},
{
"url": "https://git.kernel.org/stable/c/8460187b4852fd00bd1c76394358053f3fa4d089"
},
{
"url": "https://git.kernel.org/stable/c/27e43356d0defb9fc7fa25265219a3ffeb7b3e98"
},
{
"url": "https://git.kernel.org/stable/c/35b58d3bc716ebb9ebd10fe1cac8c1177242511c"
},
{
"url": "https://git.kernel.org/stable/c/97a0bb491cae39478c6225381f14e9ac67b7bba7"
},
{
"url": "https://git.kernel.org/stable/c/288598d80a068a0e9281de35bcb4ce495f189e2a"
}
],
"title": "serial: caif: hold tty-\u003elink reference in ldisc_open and ser_release",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43458",
"datePublished": "2026-05-08T14:22:21.997Z",
"dateReserved": "2026-05-01T14:12:56.010Z",
"dateUpdated": "2026-05-11T22:24:58.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46229 (GCVE-0-2026-46229)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-06-14 18:04
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
KFD VRAM allocations set AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE
but not AMDGPU_GEM_CREATE_VRAM_CLEARED, leaving freshly allocated
VRAM with stale data from prior use observable by compute kernels.
The GEM ioctl path already sets VRAM_CLEARED for all userspace
allocations via amdgpu_gem_create_ioctl() and
amdgpu_mode_dumb_create(). The KFD path was missing this flag,
allowing stale page table remnants to leak into user buffers.
This causes crashes in RCCL P2P transport where non-zero data in
ptrExchange/head/tail fields corrupts the protocol handshake.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1db431380879fd9d28b763a88a0c0431be5be8df",
"status": "affected",
"version": "6856e4b65f64eeb3f17148f79b36c1d60c627529",
"versionType": "git"
},
{
"lessThan": "32b153658f017ad2f5bf8aab479e8d16ac95bc3a",
"status": "affected",
"version": "6856e4b65f64eeb3f17148f79b36c1d60c627529",
"versionType": "git"
},
{
"lessThan": "77d0b5d11387071770246fd0185a69fa28e8e109",
"status": "affected",
"version": "6856e4b65f64eeb3f17148f79b36c1d60c627529",
"versionType": "git"
},
{
"lessThan": "047d44d8d29a6a1a5757256837aa9dd78e3cd0b5",
"status": "affected",
"version": "6856e4b65f64eeb3f17148f79b36c1d60c627529",
"versionType": "git"
},
{
"lessThan": "ad52d61d82181dbdb7f05826de38352d5e550cc2",
"status": "affected",
"version": "6856e4b65f64eeb3f17148f79b36c1d60c627529",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Clear VRAM on allocation to prevent stale data exposure\n\nKFD VRAM allocations set AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE\nbut not AMDGPU_GEM_CREATE_VRAM_CLEARED, leaving freshly allocated\nVRAM with stale data from prior use observable by compute kernels.\n\nThe GEM ioctl path already sets VRAM_CLEARED for all userspace\nallocations via amdgpu_gem_create_ioctl() and\namdgpu_mode_dumb_create(). The KFD path was missing this flag,\nallowing stale page table remnants to leak into user buffers.\n\nThis causes crashes in RCCL P2P transport where non-zero data in\nptrExchange/head/tail fields corrupts the protocol handshake."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:04:17.225Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1db431380879fd9d28b763a88a0c0431be5be8df"
},
{
"url": "https://git.kernel.org/stable/c/32b153658f017ad2f5bf8aab479e8d16ac95bc3a"
},
{
"url": "https://git.kernel.org/stable/c/77d0b5d11387071770246fd0185a69fa28e8e109"
},
{
"url": "https://git.kernel.org/stable/c/047d44d8d29a6a1a5757256837aa9dd78e3cd0b5"
},
{
"url": "https://git.kernel.org/stable/c/ad52d61d82181dbdb7f05826de38352d5e550cc2"
}
],
"title": "drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46229",
"datePublished": "2026-05-28T09:40:51.300Z",
"dateReserved": "2026-05-13T15:03:33.106Z",
"dateUpdated": "2026-06-14T18:04:17.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53159 (GCVE-0-2026-53159)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: fix DMA address corruption due to find_vma misuse
fastrpc_get_args() uses find_vma() to look up the VMA for a user-provided
pointer and compute a DMA address offset. When the address falls in a gap
before the returned VMA, (ptr & PAGE_MASK) - vma->vm_start underflows,
corrupting the DMA address sent to the DSP.
Replace find_vma() with vma_lookup(), which returns NULL when the address
is not contained within any VMA.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 80f3afd72bd4149c57daf852905476b43bb47647 Version: 80f3afd72bd4149c57daf852905476b43bb47647 Version: 80f3afd72bd4149c57daf852905476b43bb47647 Version: 80f3afd72bd4149c57daf852905476b43bb47647 Version: 80f3afd72bd4149c57daf852905476b43bb47647 Version: 80f3afd72bd4149c57daf852905476b43bb47647 Version: 80f3afd72bd4149c57daf852905476b43bb47647 Version: 80f3afd72bd4149c57daf852905476b43bb47647 Version: 954edc466128479872731d06f026d0e71840d153 Version: 5.1.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/misc/fastrpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d43afc412d439ffca1567e7ca8652be22f272b3b",
"status": "affected",
"version": "80f3afd72bd4149c57daf852905476b43bb47647",
"versionType": "git"
},
{
"lessThan": "2d0f47e27c1fa718b29c69aa7c96a2c5161bc2c2",
"status": "affected",
"version": "80f3afd72bd4149c57daf852905476b43bb47647",
"versionType": "git"
},
{
"lessThan": "708c17b52c60fe7a57e73b495bdee50f58feb48c",
"status": "affected",
"version": "80f3afd72bd4149c57daf852905476b43bb47647",
"versionType": "git"
},
{
"lessThan": "d3e26df2e8eb361e6bef096b2fd565476a1f14c4",
"status": "affected",
"version": "80f3afd72bd4149c57daf852905476b43bb47647",
"versionType": "git"
},
{
"lessThan": "e69e306a4cccb40a73511350cb280825a556ce3c",
"status": "affected",
"version": "80f3afd72bd4149c57daf852905476b43bb47647",
"versionType": "git"
},
{
"lessThan": "53e06f8a3c2b085c31bf1284e2ebcb8036e99625",
"status": "affected",
"version": "80f3afd72bd4149c57daf852905476b43bb47647",
"versionType": "git"
},
{
"lessThan": "7ba7b30ddb04646d4d638f4d8c4718a304bbbddd",
"status": "affected",
"version": "80f3afd72bd4149c57daf852905476b43bb47647",
"versionType": "git"
},
{
"lessThan": "464c6ad2aa16e1e1df9d559289199356493d1e00",
"status": "affected",
"version": "80f3afd72bd4149c57daf852905476b43bb47647",
"versionType": "git"
},
{
"status": "affected",
"version": "954edc466128479872731d06f026d0e71840d153",
"versionType": "git"
},
{
"lessThan": "5.2",
"status": "affected",
"version": "5.1.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/misc/fastrpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.1.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: fix DMA address corruption due to find_vma misuse\n\nfastrpc_get_args() uses find_vma() to look up the VMA for a user-provided\npointer and compute a DMA address offset. When the address falls in a gap\nbefore the returned VMA, (ptr \u0026 PAGE_MASK) - vma-\u003evm_start underflows,\ncorrupting the DMA address sent to the DSP.\n\nReplace find_vma() with vma_lookup(), which returns NULL when the address\nis not contained within any VMA."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through local FastRPC misc-device ioctls, especially FASTRPC_IOCTL_INVOKE, not through network packets or adjacent/physical input.\nAC:L - The attacker controls the invoke arguments, DMA-buf fd, length, and user address layout; placing the pointer in a VMA gap is straightforward with mmap/munmap and no race is required.\nPR:L - A caller needs local access to an openable /dev/fastrpc-* device, but the kernel path has no capable() check and FastRPC supports untrusted/unsigned user protection domains on relevant Qualcomm DSP deployments.\nUI:N - The attacker triggers the ioctl path directly and does not need another user to open files, mount anything, or perform an action.\nS:C - The corrupted address is consumed across the host/DSP DMA/IOMMU boundary, so the bug can affect memory resources outside the caller\u2019s intended FastRPC buffer authority.\nC:H - The underflow can make an attacker-controlled DSP invocation read from unintended DMA/IOMMU-visible memory rather than the supplied buffer, which is a plausible high-impact information disclosure primitive.\nI:H - For output or bidirectional buffers, the same corrupted DMA address can direct DSP writes to unintended DMA/IOMMU-visible memory, giving a plausible high-impact memory corruption primitive.\nA:H - Invalid or unintended DMA addresses can trigger IOMMU/DSP faults, hangs, or kernel-facing subsystem failure, producing high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:33.871Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d43afc412d439ffca1567e7ca8652be22f272b3b"
},
{
"url": "https://git.kernel.org/stable/c/2d0f47e27c1fa718b29c69aa7c96a2c5161bc2c2"
},
{
"url": "https://git.kernel.org/stable/c/708c17b52c60fe7a57e73b495bdee50f58feb48c"
},
{
"url": "https://git.kernel.org/stable/c/d3e26df2e8eb361e6bef096b2fd565476a1f14c4"
},
{
"url": "https://git.kernel.org/stable/c/e69e306a4cccb40a73511350cb280825a556ce3c"
},
{
"url": "https://git.kernel.org/stable/c/53e06f8a3c2b085c31bf1284e2ebcb8036e99625"
},
{
"url": "https://git.kernel.org/stable/c/7ba7b30ddb04646d4d638f4d8c4718a304bbbddd"
},
{
"url": "https://git.kernel.org/stable/c/464c6ad2aa16e1e1df9d559289199356493d1e00"
}
],
"title": "misc: fastrpc: fix DMA address corruption due to find_vma misuse",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53159",
"datePublished": "2026-06-25T08:38:41.482Z",
"dateReserved": "2026-06-09T07:44:35.388Z",
"dateUpdated": "2026-08-05T12:33:33.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46124 (GCVE-0-2026-46124)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
isofs: validate block number from NFS file handle in isofs_export_iget
isofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker-
controlled block number (ifid->block or ifid->parent_block) from
the NFS file handle to isofs_export_iget(), which only rejects
block == 0 before calling isofs_iget() and ultimately sb_bread().
A crafted file handle with fh_len sufficient to pass the check
added by commit 0405d4b63d08 ("isofs: Prevent the use of too small
fid") can still drive the server to read any in-range block on the
backing device as if it were an iso_directory_record. That earlier
fix was assigned CVE-2025-37780.
sb_bread() on an out-of-range block returns NULL cleanly via the
EIO path, so there is no memory-safety violation. For in-range
reads of adjacent-partition data on the same block device, the
unrelated bytes end up in iso_inode_info fields that reach the NFS
client as dentry metadata. The deployment surface (isofs exported
over NFS from loop-mounted images) is narrow and requires an
authenticated NFS peer, but the malformed-file-handle class is
reportable as hardening next to the existing CVE-2025-37780 fix.
Reject block >= ISOFS_SB(sb)->s_nzones in isofs_export_iget() so
the check covers both isofs_fh_to_dentry() and isofs_fh_to_parent()
call sites with a single line.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5e7de55602c61c8ff28db075cc49c8dd6989d7e0 Version: 63d5a3e207bf315a32c7d16de6c89753a759f95a Version: 0fdafdaef796816a9ed0fd7ac812932d569d9beb Version: 952e7a7e317f126d0a2b879fc531b716932d5ffa Version: 56dfffea9fd3be0b3795a9ca6401e133a8427e0b Version: 0405d4b63d082861f4eaff9d39c78ee9dc34f845 Version: 0405d4b63d082861f4eaff9d39c78ee9dc34f845 Version: 0405d4b63d082861f4eaff9d39c78ee9dc34f845 Version: ee01a309ebf598be1ff8174901ed6e91619f1749 Version: 007124c896e7d4614ac1f6bd4dedb975c35a2a8e Version: 5.10.237 ≤ Version: 5.15.181 ≤ Version: 6.1.135 ≤ Version: 6.6.88 ≤ Version: 6.12.25 ≤ Version: 5.4.293 ≤ Version: 6.14.4 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/isofs/export.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ee0024f5a7e3c73aa253869fae9650ae054093ca",
"status": "affected",
"version": "5e7de55602c61c8ff28db075cc49c8dd6989d7e0",
"versionType": "git"
},
{
"lessThan": "31dbb4ba0f719ae7774e4c0c95172c9bf81692f5",
"status": "affected",
"version": "63d5a3e207bf315a32c7d16de6c89753a759f95a",
"versionType": "git"
},
{
"lessThan": "908a76f0b1038035e6ebb4f2293ce079f92e0a02",
"status": "affected",
"version": "0fdafdaef796816a9ed0fd7ac812932d569d9beb",
"versionType": "git"
},
{
"lessThan": "bb0988ed4f2e26d59bbb58f644cb3a55b7521e21",
"status": "affected",
"version": "952e7a7e317f126d0a2b879fc531b716932d5ffa",
"versionType": "git"
},
{
"lessThan": "0a1af74ae2177bda3aee0837a0546309aa539d0d",
"status": "affected",
"version": "56dfffea9fd3be0b3795a9ca6401e133a8427e0b",
"versionType": "git"
},
{
"lessThan": "afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b",
"status": "affected",
"version": "0405d4b63d082861f4eaff9d39c78ee9dc34f845",
"versionType": "git"
},
{
"lessThan": "4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6",
"status": "affected",
"version": "0405d4b63d082861f4eaff9d39c78ee9dc34f845",
"versionType": "git"
},
{
"lessThan": "24376458138387fb251e782e624c7776e9826796",
"status": "affected",
"version": "0405d4b63d082861f4eaff9d39c78ee9dc34f845",
"versionType": "git"
},
{
"status": "affected",
"version": "ee01a309ebf598be1ff8174901ed6e91619f1749",
"versionType": "git"
},
{
"status": "affected",
"version": "007124c896e7d4614ac1f6bd4dedb975c35a2a8e",
"versionType": "git"
},
{
"lessThan": "5.10.258",
"status": "affected",
"version": "5.10.237",
"versionType": "semver"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.181",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.135",
"versionType": "semver"
},
{
"lessThan": "6.6.140",
"status": "affected",
"version": "6.6.88",
"versionType": "semver"
},
{
"lessThan": "6.12.88",
"status": "affected",
"version": "6.12.25",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.293",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/isofs/export.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10.237",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.181",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.135",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.6.88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.12.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.293",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nisofs: validate block number from NFS file handle in isofs_export_iget\n\nisofs_fh_to_dentry() and isofs_fh_to_parent() pass an attacker-\ncontrolled block number (ifid-\u003eblock or ifid-\u003eparent_block) from\nthe NFS file handle to isofs_export_iget(), which only rejects\nblock == 0 before calling isofs_iget() and ultimately sb_bread().\nA crafted file handle with fh_len sufficient to pass the check\nadded by commit 0405d4b63d08 (\"isofs: Prevent the use of too small\nfid\") can still drive the server to read any in-range block on the\nbacking device as if it were an iso_directory_record. That earlier\nfix was assigned CVE-2025-37780.\n\nsb_bread() on an out-of-range block returns NULL cleanly via the\nEIO path, so there is no memory-safety violation. For in-range\nreads of adjacent-partition data on the same block device, the\nunrelated bytes end up in iso_inode_info fields that reach the NFS\nclient as dentry metadata. The deployment surface (isofs exported\nover NFS from loop-mounted images) is narrow and requires an\nauthenticated NFS peer, but the malformed-file-handle class is\nreportable as hardening next to the existing CVE-2025-37780 fix.\n\nReject block \u003e= ISOFS_SB(sb)-\u003es_nzones in isofs_export_iget() so\nthe check covers both isofs_fh_to_dentry() and isofs_fh_to_parent()\ncall sites with a single line."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is reached when nfsd decodes an attacker-supplied NFS file handle (exportfs_decode_fh \u2192 isofs_fh_to_dentry), so a remote NFS client triggers it over the network (TCP/UDP 2049).\nAC:L - The attacker fully controls the block field in the file handle and the read is deterministic; no race or uncontrollable memory layout is involved.\nPR:N - The decode runs before per-user permission checks, and the realistic deployment (a read-only ISO exported to a subnet via default AUTH_SYS) lets any permitted network peer craft handles without credentials.\nUI:N - The NFS server processes the crafted request automatically; no victim action is required at attack time beyond the pre-existing export.\nS:U - The impact stays within the kernel filesystem/NFS security authority; no cross-authority boundary (VM, IOMMU, sandbox) is crossed.\nC:H - An out-of-bounds (cross-partition) read of arbitrary in-range blocks on the backing device is disclosed to the NFS client as inode metadata, and is not bounded to a few bytes since the attacker can probe blocks across the device.\nI:N - isofs is mounted strictly read-only and the commit confirms no memory-safety violation, so the attacker cannot modify any data or kernel memory.\nA:N - Out-of-range reads return NULL cleanly via the EIO path and in-range parsing is bounded; the commit and maintainer explicitly confirm no crash, hang, or memory-safety fault."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:53.831Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ee0024f5a7e3c73aa253869fae9650ae054093ca"
},
{
"url": "https://git.kernel.org/stable/c/31dbb4ba0f719ae7774e4c0c95172c9bf81692f5"
},
{
"url": "https://git.kernel.org/stable/c/908a76f0b1038035e6ebb4f2293ce079f92e0a02"
},
{
"url": "https://git.kernel.org/stable/c/bb0988ed4f2e26d59bbb58f644cb3a55b7521e21"
},
{
"url": "https://git.kernel.org/stable/c/0a1af74ae2177bda3aee0837a0546309aa539d0d"
},
{
"url": "https://git.kernel.org/stable/c/afbafeddf23db13fe2edb2d5c0bf4bbb13d7881b"
},
{
"url": "https://git.kernel.org/stable/c/4c721a1d9b3c4fcaf59cc9b2281e3ec5a043e1a6"
},
{
"url": "https://git.kernel.org/stable/c/24376458138387fb251e782e624c7776e9826796"
}
],
"title": "isofs: validate block number from NFS file handle in isofs_export_iget",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46124",
"datePublished": "2026-05-28T09:35:38.887Z",
"dateReserved": "2026-05-13T15:03:33.098Z",
"dateUpdated": "2026-08-05T12:29:53.831Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31510 (GCVE-0-2026-31510)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-05-11 22:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
Before using sk pointer, check if it is null.
Fix the following:
KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267]
CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025
Workqueue: events l2cap_info_timeout
RIP: 0010:kasan_byte_accessible+0x12/0x30
Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce
veth0_macvtap: entered promiscuous mode
RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000
R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0
PKRU: 55555554
Call Trace:
<TASK>
__kasan_check_byte+0x12/0x40
lock_acquire+0x79/0x2e0
lock_sock_nested+0x48/0x100
? l2cap_sock_ready_cb+0x46/0x160
l2cap_sock_ready_cb+0x46/0x160
l2cap_conn_start+0x779/0xff0
? __pfx_l2cap_conn_start+0x10/0x10
? l2cap_info_timeout+0x60/0xa0
? __pfx___mutex_lock+0x10/0x10
l2cap_info_timeout+0x68/0xa0
? process_scheduled_works+0xa8d/0x18c0
process_scheduled_works+0xb6e/0x18c0
? __pfx_process_scheduled_works+0x10/0x10
? assign_work+0x3d5/0x5e0
worker_thread+0xa53/0xfc0
kthread+0x388/0x470
? __pfx_worker_thread+0x10/0x10
? __pfx_kthread+0x10/0x10
ret_from_fork+0x51e/0xb90
? __pfx_ret_from_fork+0x10/0x10
veth1_macvtap: entered promiscuous mode
? __switch_to+0xc7d/0x1450
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
batman_adv: batadv0: Interface activated: batadv_slave_0
batman_adv: batadv0: Interface activated: batadv_slave_1
netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
RIP: 0010:kasan_byte_accessible+0x12/0x30
Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cce
ieee80211 phy39: Selected rate control algorithm 'minstrel_ht'
RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001
RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000
R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0
PKRU: 55555554
Kernel panic - not syncing: Fatal exception
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 54a59aa2b562872781d6a8fc89f300d360941691 Version: 54a59aa2b562872781d6a8fc89f300d360941691 Version: 54a59aa2b562872781d6a8fc89f300d360941691 Version: 54a59aa2b562872781d6a8fc89f300d360941691 Version: 54a59aa2b562872781d6a8fc89f300d360941691 Version: 54a59aa2b562872781d6a8fc89f300d360941691 Version: 54a59aa2b562872781d6a8fc89f300d360941691 Version: 54a59aa2b562872781d6a8fc89f300d360941691 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d34776c7fa1f2c510f1cdd14823aba701babb4ad",
"status": "affected",
"version": "54a59aa2b562872781d6a8fc89f300d360941691",
"versionType": "git"
},
{
"lessThan": "03d4eafb0f3788239df63575951f6b4c97bbfda4",
"status": "affected",
"version": "54a59aa2b562872781d6a8fc89f300d360941691",
"versionType": "git"
},
{
"lessThan": "3c821bc0fbeaa27910a20d0b43c6008d099792af",
"status": "affected",
"version": "54a59aa2b562872781d6a8fc89f300d360941691",
"versionType": "git"
},
{
"lessThan": "a04a760c06bb591989db659439efdf106f0bae76",
"status": "affected",
"version": "54a59aa2b562872781d6a8fc89f300d360941691",
"versionType": "git"
},
{
"lessThan": "0780f9333852971ca77d110019e3a66ce5a7b100",
"status": "affected",
"version": "54a59aa2b562872781d6a8fc89f300d360941691",
"versionType": "git"
},
{
"lessThan": "1dc6db047919ecd59493cd51248b37381bbabcbb",
"status": "affected",
"version": "54a59aa2b562872781d6a8fc89f300d360941691",
"versionType": "git"
},
{
"lessThan": "898b89c90ff9496e64b9331040778cc4e1b28c9d",
"status": "affected",
"version": "54a59aa2b562872781d6a8fc89f300d360941691",
"versionType": "git"
},
{
"lessThan": "b6552e0503973daf6f23bd6ed9273ef131ee364f",
"status": "affected",
"version": "54a59aa2b562872781d6a8fc89f300d360941691",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb\n\nBefore using sk pointer, check if it is null.\n\nFix the following:\n\n KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267]\n CPU: 0 UID: 0 PID: 5985 Comm: kworker/0:5 Not tainted 7.0.0-rc4-00029-ga989fde763f4 #1 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-9.fc43 06/10/2025\n Workqueue: events l2cap_info_timeout\n RIP: 0010:kasan_byte_accessible+0x12/0x30\n Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df \u003c0f\u003e b6 04 07 3c 08 0f 92 c0 c3 cc cce\n veth0_macvtap: entered promiscuous mode\n RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202\n RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001\n RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c\n RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000\n R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001\n FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00005582615a5008 CR3: 000000007007e000 CR4: 0000000000752ef0\n PKRU: 55555554\n Call Trace:\n \u003cTASK\u003e\n __kasan_check_byte+0x12/0x40\n lock_acquire+0x79/0x2e0\n lock_sock_nested+0x48/0x100\n ? l2cap_sock_ready_cb+0x46/0x160\n l2cap_sock_ready_cb+0x46/0x160\n l2cap_conn_start+0x779/0xff0\n ? __pfx_l2cap_conn_start+0x10/0x10\n ? l2cap_info_timeout+0x60/0xa0\n ? __pfx___mutex_lock+0x10/0x10\n l2cap_info_timeout+0x68/0xa0\n ? process_scheduled_works+0xa8d/0x18c0\n process_scheduled_works+0xb6e/0x18c0\n ? __pfx_process_scheduled_works+0x10/0x10\n ? assign_work+0x3d5/0x5e0\n worker_thread+0xa53/0xfc0\n kthread+0x388/0x470\n ? __pfx_worker_thread+0x10/0x10\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x51e/0xb90\n ? __pfx_ret_from_fork+0x10/0x10\n veth1_macvtap: entered promiscuous mode\n ? __switch_to+0xc7d/0x1450\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n Modules linked in:\n ---[ end trace 0000000000000000 ]---\n batman_adv: batadv0: Interface activated: batadv_slave_0\n batman_adv: batadv0: Interface activated: batadv_slave_1\n netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0\n netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0\n RIP: 0010:kasan_byte_accessible+0x12/0x30\n Code: 79 ff ff ff 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df \u003c0f\u003e b6 04 07 3c 08 0f 92 c0 c3 cc cce\n ieee80211 phy39: Selected rate control algorithm \u0027minstrel_ht\u0027\n RSP: 0018:ffffc90006e0f808 EFLAGS: 00010202\n RAX: dffffc0000000000 RBX: ffffffff89746018 RCX: 0000000080000001\n RDX: 0000000000000000 RSI: ffffffff89746018 RDI: 000000000000004c\n RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n R10: dffffc0000000000 R11: ffffffff8aae3e70 R12: 0000000000000000\n R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001\n FS: 0000000000000000(0000) GS:ffff8880983c2000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f7e16139e9c CR3: 000000000e74e000 CR4: 0000000000752ef0\n PKRU: 55555554\n Kernel panic - not syncing: Fatal exception"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:10:11.263Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d34776c7fa1f2c510f1cdd14823aba701babb4ad"
},
{
"url": "https://git.kernel.org/stable/c/03d4eafb0f3788239df63575951f6b4c97bbfda4"
},
{
"url": "https://git.kernel.org/stable/c/3c821bc0fbeaa27910a20d0b43c6008d099792af"
},
{
"url": "https://git.kernel.org/stable/c/a04a760c06bb591989db659439efdf106f0bae76"
},
{
"url": "https://git.kernel.org/stable/c/0780f9333852971ca77d110019e3a66ce5a7b100"
},
{
"url": "https://git.kernel.org/stable/c/1dc6db047919ecd59493cd51248b37381bbabcbb"
},
{
"url": "https://git.kernel.org/stable/c/898b89c90ff9496e64b9331040778cc4e1b28c9d"
},
{
"url": "https://git.kernel.org/stable/c/b6552e0503973daf6f23bd6ed9273ef131ee364f"
}
],
"title": "Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31510",
"datePublished": "2026-04-22T13:54:28.712Z",
"dateReserved": "2026-03-09T15:48:24.106Z",
"dateUpdated": "2026-05-11T22:10:11.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43200 (GCVE-0-2026-43200)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions
struct configfs_item_operations callbacks are defined like the following:
int (*allow_link)(struct config_item *src, struct config_item *target);
void (*drop_link)(struct config_item *src, struct config_item *target);
While pci_primary_epc_epf_link() and pci_secondary_epc_epf_link() specify
the parameters in the correct order, pci_primary_epc_epf_unlink() and
pci_secondary_epc_epf_unlink() specify the parameters in the wrong order,
leading to the below kernel crash when using the unlink command in
configfs:
Unable to handle kernel paging request at virtual address 0000000300000857
Mem abort info:
...
pc : string+0x54/0x14c
lr : vsnprintf+0x280/0x6e8
...
string+0x54/0x14c
vsnprintf+0x280/0x6e8
vprintk_default+0x38/0x4c
vprintk+0xc4/0xe0
pci_epf_unbind+0xdc/0x108
configfs_unlink+0xe0/0x208+0x44/0x74
vfs_unlink+0x120/0x29c
__arm64_sys_unlinkat+0x3c/0x90
invoke_syscall+0x48/0x134
do_el0_svc+0x1c/0x30prop.0+0xd0/0xf0
[mani: cced stable, changed commit message as per https://lore.kernel.org/linux-pci/aV9joi3jF1R6ca02@ryzen]
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e85a2d7837622bd99c96f5bbc7f972da90c285a2 Version: e85a2d7837622bd99c96f5bbc7f972da90c285a2 Version: e85a2d7837622bd99c96f5bbc7f972da90c285a2 Version: e85a2d7837622bd99c96f5bbc7f972da90c285a2 Version: e85a2d7837622bd99c96f5bbc7f972da90c285a2 Version: e85a2d7837622bd99c96f5bbc7f972da90c285a2 Version: e85a2d7837622bd99c96f5bbc7f972da90c285a2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/endpoint/pci-ep-cfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "58686bf62cb38b92e4b28408162a5703775b4d12",
"status": "affected",
"version": "e85a2d7837622bd99c96f5bbc7f972da90c285a2",
"versionType": "git"
},
{
"lessThan": "1c96c1acef4b4a1108fc13f84a8ac0b0633bbb46",
"status": "affected",
"version": "e85a2d7837622bd99c96f5bbc7f972da90c285a2",
"versionType": "git"
},
{
"lessThan": "142b1bba3299264b76ed8ef53cd93b2b2af65d6c",
"status": "affected",
"version": "e85a2d7837622bd99c96f5bbc7f972da90c285a2",
"versionType": "git"
},
{
"lessThan": "339191811e6fc4559c4008c5af7a91b05086d596",
"status": "affected",
"version": "e85a2d7837622bd99c96f5bbc7f972da90c285a2",
"versionType": "git"
},
{
"lessThan": "733cbc3aa97e71cc70847e75c925b364cc9b04a6",
"status": "affected",
"version": "e85a2d7837622bd99c96f5bbc7f972da90c285a2",
"versionType": "git"
},
{
"lessThan": "aefc0e0bd20f54abe3b501b8798c0be656af272b",
"status": "affected",
"version": "e85a2d7837622bd99c96f5bbc7f972da90c285a2",
"versionType": "git"
},
{
"lessThan": "8754dd7639ab0fd68c3ab9d91c7bdecc3e5740a8",
"status": "affected",
"version": "e85a2d7837622bd99c96f5bbc7f972da90c285a2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/endpoint/pci-ep-cfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions\n\nstruct configfs_item_operations callbacks are defined like the following:\n\n int (*allow_link)(struct config_item *src, struct config_item *target);\n void (*drop_link)(struct config_item *src, struct config_item *target);\n\nWhile pci_primary_epc_epf_link() and pci_secondary_epc_epf_link() specify\nthe parameters in the correct order, pci_primary_epc_epf_unlink() and\npci_secondary_epc_epf_unlink() specify the parameters in the wrong order,\nleading to the below kernel crash when using the unlink command in\nconfigfs:\n\n Unable to handle kernel paging request at virtual address 0000000300000857\n Mem abort info:\n ...\n pc : string+0x54/0x14c\n lr : vsnprintf+0x280/0x6e8\n ...\n string+0x54/0x14c\n vsnprintf+0x280/0x6e8\n vprintk_default+0x38/0x4c\n vprintk+0xc4/0xe0\n pci_epf_unbind+0xdc/0x108\n configfs_unlink+0xe0/0x208+0x44/0x74\n vfs_unlink+0x120/0x29c\n __arm64_sys_unlinkat+0x3c/0x90\n invoke_syscall+0x48/0x134\n do_el0_svc+0x1c/0x30prop.0+0xd0/0xf0\n\n[mani: cced stable, changed commit message as per https://lore.kernel.org/linux-pci/aV9joi3jF1R6ca02@ryzen]"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:19:49.591Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/58686bf62cb38b92e4b28408162a5703775b4d12"
},
{
"url": "https://git.kernel.org/stable/c/1c96c1acef4b4a1108fc13f84a8ac0b0633bbb46"
},
{
"url": "https://git.kernel.org/stable/c/142b1bba3299264b76ed8ef53cd93b2b2af65d6c"
},
{
"url": "https://git.kernel.org/stable/c/339191811e6fc4559c4008c5af7a91b05086d596"
},
{
"url": "https://git.kernel.org/stable/c/733cbc3aa97e71cc70847e75c925b364cc9b04a6"
},
{
"url": "https://git.kernel.org/stable/c/aefc0e0bd20f54abe3b501b8798c0be656af272b"
},
{
"url": "https://git.kernel.org/stable/c/8754dd7639ab0fd68c3ab9d91c7bdecc3e5740a8"
}
],
"title": "PCI: endpoint: Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink() functions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43200",
"datePublished": "2026-05-06T11:28:06.904Z",
"dateReserved": "2026-05-01T14:12:55.992Z",
"dateUpdated": "2026-05-11T22:19:49.591Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43135 (GCVE-0-2026-43135)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: cx23885: Add missing unmap in snd_cx23885_hw_params()
In error path, add cx23885_alsa_dma_unmap() to release the
resource acquired by cx23885_alsa_dma_map().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9529a4b0cf49163e489446ec159a2dfb64f78df8 Version: 9529a4b0cf49163e489446ec159a2dfb64f78df8 Version: 9529a4b0cf49163e489446ec159a2dfb64f78df8 Version: 9529a4b0cf49163e489446ec159a2dfb64f78df8 Version: 9529a4b0cf49163e489446ec159a2dfb64f78df8 Version: 9529a4b0cf49163e489446ec159a2dfb64f78df8 Version: 9529a4b0cf49163e489446ec159a2dfb64f78df8 Version: 9529a4b0cf49163e489446ec159a2dfb64f78df8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/cx23885/cx23885-alsa.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fda46c9025b755ea50a969b960f333be62421b71",
"status": "affected",
"version": "9529a4b0cf49163e489446ec159a2dfb64f78df8",
"versionType": "git"
},
{
"lessThan": "0b7f56084cc3d7766bf274b71cd14cc9674b76bf",
"status": "affected",
"version": "9529a4b0cf49163e489446ec159a2dfb64f78df8",
"versionType": "git"
},
{
"lessThan": "505630dd1ebf4b53d3f2866c057ddd93157a24d8",
"status": "affected",
"version": "9529a4b0cf49163e489446ec159a2dfb64f78df8",
"versionType": "git"
},
{
"lessThan": "544215cc37d032ccaf1919852c05e2439a4d7540",
"status": "affected",
"version": "9529a4b0cf49163e489446ec159a2dfb64f78df8",
"versionType": "git"
},
{
"lessThan": "9c0a6ff538660c36a98081916a24f08d55a91331",
"status": "affected",
"version": "9529a4b0cf49163e489446ec159a2dfb64f78df8",
"versionType": "git"
},
{
"lessThan": "9544b73cad4ee667fed6a60f71570c58a870a735",
"status": "affected",
"version": "9529a4b0cf49163e489446ec159a2dfb64f78df8",
"versionType": "git"
},
{
"lessThan": "fc4df593a8ffded2f77d69a73ecb51d364932ca5",
"status": "affected",
"version": "9529a4b0cf49163e489446ec159a2dfb64f78df8",
"versionType": "git"
},
{
"lessThan": "141c81849fab2ad4d6e3fdaff7cbaa873e8b5eb2",
"status": "affected",
"version": "9529a4b0cf49163e489446ec159a2dfb64f78df8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/cx23885/cx23885-alsa.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx23885: Add missing unmap in snd_cx23885_hw_params()\n\nIn error path, add cx23885_alsa_dma_unmap() to release the\nresource acquired by cx23885_alsa_dma_map()."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:18:26.070Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fda46c9025b755ea50a969b960f333be62421b71"
},
{
"url": "https://git.kernel.org/stable/c/0b7f56084cc3d7766bf274b71cd14cc9674b76bf"
},
{
"url": "https://git.kernel.org/stable/c/505630dd1ebf4b53d3f2866c057ddd93157a24d8"
},
{
"url": "https://git.kernel.org/stable/c/544215cc37d032ccaf1919852c05e2439a4d7540"
},
{
"url": "https://git.kernel.org/stable/c/9c0a6ff538660c36a98081916a24f08d55a91331"
},
{
"url": "https://git.kernel.org/stable/c/9544b73cad4ee667fed6a60f71570c58a870a735"
},
{
"url": "https://git.kernel.org/stable/c/fc4df593a8ffded2f77d69a73ecb51d364932ca5"
},
{
"url": "https://git.kernel.org/stable/c/141c81849fab2ad4d6e3fdaff7cbaa873e8b5eb2"
}
],
"title": "media: cx23885: Add missing unmap in snd_cx23885_hw_params()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43135",
"datePublished": "2026-05-06T11:27:22.226Z",
"dateReserved": "2026-05-01T14:12:55.988Z",
"dateUpdated": "2026-05-11T22:18:26.070Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43370 (GCVE-0-2026-43370)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix use-after-free race in VM acquire
Replace non-atomic vm->process_info assignment with cmpxchg()
to prevent race when parent/child processes sharing a drm_file
both try to acquire the same VM after fork().
(cherry picked from commit c7c573275ec20db05be769288a3e3bb2250ec618)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ede0dd86f45adf2b7083bb161f6bc81da5fe2bad Version: ede0dd86f45adf2b7083bb161f6bc81da5fe2bad Version: ede0dd86f45adf2b7083bb161f6bc81da5fe2bad Version: ede0dd86f45adf2b7083bb161f6bc81da5fe2bad Version: ede0dd86f45adf2b7083bb161f6bc81da5fe2bad Version: ede0dd86f45adf2b7083bb161f6bc81da5fe2bad Version: ede0dd86f45adf2b7083bb161f6bc81da5fe2bad Version: ede0dd86f45adf2b7083bb161f6bc81da5fe2bad |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae87aea330c24f462fc7058ed543ba8bc6798447",
"status": "affected",
"version": "ede0dd86f45adf2b7083bb161f6bc81da5fe2bad",
"versionType": "git"
},
{
"lessThan": "46d309996bd9251792d7dafdbaf615cf202b4447",
"status": "affected",
"version": "ede0dd86f45adf2b7083bb161f6bc81da5fe2bad",
"versionType": "git"
},
{
"lessThan": "e61e355cbe49e585097eee28c15b862bfb1c0668",
"status": "affected",
"version": "ede0dd86f45adf2b7083bb161f6bc81da5fe2bad",
"versionType": "git"
},
{
"lessThan": "c658c1c85ec235b7ecfbf8dbfee385b1332088f4",
"status": "affected",
"version": "ede0dd86f45adf2b7083bb161f6bc81da5fe2bad",
"versionType": "git"
},
{
"lessThan": "904025fa8bba1d028adade33346372b4ac1a9249",
"status": "affected",
"version": "ede0dd86f45adf2b7083bb161f6bc81da5fe2bad",
"versionType": "git"
},
{
"lessThan": "7885eb335d8f9e9942925d57e300a85e3f82ded4",
"status": "affected",
"version": "ede0dd86f45adf2b7083bb161f6bc81da5fe2bad",
"versionType": "git"
},
{
"lessThan": "94b7782d0c8024f5b88454241c8d4777076c3786",
"status": "affected",
"version": "ede0dd86f45adf2b7083bb161f6bc81da5fe2bad",
"versionType": "git"
},
{
"lessThan": "2c1030f2e84885cc58bffef6af67d5b9d2e7098f",
"status": "affected",
"version": "ede0dd86f45adf2b7083bb161f6bc81da5fe2bad",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix use-after-free race in VM acquire\n\nReplace non-atomic vm-\u003eprocess_info assignment with cmpxchg()\nto prevent race when parent/child processes sharing a drm_file\nboth try to acquire the same VM after fork().\n\n(cherry picked from commit c7c573275ec20db05be769288a3e3bb2250ec618)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local AMD KFD/amdgpu device ioctls, especially acquiring an amdgpu render-node VM through /dev/kfd. No network or physical-device packet path reaches this code.\nAC:L - The race is between attacker-controlled processes sharing the same drm_file after fork and issuing concurrent VM-acquire operations. Because the attacker controls both sides of the race, this is low complexity.\nPR:L - An unprivileged local user with access to /dev/kfd and the amdgpu render node can issue the relevant ioctls; no real root or init-namespace capability check is required. This is basic local user access rather than administrative privilege.\nUI:N - Exploitation does not require a victim user action after the attacker has local execution and device access. The attacker can open the device files, fork, and invoke the ioctls directly.\nS:U - The bug corrupts kernel driver state within the same kernel security authority. It is a standard local kernel memory-corruption/privilege-escalation scenario, not a VM escape or other scope change.\nC:H - The non-atomic VM ownership assignment can leave stale amdkfd_process_info references and cause a kernel use-after-free. Following kernel UAF scoring guidance, this can be leveraged for high-impact information disclosure.\nI:H - The freed process_info object contains list, mutex, fence, and process state used later by KFD/GPUVM paths, making this kernel memory corruption. A defensible worst case is arbitrary kernel memory modification or control-flow influence.\nA:H - Even without full exploitation, the UAF and associated list/lifetime corruption can crash or hang the kernel. Kernel oops/panic-level denial of service is high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:32.528Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae87aea330c24f462fc7058ed543ba8bc6798447"
},
{
"url": "https://git.kernel.org/stable/c/46d309996bd9251792d7dafdbaf615cf202b4447"
},
{
"url": "https://git.kernel.org/stable/c/e61e355cbe49e585097eee28c15b862bfb1c0668"
},
{
"url": "https://git.kernel.org/stable/c/c658c1c85ec235b7ecfbf8dbfee385b1332088f4"
},
{
"url": "https://git.kernel.org/stable/c/904025fa8bba1d028adade33346372b4ac1a9249"
},
{
"url": "https://git.kernel.org/stable/c/7885eb335d8f9e9942925d57e300a85e3f82ded4"
},
{
"url": "https://git.kernel.org/stable/c/94b7782d0c8024f5b88454241c8d4777076c3786"
},
{
"url": "https://git.kernel.org/stable/c/2c1030f2e84885cc58bffef6af67d5b9d2e7098f"
}
],
"title": "drm/amdgpu: Fix use-after-free race in VM acquire",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43370",
"datePublished": "2026-05-08T14:21:21.926Z",
"dateReserved": "2026-05-01T14:12:56.006Z",
"dateUpdated": "2026-08-05T12:27:32.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45976 (GCVE-0-2026-45976)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-05-27 12:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix memory leak in amdgpu_ras_init()
When amdgpu_nbio_ras_sw_init() fails in amdgpu_ras_init(), the function
returns directly without freeing the allocated con structure, leading
to a memory leak.
Fix this by jumping to the release_con label to properly clean up the
allocated memory before returning the error code.
Compile tested only. Issue found using a prototype static analysis tool
and code review.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f8a5426652bdadd4a5cb48326d48abbdfebe8153",
"status": "affected",
"version": "fdc94d3a8c887e4e06a7ff8dcb51d55cd70e16cf",
"versionType": "git"
},
{
"lessThan": "c11cd77a18115d2cd3f4b6915c4a537b6042f950",
"status": "affected",
"version": "fdc94d3a8c887e4e06a7ff8dcb51d55cd70e16cf",
"versionType": "git"
},
{
"lessThan": "2fef8c2ac67e7c1b0409d23653300b134c63e54c",
"status": "affected",
"version": "fdc94d3a8c887e4e06a7ff8dcb51d55cd70e16cf",
"versionType": "git"
},
{
"lessThan": "3f43e7812b30d6b2e850218f9bb1dae60727fcef",
"status": "affected",
"version": "fdc94d3a8c887e4e06a7ff8dcb51d55cd70e16cf",
"versionType": "git"
},
{
"lessThan": "ee41e5b63c8210525c936ee637a2c8d185ce873c",
"status": "affected",
"version": "fdc94d3a8c887e4e06a7ff8dcb51d55cd70e16cf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix memory leak in amdgpu_ras_init()\n\nWhen amdgpu_nbio_ras_sw_init() fails in amdgpu_ras_init(), the function\nreturns directly without freeing the allocated con structure, leading\nto a memory leak.\n\nFix this by jumping to the release_con label to properly clean up the\nallocated memory before returning the error code.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:18:34.772Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f8a5426652bdadd4a5cb48326d48abbdfebe8153"
},
{
"url": "https://git.kernel.org/stable/c/c11cd77a18115d2cd3f4b6915c4a537b6042f950"
},
{
"url": "https://git.kernel.org/stable/c/2fef8c2ac67e7c1b0409d23653300b134c63e54c"
},
{
"url": "https://git.kernel.org/stable/c/3f43e7812b30d6b2e850218f9bb1dae60727fcef"
},
{
"url": "https://git.kernel.org/stable/c/ee41e5b63c8210525c936ee637a2c8d185ce873c"
}
],
"title": "drm/amdgpu: Fix memory leak in amdgpu_ras_init()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45976",
"datePublished": "2026-05-27T12:18:34.772Z",
"dateReserved": "2026-05-13T15:03:33.090Z",
"dateUpdated": "2026-05-27T12:18:34.772Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46172 (GCVE-0-2026-46172)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-06-14 18:00
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
xfrm6_rcv_encap() performs an IPv6 route lookup when the skb does not
already have a dst attached. ip6_route_input_lookup() returns a
referenced dst entry even when the lookup resolves to an error route.
If dst->error is set, xfrm6_rcv_encap() drops the skb without attaching
the dst to the skb and without releasing the reference returned by the
lookup. Repeated packets hitting this path therefore leak dst entries.
Release the dst before jumping to the drop path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7 Version: 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7 Version: 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7 Version: 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7 Version: 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7 Version: 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7 Version: 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7 Version: 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/xfrm6_protocol.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a0721bcd72641c32b281f227a94505b31cf54117",
"status": "affected",
"version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7",
"versionType": "git"
},
{
"lessThan": "a20b34f6e854fe6f2aa82528fae7a88759919eb4",
"status": "affected",
"version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7",
"versionType": "git"
},
{
"lessThan": "870560015ce6e0d8f841c6a8aba33c44be52c727",
"status": "affected",
"version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7",
"versionType": "git"
},
{
"lessThan": "c2efc4956981066df2fef1cc77391b523db6d8e4",
"status": "affected",
"version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7",
"versionType": "git"
},
{
"lessThan": "554c9b090c8ac5b1c5c507f4badf8d5d0c9c6e13",
"status": "affected",
"version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7",
"versionType": "git"
},
{
"lessThan": "9d5047782f9bd2829e529df69209bf3232eb561f",
"status": "affected",
"version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7",
"versionType": "git"
},
{
"lessThan": "6a5eec0a2a0e99ec9743cf8f1c4082178811d90a",
"status": "affected",
"version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7",
"versionType": "git"
},
{
"lessThan": "bc0fcb9823cd0894934cf968b525c575833d7078",
"status": "affected",
"version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/xfrm6_protocol.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: xfrm6: release dst on error in xfrm6_rcv_encap()\n\nxfrm6_rcv_encap() performs an IPv6 route lookup when the skb does not\nalready have a dst attached. ip6_route_input_lookup() returns a\nreferenced dst entry even when the lookup resolves to an error route.\n\nIf dst-\u003eerror is set, xfrm6_rcv_encap() drops the skb without attaching\nthe dst to the skb and without releasing the reference returned by the\nlookup. Repeated packets hitting this path therefore leak dst entries.\n\nRelease the dst before jumping to the drop path."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:00:01.373Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a0721bcd72641c32b281f227a94505b31cf54117"
},
{
"url": "https://git.kernel.org/stable/c/a20b34f6e854fe6f2aa82528fae7a88759919eb4"
},
{
"url": "https://git.kernel.org/stable/c/870560015ce6e0d8f841c6a8aba33c44be52c727"
},
{
"url": "https://git.kernel.org/stable/c/c2efc4956981066df2fef1cc77391b523db6d8e4"
},
{
"url": "https://git.kernel.org/stable/c/554c9b090c8ac5b1c5c507f4badf8d5d0c9c6e13"
},
{
"url": "https://git.kernel.org/stable/c/9d5047782f9bd2829e529df69209bf3232eb561f"
},
{
"url": "https://git.kernel.org/stable/c/6a5eec0a2a0e99ec9743cf8f1c4082178811d90a"
},
{
"url": "https://git.kernel.org/stable/c/bc0fcb9823cd0894934cf968b525c575833d7078"
}
],
"title": "ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46172",
"datePublished": "2026-05-28T09:36:26.926Z",
"dateReserved": "2026-05-13T15:03:33.103Z",
"dateUpdated": "2026-06-14T18:00:01.373Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53136 (GCVE-0-2026-53136)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-06-29 04:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Clamp VBIOS HDMI retimer register count to array size
[Why & How]
The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and
Hdmi6GRegNum fields that are used as loop bounds when copying retimer I2C
register settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9]
and dp*_ext_hdmi_6g_reg_settings[3]). These u8 fields are not validated
before use, so a malformed VBIOS can specify values up to 255, causing an
out-of-bounds heap write during driver probe.
Clamp each register count to the destination array size using min_t()
before the copy loops, in both get_integrated_info_v11() and
get_integrated_info_v2_1().
(cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69)
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a Version: 1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a Version: 1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a Version: 1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a Version: 1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a Version: 1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a Version: 1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "029571d51140650783be4fb98fe7cb4754752086",
"status": "affected",
"version": "1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a",
"versionType": "git"
},
{
"lessThan": "5f8b39452fb16f507c9e4d8b4a83ce27e893307c",
"status": "affected",
"version": "1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a",
"versionType": "git"
},
{
"lessThan": "4d1c3c26c2ab1842e139e61983395d64bd2e518b",
"status": "affected",
"version": "1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a",
"versionType": "git"
},
{
"lessThan": "d6be8e59af412623e3d874be3a048406c0edfe60",
"status": "affected",
"version": "1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a",
"versionType": "git"
},
{
"lessThan": "3f32d52ec604c659725d865cf8cc6a17a33f9c6a",
"status": "affected",
"version": "1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a",
"versionType": "git"
},
{
"lessThan": "8aaa7e317fbd4beb9c6a9f77aa4cf52fae78b117",
"status": "affected",
"version": "1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a",
"versionType": "git"
},
{
"lessThan": "fb0707ce00eef4e2d60c3020e1c0432739703e4a",
"status": "affected",
"version": "1e8635ea0ea370bf4f0f2b2f1b3eb61474dd962a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Clamp VBIOS HDMI retimer register count to array size\n\n[Why \u0026 How]\nThe VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and\nHdmi6GRegNum fields that are used as loop bounds when copying retimer I2C\nregister settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9]\nand dp*_ext_hdmi_6g_reg_settings[3]). These u8 fields are not validated\nbefore use, so a malformed VBIOS can specify values up to 255, causing an\nout-of-bounds heap write during driver probe.\n\nClamp each register count to the destination array size using min_t()\nbefore the copy loops, in both get_integrated_info_v11() and\nget_integrated_info_v2_1().\n\n(cherry picked from commit 5a7f0ef90195940c54b0f5bb85b87da55f038c69)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T04:18:52.196Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/029571d51140650783be4fb98fe7cb4754752086"
},
{
"url": "https://git.kernel.org/stable/c/5f8b39452fb16f507c9e4d8b4a83ce27e893307c"
},
{
"url": "https://git.kernel.org/stable/c/4d1c3c26c2ab1842e139e61983395d64bd2e518b"
},
{
"url": "https://git.kernel.org/stable/c/d6be8e59af412623e3d874be3a048406c0edfe60"
},
{
"url": "https://git.kernel.org/stable/c/3f32d52ec604c659725d865cf8cc6a17a33f9c6a"
},
{
"url": "https://git.kernel.org/stable/c/8aaa7e317fbd4beb9c6a9f77aa4cf52fae78b117"
},
{
"url": "https://git.kernel.org/stable/c/fb0707ce00eef4e2d60c3020e1c0432739703e4a"
}
],
"title": "drm/amd/display: Clamp VBIOS HDMI retimer register count to array size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53136",
"datePublished": "2026-06-25T08:38:25.097Z",
"dateReserved": "2026-06-09T07:44:35.387Z",
"dateUpdated": "2026-06-29T04:18:52.196Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46177 (GCVE-0-2026-46177)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipmi: Add limits to event and receive message requests
The driver would just fetch events and receive messages until the
BMC said it was done. To avoid issues with BMCs that never say they are
done, add a limit of 10 fetches at a time.
In addition, an si interface has an attn state it can return from the
hardware which is supposed to cause a flag fetch to see if the driver
needs to fetch events or message or a few other things. If the attn
bit gets stuck, it's a similar problem. So allow messages in between
flag fetches so the driver itself doesn't get stuck.
This is a more general fix than the previous fix for the specific bad
BMC, but should fix the more general issue of a BMC that won't stop
saying it has data.
This has been there from the beginning of the driver. It's not a bug
per-se, but it is accounting for bugs in BMCs.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_si_intf.c",
"drivers/char/ipmi/ipmi_ssif.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "112df8e631636cafda64dcee4561daf09ce74a4a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "304b56883b7eff73eb606c35d062c8101aaf5471",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9059dc94421e1d4f8e5844204608b37ebfddb3da",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "67c44e0deba936d5edaebea356b4589eb43acb5c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e20212b431bef217d3886b86bbc90cc3ed00de68",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3d37d2165df9504ea99d9e6181552dc4d2d1ab37",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c024167fb00489baee08c72182ca2e7dc5fb9f20",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c4cca236968683eb0d59abfb12d5c7e4d8514227",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_si_intf.c",
"drivers/char/ipmi/ipmi_ssif.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: Add limits to event and receive message requests\n\nThe driver would just fetch events and receive messages until the\nBMC said it was done. To avoid issues with BMCs that never say they are\ndone, add a limit of 10 fetches at a time.\n\nIn addition, an si interface has an attn state it can return from the\nhardware which is supposed to cause a flag fetch to see if the driver\nneeds to fetch events or message or a few other things. If the attn\nbit gets stuck, it\u0027s a similar problem. So allow messages in between\nflag fetches so the driver itself doesn\u0027t get stuck.\n\nThis is a more general fix than the previous fix for the specific bad\nBMC, but should fix the more general issue of a BMC that won\u0027t stop\nsaying it has data.\n\nThis has been there from the beginning of the driver. It\u0027s not a bug\nper-se, but it is accounting for bugs in BMCs."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The unbounded fetch loop is driven by the BMC\u0027s `RECEIVE_MSG_AVAIL`/`EVENT_MSG_BUFFER_FULL` flags; the receive-message queue is fed by `Send Message` commands that can arrive over IPMI-over-LAN (UDP/623, routable), and the BMC\u0027s own management network is the realistic remote entry point, so the host driver processes data originating from a remote peer.\nAC:L - The attacker reliably sustains the condition by continuously injecting messages into the SMS queue (or by controlling the BMC to keep the flag asserted); no uncontrolled race or specific memory layout is required.\nPR:N - No privileges on the vulnerable component (the host kernel) are required, and the remote/BMC-channel access often needs no real authentication (e.g. cipher-0 bypass or default credentials are common), so this is treated as unauthenticated.\nUI:N - No host-user action is needed; the loop is triggered purely by BMC/peer-supplied flag and message state.\nS:U - The vulnerable component and the impacted resource are both the host kernel; no security authority boundary is crossed.\nC:N - The bug is a control-flow liveness issue with no out-of-bounds read or memory disclosure; fetched messages are well-formed and delivered normally.\nI:N - There is no memory corruption or data modification \u2014 nothing is written out of bounds or altered; the driver merely repeats legitimate fetches.\nA:H - The driver wedges in an unbounded fetch loop, never returning to idle, starving all other IPMI users and consuming a CPU/thread; an unserviceable IPMI watchdog can further escalate to a system reset."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:15.422Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/112df8e631636cafda64dcee4561daf09ce74a4a"
},
{
"url": "https://git.kernel.org/stable/c/304b56883b7eff73eb606c35d062c8101aaf5471"
},
{
"url": "https://git.kernel.org/stable/c/9059dc94421e1d4f8e5844204608b37ebfddb3da"
},
{
"url": "https://git.kernel.org/stable/c/67c44e0deba936d5edaebea356b4589eb43acb5c"
},
{
"url": "https://git.kernel.org/stable/c/e20212b431bef217d3886b86bbc90cc3ed00de68"
},
{
"url": "https://git.kernel.org/stable/c/3d37d2165df9504ea99d9e6181552dc4d2d1ab37"
},
{
"url": "https://git.kernel.org/stable/c/c024167fb00489baee08c72182ca2e7dc5fb9f20"
},
{
"url": "https://git.kernel.org/stable/c/c4cca236968683eb0d59abfb12d5c7e4d8514227"
}
],
"title": "ipmi: Add limits to event and receive message requests",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46177",
"datePublished": "2026-05-28T09:36:31.286Z",
"dateReserved": "2026-05-13T15:03:33.103Z",
"dateUpdated": "2026-08-05T12:30:15.422Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31548 (GCVE-0-2026-31548)
Vulnerability from cvelistv5
Published
2026-04-24 14:33
Modified
2026-08-05 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down
When the nl80211 socket that originated a PMSR request is
closed, cfg80211_release_pmsr() sets the request's nl_portid
to zero and schedules pmsr_free_wk to process the abort
asynchronously. If the interface is concurrently torn down
before that work runs, cfg80211_pmsr_wdev_down() calls
cfg80211_pmsr_process_abort() directly. However, the already-
scheduled pmsr_free_wk work item remains pending and may run
after the interface has been removed from the driver. This
could cause the driver's abort_pmsr callback to operate on a
torn-down interface, leading to undefined behavior and
potential crashes.
Cancel pmsr_free_wk synchronously in cfg80211_pmsr_wdev_down()
before calling cfg80211_pmsr_process_abort(). This ensures any
pending or in-progress work is drained before interface teardown
proceeds, preventing the work from invoking the driver abort
callback after the interface is gone.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 Version: 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 Version: 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 Version: 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 Version: 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 Version: 9bb7e0f24e7e7d00daa1219b14539e2e602649b2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/pmsr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "28d3551f8d8cb3aec7497894d94150fe84d20e5e",
"status": "affected",
"version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
"versionType": "git"
},
{
"lessThan": "37e776e2e0a523731e2470dce6d563f0e8632a40",
"status": "affected",
"version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
"versionType": "git"
},
{
"lessThan": "d32c07ef1880fe20cf4ab223dbfedc9c0b2816aa",
"status": "affected",
"version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
"versionType": "git"
},
{
"lessThan": "a1b7a843f12a0c3e9d3a2ca607ce451916ef42cf",
"status": "affected",
"version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
"versionType": "git"
},
{
"lessThan": "72b7ea786b8e570ae11149e9089859a4a8634a13",
"status": "affected",
"version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
"versionType": "git"
},
{
"lessThan": "6dccbc9f3e1d38565dff7730d2b7d1e8b16c9b09",
"status": "affected",
"version": "9bb7e0f24e7e7d00daa1219b14539e2e602649b2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/pmsr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down\n\nWhen the nl80211 socket that originated a PMSR request is\nclosed, cfg80211_release_pmsr() sets the request\u0027s nl_portid\nto zero and schedules pmsr_free_wk to process the abort\nasynchronously. If the interface is concurrently torn down\nbefore that work runs, cfg80211_pmsr_wdev_down() calls\ncfg80211_pmsr_process_abort() directly. However, the already-\nscheduled pmsr_free_wk work item remains pending and may run\nafter the interface has been removed from the driver. This\ncould cause the driver\u0027s abort_pmsr callback to operate on a\ntorn-down interface, leading to undefined behavior and\npotential crashes.\n\nCancel pmsr_free_wk synchronously in cfg80211_pmsr_wdev_down()\nbefore calling cfg80211_pmsr_process_abort(). This ensures any\npending or in-progress work is drained before interface teardown\nproceeds, preventing the work from invoking the driver abort\ncallback after the interface is gone."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local nl80211 generic-netlink operations for `NL80211_CMD_PEER_MEASUREMENT_START` and netlink socket teardown/device teardown, not by remote WiFi frames alone.\nAC:L - The attacker can create the PMSR request, close the originating netlink socket to schedule `pmsr_free_wk`, and trigger interface teardown concurrently; this is an attacker-controlled race.\nPR:L - The start path is gated by `GENL_UNS_ADMIN_PERM`, requiring `CAP_NET_ADMIN` in the relevant network namespace. Under the kernel guidance, namespace-reachable `CAP_NET_ADMIN` is Low privileges rather than High.\nUI:N - No victim action is required once the attacker has local access and the needed netlink privilege; the attacker controls the request, socket close, and teardown sequence.\nS:U - The impact remains within the kernel/driver security authority and does not cross a VM, IOMMU, or separate sandbox boundary.\nC:H - The stale pending work can operate on a torn-down wireless interface and driver state, a use-after-teardown/use-after-free style condition. In the highest defensible case, freed or invalid kernel objects may be reused to gain memory disclosure primitives.\nI:H - The same stale work and driver callback path can dereference and act on invalid or reallocated kernel/driver objects. Treating this as exploitable memory corruption makes arbitrary write or control-flow impact defensible.\nA:H - The commit explicitly describes undefined behavior and potential crashes from invoking the abort callback after interface teardown. A kernel crash or oops is High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:23:25.445Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/28d3551f8d8cb3aec7497894d94150fe84d20e5e"
},
{
"url": "https://git.kernel.org/stable/c/37e776e2e0a523731e2470dce6d563f0e8632a40"
},
{
"url": "https://git.kernel.org/stable/c/d32c07ef1880fe20cf4ab223dbfedc9c0b2816aa"
},
{
"url": "https://git.kernel.org/stable/c/a1b7a843f12a0c3e9d3a2ca607ce451916ef42cf"
},
{
"url": "https://git.kernel.org/stable/c/72b7ea786b8e570ae11149e9089859a4a8634a13"
},
{
"url": "https://git.kernel.org/stable/c/6dccbc9f3e1d38565dff7730d2b7d1e8b16c9b09"
}
],
"title": "wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31548",
"datePublished": "2026-04-24T14:33:16.021Z",
"dateReserved": "2026-03-09T15:48:24.114Z",
"dateUpdated": "2026-08-05T12:23:25.445Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43053 (GCVE-0-2026-43053)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-05-11 22:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: close crash window in attr dabtree inactivation
When inactivating an inode with node-format extended attributes,
xfs_attr3_node_inactive() invalidates all child leaf/node blocks via
xfs_trans_binval(), but intentionally does not remove the corresponding
entries from their parent node blocks. The implicit assumption is that
xfs_attr_inactive() will truncate the entire attr fork to zero extents
afterwards, so log recovery will never reach the root node and follow
those stale pointers.
However, if a log shutdown occurs after the leaf/node block cancellations
commit but before the attr bmap truncation commits, this assumption
breaks. Recovery replays the attr bmap intact (the inode still has
attr fork extents), but suppresses replay of all cancelled leaf/node
blocks, maybe leaving them as stale data on disk. On the next mount,
xlog_recover_process_iunlinks() retries inactivation and attempts to
read the root node via the attr bmap. If the root node was not replayed,
reading the unreplayed root block triggers a metadata verification
failure immediately; if it was replayed, following its child pointers
to unreplayed child blocks triggers the same failure:
XFS (pmem0): Metadata corruption detected at
xfs_da3_node_read_verify+0x53/0x220, xfs_da3_node block 0x78
XFS (pmem0): Unmount and run xfs_repair
XFS (pmem0): First 128 bytes of corrupted metadata buffer:
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
XFS (pmem0): metadata I/O error in "xfs_da_read_buf+0x104/0x190" at daddr 0x78 len 8 error 117
Fix this in two places:
In xfs_attr3_node_inactive(), after calling xfs_trans_binval() on a
child block, immediately remove the entry that references it from the
parent node in the same transaction. This eliminates the window where
the parent holds a pointer to a cancelled block. Once all children are
removed, the now-empty root node is converted to a leaf block within the
same transaction. This node-to-leaf conversion is necessary for crash
safety. If the system shutdown after the empty node is written to the
log but before the second-phase bmap truncation commits, log recovery
will attempt to verify the root block on disk. xfs_da3_node_verify()
does not permit a node block with count == 0; such a block will fail
verification and trigger a metadata corruption shutdown. on the other
hand, leaf blocks are allowed to have this transient state.
In xfs_attr_inactive(), split the attr fork truncation into two explicit
phases. First, truncate all extents beyond the root block (the child
extents whose parent references have already been removed above).
Second, invalidate the root block and truncate the attr bmap to zero in
a single transaction. The two operations in the second phase must be
atomic: as long as the attr bmap has any non-zero length, recovery can
follow it to the root block, so the root block invalidation must commit
together with the bmap-to-zero truncation.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_attr_inactive.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e5a3e3cdd9b3015ae79456c81beebfdbb5246c0f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_attr_inactive.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: close crash window in attr dabtree inactivation\n\nWhen inactivating an inode with node-format extended attributes,\nxfs_attr3_node_inactive() invalidates all child leaf/node blocks via\nxfs_trans_binval(), but intentionally does not remove the corresponding\nentries from their parent node blocks. The implicit assumption is that\nxfs_attr_inactive() will truncate the entire attr fork to zero extents\nafterwards, so log recovery will never reach the root node and follow\nthose stale pointers.\n\nHowever, if a log shutdown occurs after the leaf/node block cancellations\ncommit but before the attr bmap truncation commits, this assumption\nbreaks. Recovery replays the attr bmap intact (the inode still has\nattr fork extents), but suppresses replay of all cancelled leaf/node\nblocks, maybe leaving them as stale data on disk. On the next mount,\nxlog_recover_process_iunlinks() retries inactivation and attempts to\nread the root node via the attr bmap. If the root node was not replayed,\nreading the unreplayed root block triggers a metadata verification\nfailure immediately; if it was replayed, following its child pointers\nto unreplayed child blocks triggers the same failure:\n\n XFS (pmem0): Metadata corruption detected at\n xfs_da3_node_read_verify+0x53/0x220, xfs_da3_node block 0x78\n XFS (pmem0): Unmount and run xfs_repair\n XFS (pmem0): First 128 bytes of corrupted metadata buffer:\n 00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n XFS (pmem0): metadata I/O error in \"xfs_da_read_buf+0x104/0x190\" at daddr 0x78 len 8 error 117\n\nFix this in two places:\n\nIn xfs_attr3_node_inactive(), after calling xfs_trans_binval() on a\nchild block, immediately remove the entry that references it from the\nparent node in the same transaction. This eliminates the window where\nthe parent holds a pointer to a cancelled block. Once all children are\nremoved, the now-empty root node is converted to a leaf block within the\nsame transaction. This node-to-leaf conversion is necessary for crash\nsafety. If the system shutdown after the empty node is written to the\nlog but before the second-phase bmap truncation commits, log recovery\nwill attempt to verify the root block on disk. xfs_da3_node_verify()\ndoes not permit a node block with count == 0; such a block will fail\nverification and trigger a metadata corruption shutdown. on the other\nhand, leaf blocks are allowed to have this transient state.\n\nIn xfs_attr_inactive(), split the attr fork truncation into two explicit\nphases. First, truncate all extents beyond the root block (the child\nextents whose parent references have already been removed above).\nSecond, invalidate the root block and truncate the attr bmap to zero in\na single transaction. The two operations in the second phase must be\natomic: as long as the attr bmap has any non-zero length, recovery can\nfollow it to the root block, so the root block invalidation must commit\ntogether with the bmap-to-zero truncation."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:16:48.253Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e5a3e3cdd9b3015ae79456c81beebfdbb5246c0f"
},
{
"url": "https://git.kernel.org/stable/c/b854e1c4eff3473b6d3a9ae74129ac5c48bc0b61"
}
],
"title": "xfs: close crash window in attr dabtree inactivation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43053",
"datePublished": "2026-05-01T14:15:46.709Z",
"dateReserved": "2026-05-01T14:12:55.980Z",
"dateUpdated": "2026-05-11T22:16:48.253Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53066 (GCVE-0-2026-53066)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/sun4i: backend: fix error pointer dereference
The function drm_atomic_get_plane_state() can return an error pointer
and is not checked for it. Add error pointer check.
Detected by Smatch:
drivers/gpu/drm/sun4i/sun4i_backend.c:496 sun4i_backend_atomic_check() error:
'plane_state' dereferencing possible ERR_PTR()
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 96180dde23b799272ab2e7d47210c8840799d0d2 Version: 96180dde23b799272ab2e7d47210c8840799d0d2 Version: 96180dde23b799272ab2e7d47210c8840799d0d2 Version: 96180dde23b799272ab2e7d47210c8840799d0d2 Version: 96180dde23b799272ab2e7d47210c8840799d0d2 Version: 96180dde23b799272ab2e7d47210c8840799d0d2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/sun4i/sun4i_backend.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ea51fd96aca01381e8f1ac0c671a57b7619193bb",
"status": "affected",
"version": "96180dde23b799272ab2e7d47210c8840799d0d2",
"versionType": "git"
},
{
"lessThan": "cf615b90a11a39a28e313be5e508e94bcde72016",
"status": "affected",
"version": "96180dde23b799272ab2e7d47210c8840799d0d2",
"versionType": "git"
},
{
"lessThan": "779c2f10743fc021f2f0ebe2b188cadfb973c5e4",
"status": "affected",
"version": "96180dde23b799272ab2e7d47210c8840799d0d2",
"versionType": "git"
},
{
"lessThan": "47038159c559824f4dbfb5b0d87b9b3416663372",
"status": "affected",
"version": "96180dde23b799272ab2e7d47210c8840799d0d2",
"versionType": "git"
},
{
"lessThan": "e9bef62f1bb9fcb38223730657af20f4c6283c16",
"status": "affected",
"version": "96180dde23b799272ab2e7d47210c8840799d0d2",
"versionType": "git"
},
{
"lessThan": "06277983eca4a31d3c2114fa33d99a6e82484b11",
"status": "affected",
"version": "96180dde23b799272ab2e7d47210c8840799d0d2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/sun4i/sun4i_backend.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sun4i: backend: fix error pointer dereference\n\nThe function drm_atomic_get_plane_state() can return an error pointer\nand is not checked for it. Add error pointer check.\n\nDetected by Smatch:\ndrivers/gpu/drm/sun4i/sun4i_backend.c:496 sun4i_backend_atomic_check() error:\n\u0027plane_state\u0027 dereferencing possible ERR_PTR()"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:08.824Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ea51fd96aca01381e8f1ac0c671a57b7619193bb"
},
{
"url": "https://git.kernel.org/stable/c/cf615b90a11a39a28e313be5e508e94bcde72016"
},
{
"url": "https://git.kernel.org/stable/c/779c2f10743fc021f2f0ebe2b188cadfb973c5e4"
},
{
"url": "https://git.kernel.org/stable/c/47038159c559824f4dbfb5b0d87b9b3416663372"
},
{
"url": "https://git.kernel.org/stable/c/e9bef62f1bb9fcb38223730657af20f4c6283c16"
},
{
"url": "https://git.kernel.org/stable/c/06277983eca4a31d3c2114fa33d99a6e82484b11"
}
],
"title": "drm/sun4i: backend: fix error pointer dereference",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53066",
"datePublished": "2026-06-24T16:30:08.824Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-06-24T16:30:08.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53039 (GCVE-0-2026-53039)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: validate group add input before caching
[BUG]
OCFS2_IOC_GROUP_ADD can trigger a BUG_ON in
ocfs2_set_new_buffer_uptodate():
kernel BUG at fs/ocfs2/uptodate.c:509!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:ocfs2_set_new_buffer_uptodate+0x194/0x1e0 fs/ocfs2/uptodate.c:509
Code: ffffe88f 42b9fe4c 89e64889 dfe8b4df
Call Trace:
ocfs2_group_add+0x3f1/0x1510 fs/ocfs2/resize.c:507
ocfs2_ioctl+0x309/0x6e0 fs/ocfs2/ioctl.c:887
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583
x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7bbfb55a966d
[CAUSE]
ocfs2_group_add() calls ocfs2_set_new_buffer_uptodate() on a
user-controlled group block before ocfs2_verify_group_and_input()
validates that block number. That helper is only valid for newly
allocated metadata and asserts that the block is not already present in
the chosen metadata cache. The code also uses INODE_CACHE(inode) even
though the group descriptor belongs to main_bm_inode and later journal
accesses use that cache context instead.
[FIX]
Validate the on-disk group descriptor before caching it, then add it to
the metadata cache tracked by INODE_CACHE(main_bm_inode). Keep the
validation failure path separate from the later cleanup path so we only
remove the buffer from that cache after it has actually been inserted.
This keeps the group buffer lifetime consistent across validation,
journaling, and cleanup.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7909f2bf835376a20d6dbf853eb459a27566eba2 Version: 7909f2bf835376a20d6dbf853eb459a27566eba2 Version: 7909f2bf835376a20d6dbf853eb459a27566eba2 Version: 7909f2bf835376a20d6dbf853eb459a27566eba2 Version: 7909f2bf835376a20d6dbf853eb459a27566eba2 Version: 7909f2bf835376a20d6dbf853eb459a27566eba2 Version: 7909f2bf835376a20d6dbf853eb459a27566eba2 Version: 7909f2bf835376a20d6dbf853eb459a27566eba2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/resize.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f7e139d7563f6947ad509fb468903941d0bb7ddd",
"status": "affected",
"version": "7909f2bf835376a20d6dbf853eb459a27566eba2",
"versionType": "git"
},
{
"lessThan": "22544ddedf381ed5191cfc783aea8d6c936bc201",
"status": "affected",
"version": "7909f2bf835376a20d6dbf853eb459a27566eba2",
"versionType": "git"
},
{
"lessThan": "76bd722db0a92b84ccd99e03796a0b6f1ae71c31",
"status": "affected",
"version": "7909f2bf835376a20d6dbf853eb459a27566eba2",
"versionType": "git"
},
{
"lessThan": "b9ae3942deec4c9e3fa2070521f90910f7490011",
"status": "affected",
"version": "7909f2bf835376a20d6dbf853eb459a27566eba2",
"versionType": "git"
},
{
"lessThan": "e7c2cb552e6eb85c0f5aefdd7f0f7c3c8591a6a3",
"status": "affected",
"version": "7909f2bf835376a20d6dbf853eb459a27566eba2",
"versionType": "git"
},
{
"lessThan": "aed87e866d1a321edb9703563c2faa8fec89835d",
"status": "affected",
"version": "7909f2bf835376a20d6dbf853eb459a27566eba2",
"versionType": "git"
},
{
"lessThan": "6c5e70409c1961fe1278968f038eaaed6cc1145a",
"status": "affected",
"version": "7909f2bf835376a20d6dbf853eb459a27566eba2",
"versionType": "git"
},
{
"lessThan": "70b672833f4025341c11b22c7f83778a5cd611bc",
"status": "affected",
"version": "7909f2bf835376a20d6dbf853eb459a27566eba2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/resize.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate group add input before caching\n\n[BUG]\nOCFS2_IOC_GROUP_ADD can trigger a BUG_ON in\nocfs2_set_new_buffer_uptodate():\n\nkernel BUG at fs/ocfs2/uptodate.c:509!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:ocfs2_set_new_buffer_uptodate+0x194/0x1e0 fs/ocfs2/uptodate.c:509\nCode: ffffe88f 42b9fe4c 89e64889 dfe8b4df\nCall Trace:\n ocfs2_group_add+0x3f1/0x1510 fs/ocfs2/resize.c:507\n ocfs2_ioctl+0x309/0x6e0 fs/ocfs2/ioctl.c:887\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583\n x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7bbfb55a966d\n\n[CAUSE]\nocfs2_group_add() calls ocfs2_set_new_buffer_uptodate() on a\nuser-controlled group block before ocfs2_verify_group_and_input()\nvalidates that block number. That helper is only valid for newly\nallocated metadata and asserts that the block is not already present in\nthe chosen metadata cache. The code also uses INODE_CACHE(inode) even\nthough the group descriptor belongs to main_bm_inode and later journal\naccesses use that cache context instead.\n\n[FIX]\nValidate the on-disk group descriptor before caching it, then add it to\nthe metadata cache tracked by INODE_CACHE(main_bm_inode). Keep the\nvalidation failure path separate from the later cleanup path so we only\nremove the buffer from that cache after it has actually been inserted.\nThis keeps the group buffer lifetime consistent across validation,\njournaling, and cleanup."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:45.853Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f7e139d7563f6947ad509fb468903941d0bb7ddd"
},
{
"url": "https://git.kernel.org/stable/c/22544ddedf381ed5191cfc783aea8d6c936bc201"
},
{
"url": "https://git.kernel.org/stable/c/76bd722db0a92b84ccd99e03796a0b6f1ae71c31"
},
{
"url": "https://git.kernel.org/stable/c/b9ae3942deec4c9e3fa2070521f90910f7490011"
},
{
"url": "https://git.kernel.org/stable/c/e7c2cb552e6eb85c0f5aefdd7f0f7c3c8591a6a3"
},
{
"url": "https://git.kernel.org/stable/c/aed87e866d1a321edb9703563c2faa8fec89835d"
},
{
"url": "https://git.kernel.org/stable/c/6c5e70409c1961fe1278968f038eaaed6cc1145a"
},
{
"url": "https://git.kernel.org/stable/c/70b672833f4025341c11b22c7f83778a5cd611bc"
}
],
"title": "ocfs2: validate group add input before caching",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53039",
"datePublished": "2026-06-24T16:29:45.853Z",
"dateReserved": "2026-06-09T07:44:35.380Z",
"dateUpdated": "2026-06-24T16:29:45.853Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53192 (GCVE-0-2026-53192)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: timer: Fix UAF at snd_timer_user_params()
At releasing a timer object, e.g. when a userspace timer
(CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it
tries to detach the timer instances and release the resources.
However, it's still possible that other in-flight tasks are holding
the timer instance where the to-be-deleted timer object is associated,
and this may lead to racy accesses.
Fortunately, most of ioctls dealing with the timer instance list
already have the protection with register_mutex, and this also avoids
such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the
concurrent ioctl may lead to use-after-free.
This patch just adds the guard with register_mutex to protect
snd_timer_user_params() for covering the code path as a quick
workaround. It's no hot-path but rather a rarely issued ioctl, so the
performance penalty doesn't matter.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/timer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "38034d04d4a75bbca01df2b313ced0bcd0fa3242",
"status": "affected",
"version": "37745918e0e7575bc40f38da93a99b9fa6406224",
"versionType": "git"
},
{
"lessThan": "3d39da65b5c422c5e5afb7d5651b0698d060a827",
"status": "affected",
"version": "37745918e0e7575bc40f38da93a99b9fa6406224",
"versionType": "git"
},
{
"lessThan": "306427adf9b97e29e5958cb9cf3096c6151fc9ff",
"status": "affected",
"version": "37745918e0e7575bc40f38da93a99b9fa6406224",
"versionType": "git"
},
{
"lessThan": "053a401b592be424fea9d57c789f66cd5d8cec11",
"status": "affected",
"version": "37745918e0e7575bc40f38da93a99b9fa6406224",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/timer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: timer: Fix UAF at snd_timer_user_params()\n\nAt releasing a timer object, e.g. when a userspace timer\n(CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it\ntries to detach the timer instances and release the resources.\nHowever, it\u0027s still possible that other in-flight tasks are holding\nthe timer instance where the to-be-deleted timer object is associated,\nand this may lead to racy accesses.\n\nFortunately, most of ioctls dealing with the timer instance list\nalready have the protection with register_mutex, and this also avoids\nsuch races. But, SNDRV_TIMER_IOCTL_PARAMS isn\u0027t protected, hence the\nconcurrent ioctl may lead to use-after-free.\n\nThis patch just adds the guard with register_mutex to protect\nsnd_timer_user_params() for covering the code path as a quick\nworkaround. It\u0027s no hot-path but rather a rarely issued ioctl, so the\nperformance penalty doesn\u0027t matter."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local `/dev/snd/timer` ioctls, specifically `SNDRV_TIMER_IOCTL_PARAMS`, after selecting a userspace-driven ALSA timer. It is not reachable by remote network input.\nAC:L - The attacker can create the userspace-driven timer, select it, and race the params ioctl against closing the returned timer fd using their own threads or processes. No external victim state or uncontrollable timing condition is required beyond an attacker-controlled race.\nPR:L - The kernel path has no capability or admin check, but exploitation requires local access to the ALSA timer device as a basic local user. It does not require real root or init-namespace capabilities.\nUI:N - No victim action is required after the attacker has local execution and device access. The attacker can open the timer device, issue ioctls, and close fds directly.\nS:U - The impact is within the same kernel security authority. This is a standard local kernel memory corruption issue, not a VM escape or cross-scope boundary violation.\nC:H - The bug is a use-after-free of a kernel timer object reachable from a user-controlled race. Kernel UAFs can be leveraged for information disclosure through heap reuse and memory manipulation.\nI:H - The stale timer pointer is subsequently dereferenced and used for locking/state decisions, making this kernel heap UAF plausibly exploitable for memory corruption and privilege escalation. Under the required overestimation rule, integrity impact is High.\nA:H - Even without full exploitation, the UAF can dereference or lock freed kernel memory and crash or hang the kernel. Repeated local triggering can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:58.587Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/38034d04d4a75bbca01df2b313ced0bcd0fa3242"
},
{
"url": "https://git.kernel.org/stable/c/3d39da65b5c422c5e5afb7d5651b0698d060a827"
},
{
"url": "https://git.kernel.org/stable/c/306427adf9b97e29e5958cb9cf3096c6151fc9ff"
},
{
"url": "https://git.kernel.org/stable/c/053a401b592be424fea9d57c789f66cd5d8cec11"
}
],
"title": "ALSA: timer: Fix UAF at snd_timer_user_params()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53192",
"datePublished": "2026-06-25T08:39:03.696Z",
"dateReserved": "2026-06-09T07:44:35.390Z",
"dateUpdated": "2026-08-05T12:33:58.587Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43134 (GCVE-0-2026-43134)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
This adds a check for encryption key size upon receiving
L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which
expects L2CAP_CR_LE_BAD_KEY_SIZE.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d Version: 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d Version: 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d Version: 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d Version: 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d Version: 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d Version: 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d Version: 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "335071c0c3637064ec250481f589075db44fe4e6",
"status": "affected",
"version": "27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d",
"versionType": "git"
},
{
"lessThan": "fa6ad76fa8623c0a50d529cd5726fa5d819a3be4",
"status": "affected",
"version": "27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d",
"versionType": "git"
},
{
"lessThan": "9118601ff90b79e8df3c0c98f48ae00c1b02ecef",
"status": "affected",
"version": "27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d",
"versionType": "git"
},
{
"lessThan": "481ea39b342c347b6ac029f3d418486280be4e45",
"status": "affected",
"version": "27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d",
"versionType": "git"
},
{
"lessThan": "ec91078e132179b04e0c3906b599816c056ceaad",
"status": "affected",
"version": "27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d",
"versionType": "git"
},
{
"lessThan": "96581749c7c14fbec32c35728520867929600041",
"status": "affected",
"version": "27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d",
"versionType": "git"
},
{
"lessThan": "8dd43f9a9323f9c01bc8246da8d81a4c783c9e97",
"status": "affected",
"version": "27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d",
"versionType": "git"
},
{
"lessThan": "138d7eca445ef37a0333425d269ee59900ca1104",
"status": "affected",
"version": "27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.14"
},
{
"lessThan": "3.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ\n\nThis adds a check for encryption key size upon receiving\nL2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which\nexpects L2CAP_CR_LE_BAD_KEY_SIZE."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable request is an incoming Bluetooth LE L2CAP signaling packet from a nearby Bluetooth peer, so exploitation requires adjacent radio proximity rather than IP network or local shell access.\nAC:L - An attacker who can establish an LE link can send an L2CAP_LE_CONN_REQ with an insufficient encryption key size and reliably reach the missing check; there is no race or condition outside attacker control.\nPR:N - The attacker does not need privileges on the target system; Bluetooth pairing/encryption is a protocol precondition, not an OS privilege, and the vulnerable authorization decision is made from received peer traffic.\nUI:N - In a reasonable deployment with a listening LE L2CAP service and connectable device, exploitation is triggered by the adjacent peer\u2019s protocol messages without requiring the victim to open a file, mount anything, or perform an action.\nS:U - The issue bypasses Bluetooth/L2CAP security policy within the same kernel and host Bluetooth service security authority, with no VM, sandbox, or hardware boundary escape.\nC:H - Accepting a channel despite an insufficient encryption key can expose all data carried by a protected LE Credit Based L2CAP service; for high-impact Bluetooth deployments, that can disclose sensitive application or device-control data.\nI:H - The same security bypass can allow an adjacent peer using inadequate encryption strength to send commands or modify state over a service that should have rejected the connection, giving high integrity impact in the protected service context.\nA:N - The bug is a missing key-size enforcement check and does not indicate memory corruption, panic, deadlock, resource exhaustion, or another availability failure."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:10.307Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/335071c0c3637064ec250481f589075db44fe4e6"
},
{
"url": "https://git.kernel.org/stable/c/fa6ad76fa8623c0a50d529cd5726fa5d819a3be4"
},
{
"url": "https://git.kernel.org/stable/c/9118601ff90b79e8df3c0c98f48ae00c1b02ecef"
},
{
"url": "https://git.kernel.org/stable/c/481ea39b342c347b6ac029f3d418486280be4e45"
},
{
"url": "https://git.kernel.org/stable/c/ec91078e132179b04e0c3906b599816c056ceaad"
},
{
"url": "https://git.kernel.org/stable/c/96581749c7c14fbec32c35728520867929600041"
},
{
"url": "https://git.kernel.org/stable/c/8dd43f9a9323f9c01bc8246da8d81a4c783c9e97"
},
{
"url": "https://git.kernel.org/stable/c/138d7eca445ef37a0333425d269ee59900ca1104"
}
],
"title": "Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43134",
"datePublished": "2026-05-06T11:27:21.541Z",
"dateReserved": "2026-05-01T14:12:55.988Z",
"dateUpdated": "2026-08-05T12:26:10.307Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45996 (GCVE-0-2026-45996)
Vulnerability from cvelistv5
Published
2026-05-27 12:55
Modified
2026-06-19 11:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
spi: imx: fix use-after-free on unbind
The SPI subsystem frees the controller and any subsystem allocated
driver data as part of deregistration (unless the allocation is device
managed).
Take another reference before deregistering the controller so that the
driver data is not freed until the driver is done with it.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 307c897db762d1e0feee9477276b08f6deca4a5b Version: 307c897db762d1e0feee9477276b08f6deca4a5b Version: 307c897db762d1e0feee9477276b08f6deca4a5b Version: 307c897db762d1e0feee9477276b08f6deca4a5b Version: 307c897db762d1e0feee9477276b08f6deca4a5b Version: 307c897db762d1e0feee9477276b08f6deca4a5b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-imx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c7c40c3e7b9fb900504aa746de3e53c5275b24bd",
"status": "affected",
"version": "307c897db762d1e0feee9477276b08f6deca4a5b",
"versionType": "git"
},
{
"lessThan": "f99165ef067723221472ce1aff632bc74f562643",
"status": "affected",
"version": "307c897db762d1e0feee9477276b08f6deca4a5b",
"versionType": "git"
},
{
"lessThan": "385a330083f8dd47c15b02e9a83aef9234a37003",
"status": "affected",
"version": "307c897db762d1e0feee9477276b08f6deca4a5b",
"versionType": "git"
},
{
"lessThan": "132e47030b0b5e398e0da6c59df5a5dae9b52cff",
"status": "affected",
"version": "307c897db762d1e0feee9477276b08f6deca4a5b",
"versionType": "git"
},
{
"lessThan": "aa9025a498036b6012769f7af36d421385386c17",
"status": "affected",
"version": "307c897db762d1e0feee9477276b08f6deca4a5b",
"versionType": "git"
},
{
"lessThan": "1c78c2002380a1fe31bfb01a3d5f29809e55a096",
"status": "affected",
"version": "307c897db762d1e0feee9477276b08f6deca4a5b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-imx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: imx: fix use-after-free on unbind\n\nThe SPI subsystem frees the controller and any subsystem allocated\ndriver data as part of deregistration (unless the allocation is device\nmanaged).\n\nTake another reference before deregistering the controller so that the\ndriver data is not freed until the driver is done with it."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-19T11:58:52.649Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c7c40c3e7b9fb900504aa746de3e53c5275b24bd"
},
{
"url": "https://git.kernel.org/stable/c/f99165ef067723221472ce1aff632bc74f562643"
},
{
"url": "https://git.kernel.org/stable/c/385a330083f8dd47c15b02e9a83aef9234a37003"
},
{
"url": "https://git.kernel.org/stable/c/132e47030b0b5e398e0da6c59df5a5dae9b52cff"
},
{
"url": "https://git.kernel.org/stable/c/aa9025a498036b6012769f7af36d421385386c17"
},
{
"url": "https://git.kernel.org/stable/c/1c78c2002380a1fe31bfb01a3d5f29809e55a096"
}
],
"title": "spi: imx: fix use-after-free on unbind",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45996",
"datePublished": "2026-05-27T12:55:50.195Z",
"dateReserved": "2026-05-13T15:03:33.091Z",
"dateUpdated": "2026-06-19T11:58:52.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46319 (GCVE-0-2026-46319)
Vulnerability from cvelistv5
Published
2026-06-09 12:11
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_ct: Only release RCU read lock after ct_ft
When looking up a flow table in act_ct in tcf_ct_flow_table_get(),
rhashtable_lookup_fast() internally opens and closes an RCU read critical
section before returning ct_ft.
The tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero()
is invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft
object. This vulnerability can lead to privilege escalation.
Analysis from zdi-disclosures@trendmicro.com:
When initializing act_ct, tcf_ct_init() is called, which internally triggers
tcf_ct_flow_table_get().
static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)
{
struct zones_ht_key key = { .net = net, .zone = params->zone };
struct tcf_ct_flow_table *ct_ft;
int err = -ENOMEM;
mutex_lock(&zones_mutex);
ct_ft = rhashtable_lookup_fast(&zones_ht, &key, zones_params); // [1]
if (ct_ft && refcount_inc_not_zero(&ct_ft->ref)) // [2]
goto out_unlock;
...
}
static __always_inline void *rhashtable_lookup_fast(
struct rhashtable *ht, const void *key,
const struct rhashtable_params params)
{
void *obj;
rcu_read_lock();
obj = rhashtable_lookup(ht, key, params);
rcu_read_unlock();
return obj;
}
At [1], rhashtable_lookup_fast() looks up and returns the corresponding ct_ft
from zones_ht . The lookup is performed within an RCU read critical section
through rcu_read_lock() / rcu_read_unlock(), which prevents the object from
being freed. However, at the point of function return, rcu_read_unlock() has
already been called, and there is nothing preventing ct_ft from being freed
before reaching refcount_inc_not_zero(&ct_ft->ref) at [2]. This interval becomes
the race window, during which ct_ft can be freed.
Free Process:
tcf_ct_flow_table_put() is executed through the path tcf_ct_cleanup() call_rcu()
tcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put().
static void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft)
{
if (refcount_dec_and_test(&ct_ft->ref)) {
rhashtable_remove_fast(&zones_ht, &ct_ft->node, zones_params);
INIT_RCU_WORK(&ct_ft->rwork, tcf_ct_flow_table_cleanup_work); // [3]
queue_rcu_work(act_ct_wq, &ct_ft->rwork);
}
}
At [3], tcf_ct_flow_table_cleanup_work() is scheduled as RCU work
static void tcf_ct_flow_table_cleanup_work(struct work_struct *work)
{
struct tcf_ct_flow_table *ct_ft;
struct flow_block *block;
ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table,
rwork);
nf_flow_table_free(&ct_ft->nf_ft);
block = &ct_ft->nf_ft.flow_block;
down_write(&ct_ft->nf_ft.flow_block_lock);
WARN_ON(!list_empty(&block->cb_list));
up_write(&ct_ft->nf_ft.flow_block_lock);
kfree(ct_ft); // [4]
module_put(THIS_MODULE);
}
tcf_ct_flow_table_cleanup_work() frees ct_ft at [4]. When this function executes
between [1] and [2], UAF occurs.
This race condition has a very short race window, making it generally
difficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was
inserted after[1]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 138470a9b2cc2e26e6018300394afc3858a54e6a Version: 138470a9b2cc2e26e6018300394afc3858a54e6a Version: 138470a9b2cc2e26e6018300394afc3858a54e6a Version: 138470a9b2cc2e26e6018300394afc3858a54e6a Version: 138470a9b2cc2e26e6018300394afc3858a54e6a Version: 138470a9b2cc2e26e6018300394afc3858a54e6a Version: 138470a9b2cc2e26e6018300394afc3858a54e6a Version: 138470a9b2cc2e26e6018300394afc3858a54e6a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/act_ct.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ece578ca61e572df96cfc80456357ebfae0b4b9e",
"status": "affected",
"version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
"versionType": "git"
},
{
"lessThan": "a2e0c045c87aa252eb61412e67dd91f2c2b19f81",
"status": "affected",
"version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
"versionType": "git"
},
{
"lessThan": "67c9ecc9f2575273ed1323e312881fc98ac83d6d",
"status": "affected",
"version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
"versionType": "git"
},
{
"lessThan": "f23424a0ddadb494d4bd57056a7ca703312d3a7b",
"status": "affected",
"version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
"versionType": "git"
},
{
"lessThan": "17dfb67cb399b660105d9a8c6100851c0d0cdc70",
"status": "affected",
"version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
"versionType": "git"
},
{
"lessThan": "4c727c6967a41b37efe0f26332ca9ec5b74785a3",
"status": "affected",
"version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
"versionType": "git"
},
{
"lessThan": "3e20e1b3058e0b94638e7b931c138e840e266724",
"status": "affected",
"version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
"versionType": "git"
},
{
"lessThan": "f462dca0c8415bf0058d0ffa476354c4476d0f09",
"status": "affected",
"version": "138470a9b2cc2e26e6018300394afc3858a54e6a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/act_ct.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: Only release RCU read lock after ct_ft\n\nWhen looking up a flow table in act_ct in tcf_ct_flow_table_get(),\nrhashtable_lookup_fast() internally opens and closes an RCU read critical\nsection before returning ct_ft.\nThe tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero()\nis invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft\nobject. This vulnerability can lead to privilege escalation.\n\nAnalysis from zdi-disclosures@trendmicro.com:\nWhen initializing act_ct, tcf_ct_init() is called, which internally triggers\ntcf_ct_flow_table_get().\n\nstatic int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)\n\n{\n struct zones_ht_key key = { .net = net, .zone = params-\u003ezone };\n struct tcf_ct_flow_table *ct_ft;\n int err = -ENOMEM;\n\n mutex_lock(\u0026zones_mutex);\n ct_ft = rhashtable_lookup_fast(\u0026zones_ht, \u0026key, zones_params); // [1]\n if (ct_ft \u0026\u0026 refcount_inc_not_zero(\u0026ct_ft-\u003eref)) // [2]\n goto out_unlock;\n ...\n}\n\nstatic __always_inline void *rhashtable_lookup_fast(\n struct rhashtable *ht, const void *key,\n const struct rhashtable_params params)\n{\n void *obj;\n\n rcu_read_lock();\n obj = rhashtable_lookup(ht, key, params);\n rcu_read_unlock();\n\n return obj;\n}\n\nAt [1], rhashtable_lookup_fast() looks up and returns the corresponding ct_ft\nfrom zones_ht . The lookup is performed within an RCU read critical section\nthrough rcu_read_lock() / rcu_read_unlock(), which prevents the object from\nbeing freed. However, at the point of function return, rcu_read_unlock() has\nalready been called, and there is nothing preventing ct_ft from being freed\nbefore reaching refcount_inc_not_zero(\u0026ct_ft-\u003eref) at [2]. This interval becomes\nthe race window, during which ct_ft can be freed.\n\nFree Process:\n\ntcf_ct_flow_table_put() is executed through the path tcf_ct_cleanup() call_rcu()\ntcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put().\n\nstatic void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft)\n{\n if (refcount_dec_and_test(\u0026ct_ft-\u003eref)) {\n rhashtable_remove_fast(\u0026zones_ht, \u0026ct_ft-\u003enode, zones_params);\n INIT_RCU_WORK(\u0026ct_ft-\u003erwork, tcf_ct_flow_table_cleanup_work); // [3]\n queue_rcu_work(act_ct_wq, \u0026ct_ft-\u003erwork);\n }\n}\n\nAt [3], tcf_ct_flow_table_cleanup_work() is scheduled as RCU work\n\nstatic void tcf_ct_flow_table_cleanup_work(struct work_struct *work)\n\n{\n struct tcf_ct_flow_table *ct_ft;\n struct flow_block *block;\n\n ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table,\n rwork);\n nf_flow_table_free(\u0026ct_ft-\u003enf_ft);\n block = \u0026ct_ft-\u003enf_ft.flow_block;\n down_write(\u0026ct_ft-\u003enf_ft.flow_block_lock);\n WARN_ON(!list_empty(\u0026block-\u003ecb_list));\n up_write(\u0026ct_ft-\u003enf_ft.flow_block_lock);\n kfree(ct_ft); // [4]\n\n module_put(THIS_MODULE);\n}\n\ntcf_ct_flow_table_cleanup_work() frees ct_ft at [4]. When this function executes\nbetween [1] and [2], UAF occurs.\n\nThis race condition has a very short race window, making it generally\ndifficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was\ninserted after[1]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is triggered only during act_ct TC action configuration via RTM_NEWACTION/RTM_DELACTION or RTM_NEWTFILTER netlink messages, not by processing remote network packets. Per kernel guidance, tc/netlink qdisc paths are Local attack vector.\nAC:L - The race is between flow-table lookup and refcount increment during concurrent create/delete/replace of ct actions, and an attacker with CAP_NET_ADMIN controls both sides by issuing parallel netlink operations on actions sharing the same zone. UAF races where the attacker controls timing are scored AC:L.\nPR:L - All non-GET rtnetlink TC operations require CAP_NET_ADMIN, checked in rtnetlink_rcv_msg() and tc_ctl_action(). CAP_NET_ADMIN is obtainable by an unprivileged user inside a user+network namespace (unshare -Urn), which per kernel guidance is PR:L not PR:H.\nUI:N - Exploitation requires only the attacker\u0027s own netlink configuration traffic; no victim user action such as opening a file or mounting a filesystem is needed.\nS:U - A successful exploit yields kernel-level privilege escalation within the same kernel security domain. This is standard local kernel compromise, not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.\nC:H - The bug is a heap use-after-free on struct tcf_ct_flow_table during refcount_inc_not_zero() on memory that tcf_ct_flow_table_cleanup_work() may have already kfree()\u0027d. UAF on kernel heap objects enables arbitrary memory read primitives and is scored C:H.\nI:H - Freed tcf_ct_flow_table slabs can be reallocated and corrupted via the dangling refcount operation, providing heap manipulation primitives that ZDI and the fix commit describe as leading to privilege escalation. Memory corruption UAF is scored I:H.\nA:H - Hitting the UAF during refcount manipulation on freed memory can cause kernel oops/panic or deliberate denial of service, and UAF bugs inherently threaten availability even when exploitation is attempted. Any kernel crash or UAF is scored A:H."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:14.097Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ece578ca61e572df96cfc80456357ebfae0b4b9e"
},
{
"url": "https://git.kernel.org/stable/c/a2e0c045c87aa252eb61412e67dd91f2c2b19f81"
},
{
"url": "https://git.kernel.org/stable/c/67c9ecc9f2575273ed1323e312881fc98ac83d6d"
},
{
"url": "https://git.kernel.org/stable/c/f23424a0ddadb494d4bd57056a7ca703312d3a7b"
},
{
"url": "https://git.kernel.org/stable/c/17dfb67cb399b660105d9a8c6100851c0d0cdc70"
},
{
"url": "https://git.kernel.org/stable/c/4c727c6967a41b37efe0f26332ca9ec5b74785a3"
},
{
"url": "https://git.kernel.org/stable/c/3e20e1b3058e0b94638e7b931c138e840e266724"
},
{
"url": "https://git.kernel.org/stable/c/f462dca0c8415bf0058d0ffa476354c4476d0f09"
}
],
"title": "net/sched: act_ct: Only release RCU read lock after ct_ft",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46319",
"datePublished": "2026-06-09T12:11:12.128Z",
"dateReserved": "2026-05-13T15:03:33.112Z",
"dateUpdated": "2026-08-05T12:31:14.097Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43143 (GCVE-0-2026-43143)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mfd: core: Add locking around 'mfd_of_node_list'
Manipulating a list in the kernel isn't safe without some sort of
mutual exclusion. Add a mutex any time we access / modify
'mfd_of_node_list' to prevent possible crashes.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 466a62d7642f02f36d37d9b30c19a725538a01ca Version: 466a62d7642f02f36d37d9b30c19a725538a01ca Version: 466a62d7642f02f36d37d9b30c19a725538a01ca Version: 466a62d7642f02f36d37d9b30c19a725538a01ca Version: 466a62d7642f02f36d37d9b30c19a725538a01ca Version: 466a62d7642f02f36d37d9b30c19a725538a01ca |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mfd/mfd-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dcfa679bba02412f2087be21cf06ae88b1f4e0ef",
"status": "affected",
"version": "466a62d7642f02f36d37d9b30c19a725538a01ca",
"versionType": "git"
},
{
"lessThan": "e2e7c275f557e2b75e3128f4818063798248774c",
"status": "affected",
"version": "466a62d7642f02f36d37d9b30c19a725538a01ca",
"versionType": "git"
},
{
"lessThan": "db131ef9d8980cf60dcac8cf94c036eccf75e5d0",
"status": "affected",
"version": "466a62d7642f02f36d37d9b30c19a725538a01ca",
"versionType": "git"
},
{
"lessThan": "9b02e3fec3a7fcb990b4d3bd3b13d7edf123dca6",
"status": "affected",
"version": "466a62d7642f02f36d37d9b30c19a725538a01ca",
"versionType": "git"
},
{
"lessThan": "45341856ecda1d56689451abd5cf1d1aa57dbe47",
"status": "affected",
"version": "466a62d7642f02f36d37d9b30c19a725538a01ca",
"versionType": "git"
},
{
"lessThan": "20117c92bcf9c11afd64d7481d8f94fdf410726e",
"status": "affected",
"version": "466a62d7642f02f36d37d9b30c19a725538a01ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mfd/mfd-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: core: Add locking around \u0027mfd_of_node_list\u0027\n\nManipulating a list in the kernel isn\u0027t safe without some sort of\nmutual exclusion. Add a mutex any time we access / modify\n\u0027mfd_of_node_list\u0027 to prevent possible crashes."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:18:35.396Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dcfa679bba02412f2087be21cf06ae88b1f4e0ef"
},
{
"url": "https://git.kernel.org/stable/c/e2e7c275f557e2b75e3128f4818063798248774c"
},
{
"url": "https://git.kernel.org/stable/c/db131ef9d8980cf60dcac8cf94c036eccf75e5d0"
},
{
"url": "https://git.kernel.org/stable/c/9b02e3fec3a7fcb990b4d3bd3b13d7edf123dca6"
},
{
"url": "https://git.kernel.org/stable/c/45341856ecda1d56689451abd5cf1d1aa57dbe47"
},
{
"url": "https://git.kernel.org/stable/c/20117c92bcf9c11afd64d7481d8f94fdf410726e"
}
],
"title": "mfd: core: Add locking around \u0027mfd_of_node_list\u0027",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43143",
"datePublished": "2026-05-06T11:27:27.506Z",
"dateReserved": "2026-05-01T14:12:55.989Z",
"dateUpdated": "2026-05-11T22:18:35.396Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31441 (GCVE-0-2026-31441)
Vulnerability from cvelistv5
Published
2026-04-22 13:53
Modified
2026-07-14 12:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: Fix memory leak when a wq is reset
idxd_wq_disable_cleanup() which is called from the reset path for a
workqueue, sets the wq type to NONE, which for other parts of the
driver mean that the wq is empty (all its resources were released).
Only set the wq type to NONE after its resources are released.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: da32b28c95a79e399e18c03f8178f41aec9c66e4 Version: da32b28c95a79e399e18c03f8178f41aec9c66e4 Version: da32b28c95a79e399e18c03f8178f41aec9c66e4 Version: da32b28c95a79e399e18c03f8178f41aec9c66e4 Version: da32b28c95a79e399e18c03f8178f41aec9c66e4 Version: da32b28c95a79e399e18c03f8178f41aec9c66e4 Version: 2a2df2bd10de44c3804661ed15157817c12d6291 Version: 5.7.10 ≤ |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:47:50.075Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/idxd/device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a16098a2f0c11ee5e04e23aa7478ca1fcfb0f658",
"status": "affected",
"version": "da32b28c95a79e399e18c03f8178f41aec9c66e4",
"versionType": "git"
},
{
"lessThan": "54d77cc0c40ca2f894859dc7b3c52997574f1a2a",
"status": "affected",
"version": "da32b28c95a79e399e18c03f8178f41aec9c66e4",
"versionType": "git"
},
{
"lessThan": "39c1504e0e76bcfb93991fd94288a83e05d13b51",
"status": "affected",
"version": "da32b28c95a79e399e18c03f8178f41aec9c66e4",
"versionType": "git"
},
{
"lessThan": "a9e7815d38629bcf59d3005001f1f315424a58de",
"status": "affected",
"version": "da32b28c95a79e399e18c03f8178f41aec9c66e4",
"versionType": "git"
},
{
"lessThan": "0c3d3ac57e3c52b570b8c695903306bff07e04c8",
"status": "affected",
"version": "da32b28c95a79e399e18c03f8178f41aec9c66e4",
"versionType": "git"
},
{
"lessThan": "d9cfb5193a047a92a4d3c0e91ea4cc87c8f7c478",
"status": "affected",
"version": "da32b28c95a79e399e18c03f8178f41aec9c66e4",
"versionType": "git"
},
{
"status": "affected",
"version": "2a2df2bd10de44c3804661ed15157817c12d6291",
"versionType": "git"
},
{
"lessThan": "5.8",
"status": "affected",
"version": "5.7.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/idxd/device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.7.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix memory leak when a wq is reset\n\nidxd_wq_disable_cleanup() which is called from the reset path for a\nworkqueue, sets the wq type to NONE, which for other parts of the\ndriver mean that the wq is empty (all its resources were released).\n\nOnly set the wq type to NONE after its resources are released."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:05:04.689Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a16098a2f0c11ee5e04e23aa7478ca1fcfb0f658"
},
{
"url": "https://git.kernel.org/stable/c/54d77cc0c40ca2f894859dc7b3c52997574f1a2a"
},
{
"url": "https://git.kernel.org/stable/c/39c1504e0e76bcfb93991fd94288a83e05d13b51"
},
{
"url": "https://git.kernel.org/stable/c/a9e7815d38629bcf59d3005001f1f315424a58de"
},
{
"url": "https://git.kernel.org/stable/c/0c3d3ac57e3c52b570b8c695903306bff07e04c8"
},
{
"url": "https://git.kernel.org/stable/c/d9cfb5193a047a92a4d3c0e91ea4cc87c8f7c478"
}
],
"title": "dmaengine: idxd: Fix memory leak when a wq is reset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31441",
"datePublished": "2026-04-22T13:53:39.055Z",
"dateReserved": "2026-03-09T15:48:24.090Z",
"dateUpdated": "2026-07-14T12:47:50.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31503 (GCVE-0-2026-31503)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-07-14 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
udp: Fix wildcard bind conflict check when using hash2
When binding a udp_sock to a local address and port, UDP uses
two hashes (udptable->hash and udptable->hash2) for collision
detection. The current code switches to "hash2" when
hslot->count > 10.
"hash2" is keyed by local address and local port.
"hash" is keyed by local port only.
The issue can be shown in the following bind sequence (pseudo code):
bind(fd1, "[fd00::1]:8888")
bind(fd2, "[fd00::2]:8888")
bind(fd3, "[fd00::3]:8888")
bind(fd4, "[fd00::4]:8888")
bind(fd5, "[fd00::5]:8888")
bind(fd6, "[fd00::6]:8888")
bind(fd7, "[fd00::7]:8888")
bind(fd8, "[fd00::8]:8888")
bind(fd9, "[fd00::9]:8888")
bind(fd10, "[fd00::10]:8888")
/* Correctly return -EADDRINUSE because "hash" is used
* instead of "hash2". udp_lib_lport_inuse() detects the
* conflict.
*/
bind(fail_fd, "[::]:8888")
/* After one more socket is bound to "[fd00::11]:8888",
* hslot->count exceeds 10 and "hash2" is used instead.
*/
bind(fd11, "[fd00::11]:8888")
bind(fail_fd, "[::]:8888") /* succeeds unexpectedly */
The same issue applies to the IPv4 wildcard address "0.0.0.0"
and the IPv4-mapped wildcard address "::ffff:0.0.0.0". For
example, if there are existing sockets bound to
"192.168.1.[1-11]:8888", then binding "0.0.0.0:8888" or
"[::ffff:0.0.0.0]:8888" can also miss the conflict when
hslot->count > 10.
TCP inet_csk_get_port() already has the correct check in
inet_use_bhash2_on_bind(). Rename it to
inet_use_hash2_on_bind() and move it to inet_hashtables.h
so udp.c can reuse it in this fix.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 30fff9231fad757c061285e347b33c5149c2c2e4 Version: 30fff9231fad757c061285e347b33c5149c2c2e4 Version: 30fff9231fad757c061285e347b33c5149c2c2e4 Version: 30fff9231fad757c061285e347b33c5149c2c2e4 Version: 30fff9231fad757c061285e347b33c5149c2c2e4 Version: 30fff9231fad757c061285e347b33c5149c2c2e4 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:07.603Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/inet_hashtables.h",
"net/ipv4/inet_connection_sock.c",
"net/ipv4/udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d6ace0dbcbb7fd285738bb87b42b71b01858c952",
"status": "affected",
"version": "30fff9231fad757c061285e347b33c5149c2c2e4",
"versionType": "git"
},
{
"lessThan": "2297e38114316b26ae02f2d205c49b5511c5ed55",
"status": "affected",
"version": "30fff9231fad757c061285e347b33c5149c2c2e4",
"versionType": "git"
},
{
"lessThan": "f1bed05a832ae79be5f7a105da56810eaa59a5f1",
"status": "affected",
"version": "30fff9231fad757c061285e347b33c5149c2c2e4",
"versionType": "git"
},
{
"lessThan": "18d84c45def3671d5c89fbdd5d4ab8a3217fe4b4",
"status": "affected",
"version": "30fff9231fad757c061285e347b33c5149c2c2e4",
"versionType": "git"
},
{
"lessThan": "0a360f7f73a06ac88f18917055fbcc79694252d7",
"status": "affected",
"version": "30fff9231fad757c061285e347b33c5149c2c2e4",
"versionType": "git"
},
{
"lessThan": "e537dd15d0d4ad989d56a1021290f0c674dd8b28",
"status": "affected",
"version": "30fff9231fad757c061285e347b33c5149c2c2e4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/inet_hashtables.h",
"net/ipv4/inet_connection_sock.c",
"net/ipv4/udp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.33"
},
{
"lessThan": "2.6.33",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: Fix wildcard bind conflict check when using hash2\n\nWhen binding a udp_sock to a local address and port, UDP uses\ntwo hashes (udptable-\u003ehash and udptable-\u003ehash2) for collision\ndetection. The current code switches to \"hash2\" when\nhslot-\u003ecount \u003e 10.\n\n\"hash2\" is keyed by local address and local port.\n\"hash\" is keyed by local port only.\n\nThe issue can be shown in the following bind sequence (pseudo code):\n\nbind(fd1, \"[fd00::1]:8888\")\nbind(fd2, \"[fd00::2]:8888\")\nbind(fd3, \"[fd00::3]:8888\")\nbind(fd4, \"[fd00::4]:8888\")\nbind(fd5, \"[fd00::5]:8888\")\nbind(fd6, \"[fd00::6]:8888\")\nbind(fd7, \"[fd00::7]:8888\")\nbind(fd8, \"[fd00::8]:8888\")\nbind(fd9, \"[fd00::9]:8888\")\nbind(fd10, \"[fd00::10]:8888\")\n\n/* Correctly return -EADDRINUSE because \"hash\" is used\n * instead of \"hash2\". udp_lib_lport_inuse() detects the\n * conflict.\n */\nbind(fail_fd, \"[::]:8888\")\n\n/* After one more socket is bound to \"[fd00::11]:8888\",\n * hslot-\u003ecount exceeds 10 and \"hash2\" is used instead.\n */\nbind(fd11, \"[fd00::11]:8888\")\nbind(fail_fd, \"[::]:8888\") /* succeeds unexpectedly */\n\nThe same issue applies to the IPv4 wildcard address \"0.0.0.0\"\nand the IPv4-mapped wildcard address \"::ffff:0.0.0.0\". For\nexample, if there are existing sockets bound to\n\"192.168.1.[1-11]:8888\", then binding \"0.0.0.0:8888\" or\n\"[::ffff:0.0.0.0]:8888\" can also miss the conflict when\nhslot-\u003ecount \u003e 10.\n\nTCP inet_csk_get_port() already has the correct check in\ninet_use_bhash2_on_bind(). Rename it to\ninet_use_hash2_on_bind() and move it to inet_hashtables.h\nso udp.c can reuse it in this fix."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:10:00.326Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d6ace0dbcbb7fd285738bb87b42b71b01858c952"
},
{
"url": "https://git.kernel.org/stable/c/2297e38114316b26ae02f2d205c49b5511c5ed55"
},
{
"url": "https://git.kernel.org/stable/c/f1bed05a832ae79be5f7a105da56810eaa59a5f1"
},
{
"url": "https://git.kernel.org/stable/c/18d84c45def3671d5c89fbdd5d4ab8a3217fe4b4"
},
{
"url": "https://git.kernel.org/stable/c/0a360f7f73a06ac88f18917055fbcc79694252d7"
},
{
"url": "https://git.kernel.org/stable/c/e537dd15d0d4ad989d56a1021290f0c674dd8b28"
}
],
"title": "udp: Fix wildcard bind conflict check when using hash2",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31503",
"datePublished": "2026-04-22T13:54:23.221Z",
"dateReserved": "2026-03-09T15:48:24.105Z",
"dateUpdated": "2026-07-14T12:48:07.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43488 (GCVE-0-2026-43488)
Vulnerability from cvelistv5
Published
2026-05-13 15:08
Modified
2026-05-14 14:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: xhci: Prevent interrupt storm on host controller error (HCE)
The xHCI controller reports a Host Controller Error (HCE) in UAS Storage
Device plug/unplug scenarios on Android devices. HCE is checked in
xhci_irq() function and causes an interrupt storm (since the interrupt
isn’t cleared), leading to severe system-level faults.
When the xHC controller reports HCE in the interrupt handler, the driver
only logs a warning and assumes xHC activity will stop as stated in xHCI
specification. An interrupt storm does however continue on some hosts
even after HCE, and only ceases after manually disabling xHC interrupt
and stopping the controller by calling xhci_halt().
Add xhci_halt() to xhci_irq() function where STS_HCE status is checked,
mirroring the existing error handling pattern used for STS_FATAL errors.
This only fixes the interrupt storm. Proper HCE recovery requires resetting
and re-initializing the xHC.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/host/xhci-ring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b2dd9abf8c06cfcbcf242321fd54ae51a4807705",
"status": "affected",
"version": "2a25e66d676dfb9b018abd503deed3d38a892dec",
"versionType": "git"
},
{
"lessThan": "6f91f3f087194c114d6d8ea4591b850bb00672f8",
"status": "affected",
"version": "2a25e66d676dfb9b018abd503deed3d38a892dec",
"versionType": "git"
},
{
"lessThan": "cd41e0d1df8fcf5eae294657da52b50d1ce03246",
"status": "affected",
"version": "2a25e66d676dfb9b018abd503deed3d38a892dec",
"versionType": "git"
},
{
"lessThan": "09ff0099c6cf148ff1f7053b5b6c84beb1c2ef8d",
"status": "affected",
"version": "2a25e66d676dfb9b018abd503deed3d38a892dec",
"versionType": "git"
},
{
"lessThan": "d6d5febd12452b7fd951fdd15c3ec262f01901a4",
"status": "affected",
"version": "2a25e66d676dfb9b018abd503deed3d38a892dec",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/host/xhci-ring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: xhci: Prevent interrupt storm on host controller error (HCE)\n\nThe xHCI controller reports a Host Controller Error (HCE) in UAS Storage\nDevice plug/unplug scenarios on Android devices. HCE is checked in\nxhci_irq() function and causes an interrupt storm (since the interrupt\nisn\u2019t cleared), leading to severe system-level faults.\n\nWhen the xHC controller reports HCE in the interrupt handler, the driver\nonly logs a warning and assumes xHC activity will stop as stated in xHCI\nspecification. An interrupt storm does however continue on some hosts\neven after HCE, and only ceases after manually disabling xHC interrupt\nand stopping the controller by calling xhci_halt().\n\nAdd xhci_halt() to xhci_irq() function where STS_HCE status is checked,\nmirroring the existing error handling pattern used for STS_FATAL errors.\n\nThis only fixes the interrupt storm. Proper HCE recovery requires resetting\nand re-initializing the xHC."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-14T14:31:22.390Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b2dd9abf8c06cfcbcf242321fd54ae51a4807705"
},
{
"url": "https://git.kernel.org/stable/c/6f91f3f087194c114d6d8ea4591b850bb00672f8"
},
{
"url": "https://git.kernel.org/stable/c/cd41e0d1df8fcf5eae294657da52b50d1ce03246"
},
{
"url": "https://git.kernel.org/stable/c/09ff0099c6cf148ff1f7053b5b6c84beb1c2ef8d"
},
{
"url": "https://git.kernel.org/stable/c/d6d5febd12452b7fd951fdd15c3ec262f01901a4"
}
],
"title": "usb: xhci: Prevent interrupt storm on host controller error (HCE)",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43488",
"datePublished": "2026-05-13T15:08:33.196Z",
"dateReserved": "2026-05-01T14:12:56.012Z",
"dateUpdated": "2026-05-14T14:31:22.390Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45839 (GCVE-0-2026-45839)
Vulnerability from cvelistv5
Published
2026-05-27 09:24
Modified
2026-08-27 12:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()
CO-RE accessor strings are colon-separated indices that describe a path
from a root BTF type to a target field, e.g. "0:1:2" walks through
nested struct members. bpf_core_parse_spec() parses each component with
sscanf("%d"), so negative values like -1 are silently accepted. The
subsequent bounds checks (access_idx >= btf_vlen(t)) only guard the
upper bound and always pass for negative values because C integer
promotion converts the __u16 btf_vlen result to int, making the
comparison (int)(-1) >= (int)(N) false for any positive N.
When -1 reaches btf_member_bit_offset() it gets cast to u32 0xffffffff,
producing an out-of-bounds read far past the members array. A crafted
BPF program with a negative CO-RE accessor on any struct that exists in
vmlinux BTF (e.g. task_struct) crashes the kernel deterministically
during BPF_PROG_LOAD on any system with CONFIG_DEBUG_INFO_BTF=y
(default on major distributions). The bug is reachable with CAP_BPF:
BUG: unable to handle page fault for address: ffffed11818b6626
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 85 Comm: poc Not tainted 7.0.0-rc6 #18 PREEMPT(full)
RIP: 0010:bpf_core_parse_spec (tools/lib/bpf/relo_core.c:354)
RAX: 00000000ffffffff
Call Trace:
<TASK>
bpf_core_calc_relo_insn (tools/lib/bpf/relo_core.c:1321)
bpf_core_apply (kernel/bpf/btf.c:9507)
check_core_relo (kernel/bpf/verifier.c:19475)
bpf_check (kernel/bpf/verifier.c:26031)
bpf_prog_load (kernel/bpf/syscall.c:3089)
__sys_bpf (kernel/bpf/syscall.c:6228)
</TASK>
CO-RE accessor indices are inherently non-negative (struct member index,
array element index, or enumerator index), so reject them immediately
after parsing.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ddc7c3042614e273044f698d2beab25cc3842d45 Version: ddc7c3042614e273044f698d2beab25cc3842d45 Version: ddc7c3042614e273044f698d2beab25cc3842d45 Version: ddc7c3042614e273044f698d2beab25cc3842d45 Version: ddc7c3042614e273044f698d2beab25cc3842d45 Version: ddc7c3042614e273044f698d2beab25cc3842d45 Version: ddc7c3042614e273044f698d2beab25cc3842d45 Version: ddc7c3042614e273044f698d2beab25cc3842d45 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"tools/lib/bpf/relo_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c8e49b79c4b48bd687706ff6e9c82638dc81ef80",
"status": "affected",
"version": "ddc7c3042614e273044f698d2beab25cc3842d45",
"versionType": "git"
},
{
"lessThan": "a9e777f856cd2f1efc106afc7bf21aef868509d5",
"status": "affected",
"version": "ddc7c3042614e273044f698d2beab25cc3842d45",
"versionType": "git"
},
{
"lessThan": "669349b4612c26b3d7aacfa99d7174681bd19223",
"status": "affected",
"version": "ddc7c3042614e273044f698d2beab25cc3842d45",
"versionType": "git"
},
{
"lessThan": "3ff85ae79e1a74baeb916b78a63d821f6d19a994",
"status": "affected",
"version": "ddc7c3042614e273044f698d2beab25cc3842d45",
"versionType": "git"
},
{
"lessThan": "36a9012f76ba8d9189ae56a1f8bb7c87c07a1f3a",
"status": "affected",
"version": "ddc7c3042614e273044f698d2beab25cc3842d45",
"versionType": "git"
},
{
"lessThan": "76f2ebaf79a9ae6d0737b87f045fe769e425d78f",
"status": "affected",
"version": "ddc7c3042614e273044f698d2beab25cc3842d45",
"versionType": "git"
},
{
"lessThan": "99dbab7b5a12d8f58d5b0aa2f7a1fe656a70f4b2",
"status": "affected",
"version": "ddc7c3042614e273044f698d2beab25cc3842d45",
"versionType": "git"
},
{
"lessThan": "1c22483a2c4bbf747787f328392ca3e68619c4dc",
"status": "affected",
"version": "ddc7c3042614e273044f698d2beab25cc3842d45",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"tools/lib/bpf/relo_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()\n\nCO-RE accessor strings are colon-separated indices that describe a path\nfrom a root BTF type to a target field, e.g. \"0:1:2\" walks through\nnested struct members. bpf_core_parse_spec() parses each component with\nsscanf(\"%d\"), so negative values like -1 are silently accepted. The\nsubsequent bounds checks (access_idx \u003e= btf_vlen(t)) only guard the\nupper bound and always pass for negative values because C integer\npromotion converts the __u16 btf_vlen result to int, making the\ncomparison (int)(-1) \u003e= (int)(N) false for any positive N.\n\nWhen -1 reaches btf_member_bit_offset() it gets cast to u32 0xffffffff,\nproducing an out-of-bounds read far past the members array. A crafted\nBPF program with a negative CO-RE accessor on any struct that exists in\nvmlinux BTF (e.g. task_struct) crashes the kernel deterministically\nduring BPF_PROG_LOAD on any system with CONFIG_DEBUG_INFO_BTF=y\n(default on major distributions). The bug is reachable with CAP_BPF:\n\n BUG: unable to handle page fault for address: ffffed11818b6626\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n CPU: 0 UID: 0 PID: 85 Comm: poc Not tainted 7.0.0-rc6 #18 PREEMPT(full)\n RIP: 0010:bpf_core_parse_spec (tools/lib/bpf/relo_core.c:354)\n RAX: 00000000ffffffff\n Call Trace:\n \u003cTASK\u003e\n bpf_core_calc_relo_insn (tools/lib/bpf/relo_core.c:1321)\n bpf_core_apply (kernel/bpf/btf.c:9507)\n check_core_relo (kernel/bpf/verifier.c:19475)\n bpf_check (kernel/bpf/verifier.c:26031)\n bpf_prog_load (kernel/bpf/syscall.c:3089)\n __sys_bpf (kernel/bpf/syscall.c:6228)\n \u003c/TASK\u003e\n\nCO-RE accessor indices are inherently non-negative (struct member index,\narray element index, or enumerator index), so reject them immediately\nafter parsing."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:39:38.923Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c8e49b79c4b48bd687706ff6e9c82638dc81ef80"
},
{
"url": "https://git.kernel.org/stable/c/a9e777f856cd2f1efc106afc7bf21aef868509d5"
},
{
"url": "https://git.kernel.org/stable/c/669349b4612c26b3d7aacfa99d7174681bd19223"
},
{
"url": "https://git.kernel.org/stable/c/3ff85ae79e1a74baeb916b78a63d821f6d19a994"
},
{
"url": "https://git.kernel.org/stable/c/36a9012f76ba8d9189ae56a1f8bb7c87c07a1f3a"
},
{
"url": "https://git.kernel.org/stable/c/76f2ebaf79a9ae6d0737b87f045fe769e425d78f"
},
{
"url": "https://git.kernel.org/stable/c/99dbab7b5a12d8f58d5b0aa2f7a1fe656a70f4b2"
},
{
"url": "https://git.kernel.org/stable/c/1c22483a2c4bbf747787f328392ca3e68619c4dc"
}
],
"title": "bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45839",
"datePublished": "2026-05-27T09:24:37.855Z",
"dateReserved": "2026-05-13T15:03:33.077Z",
"dateUpdated": "2026-08-27T12:39:38.923Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46048 (GCVE-0-2026-46048)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-06-14 17:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: caiaq: fix usb_dev refcount leak on probe failure
create_card() takes a reference on the USB device with usb_get_dev()
and stores the matching usb_put_dev() in card_free(), which is
installed as the snd_card's ->private_free destructor.
However, ->private_free is only assigned near the end of init_card(),
after several failure points (usb_set_interface(), EP type checks,
usb_submit_urb(), the EP1_CMD_GET_DEVICE_INFO exchange, and its
timeout). When any of those fail, init_card() returns an error to
snd_probe(), which calls snd_card_free(card). Because ->private_free
is still NULL, card_free() never runs, the usb_get_dev() reference
is not dropped, and the struct usb_device leaks along with its
descriptor allocations and device_private.
syzbot reproduces this with a malformed UAC3 device whose only valid
altsetting is 0; init_card()'s usb_set_interface(usb_dev, 0, 1) call
fails with -EIO and triggers the leak.
Move the ->private_free assignment into create_card(), immediately
after usb_get_dev(), so that every error path reaching snd_card_free()
balances the reference. card_free()'s callees (snd_usb_caiaq_input_free,
free_urbs, kfree) already tolerate the partially-initialized state
because the chip private area is zero-initialized by snd_card_new().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 493b3a682ededc804555755f5d2193201339612d Version: dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e Version: ac7345f68cda6989016d85d63f7b244c064aa8f6 Version: f6634af5de728a46792f674a66d7843570cb68f7 Version: 1d9be95aee6c6246a21752e60c9519902649f482 Version: 6473ed16df1fe88051140611b3eb9a49be7f429e Version: 59b622a043cffc58b7638cd85ae6c30a0904f8e6 Version: 80bb50e2d459213cccff3111d5ef98ed4238c0d5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/caiaq/device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c874db8a1d2f9f08161470d00cfe8db2f5cca2cc",
"status": "affected",
"version": "493b3a682ededc804555755f5d2193201339612d",
"versionType": "git"
},
{
"lessThan": "6fa8dff64fb6c401ced40a05797b327659317498",
"status": "affected",
"version": "dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e",
"versionType": "git"
},
{
"lessThan": "a8d907acc3e5a078c2e5637ff60c30c6d2ddc23a",
"status": "affected",
"version": "ac7345f68cda6989016d85d63f7b244c064aa8f6",
"versionType": "git"
},
{
"lessThan": "50c6a1f05973f56d23280c9d7645a7a5734e0907",
"status": "affected",
"version": "f6634af5de728a46792f674a66d7843570cb68f7",
"versionType": "git"
},
{
"lessThan": "da3b8fd6a202d94fef11a443abc9171c52426a1c",
"status": "affected",
"version": "1d9be95aee6c6246a21752e60c9519902649f482",
"versionType": "git"
},
{
"lessThan": "6153878c5255bb69b7d0868105ca078ef13cbcf8",
"status": "affected",
"version": "6473ed16df1fe88051140611b3eb9a49be7f429e",
"versionType": "git"
},
{
"lessThan": "21ca595aafa40d3ac70eab1f4cb62cc00ca21657",
"status": "affected",
"version": "59b622a043cffc58b7638cd85ae6c30a0904f8e6",
"versionType": "git"
},
{
"lessThan": "7a5f1cd22d47f8ca4b760b6334378ae42c1bd24b",
"status": "affected",
"version": "80bb50e2d459213cccff3111d5ef98ed4238c0d5",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/caiaq/device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.6.140",
"status": "affected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThan": "6.12.86",
"status": "affected",
"version": "6.12.84",
"versionType": "semver"
},
{
"lessThan": "6.18.27",
"status": "affected",
"version": "6.18.25",
"versionType": "semver"
},
{
"lessThan": "7.0.4",
"status": "affected",
"version": "7.0.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.6.136",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "6.12.84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.18.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "7.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix usb_dev refcount leak on probe failure\n\ncreate_card() takes a reference on the USB device with usb_get_dev()\nand stores the matching usb_put_dev() in card_free(), which is\ninstalled as the snd_card\u0027s -\u003eprivate_free destructor.\n\nHowever, -\u003eprivate_free is only assigned near the end of init_card(),\nafter several failure points (usb_set_interface(), EP type checks,\nusb_submit_urb(), the EP1_CMD_GET_DEVICE_INFO exchange, and its\ntimeout). When any of those fail, init_card() returns an error to\nsnd_probe(), which calls snd_card_free(card). Because -\u003eprivate_free\nis still NULL, card_free() never runs, the usb_get_dev() reference\nis not dropped, and the struct usb_device leaks along with its\ndescriptor allocations and device_private.\n\nsyzbot reproduces this with a malformed UAC3 device whose only valid\naltsetting is 0; init_card()\u0027s usb_set_interface(usb_dev, 0, 1) call\nfails with -EIO and triggers the leak.\n\nMove the -\u003eprivate_free assignment into create_card(), immediately\nafter usb_get_dev(), so that every error path reaching snd_card_free()\nbalances the reference. card_free()\u0027s callees (snd_usb_caiaq_input_free,\nfree_urbs, kfree) already tolerate the partially-initialized state\nbecause the chip private area is zero-initialized by snd_card_new()."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:50:34.000Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c874db8a1d2f9f08161470d00cfe8db2f5cca2cc"
},
{
"url": "https://git.kernel.org/stable/c/6fa8dff64fb6c401ced40a05797b327659317498"
},
{
"url": "https://git.kernel.org/stable/c/a8d907acc3e5a078c2e5637ff60c30c6d2ddc23a"
},
{
"url": "https://git.kernel.org/stable/c/50c6a1f05973f56d23280c9d7645a7a5734e0907"
},
{
"url": "https://git.kernel.org/stable/c/da3b8fd6a202d94fef11a443abc9171c52426a1c"
},
{
"url": "https://git.kernel.org/stable/c/6153878c5255bb69b7d0868105ca078ef13cbcf8"
},
{
"url": "https://git.kernel.org/stable/c/21ca595aafa40d3ac70eab1f4cb62cc00ca21657"
},
{
"url": "https://git.kernel.org/stable/c/7a5f1cd22d47f8ca4b760b6334378ae42c1bd24b"
}
],
"title": "ALSA: caiaq: fix usb_dev refcount leak on probe failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46048",
"datePublished": "2026-05-27T12:57:04.477Z",
"dateReserved": "2026-05-13T15:03:33.094Z",
"dateUpdated": "2026-06-14T17:50:34.000Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31551 (GCVE-0-2026-31551)
Vulnerability from cvelistv5
Published
2026-04-24 14:33
Modified
2026-05-11 22:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.
syzbot reported static_branch_dec() underflow in aql_enable_write(). [0]
The problem is that aql_enable_write() does not serialise concurrent
write()s to the debugfs.
aql_enable_write() checks static_key_false(&aql_disable.key) and
later calls static_branch_inc() or static_branch_dec(), but the
state may change between the two calls.
aql_disable does not need to track inc/dec.
Let's use static_branch_enable() and static_branch_disable().
[0]:
val == 0
WARNING: kernel/jump_label.c:311 at __static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311, CPU#0: syz.1.3155/20288
Modules linked in:
CPU: 0 UID: 0 PID: 20288 Comm: syz.1.3155 Tainted: G U L syzkaller #0 PREEMPT(full)
Tainted: [U]=USER, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:__static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311
Code: f2 c9 ff 5b 5d c3 cc cc cc cc e8 54 f2 c9 ff 48 89 df e8 ac f9 ff ff eb ad e8 45 f2 c9 ff 90 0f 0b 90 eb a2 e8 3a f2 c9 ff 90 <0f> 0b 90 eb 97 48 89 df e8 5c 4b 33 00 e9 36 ff ff ff 0f 1f 80 00
RSP: 0018:ffffc9000b9f7c10 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffffffff9b3e5d40 RCX: ffffffff823c57b4
RDX: ffff8880285a0000 RSI: ffffffff823c5846 RDI: ffff8880285a0000
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000a
R13: 1ffff9200173ef88 R14: 0000000000000001 R15: ffffc9000b9f7e98
FS: 00007f530dd726c0(0000) GS:ffff8881245e3000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000001140 CR3: 000000007cc4a000 CR4: 00000000003526f0
Call Trace:
<TASK>
__static_key_slow_dec_cpuslocked kernel/jump_label.c:297 [inline]
__static_key_slow_dec kernel/jump_label.c:321 [inline]
static_key_slow_dec+0x7c/0xc0 kernel/jump_label.c:336
aql_enable_write+0x2b2/0x310 net/mac80211/debugfs.c:343
short_proxy_write+0x133/0x1a0 fs/debugfs/file.c:383
vfs_write+0x2aa/0x1070 fs/read_write.c:684
ksys_pwrite64 fs/read_write.c:793 [inline]
__do_sys_pwrite64 fs/read_write.c:801 [inline]
__se_sys_pwrite64 fs/read_write.c:798 [inline]
__x64_sys_pwrite64+0x1eb/0x250 fs/read_write.c:798
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f530cf9aeb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f530dd72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012
RAX: ffffffffffffffda RBX: 00007f530d215fa0 RCX: 00007f530cf9aeb9
RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000010
RBP: 00007f530d008c1f R08: 0000000000000000 R09: 0000000000000000
R10: 4200000000000005 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f530d216038 R14: 00007f530d215fa0 R15: 00007ffde89fb978
</TASK>
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e908435e402aff23c9b0b3c59c7cd12b08b681b0 Version: e908435e402aff23c9b0b3c59c7cd12b08b681b0 Version: e908435e402aff23c9b0b3c59c7cd12b08b681b0 Version: e908435e402aff23c9b0b3c59c7cd12b08b681b0 Version: e908435e402aff23c9b0b3c59c7cd12b08b681b0 Version: e908435e402aff23c9b0b3c59c7cd12b08b681b0 Version: e908435e402aff23c9b0b3c59c7cd12b08b681b0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/debugfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "787152497ac763deab16f6f4b7ce79aaeb3eb7e8",
"status": "affected",
"version": "e908435e402aff23c9b0b3c59c7cd12b08b681b0",
"versionType": "git"
},
{
"lessThan": "8bb90ff77326c34e75b573b1febdd9586fec5aba",
"status": "affected",
"version": "e908435e402aff23c9b0b3c59c7cd12b08b681b0",
"versionType": "git"
},
{
"lessThan": "256f7d4c11235d0569f78413c41dc89d2dc1557c",
"status": "affected",
"version": "e908435e402aff23c9b0b3c59c7cd12b08b681b0",
"versionType": "git"
},
{
"lessThan": "29a1a350afcd28a2150bd73b8bd83eac3480f13e",
"status": "affected",
"version": "e908435e402aff23c9b0b3c59c7cd12b08b681b0",
"versionType": "git"
},
{
"lessThan": "5ba05436f15d16ae7ab04b880e8bf8d440be892b",
"status": "affected",
"version": "e908435e402aff23c9b0b3c59c7cd12b08b681b0",
"versionType": "git"
},
{
"lessThan": "b24763d32d5b4ada766deca4b42d6766272fef0c",
"status": "affected",
"version": "e908435e402aff23c9b0b3c59c7cd12b08b681b0",
"versionType": "git"
},
{
"lessThan": "b94ae8e0d5fe1bdbbfdc3854ff6ce98f6876a828",
"status": "affected",
"version": "e908435e402aff23c9b0b3c59c7cd12b08b681b0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/debugfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: Fix static_branch_dec() underflow for aql_disable.\n\nsyzbot reported static_branch_dec() underflow in aql_enable_write(). [0]\n\nThe problem is that aql_enable_write() does not serialise concurrent\nwrite()s to the debugfs.\n\naql_enable_write() checks static_key_false(\u0026aql_disable.key) and\nlater calls static_branch_inc() or static_branch_dec(), but the\nstate may change between the two calls.\n\naql_disable does not need to track inc/dec.\n\nLet\u0027s use static_branch_enable() and static_branch_disable().\n\n[0]:\nval == 0\nWARNING: kernel/jump_label.c:311 at __static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311, CPU#0: syz.1.3155/20288\nModules linked in:\nCPU: 0 UID: 0 PID: 20288 Comm: syz.1.3155 Tainted: G U L syzkaller #0 PREEMPT(full)\nTainted: [U]=USER, [L]=SOFTLOCKUP\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026\nRIP: 0010:__static_key_slow_dec_cpuslocked.part.0+0x107/0x120 kernel/jump_label.c:311\nCode: f2 c9 ff 5b 5d c3 cc cc cc cc e8 54 f2 c9 ff 48 89 df e8 ac f9 ff ff eb ad e8 45 f2 c9 ff 90 0f 0b 90 eb a2 e8 3a f2 c9 ff 90 \u003c0f\u003e 0b 90 eb 97 48 89 df e8 5c 4b 33 00 e9 36 ff ff ff 0f 1f 80 00\nRSP: 0018:ffffc9000b9f7c10 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffffff9b3e5d40 RCX: ffffffff823c57b4\nRDX: ffff8880285a0000 RSI: ffffffff823c5846 RDI: ffff8880285a0000\nRBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000a\nR13: 1ffff9200173ef88 R14: 0000000000000001 R15: ffffc9000b9f7e98\nFS: 00007f530dd726c0(0000) GS:ffff8881245e3000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000001140 CR3: 000000007cc4a000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n __static_key_slow_dec_cpuslocked kernel/jump_label.c:297 [inline]\n __static_key_slow_dec kernel/jump_label.c:321 [inline]\n static_key_slow_dec+0x7c/0xc0 kernel/jump_label.c:336\n aql_enable_write+0x2b2/0x310 net/mac80211/debugfs.c:343\n short_proxy_write+0x133/0x1a0 fs/debugfs/file.c:383\n vfs_write+0x2aa/0x1070 fs/read_write.c:684\n ksys_pwrite64 fs/read_write.c:793 [inline]\n __do_sys_pwrite64 fs/read_write.c:801 [inline]\n __se_sys_pwrite64 fs/read_write.c:798 [inline]\n __x64_sys_pwrite64+0x1eb/0x250 fs/read_write.c:798\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f530cf9aeb9\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f530dd72028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012\nRAX: ffffffffffffffda RBX: 00007f530d215fa0 RCX: 00007f530cf9aeb9\nRDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000010\nRBP: 00007f530d008c1f R08: 0000000000000000 R09: 0000000000000000\nR10: 4200000000000005 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f530d216038 R14: 00007f530d215fa0 R15: 00007ffde89fb978\n \u003c/TASK\u003e"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:10:57.880Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/787152497ac763deab16f6f4b7ce79aaeb3eb7e8"
},
{
"url": "https://git.kernel.org/stable/c/8bb90ff77326c34e75b573b1febdd9586fec5aba"
},
{
"url": "https://git.kernel.org/stable/c/256f7d4c11235d0569f78413c41dc89d2dc1557c"
},
{
"url": "https://git.kernel.org/stable/c/29a1a350afcd28a2150bd73b8bd83eac3480f13e"
},
{
"url": "https://git.kernel.org/stable/c/5ba05436f15d16ae7ab04b880e8bf8d440be892b"
},
{
"url": "https://git.kernel.org/stable/c/b24763d32d5b4ada766deca4b42d6766272fef0c"
},
{
"url": "https://git.kernel.org/stable/c/b94ae8e0d5fe1bdbbfdc3854ff6ce98f6876a828"
}
],
"title": "wifi: mac80211: Fix static_branch_dec() underflow for aql_disable.",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31551",
"datePublished": "2026-04-24T14:33:18.230Z",
"dateReserved": "2026-03-09T15:48:24.115Z",
"dateUpdated": "2026-05-11T22:10:57.880Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46162 (GCVE-0-2026-46162)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-06-14 17:59
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ice: fix double free in ice_sf_eth_activate() error path
When auxiliary_device_add() fails, ice_sf_eth_activate() jumps to
aux_dev_uninit and calls auxiliary_device_uninit(&sf_dev->adev).
The device release callback ice_sf_dev_release() frees sf_dev, but
the current error path falls through to sf_dev_free and calls
kfree(sf_dev) again, causing a double free.
Keep kfree(sf_dev) for the auxiliary_device_init() failure path, but
avoid falling through to sf_dev_free after auxiliary_device_uninit().
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_sf_eth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2ca30340b5028ddc3f17086a538feeff06167b1b",
"status": "affected",
"version": "13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6",
"versionType": "git"
},
{
"lessThan": "121d1f253aed515cd85748f68c664a6cb756e8ad",
"status": "affected",
"version": "13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6",
"versionType": "git"
},
{
"lessThan": "d0c6a4816609f145ffcc74e64baa214c571c17c6",
"status": "affected",
"version": "13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6",
"versionType": "git"
},
{
"lessThan": "9aab1c3d7299285e2569cbc0ed5892d631a241b2",
"status": "affected",
"version": "13acc5c4cdbeccf3274cbbd4de2e2d316b8c4ce6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_sf_eth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix double free in ice_sf_eth_activate() error path\n\nWhen auxiliary_device_add() fails, ice_sf_eth_activate() jumps to\naux_dev_uninit and calls auxiliary_device_uninit(\u0026sf_dev-\u003eadev).\n\nThe device release callback ice_sf_dev_release() frees sf_dev, but\nthe current error path falls through to sf_dev_free and calls\nkfree(sf_dev) again, causing a double free.\n\nKeep kfree(sf_dev) for the auxiliary_device_init() failure path, but\navoid falling through to sf_dev_free after auxiliary_device_uninit()."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:59:13.179Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2ca30340b5028ddc3f17086a538feeff06167b1b"
},
{
"url": "https://git.kernel.org/stable/c/121d1f253aed515cd85748f68c664a6cb756e8ad"
},
{
"url": "https://git.kernel.org/stable/c/d0c6a4816609f145ffcc74e64baa214c571c17c6"
},
{
"url": "https://git.kernel.org/stable/c/9aab1c3d7299285e2569cbc0ed5892d631a241b2"
}
],
"title": "ice: fix double free in ice_sf_eth_activate() error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46162",
"datePublished": "2026-05-28T09:36:17.479Z",
"dateReserved": "2026-05-13T15:03:33.102Z",
"dateUpdated": "2026-06-14T17:59:13.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46079 (GCVE-0-2026-46079)
Vulnerability from cvelistv5
Published
2026-05-27 12:58
Modified
2026-06-14 17:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
rbd: fix null-ptr-deref when device_add_disk() fails
do_rbd_add() publishes the device with device_add() before calling
device_add_disk(). If device_add_disk() fails after device_add()
succeeds, the error path calls rbd_free_disk() directly and then later
falls through to rbd_dev_device_release(), which calls rbd_free_disk()
again. This double teardown can leave blk-mq cleanup operating on
invalid state and trigger a null-ptr-deref in
__blk_mq_free_map_and_rqs(), reached from blk_mq_free_tag_set().
Fix this by following the normal remove ordering: call device_del()
before rbd_dev_device_release() when device_add_disk() fails after
device_add(). That keeps the teardown sequence consistent and avoids
re-entering disk cleanup through the wrong path.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available.
We reproduced the bug on v7.0 with a real Ceph backend and a QEMU x86_64
guest booted with KASAN and CONFIG_FAILSLAB enabled. The reproducer
confines failslab injections to the __add_disk() range and injects
fail-nth while mapping an RBD image through
/sys/bus/rbd/add_single_major.
On the unpatched kernel, fail-nth=4 reliably triggered the fault:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 UID: 0 PID: 273 Comm: bash Not tainted 7.0.0-01247-gd60bc1401583 #6 PREEMPT(lazy)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
RIP: 0010:__blk_mq_free_map_and_rqs+0x8c/0x240
Code: 00 00 48 8b 6b 60 41 89 f4 49 c1 e4 03 4c 01 e5 45 85 ed 0f 85 0a 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 e9 48 c1 e9 03 <80> 3c 01 00 0f 85 31 01 00 00 4c 8b 6d 00 4d 85 ed 0f 84 e2 00 00
RSP: 0018:ff1100000ab0fac8 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ff1100000c4806a0 RCX: 0000000000000000
RDX: 0000000000000002 RSI: 0000000000000000 RDI: ff1100000c4806f4
RBP: 0000000000000000 R08: 0000000000000001 R09: ffe21c000189001b
R10: ff1100000c4800df R11: ff1100006cf37be0 R12: 0000000000000000
R13: 0000000000000000 R14: ff1100000c480700 R15: ff1100000c480004
FS: 00007f0fbe8fe740(0000) GS:ff110000e5851000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe53473b2e0 CR3: 0000000012eef000 CR4: 00000000007516f0
PKRU: 55555554
Call Trace:
<TASK>
blk_mq_free_tag_set+0x77/0x460
do_rbd_add+0x1446/0x2b80
? __pfx_do_rbd_add+0x10/0x10
? lock_acquire+0x18c/0x300
? find_held_lock+0x2b/0x80
? sysfs_file_kobj+0xb6/0x1b0
? __pfx_sysfs_kf_write+0x10/0x10
kernfs_fop_write_iter+0x2f4/0x4a0
vfs_write+0x98e/0x1000
? expand_files+0x51f/0x850
? __pfx_vfs_write+0x10/0x10
ksys_write+0xf2/0x1d0
? __pfx_ksys_write+0x10/0x10
do_syscall_64+0x115/0x690
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0fbea15907
Code: 10 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
RSP: 002b:00007ffe22346ea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f0fbea15907
RDX: 0000000000000058 RSI: 0000563ace6c0ef0 RDI: 0000000000000001
RBP: 0000563ace6c0ef0 R08: 0000563ace6c0ef0 R09: 6b6435726d694141
R10: 5250337279762f78 R11: 0000000000000246 R12: 0000000000000058
R13: 00007f0fbeb1c780 R14: ff1100000c480700 R15: ff1100000c480004
</TASK>
With this fix applied, rerunning the reproducer over fail-nth=1..256
yields no KASAN reports.
[ idryomov: rename err_out_device_del -> err_out_device ]
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 27c97abc30e2b9ad2288977c0ecbef4d50553f57 Version: 27c97abc30e2b9ad2288977c0ecbef4d50553f57 Version: 27c97abc30e2b9ad2288977c0ecbef4d50553f57 Version: 27c97abc30e2b9ad2288977c0ecbef4d50553f57 Version: 27c97abc30e2b9ad2288977c0ecbef4d50553f57 Version: 27c97abc30e2b9ad2288977c0ecbef4d50553f57 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/block/rbd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "78bd0c143dea4b7a4c23c13356987ca0eafb442e",
"status": "affected",
"version": "27c97abc30e2b9ad2288977c0ecbef4d50553f57",
"versionType": "git"
},
{
"lessThan": "2f4809a879f0750c7790bbeeae86c9505797a06f",
"status": "affected",
"version": "27c97abc30e2b9ad2288977c0ecbef4d50553f57",
"versionType": "git"
},
{
"lessThan": "564cd8f4aeb9a938e470c5c91922fd02e4d41acc",
"status": "affected",
"version": "27c97abc30e2b9ad2288977c0ecbef4d50553f57",
"versionType": "git"
},
{
"lessThan": "ad0126ffcba8777109852979eaaa6dca6703abdb",
"status": "affected",
"version": "27c97abc30e2b9ad2288977c0ecbef4d50553f57",
"versionType": "git"
},
{
"lessThan": "059fb7656723c1b77c2fc0e64b7aa99d6bb65e8e",
"status": "affected",
"version": "27c97abc30e2b9ad2288977c0ecbef4d50553f57",
"versionType": "git"
},
{
"lessThan": "d1fef92e414433ca7b89abf85cb0df42b8d475eb",
"status": "affected",
"version": "27c97abc30e2b9ad2288977c0ecbef4d50553f57",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/block/rbd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrbd: fix null-ptr-deref when device_add_disk() fails\n\ndo_rbd_add() publishes the device with device_add() before calling\ndevice_add_disk(). If device_add_disk() fails after device_add()\nsucceeds, the error path calls rbd_free_disk() directly and then later\nfalls through to rbd_dev_device_release(), which calls rbd_free_disk()\nagain. This double teardown can leave blk-mq cleanup operating on\ninvalid state and trigger a null-ptr-deref in\n__blk_mq_free_map_and_rqs(), reached from blk_mq_free_tag_set().\n\nFix this by following the normal remove ordering: call device_del()\nbefore rbd_dev_device_release() when device_add_disk() fails after\ndevice_add(). That keeps the teardown sequence consistent and avoids\nre-entering disk cleanup through the wrong path.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable.\n\nWe reproduced the bug on v7.0 with a real Ceph backend and a QEMU x86_64\nguest booted with KASAN and CONFIG_FAILSLAB enabled. The reproducer\nconfines failslab injections to the __add_disk() range and injects\nfail-nth while mapping an RBD image through\n/sys/bus/rbd/add_single_major.\n\nOn the unpatched kernel, fail-nth=4 reliably triggered the fault:\n\n\tOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI\n\tKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n\tCPU: 0 UID: 0 PID: 273 Comm: bash Not tainted 7.0.0-01247-gd60bc1401583 #6 PREEMPT(lazy)\n\tHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014\n\tRIP: 0010:__blk_mq_free_map_and_rqs+0x8c/0x240\n\tCode: 00 00 48 8b 6b 60 41 89 f4 49 c1 e4 03 4c 01 e5 45 85 ed 0f 85 0a 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 e9 48 c1 e9 03 \u003c80\u003e 3c 01 00 0f 85 31 01 00 00 4c 8b 6d 00 4d 85 ed 0f 84 e2 00 00\n\tRSP: 0018:ff1100000ab0fac8 EFLAGS: 00000246\n\tRAX: dffffc0000000000 RBX: ff1100000c4806a0 RCX: 0000000000000000\n\tRDX: 0000000000000002 RSI: 0000000000000000 RDI: ff1100000c4806f4\n\tRBP: 0000000000000000 R08: 0000000000000001 R09: ffe21c000189001b\n\tR10: ff1100000c4800df R11: ff1100006cf37be0 R12: 0000000000000000\n\tR13: 0000000000000000 R14: ff1100000c480700 R15: ff1100000c480004\n\tFS: 00007f0fbe8fe740(0000) GS:ff110000e5851000(0000) knlGS:0000000000000000\n\tCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n\tCR2: 00007fe53473b2e0 CR3: 0000000012eef000 CR4: 00000000007516f0\n\tPKRU: 55555554\n\tCall Trace:\n\t \u003cTASK\u003e\n\t blk_mq_free_tag_set+0x77/0x460\n\t do_rbd_add+0x1446/0x2b80\n\t ? __pfx_do_rbd_add+0x10/0x10\n\t ? lock_acquire+0x18c/0x300\n\t ? find_held_lock+0x2b/0x80\n\t ? sysfs_file_kobj+0xb6/0x1b0\n\t ? __pfx_sysfs_kf_write+0x10/0x10\n\t kernfs_fop_write_iter+0x2f4/0x4a0\n\t vfs_write+0x98e/0x1000\n\t ? expand_files+0x51f/0x850\n\t ? __pfx_vfs_write+0x10/0x10\n\t ksys_write+0xf2/0x1d0\n\t ? __pfx_ksys_write+0x10/0x10\n\t do_syscall_64+0x115/0x690\n\t entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\tRIP: 0033:0x7f0fbea15907\n\tCode: 10 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24\n\tRSP: 002b:00007ffe22346ea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n\tRAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007f0fbea15907\n\tRDX: 0000000000000058 RSI: 0000563ace6c0ef0 RDI: 0000000000000001\n\tRBP: 0000563ace6c0ef0 R08: 0000563ace6c0ef0 R09: 6b6435726d694141\n\tR10: 5250337279762f78 R11: 0000000000000246 R12: 0000000000000058\n\tR13: 00007f0fbeb1c780 R14: ff1100000c480700 R15: ff1100000c480004\n\t \u003c/TASK\u003e\n\nWith this fix applied, rerunning the reproducer over fail-nth=1..256\nyields no KASAN reports.\n\n[ idryomov: rename err_out_device_del -\u003e err_out_device ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:52:46.214Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/78bd0c143dea4b7a4c23c13356987ca0eafb442e"
},
{
"url": "https://git.kernel.org/stable/c/2f4809a879f0750c7790bbeeae86c9505797a06f"
},
{
"url": "https://git.kernel.org/stable/c/564cd8f4aeb9a938e470c5c91922fd02e4d41acc"
},
{
"url": "https://git.kernel.org/stable/c/ad0126ffcba8777109852979eaaa6dca6703abdb"
},
{
"url": "https://git.kernel.org/stable/c/059fb7656723c1b77c2fc0e64b7aa99d6bb65e8e"
},
{
"url": "https://git.kernel.org/stable/c/d1fef92e414433ca7b89abf85cb0df42b8d475eb"
}
],
"title": "rbd: fix null-ptr-deref when device_add_disk() fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46079",
"datePublished": "2026-05-27T12:58:13.903Z",
"dateReserved": "2026-05-13T15:03:33.096Z",
"dateUpdated": "2026-06-14T17:52:46.214Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43175 (GCVE-0-2026-43175)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841
The 9FGV0841 has 8 outputs and registers 8 struct clk_hw, make sure
there are 8 slots for those newly registered clk_hw pointers, else
there is going to be out of bounds write when pointers 4..7 are set
into struct rs9_driver_data .clk_dif[4..7] field.
Since there are other structure members past this struct clk_hw
pointer array, writing to .clk_dif[4..7] fields corrupts both
the struct rs9_driver_data content and data around it, sometimes
without crashing the kernel. However, the kernel does surely
crash when the driver is unbound or during suspend.
Fix this, increase the struct clk_hw pointer array size to the
maximum output count of 9FGV0841, which is the biggest chip that
is supported by this driver.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/clk/clk-renesas-pcie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2f926875dffe2226ea26d129e16d9092cccd03aa",
"status": "affected",
"version": "f0e5e1800204b82af6d3e8ef03012ab4afc22358",
"versionType": "git"
},
{
"lessThan": "da86ca15d7389ee0b5df08e8f70c39354e6b8a4b",
"status": "affected",
"version": "f0e5e1800204b82af6d3e8ef03012ab4afc22358",
"versionType": "git"
},
{
"lessThan": "82a34f344999d8029bcebf131028fa519140c7cc",
"status": "affected",
"version": "f0e5e1800204b82af6d3e8ef03012ab4afc22358",
"versionType": "git"
},
{
"lessThan": "5ec820fc28d0b8a0f3890d476b1976f20e8343cc",
"status": "affected",
"version": "f0e5e1800204b82af6d3e8ef03012ab4afc22358",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/clk/clk-renesas-pcie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841\n\nThe 9FGV0841 has 8 outputs and registers 8 struct clk_hw, make sure\nthere are 8 slots for those newly registered clk_hw pointers, else\nthere is going to be out of bounds write when pointers 4..7 are set\ninto struct rs9_driver_data .clk_dif[4..7] field.\n\nSince there are other structure members past this struct clk_hw\npointer array, writing to .clk_dif[4..7] fields corrupts both\nthe struct rs9_driver_data content and data around it, sometimes\nwithout crashing the kernel. However, the kernel does surely\ncrash when the driver is unbound or during suspend.\n\nFix this, increase the struct clk_hw pointer array size to the\nmaximum output count of 9FGV0841, which is the biggest chip that\nis supported by this driver."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:19:14.361Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2f926875dffe2226ea26d129e16d9092cccd03aa"
},
{
"url": "https://git.kernel.org/stable/c/da86ca15d7389ee0b5df08e8f70c39354e6b8a4b"
},
{
"url": "https://git.kernel.org/stable/c/82a34f344999d8029bcebf131028fa519140c7cc"
},
{
"url": "https://git.kernel.org/stable/c/5ec820fc28d0b8a0f3890d476b1976f20e8343cc"
}
],
"title": "clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43175",
"datePublished": "2026-05-06T11:27:49.496Z",
"dateReserved": "2026-05-01T14:12:55.991Z",
"dateUpdated": "2026-05-11T22:19:14.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39894 (GCVE-0-2025-39894)
Vulnerability from cvelistv5
Published
2025-10-01 07:42
Modified
2026-08-05 12:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm
When send a broadcast packet to a tap device, which was added to a bridge,
br_nf_local_in() is called to confirm the conntrack. If another conntrack
with the same hash value is added to the hash table, which can be
triggered by a normal packet to a non-bridge device, the below warning
may happen.
------------[ cut here ]------------
WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200
CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary)
RIP: 0010:br_nf_local_in+0x168/0x200
Call Trace:
<TASK>
nf_hook_slow+0x3e/0xf0
br_pass_frame_up+0x103/0x180
br_handle_frame_finish+0x2de/0x5b0
br_nf_hook_thresh+0xc0/0x120
br_nf_pre_routing_finish+0x168/0x3a0
br_nf_pre_routing+0x237/0x5e0
br_handle_frame+0x1ec/0x3c0
__netif_receive_skb_core+0x225/0x1210
__netif_receive_skb_one_core+0x37/0xa0
netif_receive_skb+0x36/0x160
tun_get_user+0xa54/0x10c0
tun_chr_write_iter+0x65/0xb0
vfs_write+0x305/0x410
ksys_write+0x60/0xd0
do_syscall_64+0xa4/0x260
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
---[ end trace 0000000000000000 ]---
To solve the hash conflict, nf_ct_resolve_clash() try to merge the
conntracks, and update skb->_nfct. However, br_nf_local_in() still use the
old ct from local variable 'nfct' after confirm(), which leads to this
warning.
If confirm() does not insert the conntrack entry and return NF_DROP, the
warning may also occur. There is no need to reserve the WARN_ON_ONCE, just
remove it.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7c3f28599652acf431a2211168de4a583f30b6d5 Version: 2b1414d5e94e477edff1d2c79030f1d742625ea0 Version: 80cd0487f630b5382734997c3e5e3003a77db315 Version: 62e7151ae3eb465e0ab52a20c941ff33bb6332e9 Version: 62e7151ae3eb465e0ab52a20c941ff33bb6332e9 Version: 62e7151ae3eb465e0ab52a20c941ff33bb6332e9 Version: cb734975b0ffa688ff6cc0eed463865bf07b6c01 Version: 5.15.151 ≤ Version: 6.1.81 ≤ Version: 6.6.21 ≤ Version: 6.7.9 ≤ |
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-11-03T17:44:28.733Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/br_netfilter_hooks.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d00c8b0daf56012f69075e3377da67878c775e4c",
"status": "affected",
"version": "7c3f28599652acf431a2211168de4a583f30b6d5",
"versionType": "git"
},
{
"lessThan": "ccbad4803225eafe0175d3cb19f0d8d73b504a94",
"status": "affected",
"version": "2b1414d5e94e477edff1d2c79030f1d742625ea0",
"versionType": "git"
},
{
"lessThan": "50db11e2bbb635e38e3dd096215580d6adb41fb0",
"status": "affected",
"version": "80cd0487f630b5382734997c3e5e3003a77db315",
"versionType": "git"
},
{
"lessThan": "c47ca77fee9071aa543bae592dd2a384f895c8b6",
"status": "affected",
"version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9",
"versionType": "git"
},
{
"lessThan": "a74abcf0f09f59daeecf7a3ba9c1d690808b0afe",
"status": "affected",
"version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9",
"versionType": "git"
},
{
"lessThan": "479a54ab92087318514c82428a87af2d7af1a576",
"status": "affected",
"version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9",
"versionType": "git"
},
{
"status": "affected",
"version": "cb734975b0ffa688ff6cc0eed463865bf07b6c01",
"versionType": "git"
},
{
"lessThan": "5.15.192",
"status": "affected",
"version": "5.15.151",
"versionType": "semver"
},
{
"lessThan": "6.1.151",
"status": "affected",
"version": "6.1.81",
"versionType": "semver"
},
{
"lessThan": "6.6.105",
"status": "affected",
"version": "6.6.21",
"versionType": "semver"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/br_netfilter_hooks.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.192",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.151",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.105",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.192",
"versionStartIncluding": "5.15.151",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.151",
"versionStartIncluding": "6.1.81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.105",
"versionStartIncluding": "6.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.46",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.6",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm\n\nWhen send a broadcast packet to a tap device, which was added to a bridge,\nbr_nf_local_in() is called to confirm the conntrack. If another conntrack\nwith the same hash value is added to the hash table, which can be\ntriggered by a normal packet to a non-bridge device, the below warning\nmay happen.\n\n ------------[ cut here ]------------\n WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200\n CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary)\n RIP: 0010:br_nf_local_in+0x168/0x200\n Call Trace:\n \u003cTASK\u003e\n nf_hook_slow+0x3e/0xf0\n br_pass_frame_up+0x103/0x180\n br_handle_frame_finish+0x2de/0x5b0\n br_nf_hook_thresh+0xc0/0x120\n br_nf_pre_routing_finish+0x168/0x3a0\n br_nf_pre_routing+0x237/0x5e0\n br_handle_frame+0x1ec/0x3c0\n __netif_receive_skb_core+0x225/0x1210\n __netif_receive_skb_one_core+0x37/0xa0\n netif_receive_skb+0x36/0x160\n tun_get_user+0xa54/0x10c0\n tun_chr_write_iter+0x65/0xb0\n vfs_write+0x305/0x410\n ksys_write+0x60/0xd0\n do_syscall_64+0xa4/0x260\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n \u003c/TASK\u003e\n ---[ end trace 0000000000000000 ]---\n\nTo solve the hash conflict, nf_ct_resolve_clash() try to merge the\nconntracks, and update skb-\u003e_nfct. However, br_nf_local_in() still use the\nold ct from local variable \u0027nfct\u0027 after confirm(), which leads to this\nwarning.\n\nIf confirm() does not insert the conntrack entry and return NF_DROP, the\nwarning may also occur. There is no need to reserve the WARN_ON_ONCE, just\nremove it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The trigger is a broadcast/multicast IP frame arriving on a bridge port and being locally delivered via br_pass_frame_up() \u2192 NF_BR_LOCAL_IN, requiring no host access at all; on the very common overlay deployments (VXLAN/GRE port enslaved to a Linux bridge in Docker overlay, k8s CNI, OpenStack) those inner broadcast frames originate from a routed, remote VTEP, making the vulnerable code reachable across layer 3.\nAC:L - The attacker drives both sides of the clash by flooding duplicate same-tuple broadcast datagrams, which the bridge itself fans out concurrently (flood to N ports plus local receive, plus a copy to a non-bridge device as noted in the commit), so two unconfirmed conntracks with an identical tuple reach __nf_conntrack_confirm() in parallel. The required br_netfilter+conntrack+bridge configuration is the default on container and virtualization hosts, not a rare option.\nPR:N - No credentials or capabilities on the target are needed \u2014 the attacker only has to get an IP broadcast/multicast frame onto a segment bridged by the victim, which is unauthenticated packet delivery.\nUI:N - No victim action is required; the bridge processes the received frames automatically in softirq context.\nS:U - The stale conntrack read and the WARNING both occur in the host kernel\u0027s own netfilter/bridge context, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:N - The stale read is a single unsigned long from a SLAB_TYPESAFE_BY_RCU nf_conn object and its value is consumed only by the WARN condition \u2014 it is never returned to the attacker, and the remote attacker has no channel to read the resulting dmesg splat.\nI:N - No write occurs on the stale pointer; confirm() has already repointed skb-\u003e_nfct at the surviving conntrack with a valid reference, so no kernel memory is modified and no control flow is influenced.\nA:H - The bug fires a kernel WARNING from a remotely reachable softirq path, which taints the kernel and causes an immediate panic on the many hardened, Android, ChromeOS, and cloud/CI deployments that run with panic_on_warn=1, yielding a full denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:05:56.359Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d00c8b0daf56012f69075e3377da67878c775e4c"
},
{
"url": "https://git.kernel.org/stable/c/ccbad4803225eafe0175d3cb19f0d8d73b504a94"
},
{
"url": "https://git.kernel.org/stable/c/50db11e2bbb635e38e3dd096215580d6adb41fb0"
},
{
"url": "https://git.kernel.org/stable/c/c47ca77fee9071aa543bae592dd2a384f895c8b6"
},
{
"url": "https://git.kernel.org/stable/c/a74abcf0f09f59daeecf7a3ba9c1d690808b0afe"
},
{
"url": "https://git.kernel.org/stable/c/479a54ab92087318514c82428a87af2d7af1a576"
}
],
"title": "netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39894",
"datePublished": "2025-10-01T07:42:43.126Z",
"dateReserved": "2025-04-16T07:20:57.145Z",
"dateUpdated": "2026-08-05T12:05:56.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53272 (GCVE-0-2026-53272)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix use-after-free on sbi->sync_decompress
z_erofs_decompress_kickoff() can race with filesystem unmount, causing
a use-after-free on sbi->sync_decompress.
When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff()
to queue z_erofs_decompressqueue_work() asynchronously. Then, after all
folios are unlocked, unmount workflow can proceed and sbi will be freed
before accessing to sbi->sync_decompress.
Thread (unmount) I/O completion kworker
queue_work
z_erofs_decompressqueue_work
(all folios are unlocked)
cleanup_mnt
..
erofs_kill_sb
erofs_sb_free
kfree(sbi)
access sbi->sync_decompress // UAF!!
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/erofs/zdata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "86ab00cf81d44b675bb23db62b88fd76c8ac8cea",
"status": "affected",
"version": "40452ffca3c1a0f2994e826f9fa213b107f1a2d4",
"versionType": "git"
},
{
"lessThan": "00bf6868df65fa95b3854996246d15759fdc7070",
"status": "affected",
"version": "40452ffca3c1a0f2994e826f9fa213b107f1a2d4",
"versionType": "git"
},
{
"lessThan": "95caf60da33d87ed26c28993620f0d92487b0296",
"status": "affected",
"version": "40452ffca3c1a0f2994e826f9fa213b107f1a2d4",
"versionType": "git"
},
{
"lessThan": "1aee05e814d292064bf5fa15733741040cdc48ba",
"status": "affected",
"version": "40452ffca3c1a0f2994e826f9fa213b107f1a2d4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/erofs/zdata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix use-after-free on sbi-\u003esync_decompress\n\nz_erofs_decompress_kickoff() can race with filesystem unmount, causing\na use-after-free on sbi-\u003esync_decompress.\n\nWhen I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff()\nto queue z_erofs_decompressqueue_work() asynchronously. Then, after all\nfolios are unlocked, unmount workflow can proceed and sbi will be freed\nbefore accessing to sbi-\u003esync_decompress.\n\nThread (unmount) I/O completion kworker\n queue_work\n z_erofs_decompressqueue_work\n (all folios are unlocked)\ncleanup_mnt\n ..\n erofs_kill_sb\n erofs_sb_free\n kfree(sbi)\n access sbi-\u003esync_decompress // UAF!!"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:57.147Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/86ab00cf81d44b675bb23db62b88fd76c8ac8cea"
},
{
"url": "https://git.kernel.org/stable/c/00bf6868df65fa95b3854996246d15759fdc7070"
},
{
"url": "https://git.kernel.org/stable/c/95caf60da33d87ed26c28993620f0d92487b0296"
},
{
"url": "https://git.kernel.org/stable/c/1aee05e814d292064bf5fa15733741040cdc48ba"
}
],
"title": "erofs: fix use-after-free on sbi-\u003esync_decompress",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53272",
"datePublished": "2026-06-25T08:39:57.147Z",
"dateReserved": "2026-06-09T07:44:35.395Z",
"dateUpdated": "2026-06-25T08:39:57.147Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71274 (GCVE-0-2025-71274)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-08-05 12:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
rpmsg: core: fix race in driver_override_show() and use core helper
The driver_override_show function reads the driver_override string
without holding the device_lock. However, the store function modifies
and frees the string while holding the device_lock. This creates a race
condition where the string can be freed by the store function while
being read by the show function, leading to a use-after-free.
To fix this, replace the rpmsg_string_attr macro with explicit show and
store functions. The new driver_override_store uses the standard
driver_set_override helper. Since the introduction of
driver_set_override, the comments in include/linux/rpmsg.h have stated
that this helper must be used to set or clear driver_override, but the
implementation was not updated until now.
Because driver_set_override modifies and frees the string while holding
the device_lock, the new driver_override_show now correctly holds the
device_lock during the read operation to prevent the race.
Additionally, since rpmsg_string_attr has only ever been used for
driver_override, removing the macro simplifies the code.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 39e47767ec9b22f844c2a07c9d329256960d4021 Version: 39e47767ec9b22f844c2a07c9d329256960d4021 Version: 39e47767ec9b22f844c2a07c9d329256960d4021 Version: 39e47767ec9b22f844c2a07c9d329256960d4021 Version: 39e47767ec9b22f844c2a07c9d329256960d4021 Version: 39e47767ec9b22f844c2a07c9d329256960d4021 Version: 39e47767ec9b22f844c2a07c9d329256960d4021 Version: 39e47767ec9b22f844c2a07c9d329256960d4021 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/rpmsg/rpmsg_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "392c6b68334aa0e0ae9aba95c0a366bcb0d92f5d",
"status": "affected",
"version": "39e47767ec9b22f844c2a07c9d329256960d4021",
"versionType": "git"
},
{
"lessThan": "d66b8074c555e8abb0ae19eea1c9f3635498bdde",
"status": "affected",
"version": "39e47767ec9b22f844c2a07c9d329256960d4021",
"versionType": "git"
},
{
"lessThan": "47615557447185917afa432b7958f87583c417cb",
"status": "affected",
"version": "39e47767ec9b22f844c2a07c9d329256960d4021",
"versionType": "git"
},
{
"lessThan": "90c8353f471821d7ccd4fe573a2402e056192494",
"status": "affected",
"version": "39e47767ec9b22f844c2a07c9d329256960d4021",
"versionType": "git"
},
{
"lessThan": "7654e6e3cd6bdee9602f6063b3c670bd556d7e61",
"status": "affected",
"version": "39e47767ec9b22f844c2a07c9d329256960d4021",
"versionType": "git"
},
{
"lessThan": "2e4a70f3c30910427e5ea848b799066d67b963d5",
"status": "affected",
"version": "39e47767ec9b22f844c2a07c9d329256960d4021",
"versionType": "git"
},
{
"lessThan": "954557957177c3c13d7c655976665b1170da5e50",
"status": "affected",
"version": "39e47767ec9b22f844c2a07c9d329256960d4021",
"versionType": "git"
},
{
"lessThan": "42023d4b6d2661a40ee2dcf7e1a3528a35c638ca",
"status": "affected",
"version": "39e47767ec9b22f844c2a07c9d329256960d4021",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/rpmsg/rpmsg_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrpmsg: core: fix race in driver_override_show() and use core helper\n\nThe driver_override_show function reads the driver_override string\nwithout holding the device_lock. However, the store function modifies\nand frees the string while holding the device_lock. This creates a race\ncondition where the string can be freed by the store function while\nbeing read by the show function, leading to a use-after-free.\n\nTo fix this, replace the rpmsg_string_attr macro with explicit show and\nstore functions. The new driver_override_store uses the standard\ndriver_set_override helper. Since the introduction of\ndriver_set_override, the comments in include/linux/rpmsg.h have stated\nthat this helper must be used to set or clear driver_override, but the\nimplementation was not updated until now.\n\nBecause driver_set_override modifies and frees the string while holding\nthe device_lock, the new driver_override_show now correctly holds the\ndevice_lock during the read operation to prevent the race.\n\nAdditionally, since rpmsg_string_attr has only ever been used for\ndriver_override, removing the macro simplifies the code."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Triggering uses concurrent read and write operations on the local rpmsg driver_override sysfs attribute; remote rpmsg traffic does not directly reach the vulnerable show function.\nAC:L - Separate sysfs opens have only per-open locking, allowing concurrent loops to force the load-versus-free window repeatedly. Stress testing reproduced the race, and a principal controlling both operations needs no external condition.\nPR:L - The attribute is world-readable at mode 0644, and the original report demonstrated pointer leakage to unprivileged readers. Although direct writes are root-owned, delegated rpmsg management is reasonable in embedded deployments, making low privileges the higher defensible value.\nUI:N - Once an rpmsg device exists, attacker-driven concurrent sysfs operations require no action from another user.\nS:U - The vulnerable callbacks and affected memory are within the same host kernel security authority; no VM, IOMMU, or other scope boundary is crossed.\nC:H - The freed string is consumed as an unbounded string and returned through sysfs, with stress testing leaking pointer-like kernel bytes. Heap reuse can expose additional kernel memory, making high confidentiality impact appropriate for this UAF.\nI:H - The stale string is formatted with unbounded sprintf into a PAGE_SIZE buffer; unterminated reclaimed data, or a maximum-sized override, can overrun that buffer. This kernel out-of-bounds write can corrupt adjacent memory and potentially enable control-flow hijacking.\nA:H - The UAF was reproduced under KASAN, and invalid stale-memory access or resulting buffer corruption can cause a kernel oops or panic repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:12:39.142Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/392c6b68334aa0e0ae9aba95c0a366bcb0d92f5d"
},
{
"url": "https://git.kernel.org/stable/c/d66b8074c555e8abb0ae19eea1c9f3635498bdde"
},
{
"url": "https://git.kernel.org/stable/c/47615557447185917afa432b7958f87583c417cb"
},
{
"url": "https://git.kernel.org/stable/c/90c8353f471821d7ccd4fe573a2402e056192494"
},
{
"url": "https://git.kernel.org/stable/c/7654e6e3cd6bdee9602f6063b3c670bd556d7e61"
},
{
"url": "https://git.kernel.org/stable/c/2e4a70f3c30910427e5ea848b799066d67b963d5"
},
{
"url": "https://git.kernel.org/stable/c/954557957177c3c13d7c655976665b1170da5e50"
},
{
"url": "https://git.kernel.org/stable/c/42023d4b6d2661a40ee2dcf7e1a3528a35c638ca"
}
],
"title": "rpmsg: core: fix race in driver_override_show() and use core helper",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-71274",
"datePublished": "2026-05-06T11:27:07.525Z",
"dateReserved": "2026-03-17T09:08:18.458Z",
"dateUpdated": "2026-08-05T12:12:39.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43158 (GCVE-0-2026-43158)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix freemap adjustments when adding xattrs to leaf blocks
xfs/592 and xfs/794 both trip this assertion in the leaf block freemap
adjustment code after ~20 minutes of running on my test VMs:
ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t)
+ xfs_attr3_leaf_hdr_size(leaf));
Upon enabling quite a lot more debugging code, I narrowed this down to
fsstress trying to set a local extended attribute with namelen=3 and
valuelen=71. This results in an entry size of 80 bytes.
At the start of xfs_attr3_leaf_add_work, the freemap looks like this:
i 0 base 448 size 0 rhs 448 count 46
i 1 base 388 size 132 rhs 448 count 46
i 2 base 2120 size 4 rhs 448 count 46
firstused = 520
where "rhs" is the first byte past the end of the leaf entry array.
This is inconsistent -- the entries array ends at byte 448, but
freemap[1] says there's free space starting at byte 388!
By the end of the function, the freemap is in worse shape:
i 0 base 456 size 0 rhs 456 count 47
i 1 base 388 size 52 rhs 456 count 47
i 2 base 2120 size 4 rhs 456 count 47
firstused = 440
Important note: 388 is not aligned with the entries array element size
of 8 bytes.
Based on the incorrect freemap, the name area starts at byte 440, which
is below the end of the entries array! That's why the assertion
triggers and the filesystem shuts down.
How did we end up here? First, recall from the previous patch that the
freemap array in an xattr leaf block is not intended to be a
comprehensive map of all free space in the leaf block. In other words,
it's perfectly legal to have a leaf block with:
* 376 bytes in use by the entries array
* freemap[0] has [base = 376, size = 8]
* freemap[1] has [base = 388, size = 1500]
* the space between 376 and 388 is free, but the freemap stopped
tracking that some time ago
If we add one xattr, the entries array grows to 384 bytes, and
freemap[0] becomes [base = 384, size = 0]. So far, so good. But if we
add a second xattr, the entries array grows to 392 bytes, and freemap[0]
gets pushed up to [base = 392, size = 0]. This is bad, because
freemap[1] hasn't been updated, and now the entries array and the free
space claim the same space.
The fix here is to adjust all freemap entries so that none of them
collide with the entries array. Note that this fix relies on commit
2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow") and
the previous patch that resets zero length freemap entries to have
base = 0.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_attr_leaf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d08976725355b9d54d8332fce223fa281cc304a5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6a8737afbccc340e718e0b22577312826390be8b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a396b3d73d51355e50acdb403ba9c4cae4c1174e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "38613c01f69e1e77e6b8acab1e8ac665d01c2f15",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ef42a8766ff3fdf51cf72fb36d0859c09d134478",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "43f3b18679615a93bd848afde3602ba160637a46",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "24ce71852f2cee6581e2cbebc15489ed52bf63b7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3eefc0c2b78444b64feeb3783c017d6adc3cd3ce",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_attr_leaf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix freemap adjustments when adding xattrs to leaf blocks\n\nxfs/592 and xfs/794 both trip this assertion in the leaf block freemap\nadjustment code after ~20 minutes of running on my test VMs:\n\n ASSERT(ichdr-\u003efirstused \u003e= ichdr-\u003ecount * sizeof(xfs_attr_leaf_entry_t)\n\t\t\t\t\t+ xfs_attr3_leaf_hdr_size(leaf));\n\nUpon enabling quite a lot more debugging code, I narrowed this down to\nfsstress trying to set a local extended attribute with namelen=3 and\nvaluelen=71. This results in an entry size of 80 bytes.\n\nAt the start of xfs_attr3_leaf_add_work, the freemap looks like this:\n\ni 0 base 448 size 0 rhs 448 count 46\ni 1 base 388 size 132 rhs 448 count 46\ni 2 base 2120 size 4 rhs 448 count 46\nfirstused = 520\n\nwhere \"rhs\" is the first byte past the end of the leaf entry array.\nThis is inconsistent -- the entries array ends at byte 448, but\nfreemap[1] says there\u0027s free space starting at byte 388!\n\nBy the end of the function, the freemap is in worse shape:\n\ni 0 base 456 size 0 rhs 456 count 47\ni 1 base 388 size 52 rhs 456 count 47\ni 2 base 2120 size 4 rhs 456 count 47\nfirstused = 440\n\nImportant note: 388 is not aligned with the entries array element size\nof 8 bytes.\n\nBased on the incorrect freemap, the name area starts at byte 440, which\nis below the end of the entries array! That\u0027s why the assertion\ntriggers and the filesystem shuts down.\n\nHow did we end up here? First, recall from the previous patch that the\nfreemap array in an xattr leaf block is not intended to be a\ncomprehensive map of all free space in the leaf block. In other words,\nit\u0027s perfectly legal to have a leaf block with:\n\n * 376 bytes in use by the entries array\n * freemap[0] has [base = 376, size = 8]\n * freemap[1] has [base = 388, size = 1500]\n * the space between 376 and 388 is free, but the freemap stopped\n tracking that some time ago\n\nIf we add one xattr, the entries array grows to 384 bytes, and\nfreemap[0] becomes [base = 384, size = 0]. So far, so good. But if we\nadd a second xattr, the entries array grows to 392 bytes, and freemap[0]\ngets pushed up to [base = 392, size = 0]. This is bad, because\nfreemap[1] hasn\u0027t been updated, and now the entries array and the free\nspace claim the same space.\n\nThe fix here is to adjust all freemap entries so that none of them\ncollide with the entries array. Note that this fix relies on commit\n2a2b5932db6758 (\"xfs: fix attr leaf header freemap.size underflow\") and\nthe previous patch that resets zero length freemap entries to have\nbase = 0."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable XFS xattr add path is reachable locally via setxattr/fsetxattr, and also remotely on XFS-backed network file servers through in-kernel nfsd NFSv4 SETXATTR and ksmbd xattr/ACL operations that call into vfs_setxattr. Scoring the most severe reasonable deployment, a network file server exposes this over the network.\nAC:L - The attacker controls the xattr names, values, and operation sequence needed to shape the leaf freemap state; this is not a race and does not depend on conditions outside attacker control. The fsstress reproducer indicates the bug can be triggered by ordinary repeated xattr operations.\nPR:L - The attacker needs write permission to a file or directory on the affected XFS filesystem/export, but no administrative capability is required for user.* xattrs. This is basic user/share access rather than real root or CAP_SYS_ADMIN.\nUI:N - No victim action is required once the attacker has access to a writable XFS file or exported share. The attacker can invoke the xattr operation directly.\nS:U - The vulnerability corrupts XFS/kernel filesystem metadata within the same kernel security authority. It does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The bug causes attacker-controlled corruption of xattr leaf entries in a kernel metadata buffer, and those entries drive later xattr parsing offsets and namespace interpretation. Under the required uncertainty rule, this memory/metadata corruption is treated as potentially leveragable for high confidentiality impact.\nI:H - The faulty freemap lets xattr name/value data be allocated on top of the leaf entry array, corrupting XFS metadata and potentially access-control/security xattr state. This is attacker-controlled metadata corruption with documented data-loss potential, so integrity impact is High.\nA:H - The known failure mode trips XFS corruption assertions/verifiers and shuts down the filesystem. A remote or local write-capable attacker can repeat the operation to cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:14.627Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d08976725355b9d54d8332fce223fa281cc304a5"
},
{
"url": "https://git.kernel.org/stable/c/6a8737afbccc340e718e0b22577312826390be8b"
},
{
"url": "https://git.kernel.org/stable/c/a396b3d73d51355e50acdb403ba9c4cae4c1174e"
},
{
"url": "https://git.kernel.org/stable/c/38613c01f69e1e77e6b8acab1e8ac665d01c2f15"
},
{
"url": "https://git.kernel.org/stable/c/ef42a8766ff3fdf51cf72fb36d0859c09d134478"
},
{
"url": "https://git.kernel.org/stable/c/43f3b18679615a93bd848afde3602ba160637a46"
},
{
"url": "https://git.kernel.org/stable/c/24ce71852f2cee6581e2cbebc15489ed52bf63b7"
},
{
"url": "https://git.kernel.org/stable/c/3eefc0c2b78444b64feeb3783c017d6adc3cd3ce"
}
],
"title": "xfs: fix freemap adjustments when adding xattrs to leaf blocks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43158",
"datePublished": "2026-05-06T11:27:37.848Z",
"dateReserved": "2026-05-01T14:12:55.990Z",
"dateUpdated": "2026-08-05T12:26:14.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43215 (GCVE-0-2026-43215)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
cifs: Fix locking usage for tcon fields
We used to use the cifs_tcp_ses_lock to protect a lot of objects
that are not just the server, ses or tcon lists. We later introduced
srv_lock, ses_lock and tc_lock to protect fields within the
corresponding structs. This was done to provide a more granular
protection and avoid unnecessary serialization.
There were still a couple of uses of cifs_tcp_ses_lock to provide
tcon fields. In this patch, I've replaced them with tc_lock.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cached_dir.c",
"fs/smb/client/smb2misc.c",
"fs/smb/client/smb2ops.c",
"fs/smb/client/smb2pdu.c",
"fs/smb/client/trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "953953abb66e52c224057ab91e404284fefeab62",
"status": "affected",
"version": "d7d7a66aacd6fd8ca57baf08a7bac5421282f6f8",
"versionType": "git"
},
{
"lessThan": "601dd3b79769b38d30b693c40afdb2a4b7edf9d0",
"status": "affected",
"version": "d7d7a66aacd6fd8ca57baf08a7bac5421282f6f8",
"versionType": "git"
},
{
"lessThan": "3969db6b22e3d90d8c5f22ac1a7fe0350a94c136",
"status": "affected",
"version": "d7d7a66aacd6fd8ca57baf08a7bac5421282f6f8",
"versionType": "git"
},
{
"lessThan": "8c59eeeeffa1524ef57e173a89a1a3ff539888d5",
"status": "affected",
"version": "d7d7a66aacd6fd8ca57baf08a7bac5421282f6f8",
"versionType": "git"
},
{
"lessThan": "96c4af418586ee9a6aab61738644366426e05316",
"status": "affected",
"version": "d7d7a66aacd6fd8ca57baf08a7bac5421282f6f8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cached_dir.c",
"fs/smb/client/smb2misc.c",
"fs/smb/client/smb2ops.c",
"fs/smb/client/smb2pdu.c",
"fs/smb/client/trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Fix locking usage for tcon fields\n\nWe used to use the cifs_tcp_ses_lock to protect a lot of objects\nthat are not just the server, ses or tcon lists. We later introduced\nsrv_lock, ses_lock and tc_lock to protect fields within the\ncorresponding structs. This was done to provide a more granular\nprotection and avoid unnecessary serialization.\n\nThere were still a couple of uses of cifs_tcp_ses_lock to provide\ntcon fields. In this patch, I\u0027ve replaced them with tc_lock."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable CIFS/SMB client code is exercised through SMB protocol activity with a remote server, including DFS referral handling, reconnects, cancelled closes, and cached directory lease cleanup. A malicious or compromised SMB server can influence these network-driven paths after a client connects.\nAC:L - The issue is a locking/refcount race, but the remote SMB peer can repeatedly trigger reconnects, delayed/cancelled responses, DFS behavior, and lease/cached-directory activity to exercise the affected paths. There is no rare configuration or uncontrollable one-shot condition required beyond a CIFS mount being in use.\nPR:N - The attacker does not need privileges on the vulnerable client system; they can act as the SMB server or network peer providing crafted behavior to the CIFS client. Although mounting CIFS locally is privileged, that is victim-side setup/user interaction rather than attacker privileges on the impacted host.\nUI:R - Exploitation requires the client system to mount or otherwise use an SMB/CIFS share, which is a victim/user or administrator action. Once connected, the malicious server can drive the vulnerable network paths.\nS:U - The impact is within the same Linux kernel security authority running the CIFS client. This is standard kernel memory corruption/panic potential, not a VM escape or cross-authority boundary bypass.\nC:H - The inconsistent locking can corrupt the tcon reference count and allow use-after-free of `struct cifs_tcon`. Kernel UAF conditions are reasonably capable of being shaped into memory disclosure primitives.\nI:H - The same premature free and later dereference/use of the tcon object creates kernel heap use-after-free memory corruption. Under the required higher-severity rule, this is treated as potentially exploitable for arbitrary write or control-flow compromise.\nA:H - At minimum, refcount corruption and use-after-free of a live CIFS tcon can lead to kernel oops, panic, or hangs in reconnect/close/DFS workqueue paths. The condition can be triggered repeatedly by malicious SMB server behavior while the share is mounted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:40.744Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/953953abb66e52c224057ab91e404284fefeab62"
},
{
"url": "https://git.kernel.org/stable/c/601dd3b79769b38d30b693c40afdb2a4b7edf9d0"
},
{
"url": "https://git.kernel.org/stable/c/3969db6b22e3d90d8c5f22ac1a7fe0350a94c136"
},
{
"url": "https://git.kernel.org/stable/c/8c59eeeeffa1524ef57e173a89a1a3ff539888d5"
},
{
"url": "https://git.kernel.org/stable/c/96c4af418586ee9a6aab61738644366426e05316"
}
],
"title": "cifs: Fix locking usage for tcon fields",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43215",
"datePublished": "2026-05-06T11:28:17.425Z",
"dateReserved": "2026-05-01T14:12:55.993Z",
"dateUpdated": "2026-08-05T12:26:40.744Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43452 (GCVE-0-2026-43452)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: x_tables: guard option walkers against 1-byte tail reads
When the last byte of options is a non-single-byte option kind, walkers
that advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end
of the option area.
Add an explicit i == optlen - 1 check before dereferencing op[i + 1]
in xt_tcpudp and xt_dccp option walkers.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2e4e6a17af35be359cc8f1c924f8f198fbd478cc Version: 2e4e6a17af35be359cc8f1c924f8f198fbd478cc Version: 2e4e6a17af35be359cc8f1c924f8f198fbd478cc Version: 2e4e6a17af35be359cc8f1c924f8f198fbd478cc Version: 2e4e6a17af35be359cc8f1c924f8f198fbd478cc Version: 2e4e6a17af35be359cc8f1c924f8f198fbd478cc Version: 2e4e6a17af35be359cc8f1c924f8f198fbd478cc Version: 2e4e6a17af35be359cc8f1c924f8f198fbd478cc |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_dccp.c",
"net/netfilter/xt_tcpudp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c2a445367a496a3c25dbc940c10c8bd1cfd4c14a",
"status": "affected",
"version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc",
"versionType": "git"
},
{
"lessThan": "ae1e1267650638136b84c23f2b31250f0ccb6823",
"status": "affected",
"version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc",
"versionType": "git"
},
{
"lessThan": "c39f84e4be1be63fc60ca7141ea7b76edcea5907",
"status": "affected",
"version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc",
"versionType": "git"
},
{
"lessThan": "9b94f0e42ed248eb31929da84ed9f5310d7ff540",
"status": "affected",
"version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc",
"versionType": "git"
},
{
"lessThan": "5b18b8b35c7cded2d17b2b2604c9b0694ff48d1c",
"status": "affected",
"version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc",
"versionType": "git"
},
{
"lessThan": "bc18551c6169eac5ed813778d3e3e484002dbbe5",
"status": "affected",
"version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc",
"versionType": "git"
},
{
"lessThan": "d04800323336eebf441d153f43234eac9b833d36",
"status": "affected",
"version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc",
"versionType": "git"
},
{
"lessThan": "cfe770220ac2dbd3e104c6b45094037455da81d4",
"status": "affected",
"version": "2e4e6a17af35be359cc8f1c924f8f198fbd478cc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_dccp.c",
"net/netfilter/xt_tcpudp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.16"
},
{
"lessThan": "2.6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: guard option walkers against 1-byte tail reads\n\nWhen the last byte of options is a non-single-byte option kind, walkers\nthat advance with i += op[i + 1] ? : 1 can read op[i + 1] past the end\nof the option area.\n\nAdd an explicit i == optlen - 1 check before dereferencing op[i + 1]\nin xt_tcpudp and xt_dccp option walkers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - In a reasonable highest-impact deployment, an internet-facing host or firewall has an x_tables TCP/DCCP option match rule installed, and the vulnerable walker is then reached by unauthenticated network packets. A remote attacker can craft TCP or DCCP options ending with a non-single-byte option kind to trigger the tail read.\nAC:L - The trigger is deterministic packet content: make the last option byte a kind value \u003e= 2 without a following length byte. There is no race, timing requirement, or attacker-uncontrolled memory layout condition needed to reach the bug.\nPR:N - The network packet path requires no local account or authentication once the affected rule is present. Although local rule installation is gated by CAP_NET_ADMIN in the network namespace and is user-namespace reachable, the highest reasonable trigger path is unauthenticated remote traffic.\nUI:N - No victim user action is required for each exploit attempt. The attacker only sends crafted packets to a system whose netfilter rules inspect TCP or DCCP options.\nS:U - The vulnerable code executes in the target kernel\u2019s own netfilter packet-processing context. It does not cross a separate security authority such as a VM or device/IOMMU boundary.\nC:L - The primitive is a strictly bounded one-byte out-of-bounds read past the option area, not an arbitrary read primitive. Because it can access adjacent kernel memory, limited confidentiality impact is the higher defensible value.\nI:N - The bug performs only an out-of-bounds read of op[i + 1]; it does not write memory or corrupt kernel structures. The read byte only affects loop advancement at the tail and does not provide an integrity-changing primitive.\nA:H - Malformed packets can repeatedly trigger a kernel out-of-bounds read in the netfilter hot path. On hardened, sanitizing, or faulting deployments this can produce an oops or panic, so availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:01.123Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c2a445367a496a3c25dbc940c10c8bd1cfd4c14a"
},
{
"url": "https://git.kernel.org/stable/c/ae1e1267650638136b84c23f2b31250f0ccb6823"
},
{
"url": "https://git.kernel.org/stable/c/c39f84e4be1be63fc60ca7141ea7b76edcea5907"
},
{
"url": "https://git.kernel.org/stable/c/9b94f0e42ed248eb31929da84ed9f5310d7ff540"
},
{
"url": "https://git.kernel.org/stable/c/5b18b8b35c7cded2d17b2b2604c9b0694ff48d1c"
},
{
"url": "https://git.kernel.org/stable/c/bc18551c6169eac5ed813778d3e3e484002dbbe5"
},
{
"url": "https://git.kernel.org/stable/c/d04800323336eebf441d153f43234eac9b833d36"
},
{
"url": "https://git.kernel.org/stable/c/cfe770220ac2dbd3e104c6b45094037455da81d4"
}
],
"title": "netfilter: x_tables: guard option walkers against 1-byte tail reads",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43452",
"datePublished": "2026-05-08T14:22:17.361Z",
"dateReserved": "2026-05-01T14:12:56.010Z",
"dateUpdated": "2026-08-05T12:28:01.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43015 (GCVE-0-2026-43015)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-05-23 16:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: macb: fix clk handling on PCI glue driver removal
platform_device_unregister() may still want to use the registered clks
during runtime resume callback.
Note that there is a commit d82d5303c4c5 ("net: macb: fix use after free
on rmmod") that addressed the similar problem of clk vs platform device
unregistration but just moved the bug to another place.
Save the pointers to clks into local variables for reuse after platform
device is unregistered.
BUG: KASAN: use-after-free in clk_prepare+0x5a/0x60
Read of size 8 at addr ffff888104f85e00 by task modprobe/597
CPU: 2 PID: 597 Comm: modprobe Not tainted 6.1.164+ #114
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x8d/0xba
print_report+0x17f/0x496
kasan_report+0xd9/0x180
clk_prepare+0x5a/0x60
macb_runtime_resume+0x13d/0x410 [macb]
pm_generic_runtime_resume+0x97/0xd0
__rpm_callback+0xc8/0x4d0
rpm_callback+0xf6/0x230
rpm_resume+0xeeb/0x1a70
__pm_runtime_resume+0xb4/0x170
bus_remove_device+0x2e3/0x4b0
device_del+0x5b3/0xdc0
platform_device_del+0x4e/0x280
platform_device_unregister+0x11/0x50
pci_device_remove+0xae/0x210
device_remove+0xcb/0x180
device_release_driver_internal+0x529/0x770
driver_detach+0xd4/0x1a0
bus_remove_driver+0x135/0x260
driver_unregister+0x72/0xb0
pci_unregister_driver+0x26/0x220
__do_sys_delete_module+0x32e/0x550
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
</TASK>
Allocated by task 519:
kasan_save_stack+0x2c/0x50
kasan_set_track+0x21/0x30
__kasan_kmalloc+0x8e/0x90
__clk_register+0x458/0x2890
clk_hw_register+0x1a/0x60
__clk_hw_register_fixed_rate+0x255/0x410
clk_register_fixed_rate+0x3c/0xa0
macb_probe+0x1d8/0x42e [macb_pci]
local_pci_probe+0xd7/0x190
pci_device_probe+0x252/0x600
really_probe+0x255/0x7f0
__driver_probe_device+0x1ee/0x330
driver_probe_device+0x4c/0x1f0
__driver_attach+0x1df/0x4e0
bus_for_each_dev+0x15d/0x1f0
bus_add_driver+0x486/0x5e0
driver_register+0x23a/0x3d0
do_one_initcall+0xfd/0x4d0
do_init_module+0x18b/0x5a0
load_module+0x5663/0x7950
__do_sys_finit_module+0x101/0x180
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Freed by task 597:
kasan_save_stack+0x2c/0x50
kasan_set_track+0x21/0x30
kasan_save_free_info+0x2a/0x50
__kasan_slab_free+0x106/0x180
__kmem_cache_free+0xbc/0x320
clk_unregister+0x6de/0x8d0
macb_remove+0x73/0xc0 [macb_pci]
pci_device_remove+0xae/0x210
device_remove+0xcb/0x180
device_release_driver_internal+0x529/0x770
driver_detach+0xd4/0x1a0
bus_remove_driver+0x135/0x260
driver_unregister+0x72/0xb0
pci_unregister_driver+0x26/0x220
__do_sys_delete_module+0x32e/0x550
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7721221e87d25c9840d9ca6b986dbdc410d5ce2b Version: d82d5303c4c539db86588ffb5dc5b26c3f1513e8 Version: d82d5303c4c539db86588ffb5dc5b26c3f1513e8 Version: d82d5303c4c539db86588ffb5dc5b26c3f1513e8 Version: d82d5303c4c539db86588ffb5dc5b26c3f1513e8 Version: d82d5303c4c539db86588ffb5dc5b26c3f1513e8 Version: d82d5303c4c539db86588ffb5dc5b26c3f1513e8 Version: d82d5303c4c539db86588ffb5dc5b26c3f1513e8 Version: a7d521cc726f30b8e679a6f36d04b18a8ab3c536 Version: 46670fb832ee80943715df618632ca13c2e96f2b Version: 1da750d1e2140ef43d64d17f301ff6f41b45541e Version: 4ad6f2d23b0f6ac0d3e5f3102a4256d1c86c90f5 Version: 5.10.70 ≤ Version: 4.14.249 ≤ Version: 4.19.209 ≤ Version: 5.4.150 ≤ Version: 5.14.9 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cadence/macb_pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bf64cae913cdd4821f13d5d1d68900c0891bef69",
"status": "affected",
"version": "7721221e87d25c9840d9ca6b986dbdc410d5ce2b",
"versionType": "git"
},
{
"lessThan": "67f70841a175fa3469119f52d77a3662c07507a2",
"status": "affected",
"version": "d82d5303c4c539db86588ffb5dc5b26c3f1513e8",
"versionType": "git"
},
{
"lessThan": "2d96204e4184d6f7dd2f93c6f218fd0c1f55e9ae",
"status": "affected",
"version": "d82d5303c4c539db86588ffb5dc5b26c3f1513e8",
"versionType": "git"
},
{
"lessThan": "b3f799cdf830df1782ae463cf15ace35015be99e",
"status": "affected",
"version": "d82d5303c4c539db86588ffb5dc5b26c3f1513e8",
"versionType": "git"
},
{
"lessThan": "f310a836da90d0f0321b14d446c071af63f9ee4c",
"status": "affected",
"version": "d82d5303c4c539db86588ffb5dc5b26c3f1513e8",
"versionType": "git"
},
{
"lessThan": "16ab4c0e2b15df5d33bfcb9ea8e4441b85dd4a57",
"status": "affected",
"version": "d82d5303c4c539db86588ffb5dc5b26c3f1513e8",
"versionType": "git"
},
{
"lessThan": "3496fb9e66f79d4def3bb7ec7563e3eaa33a688f",
"status": "affected",
"version": "d82d5303c4c539db86588ffb5dc5b26c3f1513e8",
"versionType": "git"
},
{
"lessThan": "ce8fe5287b87e24e225c342f3b0ec04f0b3680fe",
"status": "affected",
"version": "d82d5303c4c539db86588ffb5dc5b26c3f1513e8",
"versionType": "git"
},
{
"status": "affected",
"version": "a7d521cc726f30b8e679a6f36d04b18a8ab3c536",
"versionType": "git"
},
{
"status": "affected",
"version": "46670fb832ee80943715df618632ca13c2e96f2b",
"versionType": "git"
},
{
"status": "affected",
"version": "1da750d1e2140ef43d64d17f301ff6f41b45541e",
"versionType": "git"
},
{
"status": "affected",
"version": "4ad6f2d23b0f6ac0d3e5f3102a4256d1c86c90f5",
"versionType": "git"
},
{
"lessThan": "5.10.253",
"status": "affected",
"version": "5.10.70",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.249",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.209",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.150",
"versionType": "semver"
},
{
"lessThan": "5.15",
"status": "affected",
"version": "5.14.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cadence/macb_pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.10.70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.249",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.209",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.150",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.14.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: fix clk handling on PCI glue driver removal\n\nplatform_device_unregister() may still want to use the registered clks\nduring runtime resume callback.\n\nNote that there is a commit d82d5303c4c5 (\"net: macb: fix use after free\non rmmod\") that addressed the similar problem of clk vs platform device\nunregistration but just moved the bug to another place.\n\nSave the pointers to clks into local variables for reuse after platform\ndevice is unregistered.\n\nBUG: KASAN: use-after-free in clk_prepare+0x5a/0x60\nRead of size 8 at addr ffff888104f85e00 by task modprobe/597\n\nCPU: 2 PID: 597 Comm: modprobe Not tainted 6.1.164+ #114\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x8d/0xba\n print_report+0x17f/0x496\n kasan_report+0xd9/0x180\n clk_prepare+0x5a/0x60\n macb_runtime_resume+0x13d/0x410 [macb]\n pm_generic_runtime_resume+0x97/0xd0\n __rpm_callback+0xc8/0x4d0\n rpm_callback+0xf6/0x230\n rpm_resume+0xeeb/0x1a70\n __pm_runtime_resume+0xb4/0x170\n bus_remove_device+0x2e3/0x4b0\n device_del+0x5b3/0xdc0\n platform_device_del+0x4e/0x280\n platform_device_unregister+0x11/0x50\n pci_device_remove+0xae/0x210\n device_remove+0xcb/0x180\n device_release_driver_internal+0x529/0x770\n driver_detach+0xd4/0x1a0\n bus_remove_driver+0x135/0x260\n driver_unregister+0x72/0xb0\n pci_unregister_driver+0x26/0x220\n __do_sys_delete_module+0x32e/0x550\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n \u003c/TASK\u003e\n\nAllocated by task 519:\n kasan_save_stack+0x2c/0x50\n kasan_set_track+0x21/0x30\n __kasan_kmalloc+0x8e/0x90\n __clk_register+0x458/0x2890\n clk_hw_register+0x1a/0x60\n __clk_hw_register_fixed_rate+0x255/0x410\n clk_register_fixed_rate+0x3c/0xa0\n macb_probe+0x1d8/0x42e [macb_pci]\n local_pci_probe+0xd7/0x190\n pci_device_probe+0x252/0x600\n really_probe+0x255/0x7f0\n __driver_probe_device+0x1ee/0x330\n driver_probe_device+0x4c/0x1f0\n __driver_attach+0x1df/0x4e0\n bus_for_each_dev+0x15d/0x1f0\n bus_add_driver+0x486/0x5e0\n driver_register+0x23a/0x3d0\n do_one_initcall+0xfd/0x4d0\n do_init_module+0x18b/0x5a0\n load_module+0x5663/0x7950\n __do_sys_finit_module+0x101/0x180\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n\nFreed by task 597:\n kasan_save_stack+0x2c/0x50\n kasan_set_track+0x21/0x30\n kasan_save_free_info+0x2a/0x50\n __kasan_slab_free+0x106/0x180\n __kmem_cache_free+0xbc/0x320\n clk_unregister+0x6de/0x8d0\n macb_remove+0x73/0xc0 [macb_pci]\n pci_device_remove+0xae/0x210\n device_remove+0xcb/0x180\n device_release_driver_internal+0x529/0x770\n driver_detach+0xd4/0x1a0\n bus_remove_driver+0x135/0x260\n driver_unregister+0x72/0xb0\n pci_unregister_driver+0x26/0x220\n __do_sys_delete_module+0x32e/0x550\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x6e/0xd8"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:05:58.376Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bf64cae913cdd4821f13d5d1d68900c0891bef69"
},
{
"url": "https://git.kernel.org/stable/c/67f70841a175fa3469119f52d77a3662c07507a2"
},
{
"url": "https://git.kernel.org/stable/c/2d96204e4184d6f7dd2f93c6f218fd0c1f55e9ae"
},
{
"url": "https://git.kernel.org/stable/c/b3f799cdf830df1782ae463cf15ace35015be99e"
},
{
"url": "https://git.kernel.org/stable/c/f310a836da90d0f0321b14d446c071af63f9ee4c"
},
{
"url": "https://git.kernel.org/stable/c/16ab4c0e2b15df5d33bfcb9ea8e4441b85dd4a57"
},
{
"url": "https://git.kernel.org/stable/c/3496fb9e66f79d4def3bb7ec7563e3eaa33a688f"
},
{
"url": "https://git.kernel.org/stable/c/ce8fe5287b87e24e225c342f3b0ec04f0b3680fe"
}
],
"title": "net: macb: fix clk handling on PCI glue driver removal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43015",
"datePublished": "2026-05-01T14:15:20.242Z",
"dateReserved": "2026-05-01T14:12:55.974Z",
"dateUpdated": "2026-05-23T16:05:58.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43357 (GCVE-0-2026-43357)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-05-11 22:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: gyro: mpu3050-core: fix pm_runtime error handling
The return value of pm_runtime_get_sync() is not checked, allowing
the driver to access hardware that may fail to resume. The device
usage count is also unconditionally incremented. Use
pm_runtime_resume_and_get() which propagates errors and avoids
incrementing the usage count on failure.
In preenable, add pm_runtime_put_autosuspend() on set_8khz_samplerate()
failure since postdisable does not run when preenable fails.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/gyro/mpu3050-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "935f57dd43492240e1ca220dd065d624efece6be",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "8544c488e50206f00630a8bbba43d2c8bd290345",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "35f54e7bcb1eccdc6e5bff06580eeef2e0ff3677",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "2a86a396aa001a9f9ba2d37dda36573a76f17c90",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "66c0d1d600e7be034959cf49edab104cb5a39258",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "42685cf96e28262e0b84d74447f3d99f3f6a72e0",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "7a3dec5b265cf87678b10c98a72a435a8e769bb7",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "acc3949aab3e8094641a9c7c2768de1958c88378",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/gyro/mpu3050-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: mpu3050-core: fix pm_runtime error handling\n\nThe return value of pm_runtime_get_sync() is not checked, allowing\nthe driver to access hardware that may fail to resume. The device\nusage count is also unconditionally incremented. Use\npm_runtime_resume_and_get() which propagates errors and avoids\nincrementing the usage count on failure.\n\nIn preenable, add pm_runtime_put_autosuspend() on set_8khz_samplerate()\nfailure since postdisable does not run when preenable fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:23:00.799Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/935f57dd43492240e1ca220dd065d624efece6be"
},
{
"url": "https://git.kernel.org/stable/c/8544c488e50206f00630a8bbba43d2c8bd290345"
},
{
"url": "https://git.kernel.org/stable/c/35f54e7bcb1eccdc6e5bff06580eeef2e0ff3677"
},
{
"url": "https://git.kernel.org/stable/c/2a86a396aa001a9f9ba2d37dda36573a76f17c90"
},
{
"url": "https://git.kernel.org/stable/c/66c0d1d600e7be034959cf49edab104cb5a39258"
},
{
"url": "https://git.kernel.org/stable/c/42685cf96e28262e0b84d74447f3d99f3f6a72e0"
},
{
"url": "https://git.kernel.org/stable/c/7a3dec5b265cf87678b10c98a72a435a8e769bb7"
},
{
"url": "https://git.kernel.org/stable/c/acc3949aab3e8094641a9c7c2768de1958c88378"
}
],
"title": "iio: gyro: mpu3050-core: fix pm_runtime error handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43357",
"datePublished": "2026-05-08T14:21:13.050Z",
"dateReserved": "2026-05-01T14:12:56.005Z",
"dateUpdated": "2026-05-11T22:23:00.799Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45923 (GCVE-0-2026-45923)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-27 12:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: usb: catc: enable basic endpoint checking
catc_probe() fills three URBs with hardcoded endpoint pipes without
verifying the endpoint descriptors:
- usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX
- usb_rcvintpipe(usbdev, 2) for interrupt status
A malformed USB device can present these endpoints with transfer types
that differ from what the driver assumes.
Add a catc_usb_ep enum for endpoint numbers, replacing magic constants
throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints()
calls after usb_set_interface() to verify endpoint types before use,
rejecting devices with mismatched descriptors at probe time.
Similar to
- commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking")
which fixed the issue in rtl8150.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/catc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eade522d3e6ac3f3bfb51bfa5b5b4b32bd0b846f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ac7739b78ded519e1d9919a814da3b34120bec8c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "163d04897e57633c5d2e69734e4e4b22bb63f50d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a488001a8197da4f9c413eec8f6acbff71c60145",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "36c28b028efba0f42218d41fed12c47ce217c1f1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1a42cfced8900d33d032c7ec338484855b61b8cc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9e7021d2aeae57c323a6f722ed7915686cdcc123",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/catc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: catc: enable basic endpoint checking\n\ncatc_probe() fills three URBs with hardcoded endpoint pipes without\nverifying the endpoint descriptors:\n\n - usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX\n - usb_rcvintpipe(usbdev, 2) for interrupt status\n\nA malformed USB device can present these endpoints with transfer types\nthat differ from what the driver assumes.\n\nAdd a catc_usb_ep enum for endpoint numbers, replacing magic constants\nthroughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints()\ncalls after usb_set_interface() to verify endpoint types before use,\nrejecting devices with mismatched descriptors at probe time.\n\nSimilar to\n- commit 90b7f2961798 (\"net: usb: rtl8150: enable basic endpoint checking\")\nwhich fixed the issue in rtl8150."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:17:42.312Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eade522d3e6ac3f3bfb51bfa5b5b4b32bd0b846f"
},
{
"url": "https://git.kernel.org/stable/c/ac7739b78ded519e1d9919a814da3b34120bec8c"
},
{
"url": "https://git.kernel.org/stable/c/163d04897e57633c5d2e69734e4e4b22bb63f50d"
},
{
"url": "https://git.kernel.org/stable/c/a488001a8197da4f9c413eec8f6acbff71c60145"
},
{
"url": "https://git.kernel.org/stable/c/36c28b028efba0f42218d41fed12c47ce217c1f1"
},
{
"url": "https://git.kernel.org/stable/c/1a42cfced8900d33d032c7ec338484855b61b8cc"
},
{
"url": "https://git.kernel.org/stable/c/9e7021d2aeae57c323a6f722ed7915686cdcc123"
}
],
"title": "net: usb: catc: enable basic endpoint checking",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45923",
"datePublished": "2026-05-27T12:17:42.312Z",
"dateReserved": "2026-05-13T15:03:33.085Z",
"dateUpdated": "2026-05-27T12:17:42.312Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43101 (GCVE-0-2026-43101)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
We need to check __in6_dev_get() for possible NULL value, as
suggested by Yiming Qian.
Also add skb_dst_dev_rcu() instead of skb_dst_dev(),
and two missing READ_ONCE().
Note that @dev can't be NULL.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ioam6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4198aab6f000b4febb18ea820fea20634dd789c7",
"status": "affected",
"version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
"versionType": "git"
},
{
"lessThan": "3719c234fa94c37c955b1ecd3742ef280ec135e6",
"status": "affected",
"version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
"versionType": "git"
},
{
"lessThan": "4e65a8b8daa18d63255ec58964dd192c7fdd9f8b",
"status": "affected",
"version": "9ee11f0fff205b4b3df9750bff5e94f97c71b6a0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ioam6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()\n\nWe need to check __in6_dev_get() for possible NULL value, as\nsuggested by Yiming Qian.\n\nAlso add skb_dst_dev_rcu() instead of skb_dst_dev(),\nand two missing READ_ONCE().\n\nNote that @dev can\u0027t be NULL."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable helper is reachable while processing IPv6 IOAM Hop-by-Hop options and IOAM LWT output for packets crossing an IOAM-enabled IPv6 node, so an attacker can trigger it with network traffic in a configured IOAM deployment.\nAC:L - Once IOAM is enabled/configured on the target path, triggering only requires a valid pre-allocated trace with ingress/egress interface ID fields and a route/device state where `__in6_dev_get()` returns NULL; there is no race or difficult timing requirement.\nPR:N - The attacker does not need credentials on the target to send the triggering IPv6 traffic; the administrative IOAM setup is a target deployment condition rather than an attacker privilege.\nUI:N - No victim user action is required after the vulnerable node is configured; packet processing alone reaches the dereference.\nS:U - The impact is within the same kernel/networking security authority and does not cross a VM, IOMMU, or similar boundary.\nC:N - The bug is a NULL pointer dereference of missing IPv6 device state, not an out-of-bounds read or information disclosure primitive.\nI:N - The fixed issue does not provide attacker-controlled writes or data modification; it only prevents dereferencing NULL `inet6_dev` pointers.\nA:H - A NULL pointer dereference in kernel packet processing can oops or panic the system, causing high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:55.355Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4198aab6f000b4febb18ea820fea20634dd789c7"
},
{
"url": "https://git.kernel.org/stable/c/3719c234fa94c37c955b1ecd3742ef280ec135e6"
},
{
"url": "https://git.kernel.org/stable/c/4e65a8b8daa18d63255ec58964dd192c7fdd9f8b"
}
],
"title": "ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43101",
"datePublished": "2026-05-06T07:40:30.969Z",
"dateReserved": "2026-05-01T14:12:55.984Z",
"dateUpdated": "2026-08-05T12:25:55.355Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46225 (GCVE-0-2026-46225)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-06-14 18:03
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
spi: rspi: fix controller deregistration
Make sure to deregister the controller before releasing underlying
resources like DMA during driver unbind.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-rspi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "77defd64b405b680db73d767313fce770d368368",
"status": "affected",
"version": "9e03d05eee4ca45ed12749ef6c26bf616262cdd2",
"versionType": "git"
},
{
"lessThan": "c5090db1b31de3ef4db0cda7e822ab49cb572292",
"status": "affected",
"version": "9e03d05eee4ca45ed12749ef6c26bf616262cdd2",
"versionType": "git"
},
{
"lessThan": "aee76c1dd189562c6678313caec12761f78a9ef3",
"status": "affected",
"version": "9e03d05eee4ca45ed12749ef6c26bf616262cdd2",
"versionType": "git"
},
{
"lessThan": "fee6abd9845c3edd217b0e429d09f764f9a5690e",
"status": "affected",
"version": "9e03d05eee4ca45ed12749ef6c26bf616262cdd2",
"versionType": "git"
},
{
"lessThan": "9944fa6726afb1e6eb7e2212764e7da0c97f2dcc",
"status": "affected",
"version": "9e03d05eee4ca45ed12749ef6c26bf616262cdd2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-rspi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.14"
},
{
"lessThan": "3.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: rspi: fix controller deregistration\n\nMake sure to deregister the controller before releasing underlying\nresources like DMA during driver unbind."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:03:59.436Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/77defd64b405b680db73d767313fce770d368368"
},
{
"url": "https://git.kernel.org/stable/c/c5090db1b31de3ef4db0cda7e822ab49cb572292"
},
{
"url": "https://git.kernel.org/stable/c/aee76c1dd189562c6678313caec12761f78a9ef3"
},
{
"url": "https://git.kernel.org/stable/c/fee6abd9845c3edd217b0e429d09f764f9a5690e"
},
{
"url": "https://git.kernel.org/stable/c/9944fa6726afb1e6eb7e2212764e7da0c97f2dcc"
}
],
"title": "spi: rspi: fix controller deregistration",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46225",
"datePublished": "2026-05-28T09:40:44.066Z",
"dateReserved": "2026-05-13T15:03:33.106Z",
"dateUpdated": "2026-06-14T18:03:59.436Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43291 (GCVE-0-2026-43291)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: nfc: nci: Fix parameter validation for packet data
Since commit 9c328f54741b ("net: nfc: nci: Add parameter validation for
packet data") communication with nci nfc chips is not working any more.
The mentioned commit tries to fix access of uninitialized data, but
failed to understand that in some cases the data packet is of variable
length and can therefore not be compared to the maximum packet length
given by the sizeof(struct).
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8fcc7315a10a84264e55bb65ede10f0af20a983f Version: bfdda0123dde406dbff62e7e9136037e97998a15 Version: 0ba68bea1e356f466ad29449938bea12f5f3711f Version: 74837bca0748763a77f77db47a0bdbe63b347628 Version: 9c328f54741bd5465ca1dc717c84c04242fac2e1 Version: 9c328f54741bd5465ca1dc717c84c04242fac2e1 Version: 9c328f54741bd5465ca1dc717c84c04242fac2e1 Version: c395d1e548cc68e84584ffa2e3ca9796a78bf7b9 Version: 5.15.195 ≤ Version: 6.1.156 ≤ Version: 6.6.112 ≤ Version: 6.12.53 ≤ Version: 6.17.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/nfc/nci/ntf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a24a8a582da4426b2042e510a1080df84083b51d",
"status": "affected",
"version": "8fcc7315a10a84264e55bb65ede10f0af20a983f",
"versionType": "git"
},
{
"lessThan": "f5218426f765eee22e178df9c126d974792fb6a5",
"status": "affected",
"version": "bfdda0123dde406dbff62e7e9136037e97998a15",
"versionType": "git"
},
{
"lessThan": "ad058a4317db7fdb3f09caa6ed536d24a62ce6a0",
"status": "affected",
"version": "0ba68bea1e356f466ad29449938bea12f5f3711f",
"versionType": "git"
},
{
"lessThan": "3b91160e9a91b5a2662875417dc42dc5b0bf03ea",
"status": "affected",
"version": "74837bca0748763a77f77db47a0bdbe63b347628",
"versionType": "git"
},
{
"lessThan": "c692db813a7e3b7c3c17d6e9a3ad2a018bf1142b",
"status": "affected",
"version": "9c328f54741bd5465ca1dc717c84c04242fac2e1",
"versionType": "git"
},
{
"lessThan": "498fc5d0d650c77e87fcc73808d4f43240c21805",
"status": "affected",
"version": "9c328f54741bd5465ca1dc717c84c04242fac2e1",
"versionType": "git"
},
{
"lessThan": "571dcbeb8e635182bb825ae758399831805693c2",
"status": "affected",
"version": "9c328f54741bd5465ca1dc717c84c04242fac2e1",
"versionType": "git"
},
{
"status": "affected",
"version": "c395d1e548cc68e84584ffa2e3ca9796a78bf7b9",
"versionType": "git"
},
{
"lessThan": "5.15.202",
"status": "affected",
"version": "5.15.195",
"versionType": "semver"
},
{
"lessThan": "6.1.165",
"status": "affected",
"version": "6.1.156",
"versionType": "semver"
},
{
"lessThan": "6.6.128",
"status": "affected",
"version": "6.6.112",
"versionType": "semver"
},
{
"lessThan": "6.12.75",
"status": "affected",
"version": "6.12.53",
"versionType": "semver"
},
{
"lessThan": "6.18",
"status": "affected",
"version": "6.17.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/nfc/nci/ntf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.15.195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.1.156",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.6.112",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.12.53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nfc: nci: Fix parameter validation for packet data\n\nSince commit 9c328f54741b (\"net: nfc: nci: Add parameter validation for\npacket data\") communication with nci nfc chips is not working any more.\n\nThe mentioned commit tries to fix access of uninitialized data, but\nfailed to understand that in some cases the data packet is of variable\nlength and can therefore not be compared to the maximum packet length\ngiven by the sizeof(struct)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - An attacker in NFC proximity can plausibly trigger RF discovery or activation notifications through crafted NFC tag/peer responses that are converted by the NFCC into NCI notification payloads parsed by this code. This is not internet-routable, but it is reachable over short-range adjacent NFC communication.\nAC:L - The vulnerable parsing is deterministic once a malformed or truncated NCI notification is delivered, and there is no race or hard-to-control timing dependency. The attacker-controlled packet lengths and fields drive the out-of-bounds/uninitialized reads directly.\nPR:N - The adjacent NFC attacker needs no privileges on the victim system to present a crafted NFC peer/tag to an active reader/listener. Local administrative controls are needed to configure NFC polling, but they are not privileges required by the RF-side attacker.\nUI:N - In a reasonable high-impact deployment such as a kiosk, phone, or controller with NFC polling/listen mode active, the attacker only needs to bring the crafted NFC device into range. No victim user action is required at exploitation time.\nS:U - The impact remains within the same kernel/host security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The bug is an out-of-bounds/uninitialized read from skb-backed packet data, confirmed by the syzbot KMSAN report and addressed by added per-field bounds checks. Under the kernel scoring guidance, out-of-bounds reads are High confidentiality impact unless strictly bounded to a few bytes.\nI:L - The investigation did not show an out-of-bounds write or direct control-flow corruption primitive. However, malformed parsed data can still corrupt NFC subsystem state such as targets, activation data, and connection credits, so limited integrity impact is defensible.\nA:H - Malformed notifications can trigger kernel sanitizer reports, warnings, or crashes from invalid/uninitialized packet accesses. The packet path can be exercised repeatedly, making denial of service high impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:06.691Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a24a8a582da4426b2042e510a1080df84083b51d"
},
{
"url": "https://git.kernel.org/stable/c/f5218426f765eee22e178df9c126d974792fb6a5"
},
{
"url": "https://git.kernel.org/stable/c/ad058a4317db7fdb3f09caa6ed536d24a62ce6a0"
},
{
"url": "https://git.kernel.org/stable/c/3b91160e9a91b5a2662875417dc42dc5b0bf03ea"
},
{
"url": "https://git.kernel.org/stable/c/c692db813a7e3b7c3c17d6e9a3ad2a018bf1142b"
},
{
"url": "https://git.kernel.org/stable/c/498fc5d0d650c77e87fcc73808d4f43240c21805"
},
{
"url": "https://git.kernel.org/stable/c/571dcbeb8e635182bb825ae758399831805693c2"
}
],
"title": "net: nfc: nci: Fix parameter validation for packet data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43291",
"datePublished": "2026-05-08T13:11:15.312Z",
"dateReserved": "2026-05-01T14:12:55.999Z",
"dateUpdated": "2026-08-05T12:27:06.691Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43156 (GCVE-0-2026-43156)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: usb: pegasus: enable basic endpoint checking
pegasus_probe() fills URBs with hardcoded endpoint pipes without
verifying the endpoint descriptors:
- usb_rcvbulkpipe(dev, 1) for RX data
- usb_sndbulkpipe(dev, 2) for TX data
- usb_rcvintpipe(dev, 3) for status interrupts
A malformed USB device can present these endpoints with transfer types
that differ from what the driver assumes.
Add a pegasus_usb_ep enum for endpoint numbers, replacing magic
constants throughout. Add usb_check_bulk_endpoints() and
usb_check_int_endpoints() calls before any resource allocation to
verify endpoint types before use, rejecting devices with mismatched
descriptors at probe time, and avoid triggering assertion.
Similar fix to
- commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking")
- commit 9e7021d2aeae ("net: usb: catc: enable basic endpoint checking")
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/pegasus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a3e64e950a3981a8199de9798f6d21261b959171",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "229dc9b9db475ac900182bafe258943e0e054c6d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "26b3ec62fa1a94ac801feca47f040fc729b3c174",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "35854ed5c40b02f95824e44398f9d2ba33727203",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "67ba6b13dbcaf45681fb6758794c5ac5fa589a6c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d2e7c898cc02dfe42443489a67a45ed616cb76e9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2705709f6574a088aab246af72fc95f2fea51484",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3d7e6ce34f4fcc7083510c28b17a7c36462a25d4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/pegasus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: pegasus: enable basic endpoint checking\n\npegasus_probe() fills URBs with hardcoded endpoint pipes without\nverifying the endpoint descriptors:\n\n - usb_rcvbulkpipe(dev, 1) for RX data\n - usb_sndbulkpipe(dev, 2) for TX data\n - usb_rcvintpipe(dev, 3) for status interrupts\n\nA malformed USB device can present these endpoints with transfer types\nthat differ from what the driver assumes.\n\nAdd a pegasus_usb_ep enum for endpoint numbers, replacing magic\nconstants throughout. Add usb_check_bulk_endpoints() and\nusb_check_int_endpoints() calls before any resource allocation to\nverify endpoint types before use, rejecting devices with mismatched\ndescriptors at probe time, and avoid triggering assertion.\n\nSimilar fix to\n- commit 90b7f2961798 (\"net: usb: rtl8150: enable basic endpoint checking\")\n- commit 9e7021d2aeae (\"net: usb: catc: enable basic endpoint checking\")"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:18:50.696Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a3e64e950a3981a8199de9798f6d21261b959171"
},
{
"url": "https://git.kernel.org/stable/c/229dc9b9db475ac900182bafe258943e0e054c6d"
},
{
"url": "https://git.kernel.org/stable/c/26b3ec62fa1a94ac801feca47f040fc729b3c174"
},
{
"url": "https://git.kernel.org/stable/c/35854ed5c40b02f95824e44398f9d2ba33727203"
},
{
"url": "https://git.kernel.org/stable/c/67ba6b13dbcaf45681fb6758794c5ac5fa589a6c"
},
{
"url": "https://git.kernel.org/stable/c/d2e7c898cc02dfe42443489a67a45ed616cb76e9"
},
{
"url": "https://git.kernel.org/stable/c/2705709f6574a088aab246af72fc95f2fea51484"
},
{
"url": "https://git.kernel.org/stable/c/3d7e6ce34f4fcc7083510c28b17a7c36462a25d4"
}
],
"title": "net: usb: pegasus: enable basic endpoint checking",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43156",
"datePublished": "2026-05-06T11:27:36.491Z",
"dateReserved": "2026-05-01T14:12:55.989Z",
"dateUpdated": "2026-05-11T22:18:50.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43140 (GCVE-0-2026-43140)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: magicmouse: Do not crash on missing msc->input
Fake USB devices can send their own report descriptors for which the
input_mapping() hook does not get called. In this case, msc->input stays NULL,
leading to a crash at a later time.
Detect this condition in the input_configured() hook and reject the device.
This is not supposed to happen with actual magic mouse devices, but can be
provoked by imposing as a magic mouse USB device.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 64eb105d7f92fa48798106ac0d8bf17668eb2524 Version: 64eb105d7f92fa48798106ac0d8bf17668eb2524 Version: 64eb105d7f92fa48798106ac0d8bf17668eb2524 Version: 64eb105d7f92fa48798106ac0d8bf17668eb2524 Version: 64eb105d7f92fa48798106ac0d8bf17668eb2524 Version: 64eb105d7f92fa48798106ac0d8bf17668eb2524 Version: 64eb105d7f92fa48798106ac0d8bf17668eb2524 Version: 64eb105d7f92fa48798106ac0d8bf17668eb2524 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-magicmouse.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "db5ba06e7af9325519a03e52fccf4a9e7c1fd9b2",
"status": "affected",
"version": "64eb105d7f92fa48798106ac0d8bf17668eb2524",
"versionType": "git"
},
{
"lessThan": "165912d4321c692321c02793068d30700b4e0f1a",
"status": "affected",
"version": "64eb105d7f92fa48798106ac0d8bf17668eb2524",
"versionType": "git"
},
{
"lessThan": "f6a3860241fbb556fd72332fa31c5e787004413b",
"status": "affected",
"version": "64eb105d7f92fa48798106ac0d8bf17668eb2524",
"versionType": "git"
},
{
"lessThan": "243e1165eb03aca97d87aafa9c3130593837a1c2",
"status": "affected",
"version": "64eb105d7f92fa48798106ac0d8bf17668eb2524",
"versionType": "git"
},
{
"lessThan": "922bd3e498a4b8e445def6e6ffea2ad3682ad516",
"status": "affected",
"version": "64eb105d7f92fa48798106ac0d8bf17668eb2524",
"versionType": "git"
},
{
"lessThan": "5bbe266272d86c0657e8253600f3d5b74fb7b2ae",
"status": "affected",
"version": "64eb105d7f92fa48798106ac0d8bf17668eb2524",
"versionType": "git"
},
{
"lessThan": "36c83c1329dd881f290f7df2feadfb9a21775108",
"status": "affected",
"version": "64eb105d7f92fa48798106ac0d8bf17668eb2524",
"versionType": "git"
},
{
"lessThan": "17abd396548035fbd6179ee1a431bd75d49676a7",
"status": "affected",
"version": "64eb105d7f92fa48798106ac0d8bf17668eb2524",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-magicmouse.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.37"
},
{
"lessThan": "2.6.37",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: magicmouse: Do not crash on missing msc-\u003einput\n\nFake USB devices can send their own report descriptors for which the\ninput_mapping() hook does not get called. In this case, msc-\u003einput stays NULL,\nleading to a crash at a later time.\n\nDetect this condition in the input_configured() hook and reject the device.\n\nThis is not supposed to happen with actual magic mouse devices, but can be\nprovoked by imposing as a magic mouse USB device."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:18:31.955Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/db5ba06e7af9325519a03e52fccf4a9e7c1fd9b2"
},
{
"url": "https://git.kernel.org/stable/c/165912d4321c692321c02793068d30700b4e0f1a"
},
{
"url": "https://git.kernel.org/stable/c/f6a3860241fbb556fd72332fa31c5e787004413b"
},
{
"url": "https://git.kernel.org/stable/c/243e1165eb03aca97d87aafa9c3130593837a1c2"
},
{
"url": "https://git.kernel.org/stable/c/922bd3e498a4b8e445def6e6ffea2ad3682ad516"
},
{
"url": "https://git.kernel.org/stable/c/5bbe266272d86c0657e8253600f3d5b74fb7b2ae"
},
{
"url": "https://git.kernel.org/stable/c/36c83c1329dd881f290f7df2feadfb9a21775108"
},
{
"url": "https://git.kernel.org/stable/c/17abd396548035fbd6179ee1a431bd75d49676a7"
}
],
"title": "HID: magicmouse: Do not crash on missing msc-\u003einput",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43140",
"datePublished": "2026-05-06T11:27:25.536Z",
"dateReserved": "2026-05-01T14:12:55.988Z",
"dateUpdated": "2026-05-11T22:18:31.955Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-40341 (GCVE-0-2025-40341)
Vulnerability from cvelistv5
Published
2025-12-09 04:09
Modified
2026-05-11 21:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
futex: Don't leak robust_list pointer on exec race
sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access()
to check if the calling task is allowed to access another task's
robust_list pointer. This check is racy against a concurrent exec() in the
target process.
During exec(), a task may transition from a non-privileged binary to a
privileged one (e.g., setuid binary) and its credentials/memory mappings
may change. If get_robust_list() performs ptrace_may_access() before
this transition, it may erroneously allow access to sensitive information
after the target becomes privileged.
A racy access allows an attacker to exploit a window during which
ptrace_may_access() passes before a target process transitions to a
privileged state via exec().
For example, consider a non-privileged task T that is about to execute a
setuid-root binary. An attacker task A calls get_robust_list(T) while T
is still unprivileged. Since ptrace_may_access() checks permissions
based on current credentials, it succeeds. However, if T begins exec
immediately afterwards, it becomes privileged and may change its memory
mappings. Because get_robust_list() proceeds to access T->robust_list
without synchronizing with exec() it may read user-space pointers from a
now-privileged process.
This violates the intended post-exec access restrictions and could
expose sensitive memory addresses or be used as a primitive in a larger
exploit chain. Consequently, the race can lead to unauthorized
disclosure of information across privilege boundaries and poses a
potential security risk.
Take a read lock on signal->exec_update_lock prior to invoking
ptrace_may_access() and accessing the robust_list/compat_robust_list.
This ensures that the target task's exec state remains stable during the
check, allowing for consistent and synchronized validation of
credentials.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/futex/syscalls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6511984d1aa1360181bcafb1ca75df7f291ef237",
"status": "affected",
"version": "0771dfefc9e538f077d0b43b6dec19a5a67d0e70",
"versionType": "git"
},
{
"lessThan": "4aced32596ead1820b7dbd8e40d30b30dc1f3ad4",
"status": "affected",
"version": "0771dfefc9e538f077d0b43b6dec19a5a67d0e70",
"versionType": "git"
},
{
"lessThan": "3b4222494489f6d4b8705a496dab03384b7ca998",
"status": "affected",
"version": "0771dfefc9e538f077d0b43b6dec19a5a67d0e70",
"versionType": "git"
},
{
"lessThan": "b524455a51feb6013df3a5dba3160487b2e8e22a",
"status": "affected",
"version": "0771dfefc9e538f077d0b43b6dec19a5a67d0e70",
"versionType": "git"
},
{
"lessThan": "6b54082c3ed4dc9821cdf0edb17302355cc5bb45",
"status": "affected",
"version": "0771dfefc9e538f077d0b43b6dec19a5a67d0e70",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/futex/syscalls.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.17"
},
{
"lessThan": "2.6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.159",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.117",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.58",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.159",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.117",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.58",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.8",
"versionStartIncluding": "2.6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "2.6.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Don\u0027t leak robust_list pointer on exec race\n\nsys_get_robust_list() and compat_get_robust_list() use ptrace_may_access()\nto check if the calling task is allowed to access another task\u0027s\nrobust_list pointer. This check is racy against a concurrent exec() in the\ntarget process.\n\nDuring exec(), a task may transition from a non-privileged binary to a\nprivileged one (e.g., setuid binary) and its credentials/memory mappings\nmay change. If get_robust_list() performs ptrace_may_access() before\nthis transition, it may erroneously allow access to sensitive information\nafter the target becomes privileged.\n\nA racy access allows an attacker to exploit a window during which\nptrace_may_access() passes before a target process transitions to a\nprivileged state via exec().\n\nFor example, consider a non-privileged task T that is about to execute a\nsetuid-root binary. An attacker task A calls get_robust_list(T) while T\nis still unprivileged. Since ptrace_may_access() checks permissions\nbased on current credentials, it succeeds. However, if T begins exec\nimmediately afterwards, it becomes privileged and may change its memory\nmappings. Because get_robust_list() proceeds to access T-\u003erobust_list\nwithout synchronizing with exec() it may read user-space pointers from a\nnow-privileged process.\n\nThis violates the intended post-exec access restrictions and could\nexpose sensitive memory addresses or be used as a primitive in a larger\nexploit chain. Consequently, the race can lead to unauthorized\ndisclosure of information across privilege boundaries and poses a\npotential security risk.\n\nTake a read lock on signal-\u003eexec_update_lock prior to invoking\nptrace_may_access() and accessing the robust_list/compat_robust_list.\nThis ensures that the target task\u0027s exec state remains stable during the\ncheck, allowing for consistent and synchronized validation of\ncredentials."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T21:47:29.607Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6511984d1aa1360181bcafb1ca75df7f291ef237"
},
{
"url": "https://git.kernel.org/stable/c/4aced32596ead1820b7dbd8e40d30b30dc1f3ad4"
},
{
"url": "https://git.kernel.org/stable/c/3b4222494489f6d4b8705a496dab03384b7ca998"
},
{
"url": "https://git.kernel.org/stable/c/b524455a51feb6013df3a5dba3160487b2e8e22a"
},
{
"url": "https://git.kernel.org/stable/c/6b54082c3ed4dc9821cdf0edb17302355cc5bb45"
}
],
"title": "futex: Don\u0027t leak robust_list pointer on exec race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40341",
"datePublished": "2025-12-09T04:09:58.392Z",
"dateReserved": "2025-04-16T07:20:57.187Z",
"dateUpdated": "2026-05-11T21:47:29.607Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46253 (GCVE-0-2026-46253)
Vulnerability from cvelistv5
Published
2026-06-03 15:49
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
pstore/ram: fix buffer overflow in persistent_ram_save_old()
persistent_ram_save_old() can be called multiple times for the same
persistent_ram_zone (e.g., via ramoops_pstore_read -> ramoops_get_next_prz
for PSTORE_TYPE_DMESG records).
Currently, the function only allocates prz->old_log when it is NULL,
but it unconditionally updates prz->old_log_size to the current buffer
size and then performs memcpy_fromio() using this new size. If the
buffer size has grown since the first allocation (which can happen
across different kernel boot cycles), this leads to:
1. A heap buffer overflow (OOB write) in the memcpy_fromio() calls
2. A subsequent OOB read when ramoops_pstore_read() accesses the buffer
using the incorrect (larger) old_log_size
The KASAN splat would look similar to:
BUG: KASAN: slab-out-of-bounds in ramoops_pstore_read+0x...
Read of size N at addr ... by task ...
The conditions are likely extremely hard to hit:
0. Crash with a ramoops write of less-than-record-max-size bytes.
1. Reboot: ramoops registers, pstore_get_records(0) reads old crash,
allocates old_log with size X
2. Crash handler registered, timer started (if pstore_update_ms >= 0)
3. Oops happens (non-fatal, system continues)
4. pstore_dump() writes oops via ramoops_pstore_write() size Y (>X)
5. pstore_new_entry = 1, pstore_timer_kick() called
6. System continues running (not a panic oops)
7. Timer fires after pstore_update_ms milliseconds
8. pstore_timefunc() → schedule_work() → pstore_dowork() → pstore_get_records(1)
9. ramoops_get_next_prz() → persistent_ram_save_old()
10. buffer_size() returns Y, but old_log is X bytes
11. Y > X: memcpy_fromio() overflows heap
Requirements:
- a prior crash record exists that did not fill the record size
(almost impossible since the crash handler writes as much as it
can possibly fit into the record, capped by max record size and
the kmsg buffer almost always exceeds the max record size)
- pstore_update_ms >= 0 (disabled by default)
- Non-fatal oops (system survives)
Free and reallocate the buffer when the new size differs from the
previously allocated size. This ensures old_log always has sufficient
space for the data being copied.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 201e4aca5aa179e6c69a4dcd36a3562e56b8d670 Version: 201e4aca5aa179e6c69a4dcd36a3562e56b8d670 Version: 201e4aca5aa179e6c69a4dcd36a3562e56b8d670 Version: 201e4aca5aa179e6c69a4dcd36a3562e56b8d670 Version: 201e4aca5aa179e6c69a4dcd36a3562e56b8d670 Version: 201e4aca5aa179e6c69a4dcd36a3562e56b8d670 Version: 201e4aca5aa179e6c69a4dcd36a3562e56b8d670 Version: 201e4aca5aa179e6c69a4dcd36a3562e56b8d670 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/pstore/ram_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "58bda5a1d1ee98254383ef34f76b2c35140513ea",
"status": "affected",
"version": "201e4aca5aa179e6c69a4dcd36a3562e56b8d670",
"versionType": "git"
},
{
"lessThan": "06d2c8bd108cea503f6f6e13e47495ed1085275f",
"status": "affected",
"version": "201e4aca5aa179e6c69a4dcd36a3562e56b8d670",
"versionType": "git"
},
{
"lessThan": "2fa9a047c6a50ec80c3890dd623b85e237f0d1fd",
"status": "affected",
"version": "201e4aca5aa179e6c69a4dcd36a3562e56b8d670",
"versionType": "git"
},
{
"lessThan": "cff0ef043e16feb5a02307c8f9d0117a96c5587c",
"status": "affected",
"version": "201e4aca5aa179e6c69a4dcd36a3562e56b8d670",
"versionType": "git"
},
{
"lessThan": "9a6fc69a570c0780834246d52c856cc3dbc2605f",
"status": "affected",
"version": "201e4aca5aa179e6c69a4dcd36a3562e56b8d670",
"versionType": "git"
},
{
"lessThan": "4f73486ca822305c1cf5b8ebc0b53a6ab3801a81",
"status": "affected",
"version": "201e4aca5aa179e6c69a4dcd36a3562e56b8d670",
"versionType": "git"
},
{
"lessThan": "7cfe964e61c0ab667abd5f5b68e0acbf783efa4f",
"status": "affected",
"version": "201e4aca5aa179e6c69a4dcd36a3562e56b8d670",
"versionType": "git"
},
{
"lessThan": "5669645c052f235726a85f443769b6fc02f66762",
"status": "affected",
"version": "201e4aca5aa179e6c69a4dcd36a3562e56b8d670",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/pstore/ram_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npstore/ram: fix buffer overflow in persistent_ram_save_old()\n\npersistent_ram_save_old() can be called multiple times for the same\npersistent_ram_zone (e.g., via ramoops_pstore_read -\u003e ramoops_get_next_prz\nfor PSTORE_TYPE_DMESG records).\n\nCurrently, the function only allocates prz-\u003eold_log when it is NULL,\nbut it unconditionally updates prz-\u003eold_log_size to the current buffer\nsize and then performs memcpy_fromio() using this new size. If the\nbuffer size has grown since the first allocation (which can happen\nacross different kernel boot cycles), this leads to:\n\n1. A heap buffer overflow (OOB write) in the memcpy_fromio() calls\n2. A subsequent OOB read when ramoops_pstore_read() accesses the buffer\n using the incorrect (larger) old_log_size\n\nThe KASAN splat would look similar to:\n BUG: KASAN: slab-out-of-bounds in ramoops_pstore_read+0x...\n Read of size N at addr ... by task ...\n\nThe conditions are likely extremely hard to hit:\n\n 0. Crash with a ramoops write of less-than-record-max-size bytes.\n 1. Reboot: ramoops registers, pstore_get_records(0) reads old crash,\n allocates old_log with size X\n 2. Crash handler registered, timer started (if pstore_update_ms \u003e= 0)\n 3. Oops happens (non-fatal, system continues)\n 4. pstore_dump() writes oops via ramoops_pstore_write() size Y (\u003eX)\n 5. pstore_new_entry = 1, pstore_timer_kick() called\n 6. System continues running (not a panic oops)\n 7. Timer fires after pstore_update_ms milliseconds\n 8. pstore_timefunc() \u2192 schedule_work() \u2192 pstore_dowork() \u2192 pstore_get_records(1)\n 9. ramoops_get_next_prz() \u2192 persistent_ram_save_old()\n 10. buffer_size() returns Y, but old_log is X bytes\n 11. Y \u003e X: memcpy_fromio() overflows heap\n\n Requirements:\n - a prior crash record exists that did not fill the record size\n (almost impossible since the crash handler writes as much as it\n can possibly fit into the record, capped by max record size and\n the kmsg buffer almost always exceeds the max record size)\n - pstore_update_ms \u003e= 0 (disabled by default)\n - Non-fatal oops (system survives)\n\nFree and reallocate the buffer when the new size differs from the\npreviously allocated size. This ensures old_log always has sufficient\nspace for the data being copied."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The overflow is reached only from in-kernel pstore/ramoops paths (boot init, kmsg-dump oops handling, pstore timer workqueue, or pstore filesystem rescan via mount), not from any network, adjacent-radio, or physical-device interface.\nAC:L - Once ramoops is present (common on Android, ChromeOS, and embedded targets), a local actor who can trigger a survivable oops and influence kmsg volume can drive the size mismatch; the second `persistent_ram_save_old()` call is then triggered deterministically by the pstore update timer or a pstore remount/rescan without depending on uncontrollable memory layout or victim timing.\nPR:L - Exploitation does not require real init-namespace root: an unprivileged local user (or sandboxed code with a kernel bug primitive) can provoke the non-fatal oops that enlarges the persistent RAM record, while the actual overflow fires later in kernel context during automatic pstore rescan or when crash-log collection runs.\nUI:N - No end-user or administrator action is required on the timer-driven path (`pstore_update_ms` enabled): after the oops is logged, the kernel timer/workqueue automatically rescans records and invokes the vulnerable copy without further interaction.\nS:U - The bug corrupts kernel heap memory inside the same kernel security domain; it does not by itself cross a VM, container, or IOMMU boundary to affect a separate authority.\nC:H - The flaw performs an out-of-bounds heap write via `memcpy_fromio()` and then exposes an out-of-bounds read through the inflated `old_log_size` in `ramoops_pstore_read()`, giving memory-corruption primitives that can disclose adjacent kernel heap contents.\nI:H - The out-of-bounds write into a `kvzalloc()`-allocated shadow buffer is classic kernel heap corruption that can be leveraged for arbitrary memory modification and potential control-flow hijack, not merely a bounded data alteration.\nA:H - The overflow is detected as a slab out-of-bounds condition (KASAN splat) and can panic or oops the kernel during the copy or subsequent read, causing complete loss of availability on affected systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:47.049Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/58bda5a1d1ee98254383ef34f76b2c35140513ea"
},
{
"url": "https://git.kernel.org/stable/c/06d2c8bd108cea503f6f6e13e47495ed1085275f"
},
{
"url": "https://git.kernel.org/stable/c/2fa9a047c6a50ec80c3890dd623b85e237f0d1fd"
},
{
"url": "https://git.kernel.org/stable/c/cff0ef043e16feb5a02307c8f9d0117a96c5587c"
},
{
"url": "https://git.kernel.org/stable/c/9a6fc69a570c0780834246d52c856cc3dbc2605f"
},
{
"url": "https://git.kernel.org/stable/c/4f73486ca822305c1cf5b8ebc0b53a6ab3801a81"
},
{
"url": "https://git.kernel.org/stable/c/7cfe964e61c0ab667abd5f5b68e0acbf783efa4f"
},
{
"url": "https://git.kernel.org/stable/c/5669645c052f235726a85f443769b6fc02f66762"
}
],
"title": "pstore/ram: fix buffer overflow in persistent_ram_save_old()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46253",
"datePublished": "2026-06-03T15:49:49.864Z",
"dateReserved": "2026-05-13T15:03:33.107Z",
"dateUpdated": "2026-08-05T12:30:47.049Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52956 (GCVE-0-2026-52956)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()
In __ceph_x_decrypt(), a part of the buffer p is interpreted as a
ceph_x_encrypt_header, and the magic field of this struct is accessed.
This happens without any guarantee that the buffer is large enough to
hold this struct. The function parameter ciphertext_len represents the
length of the ciphertext to decrypt and is guaranteed to be at most the
remaining size of the allocated buffer p. However, this value is not
necessarily greater than sizeof(ceph_x_encrypt_header). E.g., a message
frame of type FRAME_TAG_AUTH_REPLY_MORE, that is just as long to hold
the ciphertext at its end with a ciphertext_len of 8 or less, can
trigger an out-of-bounds memory access when accessing hdr->magic.
This patch fixes the issue by adding a check to ensure that the
decrypted plaintext in the buffer is large enough to represent at least
the ceph_x_encrypt_header.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/auth_x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2",
"status": "affected",
"version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5",
"versionType": "git"
},
{
"lessThan": "821365487aa58d06bda65c676ba215d506ba9768",
"status": "affected",
"version": "e15fd0a11db00fc7f470a9fc804657ec3f6d04a5",
"versionType": "git"
},
{
"status": "affected",
"version": "2982b9c92a66604ffb9fb2db54cf735133d1ef56",
"versionType": "git"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/auth_x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential out-of-bounds access in __ceph_x_decrypt()\n\nIn __ceph_x_decrypt(), a part of the buffer p is interpreted as a\nceph_x_encrypt_header, and the magic field of this struct is accessed.\nThis happens without any guarantee that the buffer is large enough to\nhold this struct. The function parameter ciphertext_len represents the\nlength of the ciphertext to decrypt and is guaranteed to be at most the\nremaining size of the allocated buffer p. However, this value is not\nnecessarily greater than sizeof(ceph_x_encrypt_header). E.g., a message\nframe of type FRAME_TAG_AUTH_REPLY_MORE, that is just as long to hold\nthe ciphertext at its end with a ciphertext_len of 8 or less, can\ntrigger an out-of-bounds memory access when accessing hdr-\u003emagic.\n\nThis patch fixes the issue by adding a check to ensure that the\ndecrypted plaintext in the buffer is large enough to represent at least\nthe ceph_x_encrypt_header."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable CephX decrypt path processes auth payloads received over the Ceph messenger TCP protocol from monitors/OSDs/MDSs. A malicious or compromised remote Ceph peer can supply the malformed auth frame during connection authentication.\nAC:L - The attacker controls the frame and ciphertext length needed to reach the missing plaintext-size check. No race or unusual victim state is required once the kernel client connects to the attacker-controlled peer.\nPR:N - The vulnerable parsing occurs in the authentication handshake before the remote peer has been authenticated by the kernel client. The attacker needs no privileges on the vulnerable system.\nUI:N - In a reasonable deployment, a configured kernel Ceph client connects or reconnects to its Ceph peers automatically. Exploitation does not require an interactive victim action at trigger time.\nS:U - The impact is within the kernel/client system processing the Ceph protocol. It does not cross a separate security authority such as a guest-to-host or IOMMU boundary.\nC:N - The bug is a bounded out-of-bounds read of the CephX encryption header magic field, but the read value is only compared internally and is not returned to the attacker. There is no practical information disclosure primitive.\nI:N - The vulnerable code performs no write based on the out-of-bounds access. The fix adds a read-side length check and there is no memory corruption or data modification path.\nA:H - The peer-controlled short plaintext can trigger an out-of-bounds kernel memory access in the auth receive path. Such kernel OOB accesses can produce an oops/panic or otherwise terminate the Ceph client connection, so availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:06.334Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c7e9b53aebe401970f1b5f5a01b4e021b18e8bb2"
},
{
"url": "https://git.kernel.org/stable/c/821365487aa58d06bda65c676ba215d506ba9768"
}
],
"title": "libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52956",
"datePublished": "2026-06-24T16:28:38.414Z",
"dateReserved": "2026-06-09T07:44:35.373Z",
"dateUpdated": "2026-08-05T12:32:06.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43269 (GCVE-0-2026-43269)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback
After several commits, the slab memory increases. Some drm_crtc_commit
objects are not freed. The atomic_destroy_state callback only put the
framebuffer. Use the __drm_atomic_helper_plane_destroy_state() function
to put all the objects that are no longer needed.
It has been seen after hours of usage of a graphics application or using
kmemleak:
unreferenced object 0xc63a6580 (size 64):
comm "egt_basic", pid 171, jiffies 4294940784
hex dump (first 32 bytes):
40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:.
8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:.
backtrace (crc c25aa925):
kmemleak_alloc+0x34/0x3c
__kmalloc_cache_noprof+0x150/0x1a4
drm_atomic_helper_setup_commit+0x1e8/0x7bc
drm_atomic_helper_commit+0x3c/0x15c
drm_atomic_commit+0xc0/0xf4
drm_atomic_helper_set_config+0x84/0xb8
drm_mode_setcrtc+0x32c/0x810
drm_ioctl+0x20c/0x488
sys_ioctl+0x14c/0xc20
ret_fast_syscall+0x0/0x54
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2389fc1305fc1e2cf8b310a75463fefd3058bf48 Version: 2389fc1305fc1e2cf8b310a75463fefd3058bf48 Version: 2389fc1305fc1e2cf8b310a75463fefd3058bf48 Version: 2389fc1305fc1e2cf8b310a75463fefd3058bf48 Version: 2389fc1305fc1e2cf8b310a75463fefd3058bf48 Version: 2389fc1305fc1e2cf8b310a75463fefd3058bf48 Version: 2389fc1305fc1e2cf8b310a75463fefd3058bf48 Version: 2389fc1305fc1e2cf8b310a75463fefd3058bf48 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6d4e91ab97fda64e8cf9c8881cc3b4da026bd849",
"status": "affected",
"version": "2389fc1305fc1e2cf8b310a75463fefd3058bf48",
"versionType": "git"
},
{
"lessThan": "5718d98976ad6b9700e5a6afec67fc47a8a92580",
"status": "affected",
"version": "2389fc1305fc1e2cf8b310a75463fefd3058bf48",
"versionType": "git"
},
{
"lessThan": "57fa3487acfa3467405f8506b94682abd96e7393",
"status": "affected",
"version": "2389fc1305fc1e2cf8b310a75463fefd3058bf48",
"versionType": "git"
},
{
"lessThan": "ec40702029b08ee8d5f5b03303d64a10e74a957b",
"status": "affected",
"version": "2389fc1305fc1e2cf8b310a75463fefd3058bf48",
"versionType": "git"
},
{
"lessThan": "25e832a7830740e72103eb0b527680a4b64bbcb3",
"status": "affected",
"version": "2389fc1305fc1e2cf8b310a75463fefd3058bf48",
"versionType": "git"
},
{
"lessThan": "082271e364a3205598c2e4e6233a9f49ce7941cf",
"status": "affected",
"version": "2389fc1305fc1e2cf8b310a75463fefd3058bf48",
"versionType": "git"
},
{
"lessThan": "3e64e78f4a70e3f6ac8fe5a7071f08ffd25a2489",
"status": "affected",
"version": "2389fc1305fc1e2cf8b310a75463fefd3058bf48",
"versionType": "git"
},
{
"lessThan": "f12352471061df83a36edf54bbb16284793284e4",
"status": "affected",
"version": "2389fc1305fc1e2cf8b310a75463fefd3058bf48",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback\n\nAfter several commits, the slab memory increases. Some drm_crtc_commit\nobjects are not freed. The atomic_destroy_state callback only put the\nframebuffer. Use the __drm_atomic_helper_plane_destroy_state() function\nto put all the objects that are no longer needed.\n\nIt has been seen after hours of usage of a graphics application or using\nkmemleak:\n\nunreferenced object 0xc63a6580 (size 64):\n comm \"egt_basic\", pid 171, jiffies 4294940784\n hex dump (first 32 bytes):\n 40 50 34 c5 01 00 00 00 ff ff ff ff 8c 65 3a c6 @P4..........e:.\n 8c 65 3a c6 ff ff ff ff 98 65 3a c6 98 65 3a c6 .e:......e:..e:.\n backtrace (crc c25aa925):\n kmemleak_alloc+0x34/0x3c\n __kmalloc_cache_noprof+0x150/0x1a4\n drm_atomic_helper_setup_commit+0x1e8/0x7bc\n drm_atomic_helper_commit+0x3c/0x15c\n drm_atomic_commit+0xc0/0xf4\n drm_atomic_helper_set_config+0x84/0xb8\n drm_mode_setcrtc+0x32c/0x810\n drm_ioctl+0x20c/0x488\n sys_ioctl+0x14c/0xc20\n ret_fast_syscall+0x0/0x54"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:21:17.527Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6d4e91ab97fda64e8cf9c8881cc3b4da026bd849"
},
{
"url": "https://git.kernel.org/stable/c/5718d98976ad6b9700e5a6afec67fc47a8a92580"
},
{
"url": "https://git.kernel.org/stable/c/57fa3487acfa3467405f8506b94682abd96e7393"
},
{
"url": "https://git.kernel.org/stable/c/ec40702029b08ee8d5f5b03303d64a10e74a957b"
},
{
"url": "https://git.kernel.org/stable/c/25e832a7830740e72103eb0b527680a4b64bbcb3"
},
{
"url": "https://git.kernel.org/stable/c/082271e364a3205598c2e4e6233a9f49ce7941cf"
},
{
"url": "https://git.kernel.org/stable/c/3e64e78f4a70e3f6ac8fe5a7071f08ffd25a2489"
},
{
"url": "https://git.kernel.org/stable/c/f12352471061df83a36edf54bbb16284793284e4"
}
],
"title": "drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43269",
"datePublished": "2026-05-06T11:28:54.178Z",
"dateReserved": "2026-05-01T14:12:55.997Z",
"dateUpdated": "2026-05-11T22:21:17.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46056 (GCVE-0-2026-46056)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
hci_conn lookup and field access must be covered by hdev lock in
hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise
the connection can be freed concurrently.
Extend the hci_dev_lock critical section to cover all conn usage in both
handlers.
Keep the existing keypress notification behavior unchanged by routing
the early exits through a common unlock path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 92a25256f142d55e25f9959441cea6ddeabae57e Version: 92a25256f142d55e25f9959441cea6ddeabae57e Version: 92a25256f142d55e25f9959441cea6ddeabae57e Version: 92a25256f142d55e25f9959441cea6ddeabae57e Version: 92a25256f142d55e25f9959441cea6ddeabae57e Version: 92a25256f142d55e25f9959441cea6ddeabae57e Version: 92a25256f142d55e25f9959441cea6ddeabae57e Version: 92a25256f142d55e25f9959441cea6ddeabae57e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ea18732d2614557e59f4c0d8cdbe6611aeab33b7",
"status": "affected",
"version": "92a25256f142d55e25f9959441cea6ddeabae57e",
"versionType": "git"
},
{
"lessThan": "d28311539ac9f65e29308ea219ecaa48aa5e76e5",
"status": "affected",
"version": "92a25256f142d55e25f9959441cea6ddeabae57e",
"versionType": "git"
},
{
"lessThan": "b6ae482f88654db407c8c17619d4b62959b903ef",
"status": "affected",
"version": "92a25256f142d55e25f9959441cea6ddeabae57e",
"versionType": "git"
},
{
"lessThan": "204028af77a265e31ceb4ba7f643349a3cca72b2",
"status": "affected",
"version": "92a25256f142d55e25f9959441cea6ddeabae57e",
"versionType": "git"
},
{
"lessThan": "01a6431766c35dfedb86e0cb5d3fc80c6d604a47",
"status": "affected",
"version": "92a25256f142d55e25f9959441cea6ddeabae57e",
"versionType": "git"
},
{
"lessThan": "e08d75753db17aa943d7622f09d9c217b5bfd3b8",
"status": "affected",
"version": "92a25256f142d55e25f9959441cea6ddeabae57e",
"versionType": "git"
},
{
"lessThan": "8c6443bb9257b780986fb67ec08565bf48ecb8d7",
"status": "affected",
"version": "92a25256f142d55e25f9959441cea6ddeabae57e",
"versionType": "git"
},
{
"lessThan": "85fa3512048793076eef658f66489112dcc91993",
"status": "affected",
"version": "92a25256f142d55e25f9959441cea6ddeabae57e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: fix potential UAF in SSP passkey handlers\n\nhci_conn lookup and field access must be covered by hdev lock in\nhci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise\nthe connection can be freed concurrently.\n\nExtend the hci_dev_lock critical section to cover all conn usage in both\nhandlers.\n\nKeep the existing keypress notification behavior unchanged by routing\nthe early exits through a common unlock path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable handlers process HCI Secure Simple Pairing events (User Passkey Notify / Keypress Notify) driven by a remote Bluetooth peer during SSP pairing, so the attacker must be within Bluetooth radio range (adjacent), matching kernel guidance that Bluetooth = Adjacent.\nAC:L - This is a use-after-free where a remote peer drives the passkey/keypress events while connection teardown frees the conn from a concurrent context; the attacker influences both sides of the race and can retry, and UAF bugs are scored AC:L unless the race is uncontrollable.\nPR:N - The code path is reached by a remote Bluetooth device participating in the SSP pairing handshake, requiring no credentials or privileges on the target system.\nUI:N - The handlers execute automatically when the controller forwards the SSP passkey/keypress HCI events during the pairing protocol exchange; no local user action is required to reach the vulnerable code.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The use-after-free reads fields (dst, type, dst_type, passkey) from a freed and potentially reallocated hci_conn object, which can disclose attacker-controlled or sensitive kernel heap contents.\nI:H - The handlers write to the freed object (passkey_notify and passkey_entered fields), giving a UAF write into reallocated heap memory that can be leveraged for heap grooming and control-flow corruption.\nA:H - A use-after-free on the hci_conn structure readily causes kernel oops/panic, yielding high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:24.462Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ea18732d2614557e59f4c0d8cdbe6611aeab33b7"
},
{
"url": "https://git.kernel.org/stable/c/d28311539ac9f65e29308ea219ecaa48aa5e76e5"
},
{
"url": "https://git.kernel.org/stable/c/b6ae482f88654db407c8c17619d4b62959b903ef"
},
{
"url": "https://git.kernel.org/stable/c/204028af77a265e31ceb4ba7f643349a3cca72b2"
},
{
"url": "https://git.kernel.org/stable/c/01a6431766c35dfedb86e0cb5d3fc80c6d604a47"
},
{
"url": "https://git.kernel.org/stable/c/e08d75753db17aa943d7622f09d9c217b5bfd3b8"
},
{
"url": "https://git.kernel.org/stable/c/8c6443bb9257b780986fb67ec08565bf48ecb8d7"
},
{
"url": "https://git.kernel.org/stable/c/85fa3512048793076eef658f66489112dcc91993"
}
],
"title": "Bluetooth: hci_event: fix potential UAF in SSP passkey handlers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46056",
"datePublished": "2026-05-27T12:57:15.150Z",
"dateReserved": "2026-05-13T15:03:33.094Z",
"dateUpdated": "2026-08-05T12:29:24.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43457 (GCVE-0-2026-43457)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-11 22:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mctp: i2c: fix skb memory leak in receive path
When 'midev->allow_rx' is false, the newly allocated skb isn't consumed
by netif_rx(), it needs to free the skb directly.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f5b8abf9fc3dacd7529d363e26fe8230935d65f8 Version: f5b8abf9fc3dacd7529d363e26fe8230935d65f8 Version: f5b8abf9fc3dacd7529d363e26fe8230935d65f8 Version: f5b8abf9fc3dacd7529d363e26fe8230935d65f8 Version: f5b8abf9fc3dacd7529d363e26fe8230935d65f8 Version: f5b8abf9fc3dacd7529d363e26fe8230935d65f8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/mctp/mctp-i2c.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0fb2adbdd5c03e8c9ebcdc48afd414b2724c85eb",
"status": "affected",
"version": "f5b8abf9fc3dacd7529d363e26fe8230935d65f8",
"versionType": "git"
},
{
"lessThan": "d7900a43b0a314a645ca0a2adf45928dbc7001f4",
"status": "affected",
"version": "f5b8abf9fc3dacd7529d363e26fe8230935d65f8",
"versionType": "git"
},
{
"lessThan": "9f81be2ab9d8e4744871bfb3e868ef413413829f",
"status": "affected",
"version": "f5b8abf9fc3dacd7529d363e26fe8230935d65f8",
"versionType": "git"
},
{
"lessThan": "1ec54187e1aa40a4cfa2b265e9a311179f24b98d",
"status": "affected",
"version": "f5b8abf9fc3dacd7529d363e26fe8230935d65f8",
"versionType": "git"
},
{
"lessThan": "1b1be322342a6b0085bf6ee52235e5ac9834ec25",
"status": "affected",
"version": "f5b8abf9fc3dacd7529d363e26fe8230935d65f8",
"versionType": "git"
},
{
"lessThan": "e3f5e0f22cfc2371e7471c9fd5b4da78f9df7c69",
"status": "affected",
"version": "f5b8abf9fc3dacd7529d363e26fe8230935d65f8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/mctp/mctp-i2c.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmctp: i2c: fix skb memory leak in receive path\n\nWhen \u0027midev-\u003eallow_rx\u0027 is false, the newly allocated skb isn\u0027t consumed\nby netif_rx(), it needs to free the skb directly."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:57.488Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0fb2adbdd5c03e8c9ebcdc48afd414b2724c85eb"
},
{
"url": "https://git.kernel.org/stable/c/d7900a43b0a314a645ca0a2adf45928dbc7001f4"
},
{
"url": "https://git.kernel.org/stable/c/9f81be2ab9d8e4744871bfb3e868ef413413829f"
},
{
"url": "https://git.kernel.org/stable/c/1ec54187e1aa40a4cfa2b265e9a311179f24b98d"
},
{
"url": "https://git.kernel.org/stable/c/1b1be322342a6b0085bf6ee52235e5ac9834ec25"
},
{
"url": "https://git.kernel.org/stable/c/e3f5e0f22cfc2371e7471c9fd5b4da78f9df7c69"
}
],
"title": "mctp: i2c: fix skb memory leak in receive path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43457",
"datePublished": "2026-05-08T14:22:20.725Z",
"dateReserved": "2026-05-01T14:12:56.010Z",
"dateUpdated": "2026-05-11T22:24:57.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43425 (GCVE-0-2026-43425)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-05-11 22:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: image: mdc800: kill download URB on timeout
mdc800_device_read() submits download_urb and waits for completion.
If the timeout fires and the device has not responded, the function
returns without killing the URB, leaving it active.
A subsequent read() resubmits the same URB while it is still
in-flight, triggering the WARN in usb_submit_urb():
"URB submitted while active"
Check the return value of wait_event_timeout() and kill the URB if
it indicates timeout, ensuring the URB is complete before its status
is inspected or the URB is resubmitted.
Similar to
- commit 372c93131998 ("USB: yurex: fix control-URB timeout handling")
- commit b98d5000c505 ("media: rc: iguanair: handle timeouts")
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/image/mdc800.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9fa5a49760979ba016506fe292a431c8b83f043e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "15536f6c15f48037a1672cbdea53266d67861ff6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9bf877cc67309b2a063b0087c3ad8585fb11cec3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "155f471e38aa516f6c58c2ae03ca3dc222fa2fdb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d4a400a6a4c4d49f77a04a3f401df5ae1a10657c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b7fed917f84e484e06c5e9926746d0b524e3a93e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "cc7398447810c9450c90d092efe9997569f8d96f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1be3b77de4eb89af8ae2fd6610546be778e25589",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/image/mdc800.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: image: mdc800: kill download URB on timeout\n\nmdc800_device_read() submits download_urb and waits for completion.\nIf the timeout fires and the device has not responded, the function\nreturns without killing the URB, leaving it active.\n\nA subsequent read() resubmits the same URB while it is still\nin-flight, triggering the WARN in usb_submit_urb():\n\n \"URB submitted while active\"\n\nCheck the return value of wait_event_timeout() and kill the URB if\nit indicates timeout, ensuring the URB is complete before its status\nis inspected or the URB is resubmitted.\n\nSimilar to\n- commit 372c93131998 (\"USB: yurex: fix control-URB timeout handling\")\n- commit b98d5000c505 (\"media: rc: iguanair: handle timeouts\")"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:20.496Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9fa5a49760979ba016506fe292a431c8b83f043e"
},
{
"url": "https://git.kernel.org/stable/c/15536f6c15f48037a1672cbdea53266d67861ff6"
},
{
"url": "https://git.kernel.org/stable/c/9bf877cc67309b2a063b0087c3ad8585fb11cec3"
},
{
"url": "https://git.kernel.org/stable/c/155f471e38aa516f6c58c2ae03ca3dc222fa2fdb"
},
{
"url": "https://git.kernel.org/stable/c/d4a400a6a4c4d49f77a04a3f401df5ae1a10657c"
},
{
"url": "https://git.kernel.org/stable/c/b7fed917f84e484e06c5e9926746d0b524e3a93e"
},
{
"url": "https://git.kernel.org/stable/c/cc7398447810c9450c90d092efe9997569f8d96f"
},
{
"url": "https://git.kernel.org/stable/c/1be3b77de4eb89af8ae2fd6610546be778e25589"
}
],
"title": "usb: image: mdc800: kill download URB on timeout",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43425",
"datePublished": "2026-05-08T14:21:59.020Z",
"dateReserved": "2026-05-01T14:12:56.009Z",
"dateUpdated": "2026-05-11T22:24:20.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45912 (GCVE-0-2026-45912)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-30 10:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: don't cache extent during splitting extent
Caching extents during the splitting process is risky, as it may result
in stale extents remaining in the status tree. Moreover, in most cases,
the corresponding extent block entries are likely already cached before
the split happens, making caching here not particularly useful.
Assume we have an unwritten extent, and then DIO writes the first half.
[UUUUUUUUUUUUUUUU] on-disk extent U: unwritten extent
[UUUUUUUUUUUUUUUU] extent status tree
|<- ->| ----> dio write this range
First, when ext4_split_extent_at() splits this extent, it truncates the
existing extent and then inserts a new one. During this process, this
extent status entry may be shrunk, and calls to ext4_find_extent() and
ext4_cache_extents() may occur, which could potentially insert the
truncated range as a hole into the extent status tree. After the split
is completed, this hole is not replaced with the correct status.
[UUUUUUU|UUUUUUUU] on-disk extent U: unwritten extent
[UUUUUUU|HHHHHHHH] extent status tree H: hole
Then, the outer calling functions will not correct this remaining hole
extent either. Finally, if we perform a delayed buffer write on this
latter part, it will re-insert the delayed extent and cause an error in
space accounting.
In adition, if the unwritten extent cache is not shrunk during the
splitting, ext4_cache_extents() also conflicts with existing extents
when caching extents. In the future, we will add checks when caching
extents, which will trigger a warning. Therefore, Do not cache extents
that are being split.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 107a7bd31ac003e42c0f966aa8e5b26947de6024 Version: 107a7bd31ac003e42c0f966aa8e5b26947de6024 Version: 107a7bd31ac003e42c0f966aa8e5b26947de6024 Version: 107a7bd31ac003e42c0f966aa8e5b26947de6024 Version: 107a7bd31ac003e42c0f966aa8e5b26947de6024 Version: 107a7bd31ac003e42c0f966aa8e5b26947de6024 Version: 107a7bd31ac003e42c0f966aa8e5b26947de6024 Version: 107a7bd31ac003e42c0f966aa8e5b26947de6024 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/extents.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8302b5b4aacdbb378f7b1216bb2ee782b5142415",
"status": "affected",
"version": "107a7bd31ac003e42c0f966aa8e5b26947de6024",
"versionType": "git"
},
{
"lessThan": "692103feca376ae4298c92aa8828015d20f1d87b",
"status": "affected",
"version": "107a7bd31ac003e42c0f966aa8e5b26947de6024",
"versionType": "git"
},
{
"lessThan": "4c2d9dac4d328244f9365b0a1fa27ec802821820",
"status": "affected",
"version": "107a7bd31ac003e42c0f966aa8e5b26947de6024",
"versionType": "git"
},
{
"lessThan": "93b2ebbbcb2e63cfc21a1946dfe91d3aa7952036",
"status": "affected",
"version": "107a7bd31ac003e42c0f966aa8e5b26947de6024",
"versionType": "git"
},
{
"lessThan": "96007fd3c106aea773c1afae2d6f64cceb6da208",
"status": "affected",
"version": "107a7bd31ac003e42c0f966aa8e5b26947de6024",
"versionType": "git"
},
{
"lessThan": "5b1f4290453314e11cd8e15c7baa8a9b76c19b23",
"status": "affected",
"version": "107a7bd31ac003e42c0f966aa8e5b26947de6024",
"versionType": "git"
},
{
"lessThan": "9a2b95cdaf07785e2739199037bd9c0863ccc1be",
"status": "affected",
"version": "107a7bd31ac003e42c0f966aa8e5b26947de6024",
"versionType": "git"
},
{
"lessThan": "8b4b19a2f96348d70bfa306ef7d4a13b0bcbea79",
"status": "affected",
"version": "107a7bd31ac003e42c0f966aa8e5b26947de6024",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/extents.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.12"
},
{
"lessThan": "3.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: don\u0027t cache extent during splitting extent\n\nCaching extents during the splitting process is risky, as it may result\nin stale extents remaining in the status tree. Moreover, in most cases,\nthe corresponding extent block entries are likely already cached before\nthe split happens, making caching here not particularly useful.\n\nAssume we have an unwritten extent, and then DIO writes the first half.\n\n [UUUUUUUUUUUUUUUU] on-disk extent U: unwritten extent\n [UUUUUUUUUUUUUUUU] extent status tree\n |\u003c- -\u003e| ----\u003e dio write this range\n\nFirst, when ext4_split_extent_at() splits this extent, it truncates the\nexisting extent and then inserts a new one. During this process, this\nextent status entry may be shrunk, and calls to ext4_find_extent() and\next4_cache_extents() may occur, which could potentially insert the\ntruncated range as a hole into the extent status tree. After the split\nis completed, this hole is not replaced with the correct status.\n\n [UUUUUUU|UUUUUUUU] on-disk extent U: unwritten extent\n [UUUUUUU|HHHHHHHH] extent status tree H: hole\n\nThen, the outer calling functions will not correct this remaining hole\nextent either. Finally, if we perform a delayed buffer write on this\nlatter part, it will re-insert the delayed extent and cause an error in\nspace accounting.\n\nIn adition, if the unwritten extent cache is not shrunk during the\nsplitting, ext4_cache_extents() also conflicts with existing extents\nwhen caching extents. In the future, we will add checks when caching\nextents, which will trigger a warning. Therefore, Do not cache extents\nthat are being split."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-30T10:41:46.666Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8302b5b4aacdbb378f7b1216bb2ee782b5142415"
},
{
"url": "https://git.kernel.org/stable/c/692103feca376ae4298c92aa8828015d20f1d87b"
},
{
"url": "https://git.kernel.org/stable/c/4c2d9dac4d328244f9365b0a1fa27ec802821820"
},
{
"url": "https://git.kernel.org/stable/c/93b2ebbbcb2e63cfc21a1946dfe91d3aa7952036"
},
{
"url": "https://git.kernel.org/stable/c/96007fd3c106aea773c1afae2d6f64cceb6da208"
},
{
"url": "https://git.kernel.org/stable/c/5b1f4290453314e11cd8e15c7baa8a9b76c19b23"
},
{
"url": "https://git.kernel.org/stable/c/9a2b95cdaf07785e2739199037bd9c0863ccc1be"
},
{
"url": "https://git.kernel.org/stable/c/8b4b19a2f96348d70bfa306ef7d4a13b0bcbea79"
}
],
"title": "ext4: don\u0027t cache extent during splitting extent",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45912",
"datePublished": "2026-05-27T12:17:27.805Z",
"dateReserved": "2026-05-13T15:03:33.085Z",
"dateUpdated": "2026-05-30T10:41:46.666Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46294 (GCVE-0-2026-46294)
Vulnerability from cvelistv5
Published
2026-06-08 15:46
Modified
2026-06-14 18:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm: fix a buffer overflow in ioctl processing
Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the
function retrieve_status:
1. The code in retrieve_status checks that the output string fits into
the output buffer and writes the output string there
2. Then, the code aligns the "outptr" variable to the next 8-byte
boundary:
outptr = align_ptr(outptr);
3. The alignment doesn't check overflow, so outptr could point past the
buffer end
4. The "for" loop is iterated again, it executes:
remaining = len - (outptr - outbuf);
5. If "outptr" points past "outbuf + len", the arithmetics wraps around
and the variable "remaining" contains unusually high number
6. With "remaining" being high, the code writes more data past the end of
the buffer
Luckily, this bug has no security implications because:
1. Only root can issue device mapper ioctls
2. The commonly used libraries that communicate with device mapper
(libdevmapper and devicemapper-rs) use buffer size that is aligned to
8 bytes - thus, "outptr = align_ptr(outptr)" can't overshoot the input
buffer and the bug can't happen accidentally
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c8c5311237448f6ffeecc9aec2362e3692623668",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "526ff9126a0ae087b65726e1faf31114c718020d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f0b0b09d9840838ae77ccdd6a62de0daef4e6e0a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d271631023cbe1cbe7c31a0275ab797883be6e0a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5af6a879e915ae7bcd83695c316ebb32e1c61bc2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8daa6c708ef524089ae43f2aed9190acb26d7df8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2fa49cc884f6496a915c35621ba4da35649bf159",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix a buffer overflow in ioctl processing\n\nTony Asleson (using Claude) found a buffer overflow in dm-ioctl in the\nfunction retrieve_status:\n\n1. The code in retrieve_status checks that the output string fits into\n the output buffer and writes the output string there\n2. Then, the code aligns the \"outptr\" variable to the next 8-byte\n boundary:\n\toutptr = align_ptr(outptr);\n3. The alignment doesn\u0027t check overflow, so outptr could point past the\n buffer end\n4. The \"for\" loop is iterated again, it executes:\n\tremaining = len - (outptr - outbuf);\n5. If \"outptr\" points past \"outbuf + len\", the arithmetics wraps around\n and the variable \"remaining\" contains unusually high number\n6. With \"remaining\" being high, the code writes more data past the end of\n the buffer\n\nLuckily, this bug has no security implications because:\n1. Only root can issue device mapper ioctls\n2. The commonly used libraries that communicate with device mapper\n (libdevmapper and devicemapper-rs) use buffer size that is aligned to\n 8 bytes - thus, \"outptr = align_ptr(outptr)\" can\u0027t overshoot the input\n buffer and the bug can\u0027t happen accidentally"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:07:06.194Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c8c5311237448f6ffeecc9aec2362e3692623668"
},
{
"url": "https://git.kernel.org/stable/c/448ee8fb79c26a26599ffa4b2adeb4322d3d3d8c"
},
{
"url": "https://git.kernel.org/stable/c/526ff9126a0ae087b65726e1faf31114c718020d"
},
{
"url": "https://git.kernel.org/stable/c/f0b0b09d9840838ae77ccdd6a62de0daef4e6e0a"
},
{
"url": "https://git.kernel.org/stable/c/d271631023cbe1cbe7c31a0275ab797883be6e0a"
},
{
"url": "https://git.kernel.org/stable/c/5af6a879e915ae7bcd83695c316ebb32e1c61bc2"
},
{
"url": "https://git.kernel.org/stable/c/8daa6c708ef524089ae43f2aed9190acb26d7df8"
},
{
"url": "https://git.kernel.org/stable/c/2fa49cc884f6496a915c35621ba4da35649bf159"
}
],
"title": "dm: fix a buffer overflow in ioctl processing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46294",
"datePublished": "2026-06-08T15:46:21.401Z",
"dateReserved": "2026-05-13T15:03:33.110Z",
"dateUpdated": "2026-06-14T18:07:06.194Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53036 (GCVE-0-2026-53036)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Fix off-by-one in check_imm signed range check
check_imm(bits, imm) is used in the arm64 BPF JIT to verify that
a branch displacement (in arm64 instruction units) fits into the
signed N-bit immediate field of a B, B.cond or CBZ/CBNZ encoding
before it is handed to the encoder. The macro currently tests for
(imm > 0 && imm >> bits) || (imm < 0 && ~imm >> bits) which admits
values in [-2^N, 2^N) — effectively a signed (N+1)-bit range. A
signed N-bit field only holds [-2^(N-1), 2^(N-1)), so the check
admits one extra bit of range on each side.
In particular, for check_imm19(), values in [2^18, 2^19) slip past
the check but do not fit into the 19-bit signed imm19 field of
B.cond. aarch64_insn_encode_immediate() then masks the raw value
into the 19-bit field, setting bit 18 (the sign bit) and flipping
a forward branch into a backward one. Same class of issue exists
for check_imm26() and the B/BL encoding. Shift by (bits - 1)
instead of bits so the actual signed N-bit range is enforced.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e54bcde3d69d40023ae77727213d14f920eb264a Version: e54bcde3d69d40023ae77727213d14f920eb264a Version: e54bcde3d69d40023ae77727213d14f920eb264a Version: e54bcde3d69d40023ae77727213d14f920eb264a Version: e54bcde3d69d40023ae77727213d14f920eb264a Version: e54bcde3d69d40023ae77727213d14f920eb264a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/net/bpf_jit_comp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a5dfeb3b61065039488342d43ae06d4729d955d4",
"status": "affected",
"version": "e54bcde3d69d40023ae77727213d14f920eb264a",
"versionType": "git"
},
{
"lessThan": "7fd3b41260c6120e7b60164afea5d961af6224f9",
"status": "affected",
"version": "e54bcde3d69d40023ae77727213d14f920eb264a",
"versionType": "git"
},
{
"lessThan": "6927f0d6794aa73318bbfa929f1ff6065b0620df",
"status": "affected",
"version": "e54bcde3d69d40023ae77727213d14f920eb264a",
"versionType": "git"
},
{
"lessThan": "1a113b5497297871699cd498b1b83542e0db7f15",
"status": "affected",
"version": "e54bcde3d69d40023ae77727213d14f920eb264a",
"versionType": "git"
},
{
"lessThan": "fb74defa1cca1a73177c0c761e641332e4f979a3",
"status": "affected",
"version": "e54bcde3d69d40023ae77727213d14f920eb264a",
"versionType": "git"
},
{
"lessThan": "1dd8be4ec722ce54e4cace59f3a4ba658111b3ec",
"status": "affected",
"version": "e54bcde3d69d40023ae77727213d14f920eb264a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/net/bpf_jit_comp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, arm64: Fix off-by-one in check_imm signed range check\n\ncheck_imm(bits, imm) is used in the arm64 BPF JIT to verify that\na branch displacement (in arm64 instruction units) fits into the\nsigned N-bit immediate field of a B, B.cond or CBZ/CBNZ encoding\nbefore it is handed to the encoder. The macro currently tests for\n(imm \u003e 0 \u0026\u0026 imm \u003e\u003e bits) || (imm \u003c 0 \u0026\u0026 ~imm \u003e\u003e bits) which admits\nvalues in [-2^N, 2^N) \u2014 effectively a signed (N+1)-bit range. A\nsigned N-bit field only holds [-2^(N-1), 2^(N-1)), so the check\nadmits one extra bit of range on each side.\n\nIn particular, for check_imm19(), values in [2^18, 2^19) slip past\nthe check but do not fit into the 19-bit signed imm19 field of\nB.cond. aarch64_insn_encode_immediate() then masks the raw value\ninto the 19-bit field, setting bit 18 (the sign bit) and flipping\na forward branch into a backward one. Same class of issue exists\nfor check_imm26() and the B/BL encoding. Shift by (bits - 1)\ninstead of bits so the actual signed N-bit range is enforced."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable arm64 BPF JIT code is reached by a local attacker through the bpf() syscall with BPF_PROG_LOAD, not by remote packets or adjacent/physical access.\nAC:L - Triggering is deterministic once the attacker can load a suitably large BPF program on an arm64 kernel with BPF JIT enabled; there is no race or victim state dependency.\nPR:L - The oversized program needed to hit the bad immediate range requires privileged BPF loading, but BPF tokens/namespaced delegation make this reachable with non-host-root delegated privileges in plausible deployments. Under the required uncertainty rule, PR:L is the higher-severity defensible choice over PR:H.\nUI:N - No victim action is required after the attacker submits and runs the crafted BPF program.\nS:U - The vulnerability affects kernel execution within the same host security authority and is a standard local kernel compromise path, not a VM/container boundary escape by itself.\nC:H - The JIT can emit a verifier-unmodeled branch into attacker-shaped native BPF code, a BPF JIT verifier-bypass class issue that can plausibly yield arbitrary kernel memory read.\nI:H - The miscompiled branch can redirect execution through unintended JIT code paths, making arbitrary kernel code execution or write primitives defensible.\nA:H - Even without full exploitation, the invalid native control flow can reliably crash or hang kernel execution when the malformed BPF program runs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:47.252Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a5dfeb3b61065039488342d43ae06d4729d955d4"
},
{
"url": "https://git.kernel.org/stable/c/7fd3b41260c6120e7b60164afea5d961af6224f9"
},
{
"url": "https://git.kernel.org/stable/c/6927f0d6794aa73318bbfa929f1ff6065b0620df"
},
{
"url": "https://git.kernel.org/stable/c/1a113b5497297871699cd498b1b83542e0db7f15"
},
{
"url": "https://git.kernel.org/stable/c/fb74defa1cca1a73177c0c761e641332e4f979a3"
},
{
"url": "https://git.kernel.org/stable/c/1dd8be4ec722ce54e4cace59f3a4ba658111b3ec"
}
],
"title": "bpf, arm64: Fix off-by-one in check_imm signed range check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53036",
"datePublished": "2026-06-24T16:29:43.449Z",
"dateReserved": "2026-06-09T07:44:35.380Z",
"dateUpdated": "2026-08-05T12:32:47.252Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31429 (GCVE-0-2026-31429)
Vulnerability from cvelistv5
Published
2026-04-20 09:43
Modified
2026-05-11 22:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: skb: fix cross-cache free of KFENCE-allocated skb head
SKB_SMALL_HEAD_CACHE_SIZE is intentionally set to a non-power-of-2
value (e.g. 704 on x86_64) to avoid collisions with generic kmalloc
bucket sizes. This ensures that skb_kfree_head() can reliably use
skb_end_offset to distinguish skb heads allocated from
skb_small_head_cache vs. generic kmalloc caches.
However, when KFENCE is enabled, kfence_ksize() returns the exact
requested allocation size instead of the slab bucket size. If a caller
(e.g. bpf_test_init) allocates skb head data via kzalloc() and the
requested size happens to equal SKB_SMALL_HEAD_CACHE_SIZE, then
slab_build_skb() -> ksize() returns that exact value. After subtracting
skb_shared_info overhead, skb_end_offset ends up matching
SKB_SMALL_HEAD_HEADROOM, causing skb_kfree_head() to incorrectly free
the object to skb_small_head_cache instead of back to the original
kmalloc cache, resulting in a slab cross-cache free:
kmem_cache_free(skbuff_small_head): Wrong slab cache. Expected
skbuff_small_head but got kmalloc-1k
Fix this by always calling kfree(head) in skb_kfree_head(). This keeps
the free path generic and avoids allocator-specific misclassification
for KFENCE objects.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/skbuff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "128b03ccb2582a643983a48a37fda58df80edbde",
"status": "affected",
"version": "bf9f1baa279f0758dc2297080360c5a616843927",
"versionType": "git"
},
{
"lessThan": "60313768a8edc7094435975587c00c2d7b834083",
"status": "affected",
"version": "bf9f1baa279f0758dc2297080360c5a616843927",
"versionType": "git"
},
{
"lessThan": "2d64618ea846d8d033477311f805ca487d6a6696",
"status": "affected",
"version": "bf9f1baa279f0758dc2297080360c5a616843927",
"versionType": "git"
},
{
"lessThan": "474e00b935db250cac320d10c1d3cf4e44b46721",
"status": "affected",
"version": "bf9f1baa279f0758dc2297080360c5a616843927",
"versionType": "git"
},
{
"lessThan": "0f42e3f4fe2a58394e37241d02d9ca6ab7b7d516",
"status": "affected",
"version": "bf9f1baa279f0758dc2297080360c5a616843927",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/skbuff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.82",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skb: fix cross-cache free of KFENCE-allocated skb head\n\nSKB_SMALL_HEAD_CACHE_SIZE is intentionally set to a non-power-of-2\nvalue (e.g. 704 on x86_64) to avoid collisions with generic kmalloc\nbucket sizes. This ensures that skb_kfree_head() can reliably use\nskb_end_offset to distinguish skb heads allocated from\nskb_small_head_cache vs. generic kmalloc caches.\n\nHowever, when KFENCE is enabled, kfence_ksize() returns the exact\nrequested allocation size instead of the slab bucket size. If a caller\n(e.g. bpf_test_init) allocates skb head data via kzalloc() and the\nrequested size happens to equal SKB_SMALL_HEAD_CACHE_SIZE, then\nslab_build_skb() -\u003e ksize() returns that exact value. After subtracting\nskb_shared_info overhead, skb_end_offset ends up matching\nSKB_SMALL_HEAD_HEADROOM, causing skb_kfree_head() to incorrectly free\nthe object to skb_small_head_cache instead of back to the original\nkmalloc cache, resulting in a slab cross-cache free:\n\n kmem_cache_free(skbuff_small_head): Wrong slab cache. Expected\n skbuff_small_head but got kmalloc-1k\n\nFix this by always calling kfree(head) in skb_kfree_head(). This keeps\nthe free path generic and avoids allocator-specific misclassification\nfor KFENCE objects."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:08:32.321Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/128b03ccb2582a643983a48a37fda58df80edbde"
},
{
"url": "https://git.kernel.org/stable/c/60313768a8edc7094435975587c00c2d7b834083"
},
{
"url": "https://git.kernel.org/stable/c/2d64618ea846d8d033477311f805ca487d6a6696"
},
{
"url": "https://git.kernel.org/stable/c/474e00b935db250cac320d10c1d3cf4e44b46721"
},
{
"url": "https://git.kernel.org/stable/c/0f42e3f4fe2a58394e37241d02d9ca6ab7b7d516"
}
],
"title": "net: skb: fix cross-cache free of KFENCE-allocated skb head",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31429",
"datePublished": "2026-04-20T09:43:03.194Z",
"dateReserved": "2026-03-09T15:48:24.089Z",
"dateUpdated": "2026-05-11T22:08:32.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46289 (GCVE-0-2026-46289)
Vulnerability from cvelistv5
Published
2026-06-08 15:46
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
lib/scatterlist: fix length calculations in extract_kvec_to_sg
Patch series "Fix bugs in extract_iter_to_sg()", v3.
Fix bugs in the kvec and user variants of extract_iter_to_sg. This series
is growing due to useful remarks made by sashiko.dev.
The main bugs are:
- The length for an sglist entry when extracting from
a kvec can exceed the number of bytes in the page. This
is obviously not intended.
- When extracting a user buffer the sglist is temporarily
used as a scratch buffer for extracted page pointers.
If the sglist already contains some elements this scratch
buffer could overlap with existing entries in the sglist.
The series adds test cases to the kunit_iov_iter test that demonstrate all
of these bugs. Additionally, there is a memory leak fix for the test
itself.
The bugs were orignally introduced into kernel v6.3 where the function
lived in fs/netfs/iterator.c. It was later moved to lib/scatterlist.c in
v6.5. Thus the actual fix is only marked for backports to v6.5+.
This patch (of 5):
When extracting from a kvec to a scatterlist, do not cross page
boundaries. The required length was already calculated but not used as
intended.
Adjust the copied length if the loop runs out of sglist entries without
extracting everything.
While there, return immediately from extract_iter_to_sg if there are no
sglist entries at all.
A subsequent commit will add kunit test cases that demonstrate that the
patch is necessary.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"lib/scatterlist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3f17500e86d730c76db638bb3ae52f9b5e496c76",
"status": "affected",
"version": "0185846975339a5c348373aa450a977f5242366b",
"versionType": "git"
},
{
"lessThan": "e5e22fc9963469e678c4f4bb38d26adcec107f1e",
"status": "affected",
"version": "0185846975339a5c348373aa450a977f5242366b",
"versionType": "git"
},
{
"lessThan": "8fbba6829057979149d1b37d65690c037f3ddf4d",
"status": "affected",
"version": "0185846975339a5c348373aa450a977f5242366b",
"versionType": "git"
},
{
"lessThan": "9d38756d0a93b66163554219fa9c3365f40c4035",
"status": "affected",
"version": "0185846975339a5c348373aa450a977f5242366b",
"versionType": "git"
},
{
"lessThan": "07b7d66e65d9cfe6b9c2c34aa22cfcaac37a5c45",
"status": "affected",
"version": "0185846975339a5c348373aa450a977f5242366b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"lib/scatterlist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/scatterlist: fix length calculations in extract_kvec_to_sg\n\nPatch series \"Fix bugs in extract_iter_to_sg()\", v3.\n\nFix bugs in the kvec and user variants of extract_iter_to_sg. This series\nis growing due to useful remarks made by sashiko.dev.\n\nThe main bugs are:\n- The length for an sglist entry when extracting from\n a kvec can exceed the number of bytes in the page. This\n is obviously not intended.\n- When extracting a user buffer the sglist is temporarily\n used as a scratch buffer for extracted page pointers.\n If the sglist already contains some elements this scratch\n buffer could overlap with existing entries in the sglist.\n\nThe series adds test cases to the kunit_iov_iter test that demonstrate all\nof these bugs. Additionally, there is a memory leak fix for the test\nitself.\n\nThe bugs were orignally introduced into kernel v6.3 where the function\nlived in fs/netfs/iterator.c. It was later moved to lib/scatterlist.c in\nv6.5. Thus the actual fix is only marked for backports to v6.5+.\n\n\nThis patch (of 5):\n\nWhen extracting from a kvec to a scatterlist, do not cross page\nboundaries. The required length was already calculated but not used as\nintended.\n\nAdjust the copied length if the loop runs out of sglist entries without\nextracting everything.\n\nWhile there, return immediately from extract_iter_to_sg if there are no\nsglist entries at all.\n\nA subsequent commit will add kunit test cases that demonstrate that the\npatch is necessary."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable `extract_kvec_to_sg()` is reached through `extract_iter_to_sg()` on the SMB3/CIFS client crypto path (`decrypt_raw_data()` \u2192 `crypt_message()` \u2192 `smb2_get_aead_req()`), which processes encrypted SMB traffic received over TCP/445 from a remote peer in the `cifsd` demultiplex thread.\nAC:L - When an `ITER_KVEC` iterator spans a page boundary, the bug deterministically sets inflated scatterlist lengths (`sg_set_page(..., len, off)` instead of `seg`); an attacker can choose I/O sizes and offsets to cross page boundaries without races or layout luck.\nPR:N - A malicious SMB server operator needs no local privileges on the victim host\u2014only an established SMB3 sealed session (common in enterprise NAS, cloud file shares, and domain-joined clients) to drive encrypted read/write traffic through the affected scatterlist construction.\nUI:N - No end-user interaction beyond normal automated SMB client operation is required once a share/session exists; the kernel processes attacker-supplied encrypted payloads on the network receive path without additional victim actions.\nS:U - Impact is kernel memory corruption and privilege escalation within the same kernel security domain; it does not cross VM, container, or IOMMU boundaries.\nC:H - Inflated scatter-gather lengths cause out-of-bounds reads past page boundaries when the malformed scatterlist is consumed by AEAD crypto/DMA, yielding arbitrary adjacent-kernel-memory disclosure primitives.\nI:H - The same corrupted scatterlist metadata directs crypto/DMA writes beyond the intended page, enabling out-of-bounds kernel writes and potential control-flow hijack from memory corruption.\nA:H - Scatterlist length corruption during in-kernel AEAD operations can cause kernel oops/panic or reliably destabilize the system; memory corruption bugs in this path carry high availability impact even before full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:03.214Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3f17500e86d730c76db638bb3ae52f9b5e496c76"
},
{
"url": "https://git.kernel.org/stable/c/e5e22fc9963469e678c4f4bb38d26adcec107f1e"
},
{
"url": "https://git.kernel.org/stable/c/8fbba6829057979149d1b37d65690c037f3ddf4d"
},
{
"url": "https://git.kernel.org/stable/c/9d38756d0a93b66163554219fa9c3365f40c4035"
},
{
"url": "https://git.kernel.org/stable/c/07b7d66e65d9cfe6b9c2c34aa22cfcaac37a5c45"
}
],
"title": "lib/scatterlist: fix length calculations in extract_kvec_to_sg",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46289",
"datePublished": "2026-06-08T15:46:15.888Z",
"dateReserved": "2026-05-13T15:03:33.110Z",
"dateUpdated": "2026-08-05T12:31:03.214Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46286 (GCVE-0-2026-46286)
Vulnerability from cvelistv5
Published
2026-06-08 15:41
Modified
2026-06-14 18:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
leds: qcom-lpg: Check for array overflow when selecting the high resolution
When selecting the high resolution values from the array, FIELD_GET() is
used to pull from a 3 bit register, yet the array being indexed has only
5 values in it. Odds are the hardware is sane, but just to be safe,
properly check before just overflowing and reading random data and then
setting up chip values based on that.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/leds/rgb/leds-qcom-lpg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "28a2e047d03721e0517c67ee726eaa6621c30e5f",
"status": "affected",
"version": "b00d2ed37617b5f2f091c98acf542fbedefcbf9b",
"versionType": "git"
},
{
"lessThan": "36ce3094dc50598f38fd961b46688cd533940efc",
"status": "affected",
"version": "b00d2ed37617b5f2f091c98acf542fbedefcbf9b",
"versionType": "git"
},
{
"lessThan": "438e357b3cc6cd6900df271e4bc567bfe1142281",
"status": "affected",
"version": "b00d2ed37617b5f2f091c98acf542fbedefcbf9b",
"versionType": "git"
},
{
"lessThan": "f67a24e75d3251ba42538738120b6b659c0dca7d",
"status": "affected",
"version": "b00d2ed37617b5f2f091c98acf542fbedefcbf9b",
"versionType": "git"
},
{
"lessThan": "d45963a93c1495e9f1338fde91d0ebba8fd22474",
"status": "affected",
"version": "b00d2ed37617b5f2f091c98acf542fbedefcbf9b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/leds/rgb/leds-qcom-lpg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nleds: qcom-lpg: Check for array overflow when selecting the high resolution\n\nWhen selecting the high resolution values from the array, FIELD_GET() is\nused to pull from a 3 bit register, yet the array being indexed has only\n5 values in it. Odds are the hardware is sane, but just to be safe,\nproperly check before just overflowing and reading random data and then\nsetting up chip values based on that."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:06:28.805Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/28a2e047d03721e0517c67ee726eaa6621c30e5f"
},
{
"url": "https://git.kernel.org/stable/c/36ce3094dc50598f38fd961b46688cd533940efc"
},
{
"url": "https://git.kernel.org/stable/c/438e357b3cc6cd6900df271e4bc567bfe1142281"
},
{
"url": "https://git.kernel.org/stable/c/f67a24e75d3251ba42538738120b6b659c0dca7d"
},
{
"url": "https://git.kernel.org/stable/c/d45963a93c1495e9f1338fde91d0ebba8fd22474"
}
],
"title": "leds: qcom-lpg: Check for array overflow when selecting the high resolution",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46286",
"datePublished": "2026-06-08T15:41:29.682Z",
"dateReserved": "2026-05-13T15:03:33.110Z",
"dateUpdated": "2026-06-14T18:06:28.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53285 (GCVE-0-2026-53285)
Vulnerability from cvelistv5
Published
2026-06-26 19:40
Modified
2026-06-26 19:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED
[Why]
dcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with
DC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_START takes fpregs_lock(),
which disables local softirqs.
The DML1 path through dcn32_enable_phantom_plane() calls kvzalloc() to
allocate ~335 KiB for dc_plane_state. This triggers the vmalloc path,
which calls BUG_ON(in_interrupt()) because it's invoked within the
FPU-enabled (softirq disabled) region, leading to a kernel crash.
[How]
Wrap the dc_state_create_phantom_plane() call with the
DC_RUN_WITH_PREEMPTION_ENABLED() macro to allow preemption during
this memory allocation.
(cherry picked from commit 885ccbef7b94a8b38f69c4211c679021aa27ad11)
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "30bb2ec6695d62f63db4aa6179c4626834ed0cd6",
"status": "affected",
"version": "235c67634230b0f9ad8c0185272fed36c892b1c4",
"versionType": "git"
},
{
"lessThan": "183182235f6d53bac62c6c39014738a54a68dfa6",
"status": "affected",
"version": "235c67634230b0f9ad8c0185272fed36c892b1c4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED\n\n[Why]\ndcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with\nDC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_START takes fpregs_lock(),\nwhich disables local softirqs.\n\nThe DML1 path through dcn32_enable_phantom_plane() calls kvzalloc() to\nallocate ~335 KiB for dc_plane_state. This triggers the vmalloc path,\nwhich calls BUG_ON(in_interrupt()) because it\u0027s invoked within the\nFPU-enabled (softirq disabled) region, leading to a kernel crash.\n\n[How]\nWrap the dc_state_create_phantom_plane() call with the\nDC_RUN_WITH_PREEMPTION_ENABLED() macro to allow preemption during\nthis memory allocation.\n\n(cherry picked from commit 885ccbef7b94a8b38f69c4211c679021aa27ad11)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T19:40:46.328Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/30bb2ec6695d62f63db4aa6179c4626834ed0cd6"
},
{
"url": "https://git.kernel.org/stable/c/183182235f6d53bac62c6c39014738a54a68dfa6"
}
],
"title": "drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53285",
"datePublished": "2026-06-26T19:40:46.328Z",
"dateReserved": "2026-06-09T07:44:35.396Z",
"dateUpdated": "2026-06-26T19:40:46.328Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45933 (GCVE-0-2026-45933)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Preserve id of register in sync_linked_regs()
sync_linked_regs() copies the id of known_reg to reg when propagating
bounds of known_reg to reg using the off of known_reg, but when
known_reg was linked to reg like:
known_reg = reg ; both known_reg and reg get same id
known_reg += 4 ; known_reg gets off = 4, and its id gets BPF_ADD_CONST
now when a call to sync_linked_regs() happens, let's say with the following:
if known_reg >= 10 goto pc+2
known_reg's new bounds are propagated to reg but now reg gets
BPF_ADD_CONST from the copy.
This means if another link to reg is created like:
another_reg = reg ; another_reg should get the id of reg but
assign_scalar_id_before_mov() sees
BPF_ADD_CONST on reg and assigns a new id to it.
As reg has a new id now, known_reg's link to reg is broken. If we find
new bounds for known_reg, they will not be propagated to reg.
This can be seen in the selftest added in the next commit:
0: (85) call bpf_get_prandom_u32#7 ; R0=scalar()
1: (57) r0 &= 255 ; R0=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
2: (bf) r1 = r0 ; R0=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) R1=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))
3: (07) r1 += 4 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=4,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))
4: (a5) if r1 < 0xa goto pc+4 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=10,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))
5: (bf) r2 = r0 ; R0=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=255) R2=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=255)
6: (a5) if r1 < 0xe goto pc+2 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=14,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))
7: (35) if r0 >= 0xa goto pc+1 ; R0=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=9,var_off=(0x0; 0xf))
8: (37) r0 /= 0
div by zero
When 4 is verified, r1's bounds are propagated to r0 but r0 also gets
BPF_ADD_CONST (bug).
When 5 is verified, r0 gets a new id (2) and its link with r1 is broken.
After 6 we know r1 has bounds [14, 259] and therefore r0 should have
bounds [10, 255], therefore the branch at 7 is always taken. But because
r0's id was changed to 2, r1's new bounds are not propagated to r0.
The verifier still thinks r0 has bounds [6, 255] before 7 and execution
can reach div by zero.
Fix this by preserving id in sync_linked_regs() like off and subreg_def.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "58059335e46537de682db84984f7716c813208c4",
"status": "affected",
"version": "98d7ca374ba4b39e7535613d40e159f09ca14da2",
"versionType": "git"
},
{
"lessThan": "92a8cb1806adefb263cf096eab6705705cf7eee1",
"status": "affected",
"version": "98d7ca374ba4b39e7535613d40e159f09ca14da2",
"versionType": "git"
},
{
"lessThan": "65d114b5270b62aefb820ecd6c3b7caeea8f895d",
"status": "affected",
"version": "98d7ca374ba4b39e7535613d40e159f09ca14da2",
"versionType": "git"
},
{
"lessThan": "af9e89d8dd39530c8bd14c33ddf6b502df1071b6",
"status": "affected",
"version": "98d7ca374ba4b39e7535613d40e159f09ca14da2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve id of register in sync_linked_regs()\n\nsync_linked_regs() copies the id of known_reg to reg when propagating\nbounds of known_reg to reg using the off of known_reg, but when\nknown_reg was linked to reg like:\n\nknown_reg = reg ; both known_reg and reg get same id\nknown_reg += 4 ; known_reg gets off = 4, and its id gets BPF_ADD_CONST\n\nnow when a call to sync_linked_regs() happens, let\u0027s say with the following:\n\nif known_reg \u003e= 10 goto pc+2\n\nknown_reg\u0027s new bounds are propagated to reg but now reg gets\nBPF_ADD_CONST from the copy.\n\nThis means if another link to reg is created like:\n\nanother_reg = reg ; another_reg should get the id of reg but\n assign_scalar_id_before_mov() sees\n BPF_ADD_CONST on reg and assigns a new id to it.\n\nAs reg has a new id now, known_reg\u0027s link to reg is broken. If we find\nnew bounds for known_reg, they will not be propagated to reg.\n\nThis can be seen in the selftest added in the next commit:\n\n0: (85) call bpf_get_prandom_u32#7 ; R0=scalar()\n1: (57) r0 \u0026= 255 ; R0=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))\n2: (bf) r1 = r0 ; R0=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) R1=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))\n3: (07) r1 += 4 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=4,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))\n4: (a5) if r1 \u003c 0xa goto pc+4 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=10,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))\n5: (bf) r2 = r0 ; R0=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=255) R2=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=255)\n6: (a5) if r1 \u003c 0xe goto pc+2 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=14,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))\n7: (35) if r0 \u003e= 0xa goto pc+1 ; R0=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=9,var_off=(0x0; 0xf))\n8: (37) r0 /= 0\ndiv by zero\n\nWhen 4 is verified, r1\u0027s bounds are propagated to r0 but r0 also gets\nBPF_ADD_CONST (bug).\nWhen 5 is verified, r0 gets a new id (2) and its link with r1 is broken.\n\nAfter 6 we know r1 has bounds [14, 259] and therefore r0 should have\nbounds [10, 255], therefore the branch at 7 is always taken. But because\nr0\u0027s id was changed to 2, r1\u0027s new bounds are not propagated to r0.\nThe verifier still thinks r0 has bounds [6, 255] before 7 and execution\ncan reach div by zero.\n\nFix this by preserving id in sync_linked_regs() like off and subreg_def."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in the BPF verifier, reached only by loading a crafted BPF program via the bpf() syscall from a local process; remote data never reaches this code.\nAC:L - The attacker writes the exact BPF instruction sequence that deterministically triggers the broken link in sync_linked_regs(); no race or uncontrolled condition is involved.\nPR:L - The verifier runs for all program loads, and socket-filter/cgroup-skb programs are loadable without CAP_BPF when unprivileged_bpf_disabled=0 (a supported default), so any unprivileged local user can reach it.\nUI:N - The attacker loads and runs their own program; no victim action is required.\nS:U - Impact is confined to the kernel\u0027s own security authority \u2014 standard local privilege escalation, no crossing into a separate VM/IOMMU boundary.\nC:H - The verifier can be made to believe a register holds a wrong value, allowing a verified-as-safe out-of-bounds read primitive over kernel memory, yielding arbitrary kernel memory disclosure.\nI:H - The same false-bounds primitive enables an out-of-bounds write the verifier \"proved\" safe, giving an arbitrary kernel write usable for privilege escalation and code-flow hijacking.\nA:H - The resulting out-of-bounds accesses on attacker-controlled values readily corrupt kernel memory and panic/crash the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:47.803Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/58059335e46537de682db84984f7716c813208c4"
},
{
"url": "https://git.kernel.org/stable/c/92a8cb1806adefb263cf096eab6705705cf7eee1"
},
{
"url": "https://git.kernel.org/stable/c/65d114b5270b62aefb820ecd6c3b7caeea8f895d"
},
{
"url": "https://git.kernel.org/stable/c/af9e89d8dd39530c8bd14c33ddf6b502df1071b6"
}
],
"title": "bpf: Preserve id of register in sync_linked_regs()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45933",
"datePublished": "2026-05-27T12:17:51.127Z",
"dateReserved": "2026-05-13T15:03:33.086Z",
"dateUpdated": "2026-08-05T12:28:47.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46313 (GCVE-0-2026-46313)
Vulnerability from cvelistv5
Published
2026-06-08 15:50
Modified
2026-06-14 18:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: intel/ipu6: fix error pointer dereference
In a error path isp->psys is confirmed to be an error pointer not NULL so
this condition is true and the error pointer is dereferenced. So isp-psys
should be set to NULL before going to out_ipu6_bus_del_devices.
Detected by Smatch:
drivers/media/pci/intel/ipu6/ipu6.c:690 ipu6_pci_probe() error:
'isp->psys' dereferencing possible ERR_PTR()
[Sakari Ailus: Fix commit message.]
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/intel/ipu6/ipu6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fad134c446189e9bb48cea1a5ca426d2889a9c71",
"status": "affected",
"version": "25fedc021985a66a357a599ab771d6b495b6f78c",
"versionType": "git"
},
{
"lessThan": "f43e30646fc93799f3f48530d0ccbd52902c0541",
"status": "affected",
"version": "25fedc021985a66a357a599ab771d6b495b6f78c",
"versionType": "git"
},
{
"lessThan": "c352f90e093ae49902e47f41579e1aa41899ff64",
"status": "affected",
"version": "25fedc021985a66a357a599ab771d6b495b6f78c",
"versionType": "git"
},
{
"lessThan": "8dd088b8b106f7b119664f965b691785998edcfb",
"status": "affected",
"version": "25fedc021985a66a357a599ab771d6b495b6f78c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/intel/ipu6/ipu6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: intel/ipu6: fix error pointer dereference\n\nIn a error path isp-\u003epsys is confirmed to be an error pointer not NULL so\nthis condition is true and the error pointer is dereferenced. So isp-psys\nshould be set to NULL before going to out_ipu6_bus_del_devices.\n\nDetected by Smatch:\ndrivers/media/pci/intel/ipu6/ipu6.c:690 ipu6_pci_probe() error:\n\u0027isp-\u003epsys\u0027 dereferencing possible ERR_PTR()\n\n[Sakari Ailus: Fix commit message.]"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:08:30.237Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fad134c446189e9bb48cea1a5ca426d2889a9c71"
},
{
"url": "https://git.kernel.org/stable/c/f43e30646fc93799f3f48530d0ccbd52902c0541"
},
{
"url": "https://git.kernel.org/stable/c/c352f90e093ae49902e47f41579e1aa41899ff64"
},
{
"url": "https://git.kernel.org/stable/c/8dd088b8b106f7b119664f965b691785998edcfb"
}
],
"title": "media: intel/ipu6: fix error pointer dereference",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46313",
"datePublished": "2026-06-08T15:50:44.065Z",
"dateReserved": "2026-05-13T15:03:33.111Z",
"dateUpdated": "2026-06-14T18:08:30.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43203 (GCVE-0-2026-43203)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
atm: fore200e: fix use-after-free in tasklets during device removal
When the PCA-200E or SBA-200E adapter is being detached, the fore200e
is deallocated. However, the tx_tasklet or rx_tasklet may still be running
or pending, leading to use-after-free bug when the already freed fore200e
is accessed again in fore200e_tx_tasklet() or fore200e_rx_tasklet().
One of the race conditions can occur as follows:
CPU 0 (cleanup) | CPU 1 (tasklet)
fore200e_pca_remove_one() | fore200e_interrupt()
fore200e_shutdown() | tasklet_schedule()
kfree(fore200e) | fore200e_tx_tasklet()
| fore200e-> // UAF
Fix this by ensuring tx_tasklet or rx_tasklet is properly canceled before
the fore200e is released. Add tasklet_kill() in fore200e_shutdown() to
synchronize with any pending or running tasklets. Moreover, since
fore200e_reset() could prevent further interrupts or data transfers,
the tasklet_kill() should be placed after fore200e_reset() to prevent
the tasklet from being rescheduled in fore200e_interrupt(). Finally,
it only needs to do tasklet_kill() when the fore200e state is greater
than or equal to FORE200E_STATE_IRQ, since tasklets are uninitialized
in earlier states. In a word, the tasklet_kill() should be placed in
the FORE200E_STATE_IRQ branch within the switch...case structure.
This bug was identified through static analysis.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/atm/fore200e.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "91f25749aaf57c47ae1e12478144e6ea8c8562f2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "73fbc5d1a9ccb626937500bbd67136f077d8237b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "aba0b4bc09376dfc3d53c826514fe38fc8337f52",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e075ec9b08f862dade8011481058f7eb5f716c57",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "97900f512252a59f23d6ce4ab215cc88fed66e68",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e4ff4e3ffcf9d5aad380cdd1d8cdc008bb34f97d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5189368f10903956be05062d160b2804bf5e5016",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8930878101cd40063888a68af73b1b0f8b6c79bc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/atm/fore200e.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\natm: fore200e: fix use-after-free in tasklets during device removal\n\nWhen the PCA-200E or SBA-200E adapter is being detached, the fore200e\nis deallocated. However, the tx_tasklet or rx_tasklet may still be running\nor pending, leading to use-after-free bug when the already freed fore200e\nis accessed again in fore200e_tx_tasklet() or fore200e_rx_tasklet().\n\nOne of the race conditions can occur as follows:\n\nCPU 0 (cleanup) | CPU 1 (tasklet)\nfore200e_pca_remove_one() | fore200e_interrupt()\n fore200e_shutdown() | tasklet_schedule()\n kfree(fore200e) | fore200e_tx_tasklet()\n | fore200e-\u003e // UAF\n\nFix this by ensuring tx_tasklet or rx_tasklet is properly canceled before\nthe fore200e is released. Add tasklet_kill() in fore200e_shutdown() to\nsynchronize with any pending or running tasklets. Moreover, since\nfore200e_reset() could prevent further interrupts or data transfers,\nthe tasklet_kill() should be placed after fore200e_reset() to prevent\nthe tasklet from being rescheduled in fore200e_interrupt(). Finally,\nit only needs to do tasklet_kill() when the fore200e state is greater\nthan or equal to FORE200E_STATE_IRQ, since tasklets are uninitialized\nin earlier states. In a word, the tasklet_kill() should be placed in\nthe FORE200E_STATE_IRQ branch within the switch...case structure.\n\nThis bug was identified through static analysis."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - ATM link traffic from a remote peer can cause the adapter IRQ path (`fore200e_interrupt()`) to schedule the vulnerable RX/TX tasklets. The freeing side occurs during adapter removal, but the attacker-controlled stimulus reaches the vulnerable tasklet path over the network-facing ATM device.\nAC:H - The bug requires the non-default `CONFIG_ATM_FORE200E_USE_TASKLET` configuration and a removal event overlapping a pending or running tasklet. The remote attacker can keep interrupts likely, but does not fully control the removal side.\nPR:N - A remote ATM peer does not need credentials or local privileges on the vulnerable host to generate traffic that posts adapter interrupts. Local sysfs unbind/module removal would require real root, but the highest-severity reasonable scenario uses unauthenticated remote traffic coinciding with victim-initiated removal.\nUI:R - Network traffic alone does not free `struct fore200e`; a user/admin action or physical hotplug/removal event must detach, unbind, or remove the adapter. Once removal occurs, pending tasklets can access the freed structure.\nS:U - The corruption occurs within the kernel/driver context and affects resources under the same kernel security authority. There is no VM escape, IOMMU bypass, or cross-scope boundary indicated.\nC:H - This is a use-after-free of the driver\u2019s per-device structure, and the tasklets dereference freed pointers and queues after teardown. Per the kernel scoring guidance, UAF memory corruption is treated as enabling high confidentiality impact.\nI:H - The freed `struct fore200e` can be reallocated or corrupted before tasklet execution, creating a plausible control-flow or arbitrary-write primitive. Per the kernel scoring guidance, UAF memory corruption warrants high integrity impact.\nA:H - The tasklets dereference freed driver state after `kfree(fore200e)`, which can directly cause kernel oops, panic, or hang. Any kernel crash from this UAF is high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:31.918Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/91f25749aaf57c47ae1e12478144e6ea8c8562f2"
},
{
"url": "https://git.kernel.org/stable/c/73fbc5d1a9ccb626937500bbd67136f077d8237b"
},
{
"url": "https://git.kernel.org/stable/c/aba0b4bc09376dfc3d53c826514fe38fc8337f52"
},
{
"url": "https://git.kernel.org/stable/c/e075ec9b08f862dade8011481058f7eb5f716c57"
},
{
"url": "https://git.kernel.org/stable/c/97900f512252a59f23d6ce4ab215cc88fed66e68"
},
{
"url": "https://git.kernel.org/stable/c/e4ff4e3ffcf9d5aad380cdd1d8cdc008bb34f97d"
},
{
"url": "https://git.kernel.org/stable/c/5189368f10903956be05062d160b2804bf5e5016"
},
{
"url": "https://git.kernel.org/stable/c/8930878101cd40063888a68af73b1b0f8b6c79bc"
}
],
"title": "atm: fore200e: fix use-after-free in tasklets during device removal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43203",
"datePublished": "2026-05-06T11:28:08.949Z",
"dateReserved": "2026-05-01T14:12:55.992Z",
"dateUpdated": "2026-08-05T12:26:31.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45986 (GCVE-0-2026-45986)
Vulnerability from cvelistv5
Published
2026-05-27 12:55
Modified
2026-06-14 17:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: ccree - fix a memory leak in cc_mac_digest()
Add cc_unmap_result() if cc_map_hash_request_final()
fails to prevent potential memory leak.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 63893811b0fcb52f6eaf9811cc08bddd46f81c3e Version: 63893811b0fcb52f6eaf9811cc08bddd46f81c3e Version: 63893811b0fcb52f6eaf9811cc08bddd46f81c3e Version: 63893811b0fcb52f6eaf9811cc08bddd46f81c3e Version: 63893811b0fcb52f6eaf9811cc08bddd46f81c3e Version: 63893811b0fcb52f6eaf9811cc08bddd46f81c3e Version: 63893811b0fcb52f6eaf9811cc08bddd46f81c3e Version: 63893811b0fcb52f6eaf9811cc08bddd46f81c3e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/ccree/cc_hash.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7c21d58fcd6ad8e15a539347254093c93224a8b2",
"status": "affected",
"version": "63893811b0fcb52f6eaf9811cc08bddd46f81c3e",
"versionType": "git"
},
{
"lessThan": "f53458c7c756b3e0838d51cf1e9f41b25079801a",
"status": "affected",
"version": "63893811b0fcb52f6eaf9811cc08bddd46f81c3e",
"versionType": "git"
},
{
"lessThan": "7cd17993adb8a5d14a7e84d751316a5fdf0c251f",
"status": "affected",
"version": "63893811b0fcb52f6eaf9811cc08bddd46f81c3e",
"versionType": "git"
},
{
"lessThan": "3061c9bfb3f5b3522ab174e2fa7473b24422d1c6",
"status": "affected",
"version": "63893811b0fcb52f6eaf9811cc08bddd46f81c3e",
"versionType": "git"
},
{
"lessThan": "22f1dd4ca3bfe77db52cc7df3cc353dc114aab8b",
"status": "affected",
"version": "63893811b0fcb52f6eaf9811cc08bddd46f81c3e",
"versionType": "git"
},
{
"lessThan": "910f335786a0a0f0b46c3c8c19a13d25cb4454b6",
"status": "affected",
"version": "63893811b0fcb52f6eaf9811cc08bddd46f81c3e",
"versionType": "git"
},
{
"lessThan": "502440c235fe34cee02b24d7f893841f7565b3bc",
"status": "affected",
"version": "63893811b0fcb52f6eaf9811cc08bddd46f81c3e",
"versionType": "git"
},
{
"lessThan": "02c64052fad03699b9c6d1df2f9b444d17e4ac50",
"status": "affected",
"version": "63893811b0fcb52f6eaf9811cc08bddd46f81c3e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/ccree/cc_hash.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccree - fix a memory leak in cc_mac_digest()\n\nAdd cc_unmap_result() if cc_map_hash_request_final()\nfails to prevent potential memory leak."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:46:33.494Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7c21d58fcd6ad8e15a539347254093c93224a8b2"
},
{
"url": "https://git.kernel.org/stable/c/f53458c7c756b3e0838d51cf1e9f41b25079801a"
},
{
"url": "https://git.kernel.org/stable/c/7cd17993adb8a5d14a7e84d751316a5fdf0c251f"
},
{
"url": "https://git.kernel.org/stable/c/3061c9bfb3f5b3522ab174e2fa7473b24422d1c6"
},
{
"url": "https://git.kernel.org/stable/c/22f1dd4ca3bfe77db52cc7df3cc353dc114aab8b"
},
{
"url": "https://git.kernel.org/stable/c/910f335786a0a0f0b46c3c8c19a13d25cb4454b6"
},
{
"url": "https://git.kernel.org/stable/c/502440c235fe34cee02b24d7f893841f7565b3bc"
},
{
"url": "https://git.kernel.org/stable/c/02c64052fad03699b9c6d1df2f9b444d17e4ac50"
}
],
"title": "crypto: ccree - fix a memory leak in cc_mac_digest()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45986",
"datePublished": "2026-05-27T12:55:35.838Z",
"dateReserved": "2026-05-13T15:03:33.090Z",
"dateUpdated": "2026-06-14T17:46:33.494Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46069 (GCVE-0-2026-46069)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-06-19 11:59
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
The mwifiex_adapter_cleanup() function uses timer_delete()
(non-synchronous) for the wakeup_timer before the adapter structure is
freed. This is incorrect because timer_delete() does not wait for any
running timer callback to complete.
If the wakeup_timer callback (wakeup_timer_fn) is executing when
mwifiex_adapter_cleanup() is called, the callback will continue to
access adapter fields (adapter->hw_status, adapter->if_ops.card_reset,
etc.) which may be freed by mwifiex_free_adapter() called later in the
mwifiex_remove_card() path.
Use timer_delete_sync() instead to ensure any running timer callback has
completed before returning.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4636187da60b6e33526050235c610409d9cc00e8 Version: 4636187da60b6e33526050235c610409d9cc00e8 Version: 4636187da60b6e33526050235c610409d9cc00e8 Version: 4636187da60b6e33526050235c610409d9cc00e8 Version: 4636187da60b6e33526050235c610409d9cc00e8 Version: 4636187da60b6e33526050235c610409d9cc00e8 Version: 4636187da60b6e33526050235c610409d9cc00e8 Version: 4636187da60b6e33526050235c610409d9cc00e8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/mwifiex/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c3508895450cca4aeaf5dbadbb5e582363005264",
"status": "affected",
"version": "4636187da60b6e33526050235c610409d9cc00e8",
"versionType": "git"
},
{
"lessThan": "1958a92599b2653d730ccb6f5685fc3fbed21812",
"status": "affected",
"version": "4636187da60b6e33526050235c610409d9cc00e8",
"versionType": "git"
},
{
"lessThan": "a88f5391dc68f78cae5eb6a8cd341cafee795d3d",
"status": "affected",
"version": "4636187da60b6e33526050235c610409d9cc00e8",
"versionType": "git"
},
{
"lessThan": "11869ce402d95519d49b25a2a97741f68d69d103",
"status": "affected",
"version": "4636187da60b6e33526050235c610409d9cc00e8",
"versionType": "git"
},
{
"lessThan": "63fe3389b3e092d6c0eeea9fc0318e7918b16618",
"status": "affected",
"version": "4636187da60b6e33526050235c610409d9cc00e8",
"versionType": "git"
},
{
"lessThan": "4e179a60a60c0a5aea245e8e67768343c0f070b8",
"status": "affected",
"version": "4636187da60b6e33526050235c610409d9cc00e8",
"versionType": "git"
},
{
"lessThan": "030abbae49cf9fd1fba7aa08e15ec81efbeb78cf",
"status": "affected",
"version": "4636187da60b6e33526050235c610409d9cc00e8",
"versionType": "git"
},
{
"lessThan": "ae5e95d4157481693be2317e3ffcd84e36010cbb",
"status": "affected",
"version": "4636187da60b6e33526050235c610409d9cc00e8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/mwifiex/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()\n\nThe mwifiex_adapter_cleanup() function uses timer_delete()\n(non-synchronous) for the wakeup_timer before the adapter structure is\nfreed. This is incorrect because timer_delete() does not wait for any\nrunning timer callback to complete.\n\nIf the wakeup_timer callback (wakeup_timer_fn) is executing when\nmwifiex_adapter_cleanup() is called, the callback will continue to\naccess adapter fields (adapter-\u003ehw_status, adapter-\u003eif_ops.card_reset,\netc.) which may be freed by mwifiex_free_adapter() called later in the\nmwifiex_remove_card() path.\n\nUse timer_delete_sync() instead to ensure any running timer callback has\ncompleted before returning."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-19T11:59:16.626Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c3508895450cca4aeaf5dbadbb5e582363005264"
},
{
"url": "https://git.kernel.org/stable/c/1958a92599b2653d730ccb6f5685fc3fbed21812"
},
{
"url": "https://git.kernel.org/stable/c/a88f5391dc68f78cae5eb6a8cd341cafee795d3d"
},
{
"url": "https://git.kernel.org/stable/c/11869ce402d95519d49b25a2a97741f68d69d103"
},
{
"url": "https://git.kernel.org/stable/c/63fe3389b3e092d6c0eeea9fc0318e7918b16618"
},
{
"url": "https://git.kernel.org/stable/c/4e179a60a60c0a5aea245e8e67768343c0f070b8"
},
{
"url": "https://git.kernel.org/stable/c/030abbae49cf9fd1fba7aa08e15ec81efbeb78cf"
},
{
"url": "https://git.kernel.org/stable/c/ae5e95d4157481693be2317e3ffcd84e36010cbb"
}
],
"title": "wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46069",
"datePublished": "2026-05-27T12:57:50.213Z",
"dateReserved": "2026-05-13T15:03:33.095Z",
"dateUpdated": "2026-06-19T11:59:16.626Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46071 (GCVE-0-2026-46071)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-06-14 17:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12
svm_copy_lbrs() always marks VMCB_LBR dirty in the destination VMCB.
However, nested_svm_vmexit() uses it to copy LBRs to vmcb12, and
clearing clean bits in vmcb12 is not architecturally defined.
Move vmcb_mark_dirty() to callers and drop it for vmcb12.
This also facilitates incoming refactoring that does not pass the entire
VMCB to svm_copy_lbrs().
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/nested.c",
"arch/x86/kvm/svm/svm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a3f0981a5a0e0bd51ad74cc7d9eed32294b24002",
"status": "affected",
"version": "d20c796ca3709801f8a7fa36e8770a3dd8ebd34e",
"versionType": "git"
},
{
"lessThan": "9efe23568806d1cd06f7d146f9b3037b8d585a9f",
"status": "affected",
"version": "d20c796ca3709801f8a7fa36e8770a3dd8ebd34e",
"versionType": "git"
},
{
"lessThan": "b53ab5167a81537777ac780bbd93d32613aa3bda",
"status": "affected",
"version": "d20c796ca3709801f8a7fa36e8770a3dd8ebd34e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/nested.c",
"arch/x86/kvm/svm/svm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Avoid clearing VMCB_LBR in vmcb12\n\nsvm_copy_lbrs() always marks VMCB_LBR dirty in the destination VMCB.\nHowever, nested_svm_vmexit() uses it to copy LBRs to vmcb12, and\nclearing clean bits in vmcb12 is not architecturally defined.\n\nMove vmcb_mark_dirty() to callers and drop it for vmcb12.\n\nThis also facilitates incoming refactoring that does not pass the entire\nVMCB to svm_copy_lbrs()."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:52:10.514Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a3f0981a5a0e0bd51ad74cc7d9eed32294b24002"
},
{
"url": "https://git.kernel.org/stable/c/9efe23568806d1cd06f7d146f9b3037b8d585a9f"
},
{
"url": "https://git.kernel.org/stable/c/b53ab5167a81537777ac780bbd93d32613aa3bda"
}
],
"title": "KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46071",
"datePublished": "2026-05-27T12:57:57.316Z",
"dateReserved": "2026-05-13T15:03:33.095Z",
"dateUpdated": "2026-06-14T17:52:10.514Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43109 (GCVE-0-2026-43109)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-05-17 15:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86: shadow stacks: proper error handling for mmap lock
김영민 reports that shstk_pop_sigframe() doesn't check for errors from
mmap_read_lock_killable(), which is a silly oversight, and also shows
that we haven't marked those functions with "__must_check", which would
have immediately caught it.
So let's fix both issues.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kernel/shstk.c",
"include/linux/mmap_lock.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c79cf42321600e931933e11f94aba8b245d4cd66",
"status": "affected",
"version": "7fad2a432cd35bbf104d2d9d426e74902f22aa95",
"versionType": "git"
},
{
"lessThan": "1a30468eff661937d978495644d2e5ebfeef5ce6",
"status": "affected",
"version": "7fad2a432cd35bbf104d2d9d426e74902f22aa95",
"versionType": "git"
},
{
"lessThan": "c64cebcc5c4f223dbcbe7dcdf74908fc092a0aa4",
"status": "affected",
"version": "7fad2a432cd35bbf104d2d9d426e74902f22aa95",
"versionType": "git"
},
{
"lessThan": "262b6d38a81d51b135db81e1f30c13d30e38feee",
"status": "affected",
"version": "7fad2a432cd35bbf104d2d9d426e74902f22aa95",
"versionType": "git"
},
{
"lessThan": "52f657e34d7b21b47434d9d8b26fa7f6778b63a0",
"status": "affected",
"version": "7fad2a432cd35bbf104d2d9d426e74902f22aa95",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kernel/shstk.c",
"include/linux/mmap_lock.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86: shadow stacks: proper error handling for mmap lock\n\n\uae40\uc601\ubbfc reports that shstk_pop_sigframe() doesn\u0027t check for errors from\nmmap_read_lock_killable(), which is a silly oversight, and also shows\nthat we haven\u0027t marked those functions with \"__must_check\", which would\nhave immediately caught it.\n\nSo let\u0027s fix both issues."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T15:21:37.731Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c79cf42321600e931933e11f94aba8b245d4cd66"
},
{
"url": "https://git.kernel.org/stable/c/1a30468eff661937d978495644d2e5ebfeef5ce6"
},
{
"url": "https://git.kernel.org/stable/c/c64cebcc5c4f223dbcbe7dcdf74908fc092a0aa4"
},
{
"url": "https://git.kernel.org/stable/c/262b6d38a81d51b135db81e1f30c13d30e38feee"
},
{
"url": "https://git.kernel.org/stable/c/52f657e34d7b21b47434d9d8b26fa7f6778b63a0"
}
],
"title": "x86: shadow stacks: proper error handling for mmap lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43109",
"datePublished": "2026-05-06T07:40:36.532Z",
"dateReserved": "2026-05-01T14:12:55.986Z",
"dateUpdated": "2026-05-17T15:21:37.731Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53213 (GCVE-0-2026-53213)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: fix krealloc() memory leak
Don't just overwrite the original pointer passed to krealloc()
with its return value without checking latter:
MEM = krealloc(MEM, SZ, GFP);
If krealloc() returns NULL, that erases the pointer
to the still allocated memory, hence leaks this memory.
Instead, use a temporary variable, check it's not NULL
and only then assign it to the original pointer:
TMP = krealloc(MEM, SZ, GFP);
if (!TMP) return;
MEM = TMP;
While on it, use krealloc_array().
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6d45c81d229d71da54d374143e7d6abad4c0cf31 Version: 6d45c81d229d71da54d374143e7d6abad4c0cf31 Version: 6d45c81d229d71da54d374143e7d6abad4c0cf31 Version: 6d45c81d229d71da54d374143e7d6abad4c0cf31 Version: 6d45c81d229d71da54d374143e7d6abad4c0cf31 Version: 6d45c81d229d71da54d374143e7d6abad4c0cf31 Version: 6d45c81d229d71da54d374143e7d6abad4c0cf31 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_validate_shaders.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "30165a09f76eaf34951c818eb5d9d6e4771d76f6",
"status": "affected",
"version": "6d45c81d229d71da54d374143e7d6abad4c0cf31",
"versionType": "git"
},
{
"lessThan": "fd87d6966041e33ef7d2e5dc59f9a52b71c6ae5f",
"status": "affected",
"version": "6d45c81d229d71da54d374143e7d6abad4c0cf31",
"versionType": "git"
},
{
"lessThan": "e0ce103e89d61eef70edc1d1ae3bfd4c0aacbc2e",
"status": "affected",
"version": "6d45c81d229d71da54d374143e7d6abad4c0cf31",
"versionType": "git"
},
{
"lessThan": "c034aa0b1ba5f49cbdf8ef193d6ec714d74aac27",
"status": "affected",
"version": "6d45c81d229d71da54d374143e7d6abad4c0cf31",
"versionType": "git"
},
{
"lessThan": "02f5e4db57c0cdd7bac89d503b301a093a0fa95c",
"status": "affected",
"version": "6d45c81d229d71da54d374143e7d6abad4c0cf31",
"versionType": "git"
},
{
"lessThan": "4fc692dc6df5bc777cc1bcebf95179e28594875f",
"status": "affected",
"version": "6d45c81d229d71da54d374143e7d6abad4c0cf31",
"versionType": "git"
},
{
"lessThan": "5d563a5da8717629ae72f9eadf1e0e340bd1658b",
"status": "affected",
"version": "6d45c81d229d71da54d374143e7d6abad4c0cf31",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_validate_shaders.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: fix krealloc() memory leak\n\nDon\u0027t just overwrite the original pointer passed to krealloc()\nwith its return value without checking latter:\n\n MEM = krealloc(MEM, SZ, GFP);\n\nIf krealloc() returns NULL, that erases the pointer\nto the still allocated memory, hence leaks this memory.\nInstead, use a temporary variable, check it\u0027s not NULL\nand only then assign it to the original pointer:\n\n TMP = krealloc(MEM, SZ, GFP);\n if (!TMP) return;\n MEM = TMP;\n\nWhile on it, use krealloc_array()."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:17.552Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/30165a09f76eaf34951c818eb5d9d6e4771d76f6"
},
{
"url": "https://git.kernel.org/stable/c/fd87d6966041e33ef7d2e5dc59f9a52b71c6ae5f"
},
{
"url": "https://git.kernel.org/stable/c/e0ce103e89d61eef70edc1d1ae3bfd4c0aacbc2e"
},
{
"url": "https://git.kernel.org/stable/c/c034aa0b1ba5f49cbdf8ef193d6ec714d74aac27"
},
{
"url": "https://git.kernel.org/stable/c/02f5e4db57c0cdd7bac89d503b301a093a0fa95c"
},
{
"url": "https://git.kernel.org/stable/c/4fc692dc6df5bc777cc1bcebf95179e28594875f"
},
{
"url": "https://git.kernel.org/stable/c/5d563a5da8717629ae72f9eadf1e0e340bd1658b"
}
],
"title": "drm/vc4: fix krealloc() memory leak",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53213",
"datePublished": "2026-06-25T08:39:17.552Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-06-25T08:39:17.552Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46191 (GCVE-0-2026-46191)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-06-19 11:59
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbcon: Avoid OOB font access if console rotation fails
Clear the font buffer if the reallocation during console rotation fails
in fbcon_rotate_font(). The putcs implementations for the rotated buffer
will return early in this case. See [1] for an example.
Currently, fbcon_rotate_font() keeps the old buffer, which is too small
for the rotated font. Printing to the rotated console with a high-enough
character code will overflow the font buffer.
v2:
- fix typos in commit message
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6cc50e1c5b57180fd37a31282000f43859b0fe73 Version: 6cc50e1c5b57180fd37a31282000f43859b0fe73 Version: 6cc50e1c5b57180fd37a31282000f43859b0fe73 Version: 6cc50e1c5b57180fd37a31282000f43859b0fe73 Version: 6cc50e1c5b57180fd37a31282000f43859b0fe73 Version: 6cc50e1c5b57180fd37a31282000f43859b0fe73 Version: 6cc50e1c5b57180fd37a31282000f43859b0fe73 Version: 6cc50e1c5b57180fd37a31282000f43859b0fe73 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbcon_rotate.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b51c343a81e6e806525a4435e22532c107dd7e9d",
"status": "affected",
"version": "6cc50e1c5b57180fd37a31282000f43859b0fe73",
"versionType": "git"
},
{
"lessThan": "46cf3646dea54baeaa2eafe3fb1ba769947f31b0",
"status": "affected",
"version": "6cc50e1c5b57180fd37a31282000f43859b0fe73",
"versionType": "git"
},
{
"lessThan": "524a6079395916fb3d790ef2bb46a1d2939b27dd",
"status": "affected",
"version": "6cc50e1c5b57180fd37a31282000f43859b0fe73",
"versionType": "git"
},
{
"lessThan": "594973a2e54924d8ba31c9faac669fc1ba6fcb80",
"status": "affected",
"version": "6cc50e1c5b57180fd37a31282000f43859b0fe73",
"versionType": "git"
},
{
"lessThan": "ab6c34b9829d5de03f1d08a47a2253729a6e7e27",
"status": "affected",
"version": "6cc50e1c5b57180fd37a31282000f43859b0fe73",
"versionType": "git"
},
{
"lessThan": "7105d9f1387d63b15c9a860674fc92c959181f2f",
"status": "affected",
"version": "6cc50e1c5b57180fd37a31282000f43859b0fe73",
"versionType": "git"
},
{
"lessThan": "b44cc78ff46b96e72d333a3be6aaaa0a14797263",
"status": "affected",
"version": "6cc50e1c5b57180fd37a31282000f43859b0fe73",
"versionType": "git"
},
{
"lessThan": "e4ef723d8975a2694cc90733a6b888a5e2841842",
"status": "affected",
"version": "6cc50e1c5b57180fd37a31282000f43859b0fe73",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbcon_rotate.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.15"
},
{
"lessThan": "2.6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: Avoid OOB font access if console rotation fails\n\nClear the font buffer if the reallocation during console rotation fails\nin fbcon_rotate_font(). The putcs implementations for the rotated buffer\nwill return early in this case. See [1] for an example.\n\nCurrently, fbcon_rotate_font() keeps the old buffer, which is too small\nfor the rotated font. Printing to the rotated console with a high-enough\ncharacter code will overflow the font buffer.\n\nv2:\n- fix typos in commit message"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-19T11:59:53.468Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b51c343a81e6e806525a4435e22532c107dd7e9d"
},
{
"url": "https://git.kernel.org/stable/c/46cf3646dea54baeaa2eafe3fb1ba769947f31b0"
},
{
"url": "https://git.kernel.org/stable/c/524a6079395916fb3d790ef2bb46a1d2939b27dd"
},
{
"url": "https://git.kernel.org/stable/c/594973a2e54924d8ba31c9faac669fc1ba6fcb80"
},
{
"url": "https://git.kernel.org/stable/c/ab6c34b9829d5de03f1d08a47a2253729a6e7e27"
},
{
"url": "https://git.kernel.org/stable/c/7105d9f1387d63b15c9a860674fc92c959181f2f"
},
{
"url": "https://git.kernel.org/stable/c/b44cc78ff46b96e72d333a3be6aaaa0a14797263"
},
{
"url": "https://git.kernel.org/stable/c/e4ef723d8975a2694cc90733a6b888a5e2841842"
}
],
"title": "fbcon: Avoid OOB font access if console rotation fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46191",
"datePublished": "2026-05-28T09:36:44.961Z",
"dateReserved": "2026-05-13T15:03:33.104Z",
"dateUpdated": "2026-06-19T11:59:53.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46027 (GCVE-0-2026-46027)
Vulnerability from cvelistv5
Published
2026-05-27 12:56
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/smc: avoid early lgr access in smc_clc_wait_msg
A CLC decline can be received while the handshake is still in an early
stage, before the connection has been associated with a link group.
The decline handling in smc_clc_wait_msg() updates link-group level sync
state for first-contact declines, but that state only exists after link
group setup has completed. Guard the link-group update accordingly and
keep the per-socket peer diagnosis handling unchanged.
This preserves the existing sync_err handling for established link-group
contexts and avoids touching link-group state before it is available.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0cfdd8f92cac01afbb12e4500514036a2b78756b Version: 0cfdd8f92cac01afbb12e4500514036a2b78756b Version: 0cfdd8f92cac01afbb12e4500514036a2b78756b Version: 0cfdd8f92cac01afbb12e4500514036a2b78756b Version: 0cfdd8f92cac01afbb12e4500514036a2b78756b Version: 0cfdd8f92cac01afbb12e4500514036a2b78756b Version: 0cfdd8f92cac01afbb12e4500514036a2b78756b Version: 0cfdd8f92cac01afbb12e4500514036a2b78756b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/smc/smc_clc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "257cdf0c5ced9c0fba8aba501d94b0a5fcef2086",
"status": "affected",
"version": "0cfdd8f92cac01afbb12e4500514036a2b78756b",
"versionType": "git"
},
{
"lessThan": "22546729b96fc873b23065dc49e3d73c45cfb874",
"status": "affected",
"version": "0cfdd8f92cac01afbb12e4500514036a2b78756b",
"versionType": "git"
},
{
"lessThan": "5eedbfd82c2884e0010fdfb3c9446a6ebcadb691",
"status": "affected",
"version": "0cfdd8f92cac01afbb12e4500514036a2b78756b",
"versionType": "git"
},
{
"lessThan": "f0858e1d5624bb120b198f2a8528f97a9b0ae069",
"status": "affected",
"version": "0cfdd8f92cac01afbb12e4500514036a2b78756b",
"versionType": "git"
},
{
"lessThan": "6180a296ca65b08a81914805cbc0f78da5f10a1f",
"status": "affected",
"version": "0cfdd8f92cac01afbb12e4500514036a2b78756b",
"versionType": "git"
},
{
"lessThan": "ea0b5d0fe96356dce38f98375a57c52a04e13712",
"status": "affected",
"version": "0cfdd8f92cac01afbb12e4500514036a2b78756b",
"versionType": "git"
},
{
"lessThan": "83bcf9228b0501694fb2589ed1d142855a2887f2",
"status": "affected",
"version": "0cfdd8f92cac01afbb12e4500514036a2b78756b",
"versionType": "git"
},
{
"lessThan": "5a8db80f721deee8e916c2cfdee78decda02ce4f",
"status": "affected",
"version": "0cfdd8f92cac01afbb12e4500514036a2b78756b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/smc/smc_clc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: avoid early lgr access in smc_clc_wait_msg\n\nA CLC decline can be received while the handshake is still in an early\nstage, before the connection has been associated with a link group.\n\nThe decline handling in smc_clc_wait_msg() updates link-group level sync\nstate for first-contact declines, but that state only exists after link\ngroup setup has completed. Guard the link-group update accordingly and\nkeep the per-socket peer diagnosis handling unchanged.\n\nThis preserves the existing sync_err handling for established link-group\ncontexts and avoids touching link-group state before it is available."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The SMC CLC handshake runs over a TCP connection; a remote peer (a malicious client connecting to a listening SMC server, or a malicious server) triggers the dereference by sending a crafted DECLINE message, so the code is reachable purely over the network.\nAC:L - The attacker reliably crafts a DECLINE message with the SMC_FIRST_CONTACT_MASK bit set; the lgr==NULL condition is the default early-handshake state (the first message the server processes), so there is no race or condition outside attacker control.\nPR:N - On the server-side listen path the dereference occurs while processing the very first handshake message, before any authentication, so an unauthenticated remote peer requires no privileges.\nUI:N - A server with an AF_SMC listening socket processes the malicious handshake passively in a work queue with no local user action required.\nS:U - The crash is confined to the kernel\u0027s own security scope; no boundary (VM/IOMMU/sandbox) is crossed.\nC:N - This is a NULL pointer dereference with no information disclosure \u2014 no kernel memory contents are read or leaked.\nI:N - The write is to NULL plus a small fixed bitfield offset on a never-initialized pointer (not a controllable/dangling pointer), so it only crashes and provides no exploitable write primitive.\nA:H - Dereferencing the NULL lgr pointer causes a kernel oops/panic, taking down the system in a remotely-triggerable, unauthenticated denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:12.274Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/257cdf0c5ced9c0fba8aba501d94b0a5fcef2086"
},
{
"url": "https://git.kernel.org/stable/c/22546729b96fc873b23065dc49e3d73c45cfb874"
},
{
"url": "https://git.kernel.org/stable/c/5eedbfd82c2884e0010fdfb3c9446a6ebcadb691"
},
{
"url": "https://git.kernel.org/stable/c/f0858e1d5624bb120b198f2a8528f97a9b0ae069"
},
{
"url": "https://git.kernel.org/stable/c/6180a296ca65b08a81914805cbc0f78da5f10a1f"
},
{
"url": "https://git.kernel.org/stable/c/ea0b5d0fe96356dce38f98375a57c52a04e13712"
},
{
"url": "https://git.kernel.org/stable/c/83bcf9228b0501694fb2589ed1d142855a2887f2"
},
{
"url": "https://git.kernel.org/stable/c/5a8db80f721deee8e916c2cfdee78decda02ce4f"
}
],
"title": "net/smc: avoid early lgr access in smc_clc_wait_msg",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46027",
"datePublished": "2026-05-27T12:56:35.628Z",
"dateReserved": "2026-05-13T15:03:33.093Z",
"dateUpdated": "2026-08-05T12:29:12.274Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46064 (GCVE-0-2026-46064)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-06-14 17:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ibmasm: fix heap over-read in ibmasm_send_i2o_message()
The ibmasm_send_i2o_message() function uses get_dot_command_size() to
compute the byte count for memcpy_toio(), but this value is derived from
user-controlled fields in the dot_command_header (command_size: u8,
data_size: u16) and is never validated against the actual allocation size.
A root user can write a small buffer with inflated header fields, causing
memcpy_toio() to read up to ~65 KB past the end of the allocation into
adjacent kernel heap, which is then forwarded to the service processor
over MMIO.
Silently clamping the copy size is not sufficient: if the header fields
claim a larger size than the buffer, the SP receives a dot command whose
own header is inconsistent with the I2O message length, which can cause
the SP to desynchronize. Reject such commands outright by returning
failure.
Validate command_size before calling get_mfa_inbound() to avoid leaking
an I2O message frame: reading INBOUND_QUEUE_PORT dequeues a hardware
frame from the controller's free pool, and returning without a
corresponding set_mfa_inbound() call would permanently exhaust it.
Additionally, clamp command_size to I2O_COMMAND_SIZE before the
memcpy_toio() so the MMIO write stays within the I2O message frame,
consistent with the clamping already performed by outgoing_message_size()
for the header field.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/misc/ibmasm/lowlevel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ca1c857e2bb74a9fc0606128334f85316d57067b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b870f652877bfbe321bd0f4096fc37a93296f7b6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ce57fa439bd1b5d664f334a0c3e3f0e42abb0153",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "fd19eb1c75047a4ed4e855f56cafd704dc3914e0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "fe31722b0194ff76bf8b461e8bf97a2081147787",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c1c2417c60dbdca5ebb00462f21ee71c2d7f7083",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9e8f6c9d4ecddda2f28baa1678340286cff3969c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9aad71144fa3682cca3837a06c8623016790e7ec",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/misc/ibmasm/lowlevel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmasm: fix heap over-read in ibmasm_send_i2o_message()\n\nThe ibmasm_send_i2o_message() function uses get_dot_command_size() to\ncompute the byte count for memcpy_toio(), but this value is derived from\nuser-controlled fields in the dot_command_header (command_size: u8,\ndata_size: u16) and is never validated against the actual allocation size.\nA root user can write a small buffer with inflated header fields, causing\nmemcpy_toio() to read up to ~65 KB past the end of the allocation into\nadjacent kernel heap, which is then forwarded to the service processor\nover MMIO.\n\nSilently clamping the copy size is not sufficient: if the header fields\nclaim a larger size than the buffer, the SP receives a dot command whose\nown header is inconsistent with the I2O message length, which can cause\nthe SP to desynchronize. Reject such commands outright by returning\nfailure.\n\nValidate command_size before calling get_mfa_inbound() to avoid leaking\nan I2O message frame: reading INBOUND_QUEUE_PORT dequeues a hardware\nframe from the controller\u0027s free pool, and returning without a\ncorresponding set_mfa_inbound() call would permanently exhaust it.\n\nAdditionally, clamp command_size to I2O_COMMAND_SIZE before the\nmemcpy_toio() so the MMIO write stays within the I2O message frame,\nconsistent with the clamping already performed by outgoing_message_size()\nfor the header field."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:51:42.521Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ca1c857e2bb74a9fc0606128334f85316d57067b"
},
{
"url": "https://git.kernel.org/stable/c/b870f652877bfbe321bd0f4096fc37a93296f7b6"
},
{
"url": "https://git.kernel.org/stable/c/ce57fa439bd1b5d664f334a0c3e3f0e42abb0153"
},
{
"url": "https://git.kernel.org/stable/c/fd19eb1c75047a4ed4e855f56cafd704dc3914e0"
},
{
"url": "https://git.kernel.org/stable/c/fe31722b0194ff76bf8b461e8bf97a2081147787"
},
{
"url": "https://git.kernel.org/stable/c/c1c2417c60dbdca5ebb00462f21ee71c2d7f7083"
},
{
"url": "https://git.kernel.org/stable/c/9e8f6c9d4ecddda2f28baa1678340286cff3969c"
},
{
"url": "https://git.kernel.org/stable/c/9aad71144fa3682cca3837a06c8623016790e7ec"
}
],
"title": "ibmasm: fix heap over-read in ibmasm_send_i2o_message()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46064",
"datePublished": "2026-05-27T12:57:30.247Z",
"dateReserved": "2026-05-13T15:03:33.095Z",
"dateUpdated": "2026-06-14T17:51:42.521Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46152 (GCVE-0-2026-46152)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: drop stray 'static' from fast-RX rx_result
ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but
its per-invocation rx_result is declared static. Concurrent callers then
share one instance and can overwrite each other's result between
ieee80211_rx_mesh_data() and the switch on res.
That can make a packet that was queued or consumed by
ieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make
a packet that should continue return as queued.
Make res an automatic variable so each invocation keeps its own result.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.26.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.92.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.134.1.rt7.475.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.134.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.17.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.136.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.127.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Wi-Fi (mac80211) subsystem. The `ieee80211_invoke_fast_rx()` function uses a static variable for `rx_result`, which is shared across concurrent calls. This can lead to incorrect processing of Wi-Fi packets, where a packet might be mishandled or its status incorrectly reported. Such issues can result in unexpected network behavior or a denial of service within the wireless communication."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1058",
"description": "Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T12:04:50.791Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-46152"
},
{
"name": "RHBZ#2482563",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482563"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46152.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:44694"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27288"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36767"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:38902"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27789"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26427"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26428"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:44694: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:27288: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:36767: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:38902: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:27789: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:26427: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:26428: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-28T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-28T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: wifi: mac80211: drop stray \u0027static\u0027 from fast-RX rx_result",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, disable the Wi-Fi interface if wireless networking is not required. This can be achieved by preventing the `mac80211` kernel module from loading. To blacklist the `mac80211` module: `echo \"blacklist mac80211\" | sudo tee /etc/modprobe.d/blacklist-mac80211.conf`. After modifying the blacklist, regenerate the initramfs and reboot the system for the changes to take effect: `sudo dracut -f -v` and `sudo reboot`. Disabling the `mac80211` module will prevent Wi-Fi functionality on the system."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "03584528bfffb195e384698af9148b94e42e3f14",
"status": "affected",
"version": "3468e1e0c639032a603450f0830ccabfa76f5806",
"versionType": "git"
},
{
"lessThan": "1739fc31b4de06c5c78ce0741182770fb079091e",
"status": "affected",
"version": "3468e1e0c639032a603450f0830ccabfa76f5806",
"versionType": "git"
},
{
"lessThan": "e131562d6f2b958148c35c98831b007f47f0e3d3",
"status": "affected",
"version": "3468e1e0c639032a603450f0830ccabfa76f5806",
"versionType": "git"
},
{
"lessThan": "3ef44f96ccc3e06e059dec57842e366f0c4b1893",
"status": "affected",
"version": "3468e1e0c639032a603450f0830ccabfa76f5806",
"versionType": "git"
},
{
"lessThan": "7a5b81e0c87a075afd572f659d8eb68c9c4cd2ba",
"status": "affected",
"version": "3468e1e0c639032a603450f0830ccabfa76f5806",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: drop stray \u0027static\u0027 from fast-RX rx_result\n\nieee80211_invoke_fast_rx() is documented as safe for parallel RX, but\nits per-invocation rx_result is declared static. Concurrent callers then\nshare one instance and can overwrite each other\u0027s result between\nieee80211_rx_mesh_data() and the switch on res.\n\nThat can make a packet that was queued or consumed by\nieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make\na packet that should continue return as queued.\n\nMake res an automatic variable so each invocation keeps its own result."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerability is in the mac80211 WiFi mesh receive path, triggered by 802.11s mesh data frames received over the air from a radio-range mesh peer, matching the Adjacent (same wireless segment) attack vector.\nAC:L - Exploitation is a race on the shared `static res`, but the attacker creates the contention by flooding mesh data frames that common RSS/multi-queue WiFi hardware (iwlwifi, ath11k/12k, mt76) processes concurrently across CPUs; the attacker controls both sides of the race.\nPR:N - The attacker holds no privileges on the target host, and in an open (unauthenticated) mesh \u2014 the most severe reasonable deployment \u2014 any radio-range device can peer or inject frames appearing from a peered station to reach the fast-RX path.\nUI:N - The vulnerable path runs automatically on frame reception; no action by any local user is required.\nS:U - The corruption stays within the kernel\u0027s own security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The clobbered result causes a consumed/in-flight skb to be reprocessed (use-after-free / concurrent skb use), and a UAF gives the attacker control over freed object contents enabling arbitrary kernel memory disclosure.\nI:H - The same use-after-free on the skb enables heap manipulation and arbitrary write primitives, allowing modification of kernel memory and potential control-flow hijack.\nA:H - The double-use/use-after-free of the skb readily causes kernel oops/panic, and the misrouting of receive results also corrupts the RX/TX state, producing crashes."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:04.634Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/03584528bfffb195e384698af9148b94e42e3f14"
},
{
"url": "https://git.kernel.org/stable/c/1739fc31b4de06c5c78ce0741182770fb079091e"
},
{
"url": "https://git.kernel.org/stable/c/e131562d6f2b958148c35c98831b007f47f0e3d3"
},
{
"url": "https://git.kernel.org/stable/c/3ef44f96ccc3e06e059dec57842e366f0c4b1893"
},
{
"url": "https://git.kernel.org/stable/c/7a5b81e0c87a075afd572f659d8eb68c9c4cd2ba"
}
],
"title": "wifi: mac80211: drop stray \u0027static\u0027 from fast-RX rx_result",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46152",
"datePublished": "2026-05-28T09:36:08.211Z",
"dateReserved": "2026-05-13T15:03:33.101Z",
"dateUpdated": "2026-08-05T12:30:04.634Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43244 (GCVE-0-2026-43244)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
kcm: fix zero-frag skb in frag_list on partial sendmsg error
Syzkaller reported a warning in kcm_write_msgs() when processing a
message with a zero-fragment skb in the frag_list.
When kcm_sendmsg() fills MAX_SKB_FRAGS fragments in the current skb,
it allocates a new skb (tskb) and links it into the frag_list before
copying data. If the copy subsequently fails (e.g. -EFAULT from
user memory), tskb remains in the frag_list with zero fragments:
head skb (msg being assembled, NOT yet in sk_write_queue)
+-----------+
| frags[17] | (MAX_SKB_FRAGS, all filled with data)
| frag_list-+--> tskb
+-----------+ +----------+
| frags[0] | (empty! copy failed before filling)
+----------+
For SOCK_SEQPACKET with partial data already copied, the error path
saves this message via partial_message for later completion. For
SOCK_SEQPACKET, sock_write_iter() automatically sets MSG_EOR, so a
subsequent zero-length write(fd, NULL, 0) completes the message and
queues it to sk_write_queue. kcm_write_msgs() then walks the
frag_list and hits:
WARN_ON(!skb_shinfo(skb)->nr_frags)
TCP has a similar pattern where skbs are enqueued before data copy
and cleaned up on failure via tcp_remove_empty_skb(). KCM was
missing the equivalent cleanup.
Fix this by tracking the predecessor skb (frag_prev) when allocating
a new frag_list entry. On error, if the tail skb has zero frags,
use frag_prev to unlink and free it in O(1) without walking the
singly-linked frag_list. frag_prev is safe to dereference because
the entire message chain is only held locally (or in kcm->seq_skb)
and is not added to sk_write_queue until MSG_EOR, so the send path
cannot free it underneath us.
Also change the WARN_ON to WARN_ON_ONCE to avoid flooding the log
if the condition is somehow hit repeatedly.
There are currently no KCM selftests in the kernel tree; a simple
reproducer is available at [1].
[1] https://gist.github.com/mrpre/a94d431c757e8d6f168f4dd1a3749daa
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/kcm/kcmsock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9ea3671d70ee07480d80bebe86696397c4e99fb7",
"status": "affected",
"version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
"versionType": "git"
},
{
"lessThan": "b1e3edf688a88c1a3ac41657055d9c136a08cd25",
"status": "affected",
"version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
"versionType": "git"
},
{
"lessThan": "7af58f76e4b404a74c836881a845e6652db8a09f",
"status": "affected",
"version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
"versionType": "git"
},
{
"lessThan": "ca220141fa8ebae09765a242076b2b77338106b0",
"status": "affected",
"version": "ab7ac4eb9832e32a09f4e8042705484d2fb0aad3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/kcm/kcmsock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkcm: fix zero-frag skb in frag_list on partial sendmsg error\n\nSyzkaller reported a warning in kcm_write_msgs() when processing a\nmessage with a zero-fragment skb in the frag_list.\n\nWhen kcm_sendmsg() fills MAX_SKB_FRAGS fragments in the current skb,\nit allocates a new skb (tskb) and links it into the frag_list before\ncopying data. If the copy subsequently fails (e.g. -EFAULT from\nuser memory), tskb remains in the frag_list with zero fragments:\n\n head skb (msg being assembled, NOT yet in sk_write_queue)\n +-----------+\n | frags[17] | (MAX_SKB_FRAGS, all filled with data)\n | frag_list-+--\u003e tskb\n +-----------+ +----------+\n | frags[0] | (empty! copy failed before filling)\n +----------+\n\nFor SOCK_SEQPACKET with partial data already copied, the error path\nsaves this message via partial_message for later completion. For\nSOCK_SEQPACKET, sock_write_iter() automatically sets MSG_EOR, so a\nsubsequent zero-length write(fd, NULL, 0) completes the message and\nqueues it to sk_write_queue. kcm_write_msgs() then walks the\nfrag_list and hits:\n\n WARN_ON(!skb_shinfo(skb)-\u003enr_frags)\n\nTCP has a similar pattern where skbs are enqueued before data copy\nand cleaned up on failure via tcp_remove_empty_skb(). KCM was\nmissing the equivalent cleanup.\n\nFix this by tracking the predecessor skb (frag_prev) when allocating\na new frag_list entry. On error, if the tail skb has zero frags,\nuse frag_prev to unlink and free it in O(1) without walking the\nsingly-linked frag_list. frag_prev is safe to dereference because\nthe entire message chain is only held locally (or in kcm-\u003eseq_skb)\nand is not added to sk_write_queue until MSG_EOR, so the send path\ncannot free it underneath us.\n\nAlso change the WARN_ON to WARN_ON_ONCE to avoid flooding the log\nif the condition is somehow hit repeatedly.\n\nThere are currently no KCM selftests in the kernel tree; a simple\nreproducer is available at [1].\n\n[1] https://gist.github.com/mrpre/a94d431c757e8d6f168f4dd1a3749daa"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:20:47.856Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9ea3671d70ee07480d80bebe86696397c4e99fb7"
},
{
"url": "https://git.kernel.org/stable/c/b1e3edf688a88c1a3ac41657055d9c136a08cd25"
},
{
"url": "https://git.kernel.org/stable/c/7af58f76e4b404a74c836881a845e6652db8a09f"
},
{
"url": "https://git.kernel.org/stable/c/ca220141fa8ebae09765a242076b2b77338106b0"
}
],
"title": "kcm: fix zero-frag skb in frag_list on partial sendmsg error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43244",
"datePublished": "2026-05-06T11:28:36.946Z",
"dateReserved": "2026-05-01T14:12:55.995Z",
"dateUpdated": "2026-05-11T22:20:47.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31499 (GCVE-0-2026-31499)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-05-23 16:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
l2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer
and id_addr_timer while holding conn->lock. However, the work functions
l2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire
conn->lock, creating a potential AB-BA deadlock if the work is already
executing when l2cap_conn_del() takes the lock.
Move the work cancellations before acquiring conn->lock and use
disable_delayed_work_sync() to additionally prevent the works from
being rearmed after cancellation, consistent with the pattern used in
hci_conn_del().
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f87271d21dd4ee83857ca11b94e7b4952749bbae Version: ab4eedb790cae44313759b50fe47da285e2519d5 Version: ab4eedb790cae44313759b50fe47da285e2519d5 Version: ab4eedb790cae44313759b50fe47da285e2519d5 Version: efc30877bd4bc85fefe98d80af60fafc86e5775e Version: 18ab6b6078fa8191ca30a3065d57bf35d5635761 Version: 6.12.20 ≤ Version: 6.6.84 ≤ Version: 6.13.8 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f7f35a4f7fd574f5889bb2e4b397e14cbb83f6da",
"status": "affected",
"version": "f87271d21dd4ee83857ca11b94e7b4952749bbae",
"versionType": "git"
},
{
"lessThan": "3f26ecbd9cde621dd94be7ef252c7210b965a5c7",
"status": "affected",
"version": "ab4eedb790cae44313759b50fe47da285e2519d5",
"versionType": "git"
},
{
"lessThan": "d008460de352e534f6721de829b093368564ec66",
"status": "affected",
"version": "ab4eedb790cae44313759b50fe47da285e2519d5",
"versionType": "git"
},
{
"lessThan": "00fdebbbc557a2fc21321ff2eaa22fd70c078608",
"status": "affected",
"version": "ab4eedb790cae44313759b50fe47da285e2519d5",
"versionType": "git"
},
{
"status": "affected",
"version": "efc30877bd4bc85fefe98d80af60fafc86e5775e",
"versionType": "git"
},
{
"status": "affected",
"version": "18ab6b6078fa8191ca30a3065d57bf35d5635761",
"versionType": "git"
},
{
"lessThan": "6.12.88",
"status": "affected",
"version": "6.12.20",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.84",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.12.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix deadlock in l2cap_conn_del()\n\nl2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer\nand id_addr_timer while holding conn-\u003elock. However, the work functions\nl2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire\nconn-\u003elock, creating a potential AB-BA deadlock if the work is already\nexecuting when l2cap_conn_del() takes the lock.\n\nMove the work cancellations before acquiring conn-\u003elock and use\ndisable_delayed_work_sync() to additionally prevent the works from\nbeing rearmed after cancellation, consistent with the pattern used in\nhci_conn_del()."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:05:12.236Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f7f35a4f7fd574f5889bb2e4b397e14cbb83f6da"
},
{
"url": "https://git.kernel.org/stable/c/3f26ecbd9cde621dd94be7ef252c7210b965a5c7"
},
{
"url": "https://git.kernel.org/stable/c/d008460de352e534f6721de829b093368564ec66"
},
{
"url": "https://git.kernel.org/stable/c/00fdebbbc557a2fc21321ff2eaa22fd70c078608"
}
],
"title": "Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31499",
"datePublished": "2026-04-22T13:54:20.384Z",
"dateReserved": "2026-03-09T15:48:24.104Z",
"dateUpdated": "2026-05-23T16:05:12.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43241 (GCVE-0-2026-43241)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access
Number of MW LUTs depends on NTB configuration and can be set to MAX_MWS,
This patch protects against invalid index out of bounds access to mw_sizes
When invalid access print message to user that configuration is not valid.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ec0467ccbdeb69a86c8729073057bda7bce00eec Version: ec0467ccbdeb69a86c8729073057bda7bce00eec Version: ec0467ccbdeb69a86c8729073057bda7bce00eec Version: ec0467ccbdeb69a86c8729073057bda7bce00eec Version: ec0467ccbdeb69a86c8729073057bda7bce00eec Version: ec0467ccbdeb69a86c8729073057bda7bce00eec Version: ec0467ccbdeb69a86c8729073057bda7bce00eec Version: ec0467ccbdeb69a86c8729073057bda7bce00eec |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ntb/hw/mscc/ntb_hw_switchtec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "348e1ac9ad983ed7e62de14e1daf47f1695a4ce9",
"status": "affected",
"version": "ec0467ccbdeb69a86c8729073057bda7bce00eec",
"versionType": "git"
},
{
"lessThan": "ee02c4f980c91820845dd8e469ec7dc670ab6d9d",
"status": "affected",
"version": "ec0467ccbdeb69a86c8729073057bda7bce00eec",
"versionType": "git"
},
{
"lessThan": "740945de896021b9a859e71f38f6aea72a6393cf",
"status": "affected",
"version": "ec0467ccbdeb69a86c8729073057bda7bce00eec",
"versionType": "git"
},
{
"lessThan": "85c9daa1f8319bbb3dfee71dc6a2f969cd3b4c92",
"status": "affected",
"version": "ec0467ccbdeb69a86c8729073057bda7bce00eec",
"versionType": "git"
},
{
"lessThan": "0e930420945106151c6eb3d7837b4e6154e9b144",
"status": "affected",
"version": "ec0467ccbdeb69a86c8729073057bda7bce00eec",
"versionType": "git"
},
{
"lessThan": "2346856b74823a2a78109002e479a3d02526a9ce",
"status": "affected",
"version": "ec0467ccbdeb69a86c8729073057bda7bce00eec",
"versionType": "git"
},
{
"lessThan": "47ce292dd45dc689747c40603222691638919189",
"status": "affected",
"version": "ec0467ccbdeb69a86c8729073057bda7bce00eec",
"versionType": "git"
},
{
"lessThan": "c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface",
"status": "affected",
"version": "ec0467ccbdeb69a86c8729073057bda7bce00eec",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ntb/hw/mscc/ntb_hw_switchtec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access\n\nNumber of MW LUTs depends on NTB configuration and can be set to MAX_MWS,\nThis patch protects against invalid index out of bounds access to mw_sizes\nWhen invalid access print message to user that configuration is not valid."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:20:44.266Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/348e1ac9ad983ed7e62de14e1daf47f1695a4ce9"
},
{
"url": "https://git.kernel.org/stable/c/ee02c4f980c91820845dd8e469ec7dc670ab6d9d"
},
{
"url": "https://git.kernel.org/stable/c/740945de896021b9a859e71f38f6aea72a6393cf"
},
{
"url": "https://git.kernel.org/stable/c/85c9daa1f8319bbb3dfee71dc6a2f969cd3b4c92"
},
{
"url": "https://git.kernel.org/stable/c/0e930420945106151c6eb3d7837b4e6154e9b144"
},
{
"url": "https://git.kernel.org/stable/c/2346856b74823a2a78109002e479a3d02526a9ce"
},
{
"url": "https://git.kernel.org/stable/c/47ce292dd45dc689747c40603222691638919189"
},
{
"url": "https://git.kernel.org/stable/c/c8ba7ad2cc1c7b90570aa347b8ebbe279f1eface"
}
],
"title": "ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43241",
"datePublished": "2026-05-06T11:28:34.927Z",
"dateReserved": "2026-05-01T14:12:55.995Z",
"dateUpdated": "2026-05-11T22:20:44.266Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45834 (GCVE-0-2026-45834)
Vulnerability from cvelistv5
Published
2026-05-26 16:14
Modified
2026-06-14 17:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()
Add the same NULL guard already present in
l2cap_sock_resume_cb() and l2cap_sock_ready_cb().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 89bc500e41fc5b48e0573e6b0d927fc97b8951dc Version: 89bc500e41fc5b48e0573e6b0d927fc97b8951dc Version: 89bc500e41fc5b48e0573e6b0d927fc97b8951dc Version: 89bc500e41fc5b48e0573e6b0d927fc97b8951dc Version: 89bc500e41fc5b48e0573e6b0d927fc97b8951dc Version: 89bc500e41fc5b48e0573e6b0d927fc97b8951dc Version: 89bc500e41fc5b48e0573e6b0d927fc97b8951dc Version: 89bc500e41fc5b48e0573e6b0d927fc97b8951dc |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1b1c0da227bf63479bac9982fc8d12df9aaea0fb",
"status": "affected",
"version": "89bc500e41fc5b48e0573e6b0d927fc97b8951dc",
"versionType": "git"
},
{
"lessThan": "85426e97dc72f2088ba6d27e74cd58c3fbd43e31",
"status": "affected",
"version": "89bc500e41fc5b48e0573e6b0d927fc97b8951dc",
"versionType": "git"
},
{
"lessThan": "0c17c8832562b2aac288e89cefd0f46074f54bcb",
"status": "affected",
"version": "89bc500e41fc5b48e0573e6b0d927fc97b8951dc",
"versionType": "git"
},
{
"lessThan": "5105f3e6b2df619c635b5f6a49fac131a36c7952",
"status": "affected",
"version": "89bc500e41fc5b48e0573e6b0d927fc97b8951dc",
"versionType": "git"
},
{
"lessThan": "c88c185ae0a1067823661b220aeea613df2c127b",
"status": "affected",
"version": "89bc500e41fc5b48e0573e6b0d927fc97b8951dc",
"versionType": "git"
},
{
"lessThan": "1810e42ff6716f320c7269d5850eca48b07b7427",
"status": "affected",
"version": "89bc500e41fc5b48e0573e6b0d927fc97b8951dc",
"versionType": "git"
},
{
"lessThan": "a2dcf1a61d056aef15b63c6eae9441344d624389",
"status": "affected",
"version": "89bc500e41fc5b48e0573e6b0d927fc97b8951dc",
"versionType": "git"
},
{
"lessThan": "2ff1a41a912de8517b4482e946dd951b7d80edbf",
"status": "affected",
"version": "89bc500e41fc5b48e0573e6b0d927fc97b8951dc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"lessThan": "3.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()\n\nAdd the same NULL guard already present in\nl2cap_sock_resume_cb() and l2cap_sock_ready_cb()."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:45:52.350Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1b1c0da227bf63479bac9982fc8d12df9aaea0fb"
},
{
"url": "https://git.kernel.org/stable/c/85426e97dc72f2088ba6d27e74cd58c3fbd43e31"
},
{
"url": "https://git.kernel.org/stable/c/0c17c8832562b2aac288e89cefd0f46074f54bcb"
},
{
"url": "https://git.kernel.org/stable/c/5105f3e6b2df619c635b5f6a49fac131a36c7952"
},
{
"url": "https://git.kernel.org/stable/c/c88c185ae0a1067823661b220aeea613df2c127b"
},
{
"url": "https://git.kernel.org/stable/c/1810e42ff6716f320c7269d5850eca48b07b7427"
},
{
"url": "https://git.kernel.org/stable/c/a2dcf1a61d056aef15b63c6eae9441344d624389"
},
{
"url": "https://git.kernel.org/stable/c/2ff1a41a912de8517b4482e946dd951b7d80edbf"
}
],
"title": "Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45834",
"datePublished": "2026-05-26T16:14:11.198Z",
"dateReserved": "2026-05-13T15:03:33.077Z",
"dateUpdated": "2026-06-14T17:45:52.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53068 (GCVE-0-2026-53068)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/komeda: fix integer overflow in AFBC framebuffer size check
The AFBC framebuffer size validation calculates the minimum required
buffer size by adding the AFBC payload size to the framebuffer offset.
This addition is performed without checking for integer overflow.
If the addition oveflows, the size check may incorrectly succed and
allow userspace to provide an undersized drm_gem_object, potentially
leading to out-of-bounds memory access.
Add usage of check_add_overflow() to safely compute the minimum
required size and reject the framebuffer if an overflow is detected.
This makes the AFBC size validation more robust against malformed.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 65ad2392dd6d1691db93e82b08d3311298b9d64a Version: 65ad2392dd6d1691db93e82b08d3311298b9d64a Version: 65ad2392dd6d1691db93e82b08d3311298b9d64a Version: 65ad2392dd6d1691db93e82b08d3311298b9d64a Version: 65ad2392dd6d1691db93e82b08d3311298b9d64a Version: 65ad2392dd6d1691db93e82b08d3311298b9d64a Version: 65ad2392dd6d1691db93e82b08d3311298b9d64a Version: 65ad2392dd6d1691db93e82b08d3311298b9d64a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a3a2a9bdc0f9c2d863a5a290cb2d4a565f7268e7",
"status": "affected",
"version": "65ad2392dd6d1691db93e82b08d3311298b9d64a",
"versionType": "git"
},
{
"lessThan": "e27b58095d7d3ac72f230e318838dee956258460",
"status": "affected",
"version": "65ad2392dd6d1691db93e82b08d3311298b9d64a",
"versionType": "git"
},
{
"lessThan": "02ff8a7d3d0eecc546b9ab4c07b3d7c65d485583",
"status": "affected",
"version": "65ad2392dd6d1691db93e82b08d3311298b9d64a",
"versionType": "git"
},
{
"lessThan": "d8a541906860aa3519b1874780d933c766918a7c",
"status": "affected",
"version": "65ad2392dd6d1691db93e82b08d3311298b9d64a",
"versionType": "git"
},
{
"lessThan": "8165e8b28fdf392c2c7412518d602b4f193812a8",
"status": "affected",
"version": "65ad2392dd6d1691db93e82b08d3311298b9d64a",
"versionType": "git"
},
{
"lessThan": "fe1f80f8f6e8611ac6349b9d464e8750443390cf",
"status": "affected",
"version": "65ad2392dd6d1691db93e82b08d3311298b9d64a",
"versionType": "git"
},
{
"lessThan": "872d923b852705054bc099af663da862fdc1097d",
"status": "affected",
"version": "65ad2392dd6d1691db93e82b08d3311298b9d64a",
"versionType": "git"
},
{
"lessThan": "779ec12c85c9e4547519e3903a371a3b26a289de",
"status": "affected",
"version": "65ad2392dd6d1691db93e82b08d3311298b9d64a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/arm/display/komeda/komeda_framebuffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/komeda: fix integer overflow in AFBC framebuffer size check\n\nThe AFBC framebuffer size validation calculates the minimum required\nbuffer size by adding the AFBC payload size to the framebuffer offset.\nThis addition is performed without checking for integer overflow.\n\nIf the addition oveflows, the size check may incorrectly succed and\nallow userspace to provide an undersized drm_gem_object, potentially\nleading to out-of-bounds memory access.\n\nAdd usage of check_add_overflow() to safely compute the minimum\nrequired size and reject the framebuffer if an overflow is detected.\nThis makes the AFBC size validation more robust against malformed.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached from local userspace through DRM ioctls, specifically framebuffer creation with `DRM_IOCTL_MODE_ADDFB2` on a Komeda DRM device. It is not reachable by network or adjacent-only input.\nAC:L - The attacker controls the framebuffer dimensions, modifier, offset, and GEM handle inputs needed to trigger the integer overflow. No race or external timing condition is required.\nPR:L - The vulnerable `ADDFB2` path has no root, auth, or master ioctl flag, but it requires local access to the DRM device node and a valid GEM handle. Triggering hardware consumption of the framebuffer uses normal local DRM modeset privileges rather than init-namespace root.\nUI:N - An attacker with local DRM device access can issue the required ioctls directly. No separate victim action is required.\nS:U - The impact remains within the local kernel/device security authority. This is not a VM escape, guest-to-host boundary crossing, or demonstrated IOMMU isolation bypass.\nC:H - The overflow can allow an undersized GEM object to pass validation and cause the display engine to DMA-read outside the framebuffer allocation. Because this is an out-of-bounds read from system memory and is not tightly bounded, confidentiality is high.\nI:N - The reachable AFBC framebuffer use is a display source path, so the hardware consumes memory rather than writing to it. The writeback path rejects AFBC framebuffers through layer capability checks, so a direct out-of-bounds write was not established.\nA:H - Out-of-bounds DMA reads can trigger AXI/TBU/IOMMU faults or wedge the display pipeline, and on some deployments may escalate to a kernel-visible hardware fault. The issue can be triggered repeatedly from local userspace once the device is accessible."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:02.612Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a3a2a9bdc0f9c2d863a5a290cb2d4a565f7268e7"
},
{
"url": "https://git.kernel.org/stable/c/e27b58095d7d3ac72f230e318838dee956258460"
},
{
"url": "https://git.kernel.org/stable/c/02ff8a7d3d0eecc546b9ab4c07b3d7c65d485583"
},
{
"url": "https://git.kernel.org/stable/c/d8a541906860aa3519b1874780d933c766918a7c"
},
{
"url": "https://git.kernel.org/stable/c/8165e8b28fdf392c2c7412518d602b4f193812a8"
},
{
"url": "https://git.kernel.org/stable/c/fe1f80f8f6e8611ac6349b9d464e8750443390cf"
},
{
"url": "https://git.kernel.org/stable/c/872d923b852705054bc099af663da862fdc1097d"
},
{
"url": "https://git.kernel.org/stable/c/779ec12c85c9e4547519e3903a371a3b26a289de"
}
],
"title": "drm/komeda: fix integer overflow in AFBC framebuffer size check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53068",
"datePublished": "2026-06-24T16:30:10.140Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-08-05T12:33:02.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53347 (GCVE-0-2026-53347)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-07-01 13:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: Fix driver removal with disabled KMS
DRM atomic and modesetting aren't initialized if virtio-gpu driver built
with disabled KMS, leading to access of uninitialized data on driver
removal/unbinding and crashing kernel. Fix it by skipping shutting down
atomic core with unavailable KMS.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/virtio/virtgpu_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ed3e134700a2e07caa99b9bc0683ebbe0327c562",
"status": "affected",
"version": "72122c69d71784e390527819754ea456421c4501",
"versionType": "git"
},
{
"lessThan": "38a5f891cda6d121c149c94cda89c31ec7024ee3",
"status": "affected",
"version": "72122c69d71784e390527819754ea456421c4501",
"versionType": "git"
},
{
"lessThan": "19a6a00ff50c284f3a9818882ad2be58b33b790a",
"status": "affected",
"version": "72122c69d71784e390527819754ea456421c4501",
"versionType": "git"
},
{
"lessThan": "15e561869a8b4e4db69733be1d6f33770664f989",
"status": "affected",
"version": "72122c69d71784e390527819754ea456421c4501",
"versionType": "git"
},
{
"lessThan": "f329e8325e054bd6d84d10904f8dd51137281b92",
"status": "affected",
"version": "72122c69d71784e390527819754ea456421c4501",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/virtio/virtgpu_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: Fix driver removal with disabled KMS\n\nDRM atomic and modesetting aren\u0027t initialized if virtio-gpu driver built\nwith disabled KMS, leading to access of uninitialized data on driver\nremoval/unbinding and crashing kernel. Fix it by skipping shutting down\natomic core with unavailable KMS."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T13:32:26.262Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ed3e134700a2e07caa99b9bc0683ebbe0327c562"
},
{
"url": "https://git.kernel.org/stable/c/38a5f891cda6d121c149c94cda89c31ec7024ee3"
},
{
"url": "https://git.kernel.org/stable/c/19a6a00ff50c284f3a9818882ad2be58b33b790a"
},
{
"url": "https://git.kernel.org/stable/c/15e561869a8b4e4db69733be1d6f33770664f989"
},
{
"url": "https://git.kernel.org/stable/c/f329e8325e054bd6d84d10904f8dd51137281b92"
}
],
"title": "drm/virtio: Fix driver removal with disabled KMS",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53347",
"datePublished": "2026-07-01T13:32:26.262Z",
"dateReserved": "2026-06-09T07:44:35.399Z",
"dateUpdated": "2026-07-01T13:32:26.262Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53080 (GCVE-0-2026-53080)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_fw: fix NULL dereference of "old" filters before change()
Like pointed out by Sashiko [1], since commit ed76f5edccc9 ("net: sched:
protect filter_chain list with filter_chain_lock mutex") TC filters are
added to a shared block and published to datapath before their ->change()
function is called. This is a problem for cls_fw: an invalid filter
created with the "old" method can still classify some packets before it
is destroyed by the validation logic added by Xiang.
Therefore, insisting with repeated runs of the following script:
# ip link add dev crash0 type dummy
# ip link set dev crash0 up
# mausezahn crash0 -c 100000 -P 10 \
> -A 4.3.2.1 -B 1.2.3.4 -t udp "dp=1234" -q &
# sleep 1
# tc qdisc add dev crash0 egress_block 1 clsact
# tc filter add block 1 protocol ip prio 1 matchall \
> action skbedit mark 65536 continue
# tc filter add block 1 protocol ip prio 2 fw
# ip link del dev crash0
can still make fw_classify() hit the WARN_ON() in [2]:
WARNING: ./include/net/pkt_cls.h:88 at fw_classify+0x244/0x250 [cls_fw], CPU#18: mausezahn/1399
Modules linked in: cls_fw(E) act_skbedit(E)
CPU: 18 UID: 0 PID: 1399 Comm: mausezahn Tainted: G E 7.0.0-rc6-virtme #17 PREEMPT(full)
Tainted: [E]=UNSIGNED_MODULE
Hardware name: Red Hat KVM, BIOS 1.16.3-2.el9 04/01/2014
RIP: 0010:fw_classify+0x244/0x250 [cls_fw]
Code: 5c 49 c7 45 00 00 00 00 00 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 5b b8 ff ff ff ff 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 90 <0f> 0b 90 eb a0 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffd1b7026bf8a8 EFLAGS: 00010202
RAX: ffff8c5ac9c60800 RBX: ffff8c5ac99322c0 RCX: 0000000000000004
RDX: 0000000000000001 RSI: ffff8c5b74d7a000 RDI: ffff8c5ac8284f40
RBP: ffffd1b7026bf8d0 R08: 0000000000000000 R09: ffffd1b7026bf9b0
R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000010000
R13: ffffd1b7026bf930 R14: ffff8c5ac8284f40 R15: 0000000000000000
FS: 00007fca40c37740(0000) GS:ffff8c5b74d7a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fca40e822a0 CR3: 0000000005ca0001 CR4: 0000000000172ef0
Call Trace:
<TASK>
tcf_classify+0x17d/0x5c0
tc_run+0x9d/0x150
__dev_queue_xmit+0x2ab/0x14d0
ip_finish_output2+0x340/0x8f0
ip_output+0xa4/0x250
raw_sendmsg+0x147d/0x14b0
__sys_sendto+0x1cc/0x1f0
__x64_sys_sendto+0x24/0x30
do_syscall_64+0x126/0xf80
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fca40e822ba
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
RSP: 002b:00007ffc248a42c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 000055ef233289d0 RCX: 00007fca40e822ba
RDX: 000000000000001e RSI: 000055ef23328c30 RDI: 0000000000000003
RBP: 000055ef233289d0 R08: 00007ffc248a42d0 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000001e
R13: 00000000000186a0 R14: 0000000000000000 R15: 00007fca41043000
</TASK>
irq event stamp: 1045778
hardirqs last enabled at (1045784): [<ffffffff864ec042>] __up_console_sem+0x52/0x60
hardirqs last disabled at (1045789): [<ffffffff864ec027>] __up_console_sem+0x37/0x60
softirqs last enabled at (1045426): [<ffffffff874d48c7>] __alloc_skb+0x207/0x260
softirqs last disabled at (1045434): [<ffffffff874fe8f8>] __dev_queue_xmit+0x78/0x14d0
Then, because of the value in the packet's mark, dereference on 'q->handle'
with NULL 'q' occurs:
BUG: kernel NULL pointer dereference, address: 0000000000000038
[...]
RIP: 0010:fw_classify+0x1fe/0x250 [cls_fw]
[...]
Skip "old-style" classification on shared blocks, so that the NULL
dereference is fixed and WARN_ON() is not hit anymore in the short
lifetime of invalid cls_fw "old-style" filters.
[1] https://sashiko.dev/#/patchset/2
---truncated---
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ed76f5edccc98fa66f2337f0b3b255d6e1a568b7 Version: ed76f5edccc98fa66f2337f0b3b255d6e1a568b7 Version: ed76f5edccc98fa66f2337f0b3b255d6e1a568b7 Version: ed76f5edccc98fa66f2337f0b3b255d6e1a568b7 Version: ed76f5edccc98fa66f2337f0b3b255d6e1a568b7 Version: ed76f5edccc98fa66f2337f0b3b255d6e1a568b7 Version: ed76f5edccc98fa66f2337f0b3b255d6e1a568b7 Version: ed76f5edccc98fa66f2337f0b3b255d6e1a568b7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/cls_fw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a719275da488835e987d28effc04679b4aace3a0",
"status": "affected",
"version": "ed76f5edccc98fa66f2337f0b3b255d6e1a568b7",
"versionType": "git"
},
{
"lessThan": "c205da704c84eeb4247d770150440294fd547049",
"status": "affected",
"version": "ed76f5edccc98fa66f2337f0b3b255d6e1a568b7",
"versionType": "git"
},
{
"lessThan": "5dcce34c57d5e5990869384d69deeb9414bf9b92",
"status": "affected",
"version": "ed76f5edccc98fa66f2337f0b3b255d6e1a568b7",
"versionType": "git"
},
{
"lessThan": "5df49f0579f7e625f2358a219d31fbc7621be799",
"status": "affected",
"version": "ed76f5edccc98fa66f2337f0b3b255d6e1a568b7",
"versionType": "git"
},
{
"lessThan": "829808cbf8cf8a6d07a0e67a5ea2c3fcd63a9e5c",
"status": "affected",
"version": "ed76f5edccc98fa66f2337f0b3b255d6e1a568b7",
"versionType": "git"
},
{
"lessThan": "41845bc5bb64f3d615abe575ad655b5e7f193634",
"status": "affected",
"version": "ed76f5edccc98fa66f2337f0b3b255d6e1a568b7",
"versionType": "git"
},
{
"lessThan": "4fabcfea7a9dd159df32c5df6587fe858cb0d748",
"status": "affected",
"version": "ed76f5edccc98fa66f2337f0b3b255d6e1a568b7",
"versionType": "git"
},
{
"lessThan": "65782b2db7321d5f97c16718c4c7f6c7205a56be",
"status": "affected",
"version": "ed76f5edccc98fa66f2337f0b3b255d6e1a568b7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/cls_fw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_fw: fix NULL dereference of \"old\" filters before change()\n\nLike pointed out by Sashiko [1], since commit ed76f5edccc9 (\"net: sched:\nprotect filter_chain list with filter_chain_lock mutex\") TC filters are\nadded to a shared block and published to datapath before their -\u003echange()\nfunction is called. This is a problem for cls_fw: an invalid filter\ncreated with the \"old\" method can still classify some packets before it\nis destroyed by the validation logic added by Xiang.\nTherefore, insisting with repeated runs of the following script:\n\n # ip link add dev crash0 type dummy\n # ip link set dev crash0 up\n # mausezahn crash0 -c 100000 -P 10 \\\n \u003e -A 4.3.2.1 -B 1.2.3.4 -t udp \"dp=1234\" -q \u0026\n # sleep 1\n # tc qdisc add dev crash0 egress_block 1 clsact\n # tc filter add block 1 protocol ip prio 1 matchall \\\n \u003e action skbedit mark 65536 continue\n # tc filter add block 1 protocol ip prio 2 fw\n # ip link del dev crash0\n\ncan still make fw_classify() hit the WARN_ON() in [2]:\n\n WARNING: ./include/net/pkt_cls.h:88 at fw_classify+0x244/0x250 [cls_fw], CPU#18: mausezahn/1399\n Modules linked in: cls_fw(E) act_skbedit(E)\n CPU: 18 UID: 0 PID: 1399 Comm: mausezahn Tainted: G E 7.0.0-rc6-virtme #17 PREEMPT(full)\n Tainted: [E]=UNSIGNED_MODULE\n Hardware name: Red Hat KVM, BIOS 1.16.3-2.el9 04/01/2014\n RIP: 0010:fw_classify+0x244/0x250 [cls_fw]\n Code: 5c 49 c7 45 00 00 00 00 00 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 5b b8 ff ff ff ff 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 90 \u003c0f\u003e 0b 90 eb a0 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90\n RSP: 0018:ffffd1b7026bf8a8 EFLAGS: 00010202\n RAX: ffff8c5ac9c60800 RBX: ffff8c5ac99322c0 RCX: 0000000000000004\n RDX: 0000000000000001 RSI: ffff8c5b74d7a000 RDI: ffff8c5ac8284f40\n RBP: ffffd1b7026bf8d0 R08: 0000000000000000 R09: ffffd1b7026bf9b0\n R10: 00000000ffffffff R11: 0000000000000000 R12: 0000000000010000\n R13: ffffd1b7026bf930 R14: ffff8c5ac8284f40 R15: 0000000000000000\n FS: 00007fca40c37740(0000) GS:ffff8c5b74d7a000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fca40e822a0 CR3: 0000000005ca0001 CR4: 0000000000172ef0\n Call Trace:\n \u003cTASK\u003e\n tcf_classify+0x17d/0x5c0\n tc_run+0x9d/0x150\n __dev_queue_xmit+0x2ab/0x14d0\n ip_finish_output2+0x340/0x8f0\n ip_output+0xa4/0x250\n raw_sendmsg+0x147d/0x14b0\n __sys_sendto+0x1cc/0x1f0\n __x64_sys_sendto+0x24/0x30\n do_syscall_64+0x126/0xf80\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7fca40e822ba\n Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89\n RSP: 002b:00007ffc248a42c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c\n RAX: ffffffffffffffda RBX: 000055ef233289d0 RCX: 00007fca40e822ba\n RDX: 000000000000001e RSI: 000055ef23328c30 RDI: 0000000000000003\n RBP: 000055ef233289d0 R08: 00007ffc248a42d0 R09: 0000000000000010\n R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000001e\n R13: 00000000000186a0 R14: 0000000000000000 R15: 00007fca41043000\n \u003c/TASK\u003e\n irq event stamp: 1045778\n hardirqs last enabled at (1045784): [\u003cffffffff864ec042\u003e] __up_console_sem+0x52/0x60\n hardirqs last disabled at (1045789): [\u003cffffffff864ec027\u003e] __up_console_sem+0x37/0x60\n softirqs last enabled at (1045426): [\u003cffffffff874d48c7\u003e] __alloc_skb+0x207/0x260\n softirqs last disabled at (1045434): [\u003cffffffff874fe8f8\u003e] __dev_queue_xmit+0x78/0x14d0\n\nThen, because of the value in the packet\u0027s mark, dereference on \u0027q-\u003ehandle\u0027\nwith NULL \u0027q\u0027 occurs:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000038\n [...]\n RIP: 0010:fw_classify+0x1fe/0x250 [cls_fw]\n [...]\n\nSkip \"old-style\" classification on shared blocks, so that the NULL\ndereference is fixed and WARN_ON() is not hit anymore in the short\nlifetime of invalid cls_fw \"old-style\" filters.\n\n[1] https://sashiko.dev/#/patchset/2\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:21.172Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a719275da488835e987d28effc04679b4aace3a0"
},
{
"url": "https://git.kernel.org/stable/c/c205da704c84eeb4247d770150440294fd547049"
},
{
"url": "https://git.kernel.org/stable/c/5dcce34c57d5e5990869384d69deeb9414bf9b92"
},
{
"url": "https://git.kernel.org/stable/c/5df49f0579f7e625f2358a219d31fbc7621be799"
},
{
"url": "https://git.kernel.org/stable/c/829808cbf8cf8a6d07a0e67a5ea2c3fcd63a9e5c"
},
{
"url": "https://git.kernel.org/stable/c/41845bc5bb64f3d615abe575ad655b5e7f193634"
},
{
"url": "https://git.kernel.org/stable/c/4fabcfea7a9dd159df32c5df6587fe858cb0d748"
},
{
"url": "https://git.kernel.org/stable/c/65782b2db7321d5f97c16718c4c7f6c7205a56be"
}
],
"title": "net/sched: cls_fw: fix NULL dereference of \"old\" filters before change()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53080",
"datePublished": "2026-06-24T16:30:21.172Z",
"dateReserved": "2026-06-09T07:44:35.383Z",
"dateUpdated": "2026-06-24T16:30:21.172Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43083 (GCVE-0-2026-43083)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ioam6: fix OOB and missing lock
When trace->type.bit6 is set:
if (trace->type.bit6) {
...
queue = skb_get_tx_queue(dev, skb);
qdisc = rcu_dereference(queue->qdisc);
This code can lead to an out-of-bounds access of the dev->_tx[] array
when is_input is true. In such a case, the packet is on the RX path and
skb->queue_mapping contains the RX queue index of the ingress device. If
the ingress device has more RX queues than the egress device (dev) has
TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues.
Add a check to avoid this situation since skb_get_tx_queue() does not
clamp the index. This issue has also revealed that per queue visibility
cannot be accurate and will be replaced later as a new feature.
While at it, add missing lock around qdisc_qstats_qlen_backlog(). The
function __ioam6_fill_trace_data() is called from both softirq and
process contexts, hence the use of spin_lock_bh() here.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ioam6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6d1d9ed9b409e0662241e3d245d574a18f643494",
"status": "affected",
"version": "b63c5478e9cb1d1504eb02d9dac827ad24612b32",
"versionType": "git"
},
{
"lessThan": "95a1334748c95dd15546056280ade0c4b8dd7b78",
"status": "affected",
"version": "b63c5478e9cb1d1504eb02d9dac827ad24612b32",
"versionType": "git"
},
{
"lessThan": "b30b1675aa2bcf0491fd3830b051df4e08a7c8ca",
"status": "affected",
"version": "b63c5478e9cb1d1504eb02d9dac827ad24612b32",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ioam6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ioam6: fix OOB and missing lock\n\nWhen trace-\u003etype.bit6 is set:\n\n if (trace-\u003etype.bit6) {\n ...\n queue = skb_get_tx_queue(dev, skb);\n qdisc = rcu_dereference(queue-\u003eqdisc);\n\nThis code can lead to an out-of-bounds access of the dev-\u003e_tx[] array\nwhen is_input is true. In such a case, the packet is on the RX path and\nskb-\u003equeue_mapping contains the RX queue index of the ingress device. If\nthe ingress device has more RX queues than the egress device (dev) has\nTX queues, skb_get_queue_mapping(skb) will exceed dev-\u003enum_tx_queues.\nAdd a check to avoid this situation since skb_get_tx_queue() does not\nclamp the index. This issue has also revealed that per queue visibility\ncannot be accurate and will be replaced later as a new feature.\n\nWhile at it, add missing lock around qdisc_qstats_qlen_backlog(). The\nfunction __ioam6_fill_trace_data() is called from both softirq and\nprocess contexts, hence the use of spin_lock_bh() here."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable input path is reached by received IPv6 packets carrying a Hop-by-Hop IOAM Pre-allocated Trace option with queue-depth bit 6 set. In a reasonable IOAM-enabled routing deployment, an unauthenticated network peer can send such packets to the ingress interface.\nAC:L - The attacker controls the packet contents, including the IOAM trace type, and can repeatedly send packets; the RX-queue-to-TX-queue mismatch is a plausible target configuration rather than a race or condition the attacker must win. The OOB access occurs deterministically once the packet is processed with an out-of-range queue mapping.\nPR:N - Although enabling IOAM and creating namespaces are administrative configuration steps, the actual vulnerable code path processes unauthenticated network packets after IOAM is enabled. The packet sender needs no local account or kernel privileges.\nUI:N - No victim user action is required. Packet reception and IPv6 hop-by-hop IOAM processing trigger the vulnerable function automatically.\nS:U - The impact remains within the kernel/networking security authority of the affected system. This is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The bug is an out-of-bounds read of the egress device\u0027s `dev-\u003e_tx[]` array followed by dereferencing data as a `Qdisc`, and the resulting value can be copied into IOAM trace data. Under the required overestimation rule, this is treated as high confidentiality impact because it is not a strictly bounded, harmless read.\nI:N - The vulnerable operation reads an out-of-bounds queue entry and qdisc statistics; it does not provide an out-of-bounds write or an apparent primitive to modify kernel memory. Any packet trace update is part of normal processing of the attacker\u0027s packet.\nA:H - An out-of-bounds queue pointer dereference can fault or otherwise oops/panic the kernel, especially when the computed `Qdisc` pointer is invalid. The same crafted packet pattern can be sent repeatedly, making denial of service high impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:50.022Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6d1d9ed9b409e0662241e3d245d574a18f643494"
},
{
"url": "https://git.kernel.org/stable/c/95a1334748c95dd15546056280ade0c4b8dd7b78"
},
{
"url": "https://git.kernel.org/stable/c/b30b1675aa2bcf0491fd3830b051df4e08a7c8ca"
}
],
"title": "net: ioam6: fix OOB and missing lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43083",
"datePublished": "2026-05-06T07:40:18.504Z",
"dateReserved": "2026-05-01T14:12:55.983Z",
"dateUpdated": "2026-08-05T12:25:50.022Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43366 (GCVE-0-2026-43366)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring/kbuf: check if target buffer list is still legacy on recycle
There's a gap between when the buffer was grabbed and when it
potentially gets recycled, where if the list is empty, someone could've
upgraded it to a ring provided type. This can happen if the request
is forced via io-wq. The legacy recycling is missing checking if the
buffer_list still exists, and if it's of the correct type. Add those
checks.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c7fb19428d67dd0a2a78a4f237af01d39c78dc5a Version: c7fb19428d67dd0a2a78a4f237af01d39c78dc5a Version: c7fb19428d67dd0a2a78a4f237af01d39c78dc5a Version: c7fb19428d67dd0a2a78a4f237af01d39c78dc5a Version: c7fb19428d67dd0a2a78a4f237af01d39c78dc5a Version: c7fb19428d67dd0a2a78a4f237af01d39c78dc5a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/kbuf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a7b33671e418fca507feebd1d56e7f4952a4b25c",
"status": "affected",
"version": "c7fb19428d67dd0a2a78a4f237af01d39c78dc5a",
"versionType": "git"
},
{
"lessThan": "439a6728ec4641ffad1ca796622c19bc525e570f",
"status": "affected",
"version": "c7fb19428d67dd0a2a78a4f237af01d39c78dc5a",
"versionType": "git"
},
{
"lessThan": "f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa",
"status": "affected",
"version": "c7fb19428d67dd0a2a78a4f237af01d39c78dc5a",
"versionType": "git"
},
{
"lessThan": "50ad880db3013c6fee0ef13781762a39e2e7ef83",
"status": "affected",
"version": "c7fb19428d67dd0a2a78a4f237af01d39c78dc5a",
"versionType": "git"
},
{
"lessThan": "97b57f69fee1b61b41acbf37e7720cac9d389fa4",
"status": "affected",
"version": "c7fb19428d67dd0a2a78a4f237af01d39c78dc5a",
"versionType": "git"
},
{
"lessThan": "c2c185be5c85d37215397c8e8781abf0a69bec1f",
"status": "affected",
"version": "c7fb19428d67dd0a2a78a4f237af01d39c78dc5a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/kbuf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/kbuf: check if target buffer list is still legacy on recycle\n\nThere\u0027s a gap between when the buffer was grabbed and when it\npotentially gets recycled, where if the list is empty, someone could\u0027ve\nupgraded it to a ring provided type. This can happen if the request\nis forced via io-wq. The legacy recycling is missing checking if the\nbuffer_list still exists, and if it\u0027s of the correct type. Add those\nchecks."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reachable through local `io_uring_setup`, `io_uring_enter`, and `io_uring_register` operations using provided buffer selection and buffer-ring registration. It is not directly reachable from network packets or physical/adjacent interfaces.\nAC:L - The attacker controls the io_uring ring, the legacy provided buffer group, the in-flight async/io-wq request, and the conversion/removal of the same buffer group. The required timing can be driven by attacker-controlled concurrent local operations, so the race/lifecycle window is low complexity.\nPR:L - Exploitation requires a local unprivileged user able to create and use an io_uring instance; the relevant setup/register/submit paths do not require real root or init-namespace capabilities when io_uring is enabled. This is basic local user privilege, not administrator privilege.\nUI:N - No victim action is required after the attacker runs local code. The attacker performs all setup, submission, and buffer group conversion operations directly.\nS:U - The bug corrupts kernel memory from within the kernel/io_uring security authority and can lead to local kernel compromise or crash. It does not inherently cross a VM, IOMMU, or separate authorization boundary.\nC:H - The legacy recycle path can type-confuse a ring-provided buffer list and write kernel pointers into attacker-observable ring memory, and subsequent use can treat attacker-influenced objects as buffer-ring state. This is kernel memory corruption with a defensible path to high confidentiality impact.\nI:H - Recycling a legacy `struct io_buffer` into a ring buffer list corrupts list/ring state and can turn later ring-buffer operations into controlled kernel memory misuse. As a type confusion/memory corruption bug, high integrity impact is appropriate.\nA:H - If the target buffer list has been removed the old code can dereference a NULL buffer-list pointer, and if it has been upgraded it corrupts kernel state. Either case can produce an oops/panic or otherwise destabilize the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:30.302Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a7b33671e418fca507feebd1d56e7f4952a4b25c"
},
{
"url": "https://git.kernel.org/stable/c/439a6728ec4641ffad1ca796622c19bc525e570f"
},
{
"url": "https://git.kernel.org/stable/c/f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa"
},
{
"url": "https://git.kernel.org/stable/c/50ad880db3013c6fee0ef13781762a39e2e7ef83"
},
{
"url": "https://git.kernel.org/stable/c/97b57f69fee1b61b41acbf37e7720cac9d389fa4"
},
{
"url": "https://git.kernel.org/stable/c/c2c185be5c85d37215397c8e8781abf0a69bec1f"
}
],
"title": "io_uring/kbuf: check if target buffer list is still legacy on recycle",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43366",
"datePublished": "2026-05-08T14:21:19.191Z",
"dateReserved": "2026-05-01T14:12:56.005Z",
"dateUpdated": "2026-08-05T12:27:30.302Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43450 (GCVE-0-2026-43450)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-11 22:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label
inside the for loop body. When the "last" helper saved in cb->args[1]
is deleted between dump rounds, every entry fails the (cur != last)
check, so cb->args[1] is never cleared. The for loop finishes with
cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back
into the loop body bypassing the bounds check, causing an 8-byte
out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize].
The 'goto restart' block was meant to re-traverse the current bucket
when "last" is no longer found, but it was placed after the for loop
instead of inside it. Move the block into the for loop body so that
the restart only occurs while cb->args[0] is still within bounds.
BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0
Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131
Call Trace:
nfnl_cthelper_dump_table+0x9f/0x1b0
netlink_dump+0x333/0x880
netlink_recvmsg+0x3e2/0x4b0
sock_recvmsg+0xde/0xf0
__sys_recvfrom+0x150/0x200
__x64_sys_recvfrom+0x76/0x90
do_syscall_64+0xc3/0x6e0
Allocated by task 1:
__kvmalloc_node_noprof+0x21b/0x700
nf_ct_alloc_hashtable+0x65/0xd0
nf_conntrack_helper_init+0x21/0x60
nf_conntrack_init_start+0x18d/0x300
nf_conntrack_standalone_init+0x12/0xc0
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 12f7a505331e6b2754684b509f2ac8f0011ce644 Version: 12f7a505331e6b2754684b509f2ac8f0011ce644 Version: 12f7a505331e6b2754684b509f2ac8f0011ce644 Version: 12f7a505331e6b2754684b509f2ac8f0011ce644 Version: 12f7a505331e6b2754684b509f2ac8f0011ce644 Version: 12f7a505331e6b2754684b509f2ac8f0011ce644 Version: 12f7a505331e6b2754684b509f2ac8f0011ce644 Version: 12f7a505331e6b2754684b509f2ac8f0011ce644 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nfnetlink_cthelper.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0605e1985a95d4334a67869aee45a47e82301abf",
"status": "affected",
"version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
"versionType": "git"
},
{
"lessThan": "92441f6d9405a0c18d03f278b395e782f79a4a30",
"status": "affected",
"version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
"versionType": "git"
},
{
"lessThan": "3cc328ffc32ddb389cba7b78b6aa95d995c2876e",
"status": "affected",
"version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
"versionType": "git"
},
{
"lessThan": "4a1f6ee69267a5f524102c028981410eeacfa3da",
"status": "affected",
"version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
"versionType": "git"
},
{
"lessThan": "894c5780ddadd5fde0e16f66587918e6be1504c4",
"status": "affected",
"version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
"versionType": "git"
},
{
"lessThan": "05018cd9370f77bb18fbf6e15ff33c7a06f10b3c",
"status": "affected",
"version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
"versionType": "git"
},
{
"lessThan": "61b3a1f8621df1a5928118313f133996f6a786db",
"status": "affected",
"version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
"versionType": "git"
},
{
"lessThan": "6dcee8496d53165b2d8a5909b3050b62ae71fe89",
"status": "affected",
"version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nfnetlink_cthelper.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()\n\nnfnl_cthelper_dump_table() has a \u0027goto restart\u0027 that jumps to a label\ninside the for loop body. When the \"last\" helper saved in cb-\u003eargs[1]\nis deleted between dump rounds, every entry fails the (cur != last)\ncheck, so cb-\u003eargs[1] is never cleared. The for loop finishes with\ncb-\u003eargs[0] == nf_ct_helper_hsize, and the \u0027goto restart\u0027 jumps back\ninto the loop body bypassing the bounds check, causing an 8-byte\nout-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize].\n\nThe \u0027goto restart\u0027 block was meant to re-traverse the current bucket\nwhen \"last\" is no longer found, but it was placed after the for loop\ninstead of inside it. Move the block into the for loop body so that\nthe restart only occurs while cb-\u003eargs[0] is still within bounds.\n\n BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0\n Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131\n Call Trace:\n nfnl_cthelper_dump_table+0x9f/0x1b0\n netlink_dump+0x333/0x880\n netlink_recvmsg+0x3e2/0x4b0\n sock_recvmsg+0xde/0xf0\n __sys_recvfrom+0x150/0x200\n __x64_sys_recvfrom+0x76/0x90\n do_syscall_64+0xc3/0x6e0\n\n Allocated by task 1:\n __kvmalloc_node_noprof+0x21b/0x700\n nf_ct_alloc_hashtable+0x65/0xd0\n nf_conntrack_helper_init+0x21/0x60\n nf_conntrack_init_start+0x18d/0x300\n nf_conntrack_standalone_init+0x12/0xc0"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:49.527Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0605e1985a95d4334a67869aee45a47e82301abf"
},
{
"url": "https://git.kernel.org/stable/c/92441f6d9405a0c18d03f278b395e782f79a4a30"
},
{
"url": "https://git.kernel.org/stable/c/3cc328ffc32ddb389cba7b78b6aa95d995c2876e"
},
{
"url": "https://git.kernel.org/stable/c/4a1f6ee69267a5f524102c028981410eeacfa3da"
},
{
"url": "https://git.kernel.org/stable/c/894c5780ddadd5fde0e16f66587918e6be1504c4"
},
{
"url": "https://git.kernel.org/stable/c/05018cd9370f77bb18fbf6e15ff33c7a06f10b3c"
},
{
"url": "https://git.kernel.org/stable/c/61b3a1f8621df1a5928118313f133996f6a786db"
},
{
"url": "https://git.kernel.org/stable/c/6dcee8496d53165b2d8a5909b3050b62ae71fe89"
}
],
"title": "netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43450",
"datePublished": "2026-05-08T14:22:15.915Z",
"dateReserved": "2026-05-01T14:12:56.010Z",
"dateUpdated": "2026-05-11T22:24:49.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46184 (GCVE-0-2026-46184)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-06-14 18:00
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sound: ua101: fix division by zero at probe
Add a missing sanity check for bNrChannels in detect_usb_format()
to prevent a division by zero in playback_urb_complete() and
capture_urb_complete().
USB core does not validate class-specific descriptor fields such
as bNrChannels, so drivers must verify them before use. If a
device provides bNrChannels = 0, frame_bytes becomes zero and is
later used as a divisor in the URB completion handlers, leading
to a kernel crash.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 63978ab3e3e963db28093b53bb4598f2702e1ad7 Version: 63978ab3e3e963db28093b53bb4598f2702e1ad7 Version: 63978ab3e3e963db28093b53bb4598f2702e1ad7 Version: 63978ab3e3e963db28093b53bb4598f2702e1ad7 Version: 63978ab3e3e963db28093b53bb4598f2702e1ad7 Version: 63978ab3e3e963db28093b53bb4598f2702e1ad7 Version: 63978ab3e3e963db28093b53bb4598f2702e1ad7 Version: 63978ab3e3e963db28093b53bb4598f2702e1ad7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/misc/ua101.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e02897c5b041c9b980055fa9a6167023d6dc5caf",
"status": "affected",
"version": "63978ab3e3e963db28093b53bb4598f2702e1ad7",
"versionType": "git"
},
{
"lessThan": "aae1498c59f48d03ee358df84f07a5af9885f827",
"status": "affected",
"version": "63978ab3e3e963db28093b53bb4598f2702e1ad7",
"versionType": "git"
},
{
"lessThan": "66d9c2ed081f299cfb201d9e9c4faf920e56e0bf",
"status": "affected",
"version": "63978ab3e3e963db28093b53bb4598f2702e1ad7",
"versionType": "git"
},
{
"lessThan": "6162e8212e88c39492d981b248b5e37002486c66",
"status": "affected",
"version": "63978ab3e3e963db28093b53bb4598f2702e1ad7",
"versionType": "git"
},
{
"lessThan": "593dd7e6c890d8e4ca21b3e2f796b7cb8e8da983",
"status": "affected",
"version": "63978ab3e3e963db28093b53bb4598f2702e1ad7",
"versionType": "git"
},
{
"lessThan": "0ff2b713f406e9ecadb406014d74e7a020ac12b1",
"status": "affected",
"version": "63978ab3e3e963db28093b53bb4598f2702e1ad7",
"versionType": "git"
},
{
"lessThan": "f1862dbf09080254c52175a448290c784dd7d3de",
"status": "affected",
"version": "63978ab3e3e963db28093b53bb4598f2702e1ad7",
"versionType": "git"
},
{
"lessThan": "d1f73f169c1014463b5060e3f60813e13ddc7b87",
"status": "affected",
"version": "63978ab3e3e963db28093b53bb4598f2702e1ad7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/misc/ua101.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsound: ua101: fix division by zero at probe\n\nAdd a missing sanity check for bNrChannels in detect_usb_format()\nto prevent a division by zero in playback_urb_complete() and\ncapture_urb_complete().\n\nUSB core does not validate class-specific descriptor fields such\nas bNrChannels, so drivers must verify them before use. If a\ndevice provides bNrChannels = 0, frame_bytes becomes zero and is\nlater used as a divisor in the URB completion handlers, leading\nto a kernel crash."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:00:59.666Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e02897c5b041c9b980055fa9a6167023d6dc5caf"
},
{
"url": "https://git.kernel.org/stable/c/aae1498c59f48d03ee358df84f07a5af9885f827"
},
{
"url": "https://git.kernel.org/stable/c/66d9c2ed081f299cfb201d9e9c4faf920e56e0bf"
},
{
"url": "https://git.kernel.org/stable/c/6162e8212e88c39492d981b248b5e37002486c66"
},
{
"url": "https://git.kernel.org/stable/c/593dd7e6c890d8e4ca21b3e2f796b7cb8e8da983"
},
{
"url": "https://git.kernel.org/stable/c/0ff2b713f406e9ecadb406014d74e7a020ac12b1"
},
{
"url": "https://git.kernel.org/stable/c/f1862dbf09080254c52175a448290c784dd7d3de"
},
{
"url": "https://git.kernel.org/stable/c/d1f73f169c1014463b5060e3f60813e13ddc7b87"
}
],
"title": "sound: ua101: fix division by zero at probe",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46184",
"datePublished": "2026-05-28T09:36:38.134Z",
"dateReserved": "2026-05-13T15:03:33.103Z",
"dateUpdated": "2026-06-14T18:00:59.666Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46207 (GCVE-0-2026-46207)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-06-14 18:02
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: fix empty payload in tap skb for non-linear buffers
For non-linear skbs, virtio_transport_build_skb() goes through
virtio_transport_copy_nonlinear_skb() to copy the original payload
in the new skb to be delivered to the vsockmon tap device.
This manually initializes an iov_iter but does not set iov_iter.count.
Since the iov_iter is zero-initialized, the copy length is zero and no
payload is actually copied to the monitor interface, leaving data
un-initialized.
Fix this by removing the linear vs non-linear split and using
skb_copy_datagram_iter() with iov_iter_kvec() for all cases, as
vhost-vsock already does. This handles both linear and non-linear skbs,
properly initializes the iov_iter, and removes the now unused
virtio_transport_copy_nonlinear_skb().
While touching this code, let's also check the return value of
skb_copy_datagram_iter(), even though it's unlikely to fail.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/virtio_transport_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "06747f52ab157591cec7e5623a759473b66ef6f6",
"status": "affected",
"version": "4b0bf10eb077cb43c09746251ef3608d62c45667",
"versionType": "git"
},
{
"lessThan": "52da6a74ca3de0fcda60301096b71534b3b18641",
"status": "affected",
"version": "4b0bf10eb077cb43c09746251ef3608d62c45667",
"versionType": "git"
},
{
"lessThan": "378b131a25bd1a5ee27ca199fe486c299d5350c5",
"status": "affected",
"version": "4b0bf10eb077cb43c09746251ef3608d62c45667",
"versionType": "git"
},
{
"lessThan": "3a3e3d90cbc79600544536723911657730759af3",
"status": "affected",
"version": "4b0bf10eb077cb43c09746251ef3608d62c45667",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/virtio_transport_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: fix empty payload in tap skb for non-linear buffers\n\nFor non-linear skbs, virtio_transport_build_skb() goes through\nvirtio_transport_copy_nonlinear_skb() to copy the original payload\nin the new skb to be delivered to the vsockmon tap device.\nThis manually initializes an iov_iter but does not set iov_iter.count.\nSince the iov_iter is zero-initialized, the copy length is zero and no\npayload is actually copied to the monitor interface, leaving data\nun-initialized.\n\nFix this by removing the linear vs non-linear split and using\nskb_copy_datagram_iter() with iov_iter_kvec() for all cases, as\nvhost-vsock already does. This handles both linear and non-linear skbs,\nproperly initializes the iov_iter, and removes the now unused\nvirtio_transport_copy_nonlinear_skb().\n\nWhile touching this code, let\u0027s also check the return value of\nskb_copy_datagram_iter(), even though it\u0027s unlikely to fail."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:02:44.626Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/06747f52ab157591cec7e5623a759473b66ef6f6"
},
{
"url": "https://git.kernel.org/stable/c/52da6a74ca3de0fcda60301096b71534b3b18641"
},
{
"url": "https://git.kernel.org/stable/c/378b131a25bd1a5ee27ca199fe486c299d5350c5"
},
{
"url": "https://git.kernel.org/stable/c/3a3e3d90cbc79600544536723911657730759af3"
}
],
"title": "vsock/virtio: fix empty payload in tap skb for non-linear buffers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46207",
"datePublished": "2026-05-28T09:40:25.583Z",
"dateReserved": "2026-05-13T15:03:33.105Z",
"dateUpdated": "2026-06-14T18:02:44.626Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43132 (GCVE-0-2026-43132)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-verity: correctly handle dm_bufio_client_create() failure
If either of the calls to dm_bufio_client_create() in verity_fec_ctr()
fails, then dm_bufio_client_destroy() is later called with an ERR_PTR()
argument. That causes a crash. Fix this.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 Version: a739ff3f543afbb4a041c16cd0182c8e8d366e70 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-verity-fec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6283e49af87a9c121bb01e5a64a7fe5706c210bc",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "d3e1f1adc8a0289efe2d2cdc90edb8c6ffe0b5ef",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "5c2217ddb3b7e7ac25f4ebe9061258fc8f1c9167",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "031f2adc1499b112a39ac316bbab3c80bba16cf2",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "9b8dc1d327e2928f3da59ced0595d850d31c0936",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "451cc650e40e8c3222d37877a9e4be0fcaacb9c8",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "b154a868a3856fb5216c4f82981d8a503832e095",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
},
{
"lessThan": "119f4f04186fa4f33ee6bd39af145cdaff1ff17f",
"status": "affected",
"version": "a739ff3f543afbb4a041c16cd0182c8e8d366e70",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-verity-fec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity: correctly handle dm_bufio_client_create() failure\n\nIf either of the calls to dm_bufio_client_create() in verity_fec_ctr()\nfails, then dm_bufio_client_destroy() is later called with an ERR_PTR()\nargument. That causes a crash. Fix this."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:18:22.593Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6283e49af87a9c121bb01e5a64a7fe5706c210bc"
},
{
"url": "https://git.kernel.org/stable/c/d3e1f1adc8a0289efe2d2cdc90edb8c6ffe0b5ef"
},
{
"url": "https://git.kernel.org/stable/c/5c2217ddb3b7e7ac25f4ebe9061258fc8f1c9167"
},
{
"url": "https://git.kernel.org/stable/c/031f2adc1499b112a39ac316bbab3c80bba16cf2"
},
{
"url": "https://git.kernel.org/stable/c/9b8dc1d327e2928f3da59ced0595d850d31c0936"
},
{
"url": "https://git.kernel.org/stable/c/451cc650e40e8c3222d37877a9e4be0fcaacb9c8"
},
{
"url": "https://git.kernel.org/stable/c/b154a868a3856fb5216c4f82981d8a503832e095"
},
{
"url": "https://git.kernel.org/stable/c/119f4f04186fa4f33ee6bd39af145cdaff1ff17f"
}
],
"title": "dm-verity: correctly handle dm_bufio_client_create() failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43132",
"datePublished": "2026-05-06T11:27:20.213Z",
"dateReserved": "2026-05-01T14:12:55.988Z",
"dateUpdated": "2026-05-11T22:18:22.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31647 (GCVE-0-2026-31647)
Vulnerability from cvelistv5
Published
2026-04-24 14:45
Modified
2026-05-11 22:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling
Switch from using the completion's raw spinlock to a local lock in the
idpf_vc_xn struct. The conversion is safe because complete/_all() are
called outside the lock and there is no reason to share the completion
lock in the current logic. This avoids invalid wait context reported by
the kernel due to the async handler taking BH spinlock:
[ 805.726977] =============================
[ 805.726991] [ BUG: Invalid wait context ]
[ 805.727006] 7.0.0-rc2-net-devq-031026+ #28 Tainted: G S OE
[ 805.727026] -----------------------------
[ 805.727038] kworker/u261:0/572 is trying to lock:
[ 805.727051] ff190da6a8dbb6a0 (&vport_config->mac_filter_list_lock){+...}-{3:3}, at: idpf_mac_filter_async_handler+0xe9/0x260 [idpf]
[ 805.727099] other info that might help us debug this:
[ 805.727111] context-{5:5}
[ 805.727119] 3 locks held by kworker/u261:0/572:
[ 805.727132] #0: ff190da6db3e6148 ((wq_completion)idpf-0000:83:00.0-mbx){+.+.}-{0:0}, at: process_one_work+0x4b5/0x730
[ 805.727163] #1: ff3c6f0a6131fe50 ((work_completion)(&(&adapter->mbx_task)->work)){+.+.}-{0:0}, at: process_one_work+0x1e5/0x730
[ 805.727191] #2: ff190da765190020 (&x->wait#34){+.+.}-{2:2}, at: idpf_recv_mb_msg+0xc8/0x710 [idpf]
[ 805.727218] stack backtrace:
...
[ 805.727238] Workqueue: idpf-0000:83:00.0-mbx idpf_mbx_task [idpf]
[ 805.727247] Call Trace:
[ 805.727249] <TASK>
[ 805.727251] dump_stack_lvl+0x77/0xb0
[ 805.727259] __lock_acquire+0xb3b/0x2290
[ 805.727268] ? __irq_work_queue_local+0x59/0x130
[ 805.727275] lock_acquire+0xc6/0x2f0
[ 805.727277] ? idpf_mac_filter_async_handler+0xe9/0x260 [idpf]
[ 805.727284] ? _printk+0x5b/0x80
[ 805.727290] _raw_spin_lock_bh+0x38/0x50
[ 805.727298] ? idpf_mac_filter_async_handler+0xe9/0x260 [idpf]
[ 805.727303] idpf_mac_filter_async_handler+0xe9/0x260 [idpf]
[ 805.727310] idpf_recv_mb_msg+0x1c8/0x710 [idpf]
[ 805.727317] process_one_work+0x226/0x730
[ 805.727322] worker_thread+0x19e/0x340
[ 805.727325] ? __pfx_worker_thread+0x10/0x10
[ 805.727328] kthread+0xf4/0x130
[ 805.727333] ? __pfx_kthread+0x10/0x10
[ 805.727336] ret_from_fork+0x32c/0x410
[ 805.727345] ? __pfx_kthread+0x10/0x10
[ 805.727347] ret_from_fork_asm+0x1a/0x30
[ 805.727354] </TASK>
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/idpf/idpf_virtchnl.c",
"drivers/net/ethernet/intel/idpf/idpf_virtchnl.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b448529f2f2921c6fe82fd4e985cc7c05cbf02a3",
"status": "affected",
"version": "34c21fa894a1af6166f4284c81d1dc21efed8f38",
"versionType": "git"
},
{
"lessThan": "e02c974fc331f04b5ba2007d4bc6862df8a43148",
"status": "affected",
"version": "34c21fa894a1af6166f4284c81d1dc21efed8f38",
"versionType": "git"
},
{
"lessThan": "3bb632c6b6d8154e9019beda4a43a4b518ee3e8a",
"status": "affected",
"version": "34c21fa894a1af6166f4284c81d1dc21efed8f38",
"versionType": "git"
},
{
"lessThan": "591478118293c1bd628de330a99eb1eb2ef8d76b",
"status": "affected",
"version": "34c21fa894a1af6166f4284c81d1dc21efed8f38",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/idpf/idpf_virtchnl.c",
"drivers/net/ethernet/intel/idpf/idpf_virtchnl.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling\n\nSwitch from using the completion\u0027s raw spinlock to a local lock in the\nidpf_vc_xn struct. The conversion is safe because complete/_all() are\ncalled outside the lock and there is no reason to share the completion\nlock in the current logic. This avoids invalid wait context reported by\nthe kernel due to the async handler taking BH spinlock:\n\n[ 805.726977] =============================\n[ 805.726991] [ BUG: Invalid wait context ]\n[ 805.727006] 7.0.0-rc2-net-devq-031026+ #28 Tainted: G S OE\n[ 805.727026] -----------------------------\n[ 805.727038] kworker/u261:0/572 is trying to lock:\n[ 805.727051] ff190da6a8dbb6a0 (\u0026vport_config-\u003emac_filter_list_lock){+...}-{3:3}, at: idpf_mac_filter_async_handler+0xe9/0x260 [idpf]\n[ 805.727099] other info that might help us debug this:\n[ 805.727111] context-{5:5}\n[ 805.727119] 3 locks held by kworker/u261:0/572:\n[ 805.727132] #0: ff190da6db3e6148 ((wq_completion)idpf-0000:83:00.0-mbx){+.+.}-{0:0}, at: process_one_work+0x4b5/0x730\n[ 805.727163] #1: ff3c6f0a6131fe50 ((work_completion)(\u0026(\u0026adapter-\u003embx_task)-\u003ework)){+.+.}-{0:0}, at: process_one_work+0x1e5/0x730\n[ 805.727191] #2: ff190da765190020 (\u0026x-\u003ewait#34){+.+.}-{2:2}, at: idpf_recv_mb_msg+0xc8/0x710 [idpf]\n[ 805.727218] stack backtrace:\n...\n[ 805.727238] Workqueue: idpf-0000:83:00.0-mbx idpf_mbx_task [idpf]\n[ 805.727247] Call Trace:\n[ 805.727249] \u003cTASK\u003e\n[ 805.727251] dump_stack_lvl+0x77/0xb0\n[ 805.727259] __lock_acquire+0xb3b/0x2290\n[ 805.727268] ? __irq_work_queue_local+0x59/0x130\n[ 805.727275] lock_acquire+0xc6/0x2f0\n[ 805.727277] ? idpf_mac_filter_async_handler+0xe9/0x260 [idpf]\n[ 805.727284] ? _printk+0x5b/0x80\n[ 805.727290] _raw_spin_lock_bh+0x38/0x50\n[ 805.727298] ? idpf_mac_filter_async_handler+0xe9/0x260 [idpf]\n[ 805.727303] idpf_mac_filter_async_handler+0xe9/0x260 [idpf]\n[ 805.727310] idpf_recv_mb_msg+0x1c8/0x710 [idpf]\n[ 805.727317] process_one_work+0x226/0x730\n[ 805.727322] worker_thread+0x19e/0x340\n[ 805.727325] ? __pfx_worker_thread+0x10/0x10\n[ 805.727328] kthread+0xf4/0x130\n[ 805.727333] ? __pfx_kthread+0x10/0x10\n[ 805.727336] ret_from_fork+0x32c/0x410\n[ 805.727345] ? __pfx_kthread+0x10/0x10\n[ 805.727347] ret_from_fork_asm+0x1a/0x30\n[ 805.727354] \u003c/TASK\u003e"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:12:51.719Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b448529f2f2921c6fe82fd4e985cc7c05cbf02a3"
},
{
"url": "https://git.kernel.org/stable/c/e02c974fc331f04b5ba2007d4bc6862df8a43148"
},
{
"url": "https://git.kernel.org/stable/c/3bb632c6b6d8154e9019beda4a43a4b518ee3e8a"
},
{
"url": "https://git.kernel.org/stable/c/591478118293c1bd628de330a99eb1eb2ef8d76b"
}
],
"title": "idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31647",
"datePublished": "2026-04-24T14:45:00.734Z",
"dateReserved": "2026-03-09T15:48:24.127Z",
"dateUpdated": "2026-05-11T22:12:51.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43380 (GCVE-0-2026-43380)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read
The q54sj108a2_debugfs_read function suffers from a stack buffer overflow
due to incorrect arguments passed to bin2hex(). The function currently
passes 'data' as the destination and 'data_char' as the source.
Because bin2hex() converts each input byte into two hex characters, a
32-byte block read results in 64 bytes of output. Since 'data' is only
34 bytes (I2C_SMBUS_BLOCK_MAX + 2), this writes 30 bytes past the end
of the buffer onto the stack.
Additionally, the arguments were swapped: it was reading from the
zero-initialized 'data_char' and writing to 'data', resulting in
all-zero output regardless of the actual I2C read.
Fix this by:
1. Expanding 'data_char' to 66 bytes to safely hold the hex output.
2. Correcting the bin2hex() argument order and using the actual read count.
3. Using a pointer to select the correct output buffer for the final
simple_read_from_buffer call.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d014538aa38561cd24c5eb228223585f26c5ec71 Version: d014538aa38561cd24c5eb228223585f26c5ec71 Version: d014538aa38561cd24c5eb228223585f26c5ec71 Version: d014538aa38561cd24c5eb228223585f26c5ec71 Version: d014538aa38561cd24c5eb228223585f26c5ec71 Version: d014538aa38561cd24c5eb228223585f26c5ec71 Version: d014538aa38561cd24c5eb228223585f26c5ec71 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/pmbus/q54sj108a2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a0fc1b9c738fba231f190ab960c83202722efee5",
"status": "affected",
"version": "d014538aa38561cd24c5eb228223585f26c5ec71",
"versionType": "git"
},
{
"lessThan": "c59090c50f62a17129fc4c5407bc4071305a9e82",
"status": "affected",
"version": "d014538aa38561cd24c5eb228223585f26c5ec71",
"versionType": "git"
},
{
"lessThan": "52db5ef163c96f916d424e472fb17aadc35a9f7a",
"status": "affected",
"version": "d014538aa38561cd24c5eb228223585f26c5ec71",
"versionType": "git"
},
{
"lessThan": "b48a0f8d4541a4f6651dc9a64430ce9fdf5c120b",
"status": "affected",
"version": "d014538aa38561cd24c5eb228223585f26c5ec71",
"versionType": "git"
},
{
"lessThan": "73a7a345816946d276ad2c46c8bb771de67cfc46",
"status": "affected",
"version": "d014538aa38561cd24c5eb228223585f26c5ec71",
"versionType": "git"
},
{
"lessThan": "24a7b9daa103fa963b3fd37d8805b23e01621976",
"status": "affected",
"version": "d014538aa38561cd24c5eb228223585f26c5ec71",
"versionType": "git"
},
{
"lessThan": "25dd70a03b1f5f3aa71e1a5091ecd9cd2a13ee43",
"status": "affected",
"version": "d014538aa38561cd24c5eb228223585f26c5ec71",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/pmbus/q54sj108a2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read\n\nThe q54sj108a2_debugfs_read function suffers from a stack buffer overflow\ndue to incorrect arguments passed to bin2hex(). The function currently\npasses \u0027data\u0027 as the destination and \u0027data_char\u0027 as the source.\n\nBecause bin2hex() converts each input byte into two hex characters, a\n32-byte block read results in 64 bytes of output. Since \u0027data\u0027 is only\n34 bytes (I2C_SMBUS_BLOCK_MAX + 2), this writes 30 bytes past the end\nof the buffer onto the stack.\n\nAdditionally, the arguments were swapped: it was reading from the\nzero-initialized \u0027data_char\u0027 and writing to \u0027data\u0027, resulting in\nall-zero output regardless of the actual I2C read.\n\nFix this by:\n1. Expanding \u0027data_char\u0027 to 66 bytes to safely hold the hex output.\n2. Correcting the bin2hex() argument order and using the actual read count.\n3. Using a pointer to select the correct output buffer for the final\n simple_read_from_buffer call."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached by a local userspace read of the q54sj108a2 debugfs file, through read(2)/vfs_read/debugfs proxy operations into q54sj108a2_debugfs_read. There is no network or adjacent protocol path.\nAC:L - On an affected system with the driver, device, and debugfs entry present, a single read of blackbox_read reliably triggers the overflow; there is no race or condition the attacker must win. The vulnerable code always calls bin2hex(..., 32) for that path after a successful SMBus block read.\nPR:L - The vulnerable file is created with mode 0444 and the driver performs no capability or authentication check, so a local unprivileged user can trigger it where debugfs is exposed beyond its root-only default mount. If choosing between root-only debugfs deployment and exposed debugfs deployment, the higher-severity reasonable case is unprivileged local access.\nUI:N - No victim action is needed after the attacker has local access to the debugfs file. The attacker directly opens and reads the file.\nS:U - The corruption occurs in kernel code and impacts the same kernel security authority. It is not a guest-to-host, IOMMU, or other cross-scope boundary bypass.\nC:H - This is kernel stack memory corruption, and the buggy read path can also copy beyond the intended stack buffer back to userspace. Under the required overestimating guidance, memory corruption that can support information disclosure warrants high confidentiality impact.\nI:H - The bug is an out-of-bounds write on the kernel stack, overflowing a 34-byte buffer with up to 64 bytes of hex output plus later indexing beyond the buffer. Kernel stack corruption is defensibly treated as potentially enabling control-flow hijack or arbitrary kernel modification.\nA:H - The stack overflow can corrupt adjacent stack state and, with stack protection, can directly trigger a kernel oops/panic. Repeated local reads can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:40.763Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a0fc1b9c738fba231f190ab960c83202722efee5"
},
{
"url": "https://git.kernel.org/stable/c/c59090c50f62a17129fc4c5407bc4071305a9e82"
},
{
"url": "https://git.kernel.org/stable/c/52db5ef163c96f916d424e472fb17aadc35a9f7a"
},
{
"url": "https://git.kernel.org/stable/c/b48a0f8d4541a4f6651dc9a64430ce9fdf5c120b"
},
{
"url": "https://git.kernel.org/stable/c/73a7a345816946d276ad2c46c8bb771de67cfc46"
},
{
"url": "https://git.kernel.org/stable/c/24a7b9daa103fa963b3fd37d8805b23e01621976"
},
{
"url": "https://git.kernel.org/stable/c/25dd70a03b1f5f3aa71e1a5091ecd9cd2a13ee43"
}
],
"title": "hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43380",
"datePublished": "2026-05-08T14:21:28.702Z",
"dateReserved": "2026-05-01T14:12:56.006Z",
"dateUpdated": "2026-08-05T12:27:40.763Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53286 (GCVE-0-2026-53286)
Vulnerability from cvelistv5
Published
2026-06-26 19:40
Modified
2026-06-26 19:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
idpf: fix double free and use-after-free in aux device error paths
When auxiliary_device_add() fails in idpf_plug_vport_aux_dev() or
idpf_plug_core_aux_dev(), the err_aux_dev_add label calls
auxiliary_device_uninit() and falls through to err_aux_dev_init. The
uninit call will trigger put_device(), which invokes the release
callback (idpf_vport_adev_release / idpf_core_adev_release) that frees
iadev. The fall-through then reads adev->id from the freed iadev for
ida_free() and double-frees iadev with kfree().
Free the IDA slot and clear the back-pointer before uninit, while adev
is still valid, then return immediately.
Commit 65637c3a1811 ("idpf: fix UAF in RDMA core aux dev deinitialization")
fixed the same use-after-free in the matching unplug path in this file but
missed both probe error paths.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/idpf/idpf_idc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "722b91d5086a249318c9d0e2b36aeac80ba8c808",
"status": "affected",
"version": "f4312e6bfa2a98e94dacc75f96f916b76bdf4259",
"versionType": "git"
},
{
"lessThan": "f319de7074e1728a9f9ff7134257360c694ec2b2",
"status": "affected",
"version": "f4312e6bfa2a98e94dacc75f96f916b76bdf4259",
"versionType": "git"
},
{
"lessThan": "6c77b9510829a424d1b74409b7db9456e3522871",
"status": "affected",
"version": "f4312e6bfa2a98e94dacc75f96f916b76bdf4259",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/idpf/idpf_idc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: fix double free and use-after-free in aux device error paths\n\nWhen auxiliary_device_add() fails in idpf_plug_vport_aux_dev() or\nidpf_plug_core_aux_dev(), the err_aux_dev_add label calls\nauxiliary_device_uninit() and falls through to err_aux_dev_init. The\nuninit call will trigger put_device(), which invokes the release\ncallback (idpf_vport_adev_release / idpf_core_adev_release) that frees\niadev. The fall-through then reads adev-\u003eid from the freed iadev for\nida_free() and double-frees iadev with kfree().\n\nFree the IDA slot and clear the back-pointer before uninit, while adev\nis still valid, then return immediately.\n\nCommit 65637c3a1811 (\"idpf: fix UAF in RDMA core aux dev deinitialization\")\nfixed the same use-after-free in the matching unplug path in this file but\nmissed both probe error paths."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T19:40:47.210Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/722b91d5086a249318c9d0e2b36aeac80ba8c808"
},
{
"url": "https://git.kernel.org/stable/c/f319de7074e1728a9f9ff7134257360c694ec2b2"
},
{
"url": "https://git.kernel.org/stable/c/6c77b9510829a424d1b74409b7db9456e3522871"
}
],
"title": "idpf: fix double free and use-after-free in aux device error paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53286",
"datePublished": "2026-06-26T19:40:47.210Z",
"dateReserved": "2026-06-09T07:44:35.396Z",
"dateUpdated": "2026-06-26T19:40:47.210Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46320 (GCVE-0-2026-46320)
Vulnerability from cvelistv5
Published
2026-06-09 12:11
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tap: free page on error paths in tap_get_user_xdp()
tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL,
and returns -ENOMEM when build_skb() fails. Both paths jump to the err
label without freeing the page that vhost_net_build_xdp() allocated for
the frame. tap_sendmsg() discards the per-buffer return value and always
returns 0, so vhost_tx_batch() takes the success path and never frees
the page; each rejected frame in a batch leaks one page-frag chunk.
Free the page on both error paths, before the skb is built. This is the
tap counterpart of the same leak in tun_xdp_one().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0efac27791ee068075d80f07c55a229b1335ce12 Version: 0efac27791ee068075d80f07c55a229b1335ce12 Version: 0efac27791ee068075d80f07c55a229b1335ce12 Version: 0efac27791ee068075d80f07c55a229b1335ce12 Version: 0efac27791ee068075d80f07c55a229b1335ce12 Version: 0efac27791ee068075d80f07c55a229b1335ce12 Version: 0efac27791ee068075d80f07c55a229b1335ce12 Version: 0efac27791ee068075d80f07c55a229b1335ce12 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/tap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8d03e65eb6cfbffec471a6b65416f93679bf3286",
"status": "affected",
"version": "0efac27791ee068075d80f07c55a229b1335ce12",
"versionType": "git"
},
{
"lessThan": "f979971835dddbca86cf99e3b2e2b94a408a1ab2",
"status": "affected",
"version": "0efac27791ee068075d80f07c55a229b1335ce12",
"versionType": "git"
},
{
"lessThan": "3f52a86a482a69294c50a5a2a097bd6f4104990a",
"status": "affected",
"version": "0efac27791ee068075d80f07c55a229b1335ce12",
"versionType": "git"
},
{
"lessThan": "d30aac0fa00ca0afc3e08174cf7f974a66bdcf05",
"status": "affected",
"version": "0efac27791ee068075d80f07c55a229b1335ce12",
"versionType": "git"
},
{
"lessThan": "d68eab61944a9b0826fa2e954e42db1aa3201b7a",
"status": "affected",
"version": "0efac27791ee068075d80f07c55a229b1335ce12",
"versionType": "git"
},
{
"lessThan": "e27c17346628cb56843a83f93ac63c314c00f388",
"status": "affected",
"version": "0efac27791ee068075d80f07c55a229b1335ce12",
"versionType": "git"
},
{
"lessThan": "18a84c35842e19cd3c5534d8cee73d31863f696d",
"status": "affected",
"version": "0efac27791ee068075d80f07c55a229b1335ce12",
"versionType": "git"
},
{
"lessThan": "3bcf7aec6a9d16438f2cec29f5d7c8d5b8edf9b2",
"status": "affected",
"version": "0efac27791ee068075d80f07c55a229b1335ce12",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/tap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntap: free page on error paths in tap_get_user_xdp()\n\ntap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL,\nand returns -ENOMEM when build_skb() fails. Both paths jump to the err\nlabel without freeing the page that vhost_net_build_xdp() allocated for\nthe frame. tap_sendmsg() discards the per-buffer return value and always\nreturns 0, so vhost_tx_batch() takes the success path and never frees\nthe page; each rejected frame in a batch leaks one page-frag chunk.\n\nFree the page on both error paths, before the skb is built. This is the\ntap counterpart of the same leak in tun_xdp_one()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The bug is reached when guest-originated TX data crosses the virtio/vhost-net/macvtap boundary into the host tap driver; this is the same adjacent virtual-network path as CVE-2024-41090, not a remote Internet packet to the host stack.\nAC:L - An attacker controls the virtio TX virtqueue and can reliably submit frames shorter than ETH_HLEN or force build_skb failures; each batch can leak up to 64 page-frags and be repeated in a tight loop without race conditions.\nPR:N - In the highest-impact cloud-KVM scenario, a malicious VM tenant needs no host credentials or capabilities\u2014only the ability to send packets from inside an already-provisioned guest using virtio-net.\nUI:N - Exploitation requires no action from the host administrator or any other user beyond normal VM operation; the guest attacker drives the virtqueue directly.\nS:C - The leak occurs in the host kernel while processing guest-supplied descriptors, crossing the VM/host security boundary and degrading host-wide availability beyond the guest\u2019s own security scope.\nC:N - This is a missing put_page on error paths causing page-frag retention; there is no out-of-bounds read, use-after-free, or other memory corruption that could disclose kernel data.\nI:N - No memory is corrupted or written beyond the leaked page allocation; the bug cannot be leveraged for arbitrary write, code execution, or integrity compromise.\nA:H - Sustained submission of short or failing frames leaks one page-frag per rejected buffer; at scale this exhausts host memory and can trigger OOM kills or host panic, matching the identical tun-side fix analysis."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:15.165Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8d03e65eb6cfbffec471a6b65416f93679bf3286"
},
{
"url": "https://git.kernel.org/stable/c/f979971835dddbca86cf99e3b2e2b94a408a1ab2"
},
{
"url": "https://git.kernel.org/stable/c/3f52a86a482a69294c50a5a2a097bd6f4104990a"
},
{
"url": "https://git.kernel.org/stable/c/d30aac0fa00ca0afc3e08174cf7f974a66bdcf05"
},
{
"url": "https://git.kernel.org/stable/c/d68eab61944a9b0826fa2e954e42db1aa3201b7a"
},
{
"url": "https://git.kernel.org/stable/c/e27c17346628cb56843a83f93ac63c314c00f388"
},
{
"url": "https://git.kernel.org/stable/c/18a84c35842e19cd3c5534d8cee73d31863f696d"
},
{
"url": "https://git.kernel.org/stable/c/3bcf7aec6a9d16438f2cec29f5d7c8d5b8edf9b2"
}
],
"title": "tap: free page on error paths in tap_get_user_xdp()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46320",
"datePublished": "2026-06-09T12:11:12.882Z",
"dateReserved": "2026-05-13T15:03:33.112Z",
"dateUpdated": "2026-08-05T12:31:15.165Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43136 (GCVE-0-2026-43136)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()
Do not crash when a report has no fields.
Fake USB gadgets can send their own HID report descriptors and can define report
structures without valid fields. This can be used to crash the kernel over USB.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435 Version: fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435 Version: fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435 Version: fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435 Version: fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435 Version: fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435 Version: fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435 Version: fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-logitech-hidpp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae81fac9ce81917817d787e6b74e68482d99bdf2",
"status": "affected",
"version": "fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435",
"versionType": "git"
},
{
"lessThan": "2dc023dbc11b8dfa8afa63242762acd8cddcad03",
"status": "affected",
"version": "fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435",
"versionType": "git"
},
{
"lessThan": "7f59999fcd699af06ad2aef446a635ea6aa87db3",
"status": "affected",
"version": "fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435",
"versionType": "git"
},
{
"lessThan": "b74bf7d0d01fa9b53653f58c29aa00772121f6e9",
"status": "affected",
"version": "fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435",
"versionType": "git"
},
{
"lessThan": "f1ceaaf93ea32d0f2b95c95f784ee155962c52ad",
"status": "affected",
"version": "fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435",
"versionType": "git"
},
{
"lessThan": "1acb28123e57b50d737377f400f57eec889fe5e4",
"status": "affected",
"version": "fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435",
"versionType": "git"
},
{
"lessThan": "fb1725c0804dbec9dd01c4cb5c9f1f77a69e36dc",
"status": "affected",
"version": "fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435",
"versionType": "git"
},
{
"lessThan": "1547d41f9f19d691c2c9ce4c29f746297baef9e9",
"status": "affected",
"version": "fe3ee1ec007bf7b10d7c02814d4b8fbe7d9bb435",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-logitech-hidpp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: logitech-hidpp: Check maxfield in hidpp_get_report_length()\n\nDo not crash when a report has no fields.\n\nFake USB gadgets can send their own HID report descriptors and can define report\nstructures without valid fields. This can be used to crash the kernel over USB."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:18:27.298Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae81fac9ce81917817d787e6b74e68482d99bdf2"
},
{
"url": "https://git.kernel.org/stable/c/2dc023dbc11b8dfa8afa63242762acd8cddcad03"
},
{
"url": "https://git.kernel.org/stable/c/7f59999fcd699af06ad2aef446a635ea6aa87db3"
},
{
"url": "https://git.kernel.org/stable/c/b74bf7d0d01fa9b53653f58c29aa00772121f6e9"
},
{
"url": "https://git.kernel.org/stable/c/f1ceaaf93ea32d0f2b95c95f784ee155962c52ad"
},
{
"url": "https://git.kernel.org/stable/c/1acb28123e57b50d737377f400f57eec889fe5e4"
},
{
"url": "https://git.kernel.org/stable/c/fb1725c0804dbec9dd01c4cb5c9f1f77a69e36dc"
},
{
"url": "https://git.kernel.org/stable/c/1547d41f9f19d691c2c9ce4c29f746297baef9e9"
}
],
"title": "HID: logitech-hidpp: Check maxfield in hidpp_get_report_length()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43136",
"datePublished": "2026-05-06T11:27:22.892Z",
"dateReserved": "2026-05-01T14:12:55.988Z",
"dateUpdated": "2026-05-11T22:18:27.298Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53196 (GCVE-0-2026-53196)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-07-15 00:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: io_ti: fix heap overflow in get_manuf_info()
get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the
device I2C EEPROM into a buffer allocated with kmalloc_obj(), which
is sizeof(struct edge_ti_manuf_descriptor) = 10 bytes.
The Size field comes from the device and is only validated (in
check_i2c_image()) to make sure the descriptor fits within
TI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size.
A malicious USB device can therefore set Size to any value up to 16377,
causing a heap overflow of up to 16367 bytes when plugged into a host
running this driver.
valid_csum() is called after read_rom() and also iterates
buffer[0..Size-1], compounding the out-of-bounds access.
Fix by rejecting descriptors with unexpected length before calling
read_rom().
[ johan: amend commit message; also check for short descriptors ]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s `io_ti` USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the `get_manuf_info()` function. This occurs because the driver does not properly validate the size of data read from the device\u0027s I2C EEPROM against the allocated memory buffer. This improper validation can lead to out-of-bounds memory writes, potentially allowing an attacker to execute arbitrary code or cause a system crash (Denial of Service)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:44:34.377Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53196"
},
{
"name": "RHBZ#2492750",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492750"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53196.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, prevent module io_ti from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/io_ti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e168db91442b94e64fa82a7dd297983d48ea5cc0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "561edb021486e6723d841926aa4b48097da06190",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "cfd634f6dfd40c49a84f9bddc2867a80e2e2623a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d92f17af7097d10bdeddf26f66f34b354104b277",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b849f30d1a9e66aae6b715aaef66e427390cb081",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f96cf7bf9fbf15d7fcf0c91fec47ba8a010369ea",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d214d2341d4f9f447e36a7d012cdf6a6631a55f1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "183c1076eca43bbb3e7bdf597456f91d81c73e74",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/io_ti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: io_ti: fix heap overflow in get_manuf_info()\n\nget_manuf_info() reads le16_to_cpu(rom_desc-\u003eSize) bytes from the\ndevice I2C EEPROM into a buffer allocated with kmalloc_obj(), which\nis sizeof(struct edge_ti_manuf_descriptor) = 10 bytes.\n\nThe Size field comes from the device and is only validated (in\ncheck_i2c_image()) to make sure the descriptor fits within\nTI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size.\nA malicious USB device can therefore set Size to any value up to 16377,\ncausing a heap overflow of up to 16367 bytes when plugged into a host\nrunning this driver.\n\nvalid_csum() is called after read_rom() and also iterates\nbuffer[0..Size-1], compounding the out-of-bounds access.\n\nFix by rejecting descriptors with unexpected length before calling\nread_rom().\n\n[ johan: amend commit message; also check for short descriptors ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:06.330Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e168db91442b94e64fa82a7dd297983d48ea5cc0"
},
{
"url": "https://git.kernel.org/stable/c/561edb021486e6723d841926aa4b48097da06190"
},
{
"url": "https://git.kernel.org/stable/c/cfd634f6dfd40c49a84f9bddc2867a80e2e2623a"
},
{
"url": "https://git.kernel.org/stable/c/d92f17af7097d10bdeddf26f66f34b354104b277"
},
{
"url": "https://git.kernel.org/stable/c/b849f30d1a9e66aae6b715aaef66e427390cb081"
},
{
"url": "https://git.kernel.org/stable/c/f96cf7bf9fbf15d7fcf0c91fec47ba8a010369ea"
},
{
"url": "https://git.kernel.org/stable/c/d214d2341d4f9f447e36a7d012cdf6a6631a55f1"
},
{
"url": "https://git.kernel.org/stable/c/183c1076eca43bbb3e7bdf597456f91d81c73e74"
}
],
"title": "USB: serial: io_ti: fix heap overflow in get_manuf_info()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53196",
"datePublished": "2026-06-25T08:39:06.330Z",
"dateReserved": "2026-06-09T07:44:35.391Z",
"dateUpdated": "2026-07-15T00:44:34.377Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31583 (GCVE-0-2026-31583)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: em28xx: fix use-after-free in em28xx_v4l2_open()
em28xx_v4l2_open() reads dev->v4l2 without holding dev->lock,
creating a race with em28xx_v4l2_init()'s error path and
em28xx_v4l2_fini(), both of which free the em28xx_v4l2 struct
and set dev->v4l2 to NULL under dev->lock.
This race leads to two issues:
- use-after-free in v4l2_fh_init() when accessing vdev->ctrl_handler,
since the video_device is embedded in the freed em28xx_v4l2 struct.
- NULL pointer dereference in em28xx_resolution_set() when accessing
v4l2->norm, since dev->v4l2 has been set to NULL.
Fix this by moving the mutex_lock() before the dev->v4l2 read and
adding a NULL check for dev->v4l2 under the lock.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8139a4d583abad45eb987b5a99b3281b6d435b7e Version: 8139a4d583abad45eb987b5a99b3281b6d435b7e Version: 8139a4d583abad45eb987b5a99b3281b6d435b7e Version: 8139a4d583abad45eb987b5a99b3281b6d435b7e Version: 8139a4d583abad45eb987b5a99b3281b6d435b7e Version: 8139a4d583abad45eb987b5a99b3281b6d435b7e Version: 8139a4d583abad45eb987b5a99b3281b6d435b7e Version: 8139a4d583abad45eb987b5a99b3281b6d435b7e Version: 8139a4d583abad45eb987b5a99b3281b6d435b7e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/usb/em28xx/em28xx-video.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3c0283a59e36e3707c4a81f4952e362d31f876b8",
"status": "affected",
"version": "8139a4d583abad45eb987b5a99b3281b6d435b7e",
"versionType": "git"
},
{
"lessThan": "2cbf81f76842e46bdf25823c70e1db4044a65678",
"status": "affected",
"version": "8139a4d583abad45eb987b5a99b3281b6d435b7e",
"versionType": "git"
},
{
"lessThan": "38a327221f7f765e7d853b7bafe47e342441ec85",
"status": "affected",
"version": "8139a4d583abad45eb987b5a99b3281b6d435b7e",
"versionType": "git"
},
{
"lessThan": "b5d141ea15f173f15b9f0a72965902f3428c0d92",
"status": "affected",
"version": "8139a4d583abad45eb987b5a99b3281b6d435b7e",
"versionType": "git"
},
{
"lessThan": "5fb2940327722b4684d2f964b54c1c90aa277324",
"status": "affected",
"version": "8139a4d583abad45eb987b5a99b3281b6d435b7e",
"versionType": "git"
},
{
"lessThan": "871b8ea8ef39a6c253594649f4339378fad3d0dd",
"status": "affected",
"version": "8139a4d583abad45eb987b5a99b3281b6d435b7e",
"versionType": "git"
},
{
"lessThan": "6b9e66437cc6123ddedac141e1b8b6fcf57d2972",
"status": "affected",
"version": "8139a4d583abad45eb987b5a99b3281b6d435b7e",
"versionType": "git"
},
{
"lessThan": "dd2b888e08d3b3d6aacd65d76cd44fac11da750f",
"status": "affected",
"version": "8139a4d583abad45eb987b5a99b3281b6d435b7e",
"versionType": "git"
},
{
"lessThan": "a66485a934c7187ae8e36517d40615fa2e961cff",
"status": "affected",
"version": "8139a4d583abad45eb987b5a99b3281b6d435b7e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/usb/em28xx/em28xx-video.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: em28xx: fix use-after-free in em28xx_v4l2_open()\n\nem28xx_v4l2_open() reads dev-\u003ev4l2 without holding dev-\u003elock,\ncreating a race with em28xx_v4l2_init()\u0027s error path and\nem28xx_v4l2_fini(), both of which free the em28xx_v4l2 struct\nand set dev-\u003ev4l2 to NULL under dev-\u003elock.\n\nThis race leads to two issues:\n - use-after-free in v4l2_fh_init() when accessing vdev-\u003ectrl_handler,\n since the video_device is embedded in the freed em28xx_v4l2 struct.\n - NULL pointer dereference in em28xx_resolution_set() when accessing\n v4l2-\u003enorm, since dev-\u003ev4l2 has been set to NULL.\n\nFix this by moving the mutex_lock() before the dev-\u003ev4l2 read and\nadding a NULL check for dev-\u003ev4l2 under the lock."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:42:13.585Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3c0283a59e36e3707c4a81f4952e362d31f876b8"
},
{
"url": "https://git.kernel.org/stable/c/2cbf81f76842e46bdf25823c70e1db4044a65678"
},
{
"url": "https://git.kernel.org/stable/c/38a327221f7f765e7d853b7bafe47e342441ec85"
},
{
"url": "https://git.kernel.org/stable/c/b5d141ea15f173f15b9f0a72965902f3428c0d92"
},
{
"url": "https://git.kernel.org/stable/c/5fb2940327722b4684d2f964b54c1c90aa277324"
},
{
"url": "https://git.kernel.org/stable/c/871b8ea8ef39a6c253594649f4339378fad3d0dd"
},
{
"url": "https://git.kernel.org/stable/c/6b9e66437cc6123ddedac141e1b8b6fcf57d2972"
},
{
"url": "https://git.kernel.org/stable/c/dd2b888e08d3b3d6aacd65d76cd44fac11da750f"
},
{
"url": "https://git.kernel.org/stable/c/a66485a934c7187ae8e36517d40615fa2e961cff"
}
],
"title": "media: em28xx: fix use-after-free in em28xx_v4l2_open()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31583",
"datePublished": "2026-04-24T14:42:12.923Z",
"dateReserved": "2026-03-09T15:48:24.120Z",
"dateUpdated": "2026-06-14T17:42:13.585Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46077 (GCVE-0-2026-46077)
Vulnerability from cvelistv5
Published
2026-05-27 12:58
Modified
2026-06-14 17:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: atmel-tdes - fix DMA sync direction
Before DMA output is consumed by the CPU, ->dma_addr_out must be synced
with dma_sync_single_for_cpu() instead of dma_sync_single_for_device().
Using the wrong direction can return stale cache data on non-coherent
platforms.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 13802005d8f2db244ec1f5d7f6923de8f7a463db Version: 13802005d8f2db244ec1f5d7f6923de8f7a463db Version: 13802005d8f2db244ec1f5d7f6923de8f7a463db Version: 13802005d8f2db244ec1f5d7f6923de8f7a463db Version: 13802005d8f2db244ec1f5d7f6923de8f7a463db Version: 13802005d8f2db244ec1f5d7f6923de8f7a463db Version: 13802005d8f2db244ec1f5d7f6923de8f7a463db Version: 13802005d8f2db244ec1f5d7f6923de8f7a463db |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/atmel-tdes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ce3224678acb8c0b3473daa7d7dbffc998c6951a",
"status": "affected",
"version": "13802005d8f2db244ec1f5d7f6923de8f7a463db",
"versionType": "git"
},
{
"lessThan": "b9b28f3881dd514e74f98ae04e79a635022a4804",
"status": "affected",
"version": "13802005d8f2db244ec1f5d7f6923de8f7a463db",
"versionType": "git"
},
{
"lessThan": "c0f3002c02a3a83250e25582ffbe8df7eb78a8bd",
"status": "affected",
"version": "13802005d8f2db244ec1f5d7f6923de8f7a463db",
"versionType": "git"
},
{
"lessThan": "5281e6e2302362f6b75b70cbfe4098d2a25dafd9",
"status": "affected",
"version": "13802005d8f2db244ec1f5d7f6923de8f7a463db",
"versionType": "git"
},
{
"lessThan": "12a0adfe498cd5d87e6365d7ca5f6b3eed79e523",
"status": "affected",
"version": "13802005d8f2db244ec1f5d7f6923de8f7a463db",
"versionType": "git"
},
{
"lessThan": "863d11b3927703ad95077c81a8a6489c5c7872f7",
"status": "affected",
"version": "13802005d8f2db244ec1f5d7f6923de8f7a463db",
"versionType": "git"
},
{
"lessThan": "b5f5df801d161ba244f391519cbff2f4e5c6edc2",
"status": "affected",
"version": "13802005d8f2db244ec1f5d7f6923de8f7a463db",
"versionType": "git"
},
{
"lessThan": "c8a9a647532f5c2a04180352693215e24e9dba03",
"status": "affected",
"version": "13802005d8f2db244ec1f5d7f6923de8f7a463db",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/atmel-tdes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.6"
},
{
"lessThan": "3.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "3.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: atmel-tdes - fix DMA sync direction\n\nBefore DMA output is consumed by the CPU, -\u003edma_addr_out must be synced\nwith dma_sync_single_for_cpu() instead of dma_sync_single_for_device().\nUsing the wrong direction can return stale cache data on non-coherent\nplatforms."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:52:37.968Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ce3224678acb8c0b3473daa7d7dbffc998c6951a"
},
{
"url": "https://git.kernel.org/stable/c/b9b28f3881dd514e74f98ae04e79a635022a4804"
},
{
"url": "https://git.kernel.org/stable/c/c0f3002c02a3a83250e25582ffbe8df7eb78a8bd"
},
{
"url": "https://git.kernel.org/stable/c/5281e6e2302362f6b75b70cbfe4098d2a25dafd9"
},
{
"url": "https://git.kernel.org/stable/c/12a0adfe498cd5d87e6365d7ca5f6b3eed79e523"
},
{
"url": "https://git.kernel.org/stable/c/863d11b3927703ad95077c81a8a6489c5c7872f7"
},
{
"url": "https://git.kernel.org/stable/c/b5f5df801d161ba244f391519cbff2f4e5c6edc2"
},
{
"url": "https://git.kernel.org/stable/c/c8a9a647532f5c2a04180352693215e24e9dba03"
}
],
"title": "crypto: atmel-tdes - fix DMA sync direction",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46077",
"datePublished": "2026-05-27T12:58:10.542Z",
"dateReserved": "2026-05-13T15:03:33.096Z",
"dateUpdated": "2026-06-14T17:52:37.968Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31659 (GCVE-0-2026-31659)
Vulnerability from cvelistv5
Published
2026-04-24 14:45
Modified
2026-08-05 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: reject oversized global TT response buffers
batadv_tt_prepare_tvlv_global_data() builds the allocation length for a
global TT response in 16-bit temporaries. When a remote originator
advertises a large enough global TT, the TT payload length plus the VLAN
header offset can exceed 65535 and wrap before kmalloc().
The full-table response path still uses the original TT payload length when
it fills tt_change, so the wrapped allocation is too small and
batadv_tt_prepare_tvlv_global_data() writes past the end of the heap object
before the later packet-size check runs.
Fix this by rejecting TT responses whose TVLV value length cannot fit in
the 16-bit TVLV payload length field.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b Version: 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b Version: 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b Version: 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b Version: 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b Version: 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b Version: 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b Version: 7ea7b4a142758deaf46c1af0ca9ceca6dd55138b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/translation-table.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7e5d007e0df946bffb8542fb112e0044014a5897",
"status": "affected",
"version": "7ea7b4a142758deaf46c1af0ca9ceca6dd55138b",
"versionType": "git"
},
{
"lessThan": "2997f4bd1f982e7013709946e00be89b507693fa",
"status": "affected",
"version": "7ea7b4a142758deaf46c1af0ca9ceca6dd55138b",
"versionType": "git"
},
{
"lessThan": "95c71365a2222908441b54d6f2c315e0c79fcec3",
"status": "affected",
"version": "7ea7b4a142758deaf46c1af0ca9ceca6dd55138b",
"versionType": "git"
},
{
"lessThan": "69d61639bc7e963c3b645e570279d731e7c89062",
"status": "affected",
"version": "7ea7b4a142758deaf46c1af0ca9ceca6dd55138b",
"versionType": "git"
},
{
"lessThan": "f970646b9a39539d1bac86822ac78b5915455ea9",
"status": "affected",
"version": "7ea7b4a142758deaf46c1af0ca9ceca6dd55138b",
"versionType": "git"
},
{
"lessThan": "de6c1dc3c7d01a152607e6fcecee4d5288283f10",
"status": "affected",
"version": "7ea7b4a142758deaf46c1af0ca9ceca6dd55138b",
"versionType": "git"
},
{
"lessThan": "cf2199171ef799ca7270019125f4a91bd20ad4d9",
"status": "affected",
"version": "7ea7b4a142758deaf46c1af0ca9ceca6dd55138b",
"versionType": "git"
},
{
"lessThan": "3a359bf5c61d52e7f09754108309d637532164a6",
"status": "affected",
"version": "7ea7b4a142758deaf46c1af0ca9ceca6dd55138b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/translation-table.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.169",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.135",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.169",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.135",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.82",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: reject oversized global TT response buffers\n\nbatadv_tt_prepare_tvlv_global_data() builds the allocation length for a\nglobal TT response in 16-bit temporaries. When a remote originator\nadvertises a large enough global TT, the TT payload length plus the VLAN\nheader offset can exceed 65535 and wrap before kmalloc().\n\nThe full-table response path still uses the original TT payload length when\nit fills tt_change, so the wrapped allocation is too small and\nbatadv_tt_prepare_tvlv_global_data() writes past the end of the heap object\nbefore the later packet-size check runs.\n\nFix this by rejecting TT responses whose TVLV value length cannot fit in\nthe 16-bit TVLV payload length field."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable path is reached by received batman-adv network packets on an active mesh hard interface via ETH_P_BATMAN/BATADV_UNICAST_TVLV into the TT TVLV handler. A malicious mesh peer can advertise a large TT and then send a TT_REQUEST that makes the victim build the oversized global TT response.\nAC:L - The trigger is a deterministic protocol sequence: create/advertise enough TT entries and send a matching request with controlled TTVN/CRC data. There is no race or condition outside attacker control once the target participates in the affected batman-adv mesh.\nPR:N - The packet receive path performs format, version, address, and active-interface checks but no authentication or privilege check for the remote sender. The attacker needs only network reachability to the batman-adv mesh, not privileges on the victim.\nUI:N - No victim user action is needed after the batman-adv interface is already active. The vulnerable response is generated automatically while processing attacker-supplied protocol packets.\nS:U - The corruption occurs inside the kernel networking subsystem and affects the same kernel security authority. This is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The bug is a controllable heap out-of-bounds write in kernel memory, using attacker-influenced TT entries and lengths. Such memory corruption is plausibly exploitable to obtain kernel memory disclosure primitives.\nI:H - The wrapped allocation followed by TT entry generation writes past the end of a kernel heap object. A kernel heap out-of-bounds write is a high-integrity impact because it can plausibly corrupt objects for control-flow hijack or arbitrary modification.\nA:H - The same heap corruption can reliably crash or destabilize the kernel even if not fully exploited. Repeated unauthenticated network triggering makes high availability impact defensible."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:11.810Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7e5d007e0df946bffb8542fb112e0044014a5897"
},
{
"url": "https://git.kernel.org/stable/c/2997f4bd1f982e7013709946e00be89b507693fa"
},
{
"url": "https://git.kernel.org/stable/c/95c71365a2222908441b54d6f2c315e0c79fcec3"
},
{
"url": "https://git.kernel.org/stable/c/69d61639bc7e963c3b645e570279d731e7c89062"
},
{
"url": "https://git.kernel.org/stable/c/f970646b9a39539d1bac86822ac78b5915455ea9"
},
{
"url": "https://git.kernel.org/stable/c/de6c1dc3c7d01a152607e6fcecee4d5288283f10"
},
{
"url": "https://git.kernel.org/stable/c/cf2199171ef799ca7270019125f4a91bd20ad4d9"
},
{
"url": "https://git.kernel.org/stable/c/3a359bf5c61d52e7f09754108309d637532164a6"
}
],
"title": "batman-adv: reject oversized global TT response buffers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31659",
"datePublished": "2026-04-24T14:45:10.254Z",
"dateReserved": "2026-03-09T15:48:24.129Z",
"dateUpdated": "2026-08-05T12:24:11.810Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43295 (GCVE-0-2026-43295)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-05-11 22:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()
When idtab allocation fails, net is not registered with rio_add_net() yet,
so kfree(net) is sufficient to release the memory. Set mport->net to NULL
to avoid dangling pointer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e6b585ca6e81badeb3d42db3cc408174f2826034 Version: e6b585ca6e81badeb3d42db3cc408174f2826034 Version: e6b585ca6e81badeb3d42db3cc408174f2826034 Version: e6b585ca6e81badeb3d42db3cc408174f2826034 Version: e6b585ca6e81badeb3d42db3cc408174f2826034 Version: e6b585ca6e81badeb3d42db3cc408174f2826034 Version: e6b585ca6e81badeb3d42db3cc408174f2826034 Version: e6b585ca6e81badeb3d42db3cc408174f2826034 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/rapidio/rio-scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "83e579c2f7f6b1706323d744833b26470049dcc2",
"status": "affected",
"version": "e6b585ca6e81badeb3d42db3cc408174f2826034",
"versionType": "git"
},
{
"lessThan": "34a4f233df5eef5f1f113b2196142c0568b387f8",
"status": "affected",
"version": "e6b585ca6e81badeb3d42db3cc408174f2826034",
"versionType": "git"
},
{
"lessThan": "fecf292c6691970897396190855aa38826b7104e",
"status": "affected",
"version": "e6b585ca6e81badeb3d42db3cc408174f2826034",
"versionType": "git"
},
{
"lessThan": "649c2e853608cad0b0cba545555d168e67f094b3",
"status": "affected",
"version": "e6b585ca6e81badeb3d42db3cc408174f2826034",
"versionType": "git"
},
{
"lessThan": "87272e3e70ec4b666885bd520ff77463c11444ef",
"status": "affected",
"version": "e6b585ca6e81badeb3d42db3cc408174f2826034",
"versionType": "git"
},
{
"lessThan": "e5a732bfe29451e16abf9c6f07ce5948b22f3d59",
"status": "affected",
"version": "e6b585ca6e81badeb3d42db3cc408174f2826034",
"versionType": "git"
},
{
"lessThan": "78812c4fb7ed242d5961bf1337a49070d6487c94",
"status": "affected",
"version": "e6b585ca6e81badeb3d42db3cc408174f2826034",
"versionType": "git"
},
{
"lessThan": "666183dcdd9ad3b8156a1df7f204f728f720380f",
"status": "affected",
"version": "e6b585ca6e81badeb3d42db3cc408174f2826034",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/rapidio/rio-scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()\n\nWhen idtab allocation fails, net is not registered with rio_add_net() yet,\nso kfree(net) is sufficient to release the memory. Set mport-\u003enet to NULL\nto avoid dangling pointer."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:21:47.637Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/83e579c2f7f6b1706323d744833b26470049dcc2"
},
{
"url": "https://git.kernel.org/stable/c/34a4f233df5eef5f1f113b2196142c0568b387f8"
},
{
"url": "https://git.kernel.org/stable/c/fecf292c6691970897396190855aa38826b7104e"
},
{
"url": "https://git.kernel.org/stable/c/649c2e853608cad0b0cba545555d168e67f094b3"
},
{
"url": "https://git.kernel.org/stable/c/87272e3e70ec4b666885bd520ff77463c11444ef"
},
{
"url": "https://git.kernel.org/stable/c/e5a732bfe29451e16abf9c6f07ce5948b22f3d59"
},
{
"url": "https://git.kernel.org/stable/c/78812c4fb7ed242d5961bf1337a49070d6487c94"
},
{
"url": "https://git.kernel.org/stable/c/666183dcdd9ad3b8156a1df7f204f728f720380f"
}
],
"title": "rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43295",
"datePublished": "2026-05-08T13:11:18.226Z",
"dateReserved": "2026-05-01T14:12:55.999Z",
"dateUpdated": "2026-05-11T22:21:47.637Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43493 (GCVE-0-2026-43493)
Vulnerability from cvelistv5
Published
2026-05-19 10:44
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: pcrypt - Fix handling of MAY_BACKLOG requests
MAY_BACKLOG requests can return EBUSY. Handle them by checking
for that value and filtering out EINPROGRESS notifications.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5a1436beec5744029f3ac90b6fe71a698dcd6155 Version: 5a1436beec5744029f3ac90b6fe71a698dcd6155 Version: 5a1436beec5744029f3ac90b6fe71a698dcd6155 Version: 5a1436beec5744029f3ac90b6fe71a698dcd6155 Version: 5a1436beec5744029f3ac90b6fe71a698dcd6155 Version: 5a1436beec5744029f3ac90b6fe71a698dcd6155 Version: 5a1436beec5744029f3ac90b6fe71a698dcd6155 Version: 5a1436beec5744029f3ac90b6fe71a698dcd6155 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/pcrypt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae7e95638d956d556d74b9abb9e780d3bd3dcd9e",
"status": "affected",
"version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
"versionType": "git"
},
{
"lessThan": "1d7f07df450bac3301938fbc4251f2611be4084e",
"status": "affected",
"version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
"versionType": "git"
},
{
"lessThan": "76641449b28979ebd6c02e9598367e119e385236",
"status": "affected",
"version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
"versionType": "git"
},
{
"lessThan": "9f1cbca178c03188e201ed175251372149bb25f2",
"status": "affected",
"version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
"versionType": "git"
},
{
"lessThan": "eb34e243df57e32f4c08fa191f3602ea19076276",
"status": "affected",
"version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
"versionType": "git"
},
{
"lessThan": "77d55bc8675ee851ed639dc9be77325a8024cf67",
"status": "affected",
"version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
"versionType": "git"
},
{
"lessThan": "46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a",
"status": "affected",
"version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
"versionType": "git"
},
{
"lessThan": "915b692e6cb723aac658c25eb82c58fd81235110",
"status": "affected",
"version": "5a1436beec5744029f3ac90b6fe71a698dcd6155",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/pcrypt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: pcrypt - Fix handling of MAY_BACKLOG requests\n\nMAY_BACKLOG requests can return EBUSY. Handle them by checking\nfor that value and filtering out EINPROGRESS notifications."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - pcrypt AEAD can sit under network-facing kernel crypto consumers such as kTLS/TIPC that process peer-supplied records or packets. In the highest reasonable deployment, a remote peer can drive the vulnerable encrypt/decrypt path through network traffic.\nAC:L - The trigger is child crypto backlog behavior under `CRYPTO_TFM_REQ_MAY_BACKLOG`; an attacker can induce queue pressure with concurrent requests or traffic. There is no race that depends on conditions outside the attacker\u0027s control.\nPR:N - The network-facing path requires no kernel privileges from the remote peer. The local AF_ALG AEAD path also has no capability gate, but the higher-severity network scenario is defensible.\nUI:N - No victim interaction is required once the affected crypto consumer is configured. The attacker only sends data or submits crypto requests.\nS:U - The bug corrupts kernel crypto/request state within the same kernel security authority. It is not a VM escape, IOMMU bypass, or other scope-changing boundary crossing.\nC:H - Mishandling `-EBUSY` can complete and free the request while the child request remains queued, leading to use-after-free on later callbacks. A kernel UAF is reasonably exploitable for high-impact information disclosure.\nI:H - The stale callback reuses freed request/padata memory and can drive list operations and completion paths on attacker-reclaimed objects. This is memory corruption with a plausible path to arbitrary write or control-flow corruption.\nA:H - At minimum, the premature completion and later queued callback can dereference or manipulate freed kernel memory. That can produce kernel oops/panic or list corruption, giving high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:16.602Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae7e95638d956d556d74b9abb9e780d3bd3dcd9e"
},
{
"url": "https://git.kernel.org/stable/c/1d7f07df450bac3301938fbc4251f2611be4084e"
},
{
"url": "https://git.kernel.org/stable/c/76641449b28979ebd6c02e9598367e119e385236"
},
{
"url": "https://git.kernel.org/stable/c/9f1cbca178c03188e201ed175251372149bb25f2"
},
{
"url": "https://git.kernel.org/stable/c/eb34e243df57e32f4c08fa191f3602ea19076276"
},
{
"url": "https://git.kernel.org/stable/c/77d55bc8675ee851ed639dc9be77325a8024cf67"
},
{
"url": "https://git.kernel.org/stable/c/46271895ddfb1ba41f89f7e0dffbe9c2bcf7380a"
},
{
"url": "https://git.kernel.org/stable/c/915b692e6cb723aac658c25eb82c58fd81235110"
}
],
"title": "crypto: pcrypt - Fix handling of MAY_BACKLOG requests",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43493",
"datePublished": "2026-05-19T10:44:25.402Z",
"dateReserved": "2026-05-01T14:12:56.013Z",
"dateUpdated": "2026-08-05T12:28:16.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43465 (GCVE-0-2026-43465)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ
XDP multi-buf programs can modify the layout of the XDP buffer when the
program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The
referenced commit in the fixes tag corrected the assumption in the mlx5
driver that the XDP buffer layout doesn't change during a program
execution. However, this fix introduced another issue: the dropped
fragments still need to be counted on the driver side to avoid page
fragment reference counting issues.
The issue was discovered by the drivers/net/xdp.py selftest,
more specifically the test_xdp_native_tx_mb:
- The mlx5 driver allocates a page_pool page and initializes it with
a frag counter of 64 (pp_ref_count=64) and the internal frag counter
to 0.
- The test sends one packet with no payload.
- On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP
buffer with the packet data starting in the first fragment which is the
page mentioned above.
- The XDP program runs and calls bpf_xdp_pull_data() which moves the
header into the linear part of the XDP buffer. As the packet doesn't
contain more data, the program drops the tail fragment since it no
longer contains any payload (pp_ref_count=63).
- mlx5 device skips counting this fragment. Internal frag counter
remains 0.
- mlx5 releases all 64 fragments of the page but page pp_ref_count is
63 => negative reference counting error.
Resulting splat during the test:
WARNING: CPU: 0 PID: 188225 at ./include/net/page_pool/helpers.h:297 mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core]
Modules linked in: [...]
CPU: 0 UID: 0 PID: 188225 Comm: ip Not tainted 6.18.0-rc7_for_upstream_min_debug_2025_12_08_11_44 #1 NONE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
RIP: 0010:mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core]
[...]
Call Trace:
<TASK>
mlx5e_free_rx_mpwqe+0x20a/0x250 [mlx5_core]
mlx5e_dealloc_rx_mpwqe+0x37/0xb0 [mlx5_core]
mlx5e_free_rx_descs+0x11a/0x170 [mlx5_core]
mlx5e_close_rq+0x78/0xa0 [mlx5_core]
mlx5e_close_queues+0x46/0x2a0 [mlx5_core]
mlx5e_close_channel+0x24/0x90 [mlx5_core]
mlx5e_close_channels+0x5d/0xf0 [mlx5_core]
mlx5e_safe_switch_params+0x2ec/0x380 [mlx5_core]
mlx5e_change_mtu+0x11d/0x490 [mlx5_core]
mlx5e_change_nic_mtu+0x19/0x30 [mlx5_core]
netif_set_mtu_ext+0xfc/0x240
do_setlink.isra.0+0x226/0x1100
rtnl_newlink+0x7a9/0xba0
rtnetlink_rcv_msg+0x220/0x3c0
netlink_rcv_skb+0x4b/0xf0
netlink_unicast+0x255/0x380
netlink_sendmsg+0x1f3/0x420
__sock_sendmsg+0x38/0x60
____sys_sendmsg+0x1e8/0x240
___sys_sendmsg+0x7c/0xb0
[...]
__sys_sendmsg+0x5f/0xb0
do_syscall_64+0x55/0xc70
The problem applies for XDP_PASS as well which is handled in a different
code path in the driver.
This patch fixes the issue by doing page frag counting on all the
original XDP buffer fragments for all relevant XDP actions (XDP_TX ,
XDP_REDIRECT and XDP_PASS). This is basically reverting to the original
counting before the commit in the fixes tag.
As frag_page is still pointing to the original tail, the nr_frags
parameter to xdp_update_skb_frags_info() needs to be calculated
in a different way to reflect the new nr_frags.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 87bcef158ac1faca1bd7e0104588e8e2956d10be Version: 87bcef158ac1faca1bd7e0104588e8e2956d10be Version: 87bcef158ac1faca1bd7e0104588e8e2956d10be Version: 8b051d7f530e8a5237da242fbeafef02fec6b813 Version: cb9edd583e23979ee546981be963ad5f217e8b18 Version: f2557d7fa38e9475b38588f5c124476091480f53 Version: 6.6.115 ≤ Version: 6.12.56 ≤ Version: 6.17.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7d7342a18fadcdb70a63b3c930dc63528ce51832",
"status": "affected",
"version": "87bcef158ac1faca1bd7e0104588e8e2956d10be",
"versionType": "git"
},
{
"lessThan": "043bd62f748bc9fd98154037aa598cffbd3c667c",
"status": "affected",
"version": "87bcef158ac1faca1bd7e0104588e8e2956d10be",
"versionType": "git"
},
{
"lessThan": "db25c42c2e1f9c0d136420fff5e5700f7e771a6f",
"status": "affected",
"version": "87bcef158ac1faca1bd7e0104588e8e2956d10be",
"versionType": "git"
},
{
"status": "affected",
"version": "8b051d7f530e8a5237da242fbeafef02fec6b813",
"versionType": "git"
},
{
"status": "affected",
"version": "cb9edd583e23979ee546981be963ad5f217e8b18",
"versionType": "git"
},
{
"status": "affected",
"version": "f2557d7fa38e9475b38588f5c124476091480f53",
"versionType": "git"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.115",
"versionType": "semver"
},
{
"lessThan": "6.13",
"status": "affected",
"version": "6.12.56",
"versionType": "semver"
},
{
"lessThan": "6.18",
"status": "affected",
"version": "6.17.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_rx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12.56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ\n\nXDP multi-buf programs can modify the layout of the XDP buffer when the\nprogram calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The\nreferenced commit in the fixes tag corrected the assumption in the mlx5\ndriver that the XDP buffer layout doesn\u0027t change during a program\nexecution. However, this fix introduced another issue: the dropped\nfragments still need to be counted on the driver side to avoid page\nfragment reference counting issues.\n\nThe issue was discovered by the drivers/net/xdp.py selftest,\nmore specifically the test_xdp_native_tx_mb:\n- The mlx5 driver allocates a page_pool page and initializes it with\n a frag counter of 64 (pp_ref_count=64) and the internal frag counter\n to 0.\n- The test sends one packet with no payload.\n- On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP\n buffer with the packet data starting in the first fragment which is the\n page mentioned above.\n- The XDP program runs and calls bpf_xdp_pull_data() which moves the\n header into the linear part of the XDP buffer. As the packet doesn\u0027t\n contain more data, the program drops the tail fragment since it no\n longer contains any payload (pp_ref_count=63).\n- mlx5 device skips counting this fragment. Internal frag counter\n remains 0.\n- mlx5 releases all 64 fragments of the page but page pp_ref_count is\n 63 =\u003e negative reference counting error.\n\nResulting splat during the test:\n\n WARNING: CPU: 0 PID: 188225 at ./include/net/page_pool/helpers.h:297 mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core]\n Modules linked in: [...]\n CPU: 0 UID: 0 PID: 188225 Comm: ip Not tainted 6.18.0-rc7_for_upstream_min_debug_2025_12_08_11_44 #1 NONE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n RIP: 0010:mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core]\n [...]\n Call Trace:\n \u003cTASK\u003e\n mlx5e_free_rx_mpwqe+0x20a/0x250 [mlx5_core]\n mlx5e_dealloc_rx_mpwqe+0x37/0xb0 [mlx5_core]\n mlx5e_free_rx_descs+0x11a/0x170 [mlx5_core]\n mlx5e_close_rq+0x78/0xa0 [mlx5_core]\n mlx5e_close_queues+0x46/0x2a0 [mlx5_core]\n mlx5e_close_channel+0x24/0x90 [mlx5_core]\n mlx5e_close_channels+0x5d/0xf0 [mlx5_core]\n mlx5e_safe_switch_params+0x2ec/0x380 [mlx5_core]\n mlx5e_change_mtu+0x11d/0x490 [mlx5_core]\n mlx5e_change_nic_mtu+0x19/0x30 [mlx5_core]\n netif_set_mtu_ext+0xfc/0x240\n do_setlink.isra.0+0x226/0x1100\n rtnl_newlink+0x7a9/0xba0\n rtnetlink_rcv_msg+0x220/0x3c0\n netlink_rcv_skb+0x4b/0xf0\n netlink_unicast+0x255/0x380\n netlink_sendmsg+0x1f3/0x420\n __sock_sendmsg+0x38/0x60\n ____sys_sendmsg+0x1e8/0x240\n ___sys_sendmsg+0x7c/0xb0\n [...]\n __sys_sendmsg+0x5f/0xb0\n do_syscall_64+0x55/0xc70\n\nThe problem applies for XDP_PASS as well which is handled in a different\ncode path in the driver.\n\nThis patch fixes the issue by doing page frag counting on all the\noriginal XDP buffer fragments for all relevant XDP actions (XDP_TX ,\nXDP_REDIRECT and XDP_PASS). This is basically reverting to the original\ncounting before the commit in the fixes tag.\n\nAs frag_page is still pointing to the original tail, the nr_frags\nparameter to xdp_update_skb_frags_info() needs to be calculated\nin a different way to reflect the new nr_frags."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable mlx5e RX path is reached by received packets on an affected Mellanox interface in a deployment running an XDP multi-buffer program. A remote peer can trigger the fragment-accounting path by sending packets processed by that XDP program.\nAC:L - Once the affected striding RQ and XDP multi-buffer program are in use, triggering only requires packets that cause bpf_xdp_pull_data() or bpf_xdp_adjust_tail() to drop fragments. There is no race or probabilistic condition in the vulnerable path.\nPR:N - The attacker does not need privileges to send the triggering network traffic to a configured affected interface. Loading the XDP program is an environmental precondition for the vulnerable deployment, not an action required from the attacker.\nUI:N - No victim user action is required after the affected interface and XDP program are configured. Packet reception drives the vulnerable path automatically in NAPI RX processing.\nS:U - The impact remains within the same kernel and host security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug corrupts page-pool fragment lifetime accounting, which can leave pages recycled or referenced incorrectly while packet buffers still point to them. Under the required higher-severity assumption, this memory lifetime corruption can expose kernel or packet memory.\nI:H - Incorrect page-pool reference accounting can cause stale or prematurely recycled packet pages to be reused while still referenced, creating a kernel memory corruption condition. Such lifetime corruption is defensibly treated as high integrity impact.\nA:H - The observed failure is a page_pool refcount underflow warning, and repeated triggering can corrupt RX page accounting, exhaust resources, or panic systems configured with panic_on_warn. This provides high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:08.583Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7d7342a18fadcdb70a63b3c930dc63528ce51832"
},
{
"url": "https://git.kernel.org/stable/c/043bd62f748bc9fd98154037aa598cffbd3c667c"
},
{
"url": "https://git.kernel.org/stable/c/db25c42c2e1f9c0d136420fff5e5700f7e771a6f"
}
],
"title": "net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43465",
"datePublished": "2026-05-08T14:22:26.822Z",
"dateReserved": "2026-05-01T14:12:56.011Z",
"dateUpdated": "2026-08-05T12:28:08.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53015 (GCVE-0-2026-53015)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
erofs: unify lcn as u64 for 32-bit platforms
As sashiko reported [1], `lcn` was typed as `unsigned long` (or
`unsigned int` sometimes), which is only 32 bits wide on 32-bit
platforms, which causes `(lcn << lclusterbits)` to be truncated
at 4 GiB.
In order to consolidate the logic, just use `u64` consistently
around the codebase.
[1] https://sashiko.dev/r/20260420034612.1899973-1-hsiangkao%40linux.alibaba.com
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/erofs/zmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4fc9b12e43a3f19a01a8fb61f7961be79de20253",
"status": "affected",
"version": "152a333a589560bee002e4c96761f1b560a5793c",
"versionType": "git"
},
{
"lessThan": "858e4d98a86adf34584767388deb6c9b217f70c5",
"status": "affected",
"version": "152a333a589560bee002e4c96761f1b560a5793c",
"versionType": "git"
},
{
"lessThan": "582b0bf201157632cb5474c885989a6ebda46521",
"status": "affected",
"version": "152a333a589560bee002e4c96761f1b560a5793c",
"versionType": "git"
},
{
"lessThan": "2d8c7edcb661812249469f4a5b62e9339118846f",
"status": "affected",
"version": "152a333a589560bee002e4c96761f1b560a5793c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/erofs/zmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: unify lcn as u64 for 32-bit platforms\n\nAs sashiko reported [1], `lcn` was typed as `unsigned long` (or\n`unsigned int` sometimes), which is only 32 bits wide on 32-bit\nplatforms, which causes `(lcn \u003c\u003c lclusterbits)` to be truncated\nat 4 GiB.\n\nIn order to consolidate the logic, just use `u64` consistently\naround the codebase.\n\n[1] https://sashiko.dev/r/20260420034612.1899973-1-hsiangkao%40linux.alibaba.com"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:25.396Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4fc9b12e43a3f19a01a8fb61f7961be79de20253"
},
{
"url": "https://git.kernel.org/stable/c/858e4d98a86adf34584767388deb6c9b217f70c5"
},
{
"url": "https://git.kernel.org/stable/c/582b0bf201157632cb5474c885989a6ebda46521"
},
{
"url": "https://git.kernel.org/stable/c/2d8c7edcb661812249469f4a5b62e9339118846f"
}
],
"title": "erofs: unify lcn as u64 for 32-bit platforms",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53015",
"datePublished": "2026-06-24T16:29:25.396Z",
"dateReserved": "2026-06-09T07:44:35.378Z",
"dateUpdated": "2026-06-24T16:29:25.396Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45848 (GCVE-0-2026-45848)
Vulnerability from cvelistv5
Published
2026-05-27 12:15
Modified
2026-05-27 12:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix NULL sock in aa_sock_file_perm
Deal with the potential that sock and sock-sk can be NULL during
socket setup or teardown. This could lead to an oops. The fix for NULL
pointer dereference in __unix_needs_revalidation shows this is at
least possible for af_unix sockets. While the fix for af_unix sockets
applies for newer mediation this is still the fall back path for older
af_unix mediation and other sockets, so ensure it is covered.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 56974a6fcfef69ee0825bd66ed13e92070ac5224 Version: 56974a6fcfef69ee0825bd66ed13e92070ac5224 Version: 56974a6fcfef69ee0825bd66ed13e92070ac5224 Version: 56974a6fcfef69ee0825bd66ed13e92070ac5224 Version: 56974a6fcfef69ee0825bd66ed13e92070ac5224 Version: 56974a6fcfef69ee0825bd66ed13e92070ac5224 Version: 56974a6fcfef69ee0825bd66ed13e92070ac5224 Version: 56974a6fcfef69ee0825bd66ed13e92070ac5224 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/apparmor/net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "68538ec34fcb4194c7961dc4eca6f5537fec8067",
"status": "affected",
"version": "56974a6fcfef69ee0825bd66ed13e92070ac5224",
"versionType": "git"
},
{
"lessThan": "5121b7283f1c46e4c06b88b1dda7b064429d77de",
"status": "affected",
"version": "56974a6fcfef69ee0825bd66ed13e92070ac5224",
"versionType": "git"
},
{
"lessThan": "c11b7c3280d000376e27ebfed17ec7046699eab4",
"status": "affected",
"version": "56974a6fcfef69ee0825bd66ed13e92070ac5224",
"versionType": "git"
},
{
"lessThan": "0dc19bca22606f7a61d5988408f74e3ae0ef3486",
"status": "affected",
"version": "56974a6fcfef69ee0825bd66ed13e92070ac5224",
"versionType": "git"
},
{
"lessThan": "3852eb9a0392eb435c03dcb47d581bcfe6a9a95b",
"status": "affected",
"version": "56974a6fcfef69ee0825bd66ed13e92070ac5224",
"versionType": "git"
},
{
"lessThan": "ccb66a3c6c8f51b3ed1bc003b70bb9ff99e8d835",
"status": "affected",
"version": "56974a6fcfef69ee0825bd66ed13e92070ac5224",
"versionType": "git"
},
{
"lessThan": "8a0ededbfcff74598f82f1d4b8ef9db28878b317",
"status": "affected",
"version": "56974a6fcfef69ee0825bd66ed13e92070ac5224",
"versionType": "git"
},
{
"lessThan": "00b67657535dfea56e84d11492f5c0f61d0af297",
"status": "affected",
"version": "56974a6fcfef69ee0825bd66ed13e92070ac5224",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/apparmor/net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix NULL sock in aa_sock_file_perm\n\nDeal with the potential that sock and sock-sk can be NULL during\nsocket setup or teardown. This could lead to an oops. The fix for NULL\npointer dereference in __unix_needs_revalidation shows this is at\nleast possible for af_unix sockets. While the fix for af_unix sockets\napplies for newer mediation this is still the fall back path for older\naf_unix mediation and other sockets, so ensure it is covered."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:15:12.310Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/68538ec34fcb4194c7961dc4eca6f5537fec8067"
},
{
"url": "https://git.kernel.org/stable/c/5121b7283f1c46e4c06b88b1dda7b064429d77de"
},
{
"url": "https://git.kernel.org/stable/c/c11b7c3280d000376e27ebfed17ec7046699eab4"
},
{
"url": "https://git.kernel.org/stable/c/0dc19bca22606f7a61d5988408f74e3ae0ef3486"
},
{
"url": "https://git.kernel.org/stable/c/3852eb9a0392eb435c03dcb47d581bcfe6a9a95b"
},
{
"url": "https://git.kernel.org/stable/c/ccb66a3c6c8f51b3ed1bc003b70bb9ff99e8d835"
},
{
"url": "https://git.kernel.org/stable/c/8a0ededbfcff74598f82f1d4b8ef9db28878b317"
},
{
"url": "https://git.kernel.org/stable/c/00b67657535dfea56e84d11492f5c0f61d0af297"
}
],
"title": "apparmor: fix NULL sock in aa_sock_file_perm",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45848",
"datePublished": "2026-05-27T12:15:12.310Z",
"dateReserved": "2026-05-13T15:03:33.078Z",
"dateUpdated": "2026-05-27T12:15:12.310Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31447 (GCVE-0-2026-31447)
Vulnerability from cvelistv5
Published
2026-04-22 13:53
Modified
2026-08-05 12:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: reject mount if bigalloc with s_first_data_block != 0
bigalloc with s_first_data_block != 0 is not supported, reject mounting
it.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 281b59959707dfae03ce038cdf231bf4904e170c Version: 281b59959707dfae03ce038cdf231bf4904e170c Version: 281b59959707dfae03ce038cdf231bf4904e170c Version: 281b59959707dfae03ce038cdf231bf4904e170c Version: 281b59959707dfae03ce038cdf231bf4904e170c Version: 281b59959707dfae03ce038cdf231bf4904e170c Version: 281b59959707dfae03ce038cdf231bf4904e170c Version: 281b59959707dfae03ce038cdf231bf4904e170c |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:47:53.009Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5ad6d994255e27a3254079dfb50ca861fc31f2d0",
"status": "affected",
"version": "281b59959707dfae03ce038cdf231bf4904e170c",
"versionType": "git"
},
{
"lessThan": "3a926957cc95899ef88529710836edadc03c71a1",
"status": "affected",
"version": "281b59959707dfae03ce038cdf231bf4904e170c",
"versionType": "git"
},
{
"lessThan": "7b58c110b4e1f028eb38eec9ed3555e9be81c8b0",
"status": "affected",
"version": "281b59959707dfae03ce038cdf231bf4904e170c",
"versionType": "git"
},
{
"lessThan": "b77de3fceafbb39f30e4ff5dc986f863d5456417",
"status": "affected",
"version": "281b59959707dfae03ce038cdf231bf4904e170c",
"versionType": "git"
},
{
"lessThan": "d787d3ae96648dc14a3b7ca8fde817177e82c1c7",
"status": "affected",
"version": "281b59959707dfae03ce038cdf231bf4904e170c",
"versionType": "git"
},
{
"lessThan": "ad1f6d608f33f59d21a3d025615d6786a6443998",
"status": "affected",
"version": "281b59959707dfae03ce038cdf231bf4904e170c",
"versionType": "git"
},
{
"lessThan": "7d5b04290156c3fc316eecc86a4f9d201ab7d44a",
"status": "affected",
"version": "281b59959707dfae03ce038cdf231bf4904e170c",
"versionType": "git"
},
{
"lessThan": "3822743dc20386d9897e999dbb990befa3a5b3f8",
"status": "affected",
"version": "281b59959707dfae03ce038cdf231bf4904e170c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: reject mount if bigalloc with s_first_data_block != 0\n\nbigalloc with s_first_data_block != 0 is not supported, reject mounting\nit."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable ext4 code is reached through local filesystem mount and file-operation paths on an attacker-controlled ext4 image or block device, not through a network protocol.\nAC:L - The attacker controls the filesystem geometry and extent layout, and the reported trigger is deterministic after mounting and operating on the crafted filesystem; no race or external timing condition is required.\nPR:N - Direct mounting is gated by CAP_SYS_ADMIN in the initial user namespace because ext4 lacks FS_USERNS_MOUNT, but in the attacker-supplied filesystem scenario the privileged mount is performed by the victim or system automounter. The attacker does not need their own kernel privileges.\nUI:R - Exploitation requires a victim or privileged mounting path to mount the crafted ext4 filesystem and perform an operation such as unlink/truncate on it.\nS:U - The impact remains within the kernel/filesystem security authority; this is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is a use-after-free in ext4 extent metadata handling, and UAF conditions can expose reused memory contents or be shaped into broader kernel information disclosure.\nI:H - The faulty cluster arithmetic can free and reuse metadata blocks still referenced by extents, creating memory/filesystem metadata corruption that is defensibly exploitable for high-integrity impact.\nA:H - The observed failure is a KASAN use-after-free in ext4_ext_remove_space and can crash or destabilize the kernel, giving high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:37.767Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5ad6d994255e27a3254079dfb50ca861fc31f2d0"
},
{
"url": "https://git.kernel.org/stable/c/3a926957cc95899ef88529710836edadc03c71a1"
},
{
"url": "https://git.kernel.org/stable/c/7b58c110b4e1f028eb38eec9ed3555e9be81c8b0"
},
{
"url": "https://git.kernel.org/stable/c/b77de3fceafbb39f30e4ff5dc986f863d5456417"
},
{
"url": "https://git.kernel.org/stable/c/d787d3ae96648dc14a3b7ca8fde817177e82c1c7"
},
{
"url": "https://git.kernel.org/stable/c/ad1f6d608f33f59d21a3d025615d6786a6443998"
},
{
"url": "https://git.kernel.org/stable/c/7d5b04290156c3fc316eecc86a4f9d201ab7d44a"
},
{
"url": "https://git.kernel.org/stable/c/3822743dc20386d9897e999dbb990befa3a5b3f8"
}
],
"title": "ext4: reject mount if bigalloc with s_first_data_block != 0",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31447",
"datePublished": "2026-04-22T13:53:43.467Z",
"dateReserved": "2026-03-09T15:48:24.091Z",
"dateUpdated": "2026-08-05T12:22:37.767Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43231 (GCVE-0-2026-43231)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: radio-keene: fix memory leak in error path
Fix a memory leak in usb_keene_probe(). The v4l2 control handler is
initialized and controls are added, but if v4l2_device_register() or
video_register_device() fails afterward, the handler was never freed,
leaking memory.
Add v4l2_ctrl_handler_free() call in the err_v4l2 error path to ensure
the control handler is properly freed for all error paths after it is
initialized.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1bf20c3a0c616f44359c573b533d06bae960ee45 Version: 1bf20c3a0c616f44359c573b533d06bae960ee45 Version: 1bf20c3a0c616f44359c573b533d06bae960ee45 Version: 1bf20c3a0c616f44359c573b533d06bae960ee45 Version: 1bf20c3a0c616f44359c573b533d06bae960ee45 Version: 1bf20c3a0c616f44359c573b533d06bae960ee45 Version: 1bf20c3a0c616f44359c573b533d06bae960ee45 Version: 1bf20c3a0c616f44359c573b533d06bae960ee45 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/radio/radio-keene.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ad85bb5623079a35bd400f51de2e2fbc2170bdb2",
"status": "affected",
"version": "1bf20c3a0c616f44359c573b533d06bae960ee45",
"versionType": "git"
},
{
"lessThan": "242b0aabb1866024a7995a767ac330c158b39aa4",
"status": "affected",
"version": "1bf20c3a0c616f44359c573b533d06bae960ee45",
"versionType": "git"
},
{
"lessThan": "2fe28a63d598235595a9601e0d8fdc7c8f4fd575",
"status": "affected",
"version": "1bf20c3a0c616f44359c573b533d06bae960ee45",
"versionType": "git"
},
{
"lessThan": "27c508f61963013fdf29097578284099ee7a85a4",
"status": "affected",
"version": "1bf20c3a0c616f44359c573b533d06bae960ee45",
"versionType": "git"
},
{
"lessThan": "7fa9754f48cb8eefa566156be341e63d313247e5",
"status": "affected",
"version": "1bf20c3a0c616f44359c573b533d06bae960ee45",
"versionType": "git"
},
{
"lessThan": "1d8558a232ecb187e8e0328d6347a125f437a0fc",
"status": "affected",
"version": "1bf20c3a0c616f44359c573b533d06bae960ee45",
"versionType": "git"
},
{
"lessThan": "de204d87e7d61859937272fe30cbdd46a4cfb10a",
"status": "affected",
"version": "1bf20c3a0c616f44359c573b533d06bae960ee45",
"versionType": "git"
},
{
"lessThan": "b8bf939d77c0cd01118e953bbf554e0fa15e9006",
"status": "affected",
"version": "1bf20c3a0c616f44359c573b533d06bae960ee45",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/radio/radio-keene.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.4"
},
{
"lessThan": "3.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: radio-keene: fix memory leak in error path\n\nFix a memory leak in usb_keene_probe(). The v4l2 control handler is\ninitialized and controls are added, but if v4l2_device_register() or\nvideo_register_device() fails afterward, the handler was never freed,\nleaking memory.\n\nAdd v4l2_ctrl_handler_free() call in the err_v4l2 error path to ensure\nthe control handler is properly freed for all error paths after it is\ninitialized."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:20:32.379Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ad85bb5623079a35bd400f51de2e2fbc2170bdb2"
},
{
"url": "https://git.kernel.org/stable/c/242b0aabb1866024a7995a767ac330c158b39aa4"
},
{
"url": "https://git.kernel.org/stable/c/2fe28a63d598235595a9601e0d8fdc7c8f4fd575"
},
{
"url": "https://git.kernel.org/stable/c/27c508f61963013fdf29097578284099ee7a85a4"
},
{
"url": "https://git.kernel.org/stable/c/7fa9754f48cb8eefa566156be341e63d313247e5"
},
{
"url": "https://git.kernel.org/stable/c/1d8558a232ecb187e8e0328d6347a125f437a0fc"
},
{
"url": "https://git.kernel.org/stable/c/de204d87e7d61859937272fe30cbdd46a4cfb10a"
},
{
"url": "https://git.kernel.org/stable/c/b8bf939d77c0cd01118e953bbf554e0fa15e9006"
}
],
"title": "media: radio-keene: fix memory leak in error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43231",
"datePublished": "2026-05-06T11:28:28.268Z",
"dateReserved": "2026-05-01T14:12:55.995Z",
"dateUpdated": "2026-05-11T22:20:32.379Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31540 (GCVE-0-2026-31540)
Vulnerability from cvelistv5
Published
2026-04-24 14:33
Modified
2026-05-11 22:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/i915/gt: Check set_default_submission() before deferencing
When the i915 driver firmware binaries are not present, the
set_default_submission pointer is not set. This pointer is
dereferenced during suspend anyways.
Add a check to make sure it is set before dereferencing.
[ 23.289926] PM: suspend entry (deep)
[ 23.293558] Filesystems sync: 0.000 seconds
[ 23.298010] Freezing user space processes
[ 23.302771] Freezing user space processes completed (elapsed 0.000 seconds)
[ 23.309766] OOM killer disabled.
[ 23.313027] Freezing remaining freezable tasks
[ 23.318540] Freezing remaining freezable tasks completed (elapsed 0.001 seconds)
[ 23.342038] serial 00:05: disabled
[ 23.345719] serial 00:02: disabled
[ 23.349342] serial 00:01: disabled
[ 23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache
[ 23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache
[ 23.361635] ata1.00: Entering standby power mode
[ 23.368863] ata2.00: Entering standby power mode
[ 23.445187] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 23.452194] #PF: supervisor instruction fetch in kernel mode
[ 23.457896] #PF: error_code(0x0010) - not-present page
[ 23.463065] PGD 0 P4D 0
[ 23.465640] Oops: Oops: 0010 [#1] SMP NOPTI
[ 23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S W 6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary)
[ 23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN
[ 23.496511] Workqueue: async async_run_entry_fn
[ 23.501087] RIP: 0010:0x0
[ 23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6.
[ 23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246
[ 23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f
[ 23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000
[ 23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff
[ 23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8
[ 23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68
[ 23.551457] FS: 0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000
[ 23.559588] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0
[ 23.572539] PKRU: 55555554
[ 23.575281] Call Trace:
[ 23.577770] <TASK>
[ 23.579905] intel_engines_reset_default_submission+0x42/0x60
[ 23.585695] __intel_gt_unset_wedged+0x191/0x200
[ 23.590360] intel_gt_unset_wedged+0x20/0x40
[ 23.594675] gt_sanitize+0x15e/0x170
[ 23.598290] i915_gem_suspend_late+0x6b/0x180
[ 23.602692] i915_drm_suspend_late+0x35/0xf0
[ 23.607008] ? __pfx_pci_pm_suspend_late+0x10/0x10
[ 23.611843] dpm_run_callback+0x78/0x1c0
[ 23.615817] device_suspend_late+0xde/0x2e0
[ 23.620037] async_suspend_late+0x18/0x30
[ 23.624082] async_run_entry_fn+0x25/0xa0
[ 23.628129] process_one_work+0x15b/0x380
[ 23.632182] worker_thread+0x2a5/0x3c0
[ 23.635973] ? __pfx_worker_thread+0x10/0x10
[ 23.640279] kthread+0xf6/0x1f0
[ 23.643464] ? __pfx_kthread+0x10/0x10
[ 23.647263] ? __pfx_kthread+0x10/0x10
[ 23.651045] ret_from_fork+0x131/0x190
[ 23.654837] ? __pfx_kthread+0x10/0x10
[ 23.658634] ret_from_fork_asm+0x1a/0x30
[ 23.662597] </TASK>
[ 23.664826] Modules linked in:
[ 23.667914] CR2: 0000000000000000
[ 23.671271] ------------[ cut here ]------------
(cherry picked from commit daa199abc3d3d1740c9e3a2c3e9216ae5b447cad)
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f Version: ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f Version: ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f Version: ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f Version: ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f Version: ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f Version: ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/gt/intel_engine_cs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "db8b1bebe81ffb410ddd746b6869f72e22420850",
"status": "affected",
"version": "ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f",
"versionType": "git"
},
{
"lessThan": "da6552d67012a1cf0585f2eb401d0c4abcf108c9",
"status": "affected",
"version": "ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f",
"versionType": "git"
},
{
"lessThan": "df1f4a7d9cf689b4e96c95255228896505f44c31",
"status": "affected",
"version": "ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f",
"versionType": "git"
},
{
"lessThan": "2e20a886b443a71b573ceaed3ca7053d15380916",
"status": "affected",
"version": "ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f",
"versionType": "git"
},
{
"lessThan": "cf4b224ffb9a58181be32b64130fc36cf59c3192",
"status": "affected",
"version": "ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f",
"versionType": "git"
},
{
"lessThan": "1a16150729db8d997e39519f9d58e6b435c4c087",
"status": "affected",
"version": "ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f",
"versionType": "git"
},
{
"lessThan": "0162ab3220bac870e43e229e6e3024d1a21c3f26",
"status": "affected",
"version": "ff44ad51ebf8e4693bd66ae41aa37a6bc88a134f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/gt/intel_engine_cs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/gt: Check set_default_submission() before deferencing\n\nWhen the i915 driver firmware binaries are not present, the\nset_default_submission pointer is not set. This pointer is\ndereferenced during suspend anyways.\n\nAdd a check to make sure it is set before dereferencing.\n\n[ 23.289926] PM: suspend entry (deep)\n[ 23.293558] Filesystems sync: 0.000 seconds\n[ 23.298010] Freezing user space processes\n[ 23.302771] Freezing user space processes completed (elapsed 0.000 seconds)\n[ 23.309766] OOM killer disabled.\n[ 23.313027] Freezing remaining freezable tasks\n[ 23.318540] Freezing remaining freezable tasks completed (elapsed 0.001 seconds)\n[ 23.342038] serial 00:05: disabled\n[ 23.345719] serial 00:02: disabled\n[ 23.349342] serial 00:01: disabled\n[ 23.353782] sd 0:0:0:0: [sda] Synchronizing SCSI cache\n[ 23.358993] sd 1:0:0:0: [sdb] Synchronizing SCSI cache\n[ 23.361635] ata1.00: Entering standby power mode\n[ 23.368863] ata2.00: Entering standby power mode\n[ 23.445187] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 23.452194] #PF: supervisor instruction fetch in kernel mode\n[ 23.457896] #PF: error_code(0x0010) - not-present page\n[ 23.463065] PGD 0 P4D 0\n[ 23.465640] Oops: Oops: 0010 [#1] SMP NOPTI\n[ 23.469869] CPU: 8 UID: 0 PID: 211 Comm: kworker/u48:18 Tainted: G S W 6.19.0-rc4-00020-gf0b9d8eb98df #10 PREEMPT(voluntary)\n[ 23.482512] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN\n[ 23.496511] Workqueue: async async_run_entry_fn\n[ 23.501087] RIP: 0010:0x0\n[ 23.503755] Code: Unable to access opcode bytes at 0xffffffffffffffd6.\n[ 23.510324] RSP: 0018:ffffb4a60065fca8 EFLAGS: 00010246\n[ 23.515592] RAX: 0000000000000000 RBX: ffff9f428290e000 RCX: 000000000000000f\n[ 23.522765] RDX: 0000000000000000 RSI: 0000000000000282 RDI: ffff9f428290e000\n[ 23.529937] RBP: ffff9f4282907070 R08: ffff9f4281130428 R09: 00000000ffffffff\n[ 23.537111] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f42829070f8\n[ 23.544284] R13: ffff9f4282906028 R14: ffff9f4282900000 R15: ffff9f4282906b68\n[ 23.551457] FS: 0000000000000000(0000) GS:ffff9f466b2cf000(0000) knlGS:0000000000000000\n[ 23.559588] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 23.565365] CR2: ffffffffffffffd6 CR3: 000000031c230001 CR4: 0000000000f70ef0\n[ 23.572539] PKRU: 55555554\n[ 23.575281] Call Trace:\n[ 23.577770] \u003cTASK\u003e\n[ 23.579905] intel_engines_reset_default_submission+0x42/0x60\n[ 23.585695] __intel_gt_unset_wedged+0x191/0x200\n[ 23.590360] intel_gt_unset_wedged+0x20/0x40\n[ 23.594675] gt_sanitize+0x15e/0x170\n[ 23.598290] i915_gem_suspend_late+0x6b/0x180\n[ 23.602692] i915_drm_suspend_late+0x35/0xf0\n[ 23.607008] ? __pfx_pci_pm_suspend_late+0x10/0x10\n[ 23.611843] dpm_run_callback+0x78/0x1c0\n[ 23.615817] device_suspend_late+0xde/0x2e0\n[ 23.620037] async_suspend_late+0x18/0x30\n[ 23.624082] async_run_entry_fn+0x25/0xa0\n[ 23.628129] process_one_work+0x15b/0x380\n[ 23.632182] worker_thread+0x2a5/0x3c0\n[ 23.635973] ? __pfx_worker_thread+0x10/0x10\n[ 23.640279] kthread+0xf6/0x1f0\n[ 23.643464] ? __pfx_kthread+0x10/0x10\n[ 23.647263] ? __pfx_kthread+0x10/0x10\n[ 23.651045] ret_from_fork+0x131/0x190\n[ 23.654837] ? __pfx_kthread+0x10/0x10\n[ 23.658634] ret_from_fork_asm+0x1a/0x30\n[ 23.662597] \u003c/TASK\u003e\n[ 23.664826] Modules linked in:\n[ 23.667914] CR2: 0000000000000000\n[ 23.671271] ------------[ cut here ]------------\n\n(cherry picked from commit daa199abc3d3d1740c9e3a2c3e9216ae5b447cad)"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:10:45.183Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/db8b1bebe81ffb410ddd746b6869f72e22420850"
},
{
"url": "https://git.kernel.org/stable/c/da6552d67012a1cf0585f2eb401d0c4abcf108c9"
},
{
"url": "https://git.kernel.org/stable/c/df1f4a7d9cf689b4e96c95255228896505f44c31"
},
{
"url": "https://git.kernel.org/stable/c/2e20a886b443a71b573ceaed3ca7053d15380916"
},
{
"url": "https://git.kernel.org/stable/c/cf4b224ffb9a58181be32b64130fc36cf59c3192"
},
{
"url": "https://git.kernel.org/stable/c/1a16150729db8d997e39519f9d58e6b435c4c087"
},
{
"url": "https://git.kernel.org/stable/c/0162ab3220bac870e43e229e6e3024d1a21c3f26"
}
],
"title": "drm/i915/gt: Check set_default_submission() before deferencing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31540",
"datePublished": "2026-04-24T14:33:09.705Z",
"dateReserved": "2026-03-09T15:48:24.114Z",
"dateUpdated": "2026-05-11T22:10:45.183Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46078 (GCVE-0-2026-46078)
Vulnerability from cvelistv5
Published
2026-05-27 12:58
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
erofs: fix the out-of-bounds nameoff handling for trailing dirents
Currently we already have boundary-checks for nameoffs, but the trailing
dirents are special since the namelens are calculated with strnlen()
with unchecked nameoffs.
If a crafted EROFS has a trailing dirent with nameoff >= maxsize,
maxsize - nameoff can underflow, causing strnlen() to read past the
directory block.
nameoff0 should also be verified to be a multiple of
`sizeof(struct erofs_dirent)` as well [1].
[1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3aa8ec716e52c02360457fa018296629b4d0becf Version: 3aa8ec716e52c02360457fa018296629b4d0becf Version: 3aa8ec716e52c02360457fa018296629b4d0becf Version: 3aa8ec716e52c02360457fa018296629b4d0becf Version: 3aa8ec716e52c02360457fa018296629b4d0becf Version: 3aa8ec716e52c02360457fa018296629b4d0becf Version: 3aa8ec716e52c02360457fa018296629b4d0becf Version: 3aa8ec716e52c02360457fa018296629b4d0becf |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/erofs/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a8ee527807f7d97e55ce2ef2906f7f34975eb1c7",
"status": "affected",
"version": "3aa8ec716e52c02360457fa018296629b4d0becf",
"versionType": "git"
},
{
"lessThan": "aa16dca1b062355181ef215229eeac249d7c0d61",
"status": "affected",
"version": "3aa8ec716e52c02360457fa018296629b4d0becf",
"versionType": "git"
},
{
"lessThan": "80a23c6d1aba35be8746d74ac14e6ba5ae46da21",
"status": "affected",
"version": "3aa8ec716e52c02360457fa018296629b4d0becf",
"versionType": "git"
},
{
"lessThan": "222055e6b4063abd2d9e13c3d49bbd1724c50789",
"status": "affected",
"version": "3aa8ec716e52c02360457fa018296629b4d0becf",
"versionType": "git"
},
{
"lessThan": "48b27a955d22391c7f30169fa7b6b2e1977f1ce4",
"status": "affected",
"version": "3aa8ec716e52c02360457fa018296629b4d0becf",
"versionType": "git"
},
{
"lessThan": "8ebb951a284b7446e025afc7dc5e9516ef9a7214",
"status": "affected",
"version": "3aa8ec716e52c02360457fa018296629b4d0becf",
"versionType": "git"
},
{
"lessThan": "1d55445226c75ddd4e78b09b3e7d99109b28c366",
"status": "affected",
"version": "3aa8ec716e52c02360457fa018296629b4d0becf",
"versionType": "git"
},
{
"lessThan": "d18a3b5d337fa412a38e776e6b4b857a58836575",
"status": "affected",
"version": "3aa8ec716e52c02360457fa018296629b4d0becf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/erofs/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix the out-of-bounds nameoff handling for trailing dirents\n\nCurrently we already have boundary-checks for nameoffs, but the trailing\ndirents are special since the namelens are calculated with strnlen()\nwith unchecked nameoffs.\n\nIf a crafted EROFS has a trailing dirent with nameoff \u003e= maxsize,\nmaxsize - nameoff can underflow, causing strnlen() to read past the\ndirectory block.\n\nnameoff0 should also be verified to be a multiple of\n`sizeof(struct erofs_dirent)` as well [1].\n\n[1] https://sashiko.dev/#/patchset/20260416063511.3173774-1-hsiangkao%40linux.alibaba.com"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is triggered by parsing a maliciously crafted EROFS filesystem image during a directory read; the data is processed locally after the image is presented (file/loop/removable media), with no network reachability for the readdir path.\nAC:L - An attacker fully controls the on-disk `nameoff` field of the trailing dirent in the crafted image, so the unsigned underflow and resulting out-of-bounds `strnlen` are reproduced deterministically every time the directory is read.\nPR:N - Once the crafted image is mounted, triggering the bug requires only an ordinary directory listing (getdents/readdir), which needs no special privileges; this matches the sibling crafted-image EROFS CVE-2026-43166.\nUI:R - EROFS lacks FS_USERNS_MOUNT and requires CAP_SYS_ADMIN to mount, so a separate user/automounter must mount the attacker-supplied image before the vulnerable readdir path can execute.\nS:U - The out-of-bounds access stays within the kernel\u0027s own memory and security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The underflowed length drives an unbounded `strnlen` that reads kernel memory far past the directory-block buffer; per the OOB-read guidance this unbounded read is High.\nI:N - The defect is strictly a read (strnlen over adjacent memory); no out-of-bounds write, use-after-free, or type confusion occurs, so no data can be modified.\nA:H - Scanning up to ~4 GB past the buffer readily walks into unmapped memory, producing a kernel oops/panic and denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:31.009Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a8ee527807f7d97e55ce2ef2906f7f34975eb1c7"
},
{
"url": "https://git.kernel.org/stable/c/aa16dca1b062355181ef215229eeac249d7c0d61"
},
{
"url": "https://git.kernel.org/stable/c/80a23c6d1aba35be8746d74ac14e6ba5ae46da21"
},
{
"url": "https://git.kernel.org/stable/c/222055e6b4063abd2d9e13c3d49bbd1724c50789"
},
{
"url": "https://git.kernel.org/stable/c/48b27a955d22391c7f30169fa7b6b2e1977f1ce4"
},
{
"url": "https://git.kernel.org/stable/c/8ebb951a284b7446e025afc7dc5e9516ef9a7214"
},
{
"url": "https://git.kernel.org/stable/c/1d55445226c75ddd4e78b09b3e7d99109b28c366"
},
{
"url": "https://git.kernel.org/stable/c/d18a3b5d337fa412a38e776e6b4b857a58836575"
}
],
"title": "erofs: fix the out-of-bounds nameoff handling for trailing dirents",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46078",
"datePublished": "2026-05-27T12:58:11.916Z",
"dateReserved": "2026-05-13T15:03:33.096Z",
"dateUpdated": "2026-08-05T12:29:31.009Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45946 (GCVE-0-2026-45946)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-05-27 12:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: supply: ab8500: Fix use-after-free in power_supply_changed()
Using the `devm_` variant for requesting IRQ _before_ the `devm_`
variant for allocating/registering the `power_supply` handle, means that
the `power_supply` handle will be deallocated/unregistered _before_ the
interrupt handler (since `devm_` naturally deallocates in reverse
allocation order). This means that during removal, there is a race
condition where an interrupt can fire just _after_ the `power_supply`
handle has been freed, *but* just _before_ the corresponding
unregistration of the IRQ handler has run.
This will lead to the IRQ handler calling `power_supply_changed()` with
a freed `power_supply` handle. Which usually crashes the system or
otherwise silently corrupts the memory...
Note that there is a similar situation which can also happen during
`probe()`; the possibility of an interrupt firing _before_ registering
the `power_supply` handle. This would then lead to the nasty situation
of using the `power_supply` handle *uninitialized* in
`power_supply_changed()`.
Commit 1c1f13a006ed ("power: supply: ab8500: Move to componentized
binding") introduced this issue during a refactorization. Fix this racy
use-after-free by making sure the IRQ is requested _after_ the
registration of the `power_supply` handle.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb Version: 1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb Version: 1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb Version: 1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb Version: 1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb Version: 1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb Version: 1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb Version: 341db343768bc44f3512facc464021730d64071c Version: 5.13.4 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/ab8500_charger.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "43cbb78ee047b9b12d096d40e3be265969d4c1f8",
"status": "affected",
"version": "1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb",
"versionType": "git"
},
{
"lessThan": "551672981fe227122258a25a385a05f5c0746ad6",
"status": "affected",
"version": "1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb",
"versionType": "git"
},
{
"lessThan": "f50433f2603def08b21a4bf2fd238687fb5cbde9",
"status": "affected",
"version": "1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb",
"versionType": "git"
},
{
"lessThan": "847eeb6c0efcd76c7def73857cf798a4fcd8f79b",
"status": "affected",
"version": "1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb",
"versionType": "git"
},
{
"lessThan": "709db4b476e254579d9c48ec34d397a41ca0c407",
"status": "affected",
"version": "1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb",
"versionType": "git"
},
{
"lessThan": "46dbda27b028d78087667e8280966b99cec015ca",
"status": "affected",
"version": "1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb",
"versionType": "git"
},
{
"lessThan": "c4af8a98bb52825a5331ae1d0604c0ea6956ba4b",
"status": "affected",
"version": "1c1f13a006ed0d71bb5664c8b7e3e77a28da3beb",
"versionType": "git"
},
{
"status": "affected",
"version": "341db343768bc44f3512facc464021730d64071c",
"versionType": "git"
},
{
"lessThan": "5.14",
"status": "affected",
"version": "5.13.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/ab8500_charger.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.13.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: ab8500: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nCommit 1c1f13a006ed (\"power: supply: ab8500: Move to componentized\nbinding\") introduced this issue during a refactorization. Fix this racy\nuse-after-free by making sure the IRQ is requested _after_ the\nregistration of the `power_supply` handle."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:18:02.708Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/43cbb78ee047b9b12d096d40e3be265969d4c1f8"
},
{
"url": "https://git.kernel.org/stable/c/551672981fe227122258a25a385a05f5c0746ad6"
},
{
"url": "https://git.kernel.org/stable/c/f50433f2603def08b21a4bf2fd238687fb5cbde9"
},
{
"url": "https://git.kernel.org/stable/c/847eeb6c0efcd76c7def73857cf798a4fcd8f79b"
},
{
"url": "https://git.kernel.org/stable/c/709db4b476e254579d9c48ec34d397a41ca0c407"
},
{
"url": "https://git.kernel.org/stable/c/46dbda27b028d78087667e8280966b99cec015ca"
},
{
"url": "https://git.kernel.org/stable/c/c4af8a98bb52825a5331ae1d0604c0ea6956ba4b"
}
],
"title": "power: supply: ab8500: Fix use-after-free in power_supply_changed()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45946",
"datePublished": "2026-05-27T12:18:02.708Z",
"dateReserved": "2026-05-13T15:03:33.088Z",
"dateUpdated": "2026-05-27T12:18:02.708Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53144 (GCVE-0-2026-53144)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-06-25 08:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: fix NULL dereference in get_queue_ids()
When usr_queue_id_array is NULL and num_queues is non-zero,
get_queue_ids() returns NULL. The callers check only IS_ERR() on the
return value; since IS_ERR(NULL) == false the check passes, and
suspend_queues() calls q_array_invalidate() which immediately
dereferences NULL while iterating num_queues times.
Userspace can trigger this via kfd_ioctl_set_debug_trap() by supplying
num_queues > 0 with a zero queue_array_ptr, causing a kernel panic.
A NULL usr_queue_id_array with num_queues == 0 is a legitimate no-op
(q_array_invalidate never executes, and resume_queues already guards
all queue_ids dereferences behind a NULL check). Return ERR_PTR(-EINVAL)
only when num_queues is non-zero and the pointer is absent; both callers
already propagate IS_ERR() returns correctly to userspace.
(cherry picked from commit f165a82cdf503884bb1797771c61b2fcc72113d4)
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "62bd09e23a23da70f9aae02748eba3e6bd93095d",
"status": "affected",
"version": "a70a93fa568b4f05aba548dadb673703eccf5480",
"versionType": "git"
},
{
"lessThan": "daeceb0fe2a19651c58bbfa3d9d515ecb6ca8996",
"status": "affected",
"version": "a70a93fa568b4f05aba548dadb673703eccf5480",
"versionType": "git"
},
{
"lessThan": "72e259a32084c42816152c346096d2edd4213e23",
"status": "affected",
"version": "a70a93fa568b4f05aba548dadb673703eccf5480",
"versionType": "git"
},
{
"lessThan": "e1965e8913cfbf17622ca12638e7a07f68ba0848",
"status": "affected",
"version": "a70a93fa568b4f05aba548dadb673703eccf5480",
"versionType": "git"
},
{
"lessThan": "2bd550b547deabef98bd3b017ff743b7c34d3a6d",
"status": "affected",
"version": "a70a93fa568b4f05aba548dadb673703eccf5480",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix NULL dereference in get_queue_ids()\n\nWhen usr_queue_id_array is NULL and num_queues is non-zero,\nget_queue_ids() returns NULL. The callers check only IS_ERR() on the\nreturn value; since IS_ERR(NULL) == false the check passes, and\nsuspend_queues() calls q_array_invalidate() which immediately\ndereferences NULL while iterating num_queues times.\n\nUserspace can trigger this via kfd_ioctl_set_debug_trap() by supplying\nnum_queues \u003e 0 with a zero queue_array_ptr, causing a kernel panic.\n\nA NULL usr_queue_id_array with num_queues == 0 is a legitimate no-op\n(q_array_invalidate never executes, and resume_queues already guards\nall queue_ids dereferences behind a NULL check). Return ERR_PTR(-EINVAL)\nonly when num_queues is non-zero and the pointer is absent; both callers\nalready propagate IS_ERR() returns correctly to userspace.\n\n(cherry picked from commit f165a82cdf503884bb1797771c61b2fcc72113d4)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:38:31.569Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/62bd09e23a23da70f9aae02748eba3e6bd93095d"
},
{
"url": "https://git.kernel.org/stable/c/daeceb0fe2a19651c58bbfa3d9d515ecb6ca8996"
},
{
"url": "https://git.kernel.org/stable/c/72e259a32084c42816152c346096d2edd4213e23"
},
{
"url": "https://git.kernel.org/stable/c/e1965e8913cfbf17622ca12638e7a07f68ba0848"
},
{
"url": "https://git.kernel.org/stable/c/2bd550b547deabef98bd3b017ff743b7c34d3a6d"
}
],
"title": "drm/amdkfd: fix NULL dereference in get_queue_ids()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53144",
"datePublished": "2026-06-25T08:38:31.569Z",
"dateReserved": "2026-06-09T07:44:35.387Z",
"dateUpdated": "2026-06-25T08:38:31.569Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46138 (GCVE-0-2026-46138)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt
hci_le_create_big_complete_evt() iterates over BT_BOUND connections for
a BIG handle using a while loop, accessing ev->bis_handle[i++] on each
iteration. However, there is no check that i stays within ev->num_bis
before the array access.
When a controller sends a LE_Create_BIG_Complete event with fewer
bis_handle entries than there are BT_BOUND connections for that BIG,
or with num_bis=0, the loop reads beyond the valid bis_handle[] flex
array into adjacent heap memory. Since the out-of-bounds values
typically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle()
rejects them and the connection remains in BT_BOUND state. The same
connection is then found again by hci_conn_hash_lookup_big_state(),
creating an infinite loop with hci_dev_lock held.
Fix this by terminating the BIG if in case not all BIS could be setup
properly.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a0bfde167b506423111ddb8cd71930497a40fc54 Version: a0bfde167b506423111ddb8cd71930497a40fc54 Version: a0bfde167b506423111ddb8cd71930497a40fc54 Version: a0bfde167b506423111ddb8cd71930497a40fc54 Version: a0bfde167b506423111ddb8cd71930497a40fc54 Version: b475c1109251e30ec21fb574d72a1c71a4ab0039 Version: 2ccde10127447c1a5caad8469fede945bdb62fdf Version: 6.4.16 ≤ Version: 6.5.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6cb7f67bc28da787499291a562d49a084d9c90cd",
"status": "affected",
"version": "a0bfde167b506423111ddb8cd71930497a40fc54",
"versionType": "git"
},
{
"lessThan": "22559ad7654f61727fc270ee4893da9f4b70cf17",
"status": "affected",
"version": "a0bfde167b506423111ddb8cd71930497a40fc54",
"versionType": "git"
},
{
"lessThan": "77981a507aa0fc001dc37f0dd6631dd2042fed17",
"status": "affected",
"version": "a0bfde167b506423111ddb8cd71930497a40fc54",
"versionType": "git"
},
{
"lessThan": "665da0baaf0396f9ed3c86ccb3955dcd0b73e774",
"status": "affected",
"version": "a0bfde167b506423111ddb8cd71930497a40fc54",
"versionType": "git"
},
{
"lessThan": "5ddb8014261137cadaf83ab5617a588d80a22586",
"status": "affected",
"version": "a0bfde167b506423111ddb8cd71930497a40fc54",
"versionType": "git"
},
{
"status": "affected",
"version": "b475c1109251e30ec21fb574d72a1c71a4ab0039",
"versionType": "git"
},
{
"status": "affected",
"version": "2ccde10127447c1a5caad8469fede945bdb62fdf",
"versionType": "git"
},
{
"lessThan": "6.5",
"status": "affected",
"version": "6.4.16",
"versionType": "semver"
},
{
"lessThan": "6.6",
"status": "affected",
"version": "6.5.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt\n\nhci_le_create_big_complete_evt() iterates over BT_BOUND connections for\na BIG handle using a while loop, accessing ev-\u003ebis_handle[i++] on each\niteration. However, there is no check that i stays within ev-\u003enum_bis\nbefore the array access.\n\nWhen a controller sends a LE_Create_BIG_Complete event with fewer\nbis_handle entries than there are BT_BOUND connections for that BIG,\nor with num_bis=0, the loop reads beyond the valid bis_handle[] flex\narray into adjacent heap memory. Since the out-of-bounds values\ntypically exceed HCI_CONN_HANDLE_MAX (0x0EFF), hci_conn_set_handle()\nrejects them and the connection remains in BT_BOUND state. The same\nconnection is then found again by hci_conn_hash_lookup_big_state(),\ncreating an infinite loop with hci_dev_lock held.\n\nFix this by terminating the BIG if in case not all BIS could be setup\nproperly."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable handler is in the Bluetooth ISO/BIS stack; per kernel CNA convention Bluetooth subsystem bugs are reachable by an attacker within Bluetooth radio range, i.e. the adjacent vector.\nAC:L - An event with num_bis=0 (or fewer bis_handle entries than bound connections) deterministically triggers the OOB read and the infinite loop; the OOB heap values reliably exceed HCI_CONN_HANDLE_MAX, so no uncontrolled condition is required.\nPR:N - Exploitation requires no privileges or credentials on the target host; the malformed BIG-complete event is processed without any authentication gate.\nUI:N - No victim interaction is needed at exploit time \u2014 the device merely has to be operating as a BIS broadcaster, which is a configuration state, not a per-attack user action.\nS:U - The OOB read and the hang are confined to the kernel\u0027s own security authority; no boundary such as a VM/hypervisor or IOMMU is crossed.\nC:H - The loop reads the bis_handle[] flex array out of bounds into adjacent heap memory (up to ~512 bytes), well beyond a few bounded bytes, which under kernel guidance is scored High.\nI:N - The bug path performs only an out-of-bounds read and a spinning lookup; there is no out-of-bounds write or memory corruption that modifies kernel state.\nA:H - The OOB values keep the connection in BT_BOUND, producing an infinite loop while hci_dev_lock is held, which hangs the HCI device and causes a denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:00.334Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6cb7f67bc28da787499291a562d49a084d9c90cd"
},
{
"url": "https://git.kernel.org/stable/c/22559ad7654f61727fc270ee4893da9f4b70cf17"
},
{
"url": "https://git.kernel.org/stable/c/77981a507aa0fc001dc37f0dd6631dd2042fed17"
},
{
"url": "https://git.kernel.org/stable/c/665da0baaf0396f9ed3c86ccb3955dcd0b73e774"
},
{
"url": "https://git.kernel.org/stable/c/5ddb8014261137cadaf83ab5617a588d80a22586"
}
],
"title": "Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46138",
"datePublished": "2026-05-28T09:35:54.467Z",
"dateReserved": "2026-05-13T15:03:33.100Z",
"dateUpdated": "2026-08-05T12:30:00.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43213 (GCVE-0-2026-43213)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: pci: validate sequence number of TX release report
Hardware rarely reports abnormal sequence number in TX release report,
which will access out-of-bounds of wd_ring->pages array, causing NULL
pointer dereference.
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S U
6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1)
Call Trace:
<IRQ>
rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)]
rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)]
net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759
handle_softirqs+0xbe/0x290 kernel/softirq.c:601
? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)]
__local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423
</IRQ>
<TASK>
rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)]
? irq_thread+0xa7/0x340 kernel/irq/manage.c:0
irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314
? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202
? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220
kthread+0xea/0x110 kernel/kthread.c:376
? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287
? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
To prevent crash, validate rpp_info.seq before using.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw89/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ef7fa19809b2d892d45da53f90ac698d13c367fd",
"status": "affected",
"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd",
"versionType": "git"
},
{
"lessThan": "b342dd13aedccb0dd27365f6cc63a262f42394ce",
"status": "affected",
"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd",
"versionType": "git"
},
{
"lessThan": "957eda596c7665f2966970fd1dcc35fe299b38e8",
"status": "affected",
"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw89/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: pci: validate sequence number of TX release report\n\nHardware rarely reports abnormal sequence number in TX release report,\nwhich will access out-of-bounds of wd_ring-\u003epages array, causing NULL\npointer dereference.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 1 PID: 1085 Comm: irq/129-rtw89_p Tainted: G S U\n 6.1.145-17510-g2f3369c91536 #1 (HASH:69e8 1)\n Call Trace:\n \u003cIRQ\u003e\n rtw89_pci_release_tx+0x18f/0x300 [rtw89_pci (HASH:4c83 2)]\n rtw89_pci_napi_poll+0xc2/0x190 [rtw89_pci (HASH:4c83 2)]\n net_rx_action+0xfc/0x460 net/core/dev.c:6578 net/core/dev.c:6645 net/core/dev.c:6759\n handle_softirqs+0xbe/0x290 kernel/softirq.c:601\n ? rtw89_pci_interrupt_threadfn+0xc5/0x350 [rtw89_pci (HASH:4c83 2)]\n __local_bh_enable_ip+0xeb/0x120 kernel/softirq.c:499 kernel/softirq.c:423\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n rtw89_pci_interrupt_threadfn+0xf8/0x350 [rtw89_pci (HASH:4c83 2)]\n ? irq_thread+0xa7/0x340 kernel/irq/manage.c:0\n irq_thread+0x177/0x340 kernel/irq/manage.c:1205 kernel/irq/manage.c:1314\n ? thaw_kernel_threads+0xb0/0xb0 kernel/irq/manage.c:1202\n ? irq_forced_thread_fn+0x80/0x80 kernel/irq/manage.c:1220\n kthread+0xea/0x110 kernel/kthread.c:376\n ? synchronize_irq+0x1a0/0x1a0 kernel/irq/manage.c:1287\n ? kthread_associate_blkcg+0x80/0x80 kernel/kthread.c:331\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295\n \u003c/TASK\u003e\n\nTo prevent crash, validate rpp_info.seq before using."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable path is the rtw89 PCI WiFi TX release-report path reached from the device RPQ interrupt/NAPI handler after wireless transmissions. In AP or client deployments, an unauthenticated radio-range attacker can plausibly induce repeated TX completions by injecting or eliciting WiFi traffic.\nAC:H - The code path is deterministic once a malformed release report with an out-of-range sequence number is produced. However, the malformed sequence is described as a rare hardware/firmware report and is not directly chosen by the attacker.\nPR:N - In the adjacent WiFi attack scenario, the attacker does not need local accounts, capabilities, or authenticated access to the target host. Radio proximity is sufficient to stimulate the vulnerable TX completion path.\nUI:N - No victim action is required once the affected WiFi interface is active. The vulnerable processing occurs asynchronously in interrupt/NAPI context.\nS:U - The impact remains within the kernel and the affected host. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The invalid 15-bit sequence number indexes past the 512-entry wd_ring-\u003epages array and causes adjacent kernel memory to be interpreted as TX descriptor/list/queue state. Conservatively, this out-of-bounds kernel memory access can expose sensitive kernel memory even though the observed failure is a NULL dereference.\nI:H - The out-of-bounds pseudo-TX descriptor can drive list, skb queue, DMA-unmap, status, and enqueue operations using invalid pointer fields. Conservatively, this kernel memory corruption can permit high-integrity impact.\nA:H - The fix commit documents a kernel NULL pointer dereference and oops in rtw89_pci_release_tx from this bug. A kernel crash or panic is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:38.601Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ef7fa19809b2d892d45da53f90ac698d13c367fd"
},
{
"url": "https://git.kernel.org/stable/c/b342dd13aedccb0dd27365f6cc63a262f42394ce"
},
{
"url": "https://git.kernel.org/stable/c/957eda596c7665f2966970fd1dcc35fe299b38e8"
}
],
"title": "wifi: rtw89: pci: validate sequence number of TX release report",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43213",
"datePublished": "2026-05-06T11:28:15.998Z",
"dateReserved": "2026-05-01T14:12:55.993Z",
"dateUpdated": "2026-08-05T12:26:38.601Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45853 (GCVE-0-2026-45853)
Vulnerability from cvelistv5
Published
2026-05-27 12:15
Modified
2026-05-27 12:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()
amdgpu_discovery_get_nps_info() internally allocates memory for ranges
using kvcalloc(), which may use vmalloc() for large allocation. Using
kfree() to release vmalloc memory will lead to a memory corruption.
Use kvfree() to safely handle both kmalloc and vmalloc allocations.
Compile tested only. Issue found using a prototype static analysis tool
and code review.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "16e7e7ad8cdc6b4c4af7f31e262f1494c1b2a55e",
"status": "affected",
"version": "b194d21b9bcc15b50df1bc3ff7428e51c2918a6f",
"versionType": "git"
},
{
"lessThan": "9ae85b0c1909b6c6bfd2636b04cdaf7f520bf2b5",
"status": "affected",
"version": "b194d21b9bcc15b50df1bc3ff7428e51c2918a6f",
"versionType": "git"
},
{
"lessThan": "f441538893eba6347b983f2904819ca6c99da65e",
"status": "affected",
"version": "b194d21b9bcc15b50df1bc3ff7428e51c2918a6f",
"versionType": "git"
},
{
"lessThan": "0c44d61945c4a80775292d96460aa2f22e62f86c",
"status": "affected",
"version": "b194d21b9bcc15b50df1bc3ff7428e51c2918a6f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()\n\namdgpu_discovery_get_nps_info() internally allocates memory for ranges\nusing kvcalloc(), which may use vmalloc() for large allocation. Using\nkfree() to release vmalloc memory will lead to a memory corruption.\n\nUse kvfree() to safely handle both kmalloc and vmalloc allocations.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:15:27.453Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/16e7e7ad8cdc6b4c4af7f31e262f1494c1b2a55e"
},
{
"url": "https://git.kernel.org/stable/c/9ae85b0c1909b6c6bfd2636b04cdaf7f520bf2b5"
},
{
"url": "https://git.kernel.org/stable/c/f441538893eba6347b983f2904819ca6c99da65e"
},
{
"url": "https://git.kernel.org/stable/c/0c44d61945c4a80775292d96460aa2f22e62f86c"
}
],
"title": "drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45853",
"datePublished": "2026-05-27T12:15:27.453Z",
"dateReserved": "2026-05-13T15:03:33.079Z",
"dateUpdated": "2026-05-27T12:15:27.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43007 (GCVE-0-2026-43007)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-05-11 22:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/qaic: Handle DBC deactivation if the owner went away
When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV
transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles
this by calling decode_deactivate() to release the resources allocated for
that DBC. Since that handling is done in the qaic_manage_ioctl() context,
if the user goes away before receiving and handling the deactivation, the
host will be out-of-sync with the DBCs available for use, and the DBC
resources will not be freed unless the device is removed. If another user
loads and requests to activate a network, then the device assigns the same
DBC to that network, QAIC will "indefinitely" wait for dbc->in_use = false,
leading the user process to hang.
As a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions
that are received after the user has gone away.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/qaic/qaic_control.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2dd67966f39a2abf8ccb4865031c722e40e01b7f",
"status": "affected",
"version": "129776ac2e38231fa9c02ce20e116c99de291666",
"versionType": "git"
},
{
"lessThan": "08021f2d4a557d6491e3bcc288e96425f50aa3cf",
"status": "affected",
"version": "129776ac2e38231fa9c02ce20e116c99de291666",
"versionType": "git"
},
{
"lessThan": "f403094d9075d7c565a3d81002b781c325cb3c07",
"status": "affected",
"version": "129776ac2e38231fa9c02ce20e116c99de291666",
"versionType": "git"
},
{
"lessThan": "ee0180e77e6c8482644569632065411de844c515",
"status": "affected",
"version": "129776ac2e38231fa9c02ce20e116c99de291666",
"versionType": "git"
},
{
"lessThan": "2feec5ae5df785658924ab6bd91280dc3926507c",
"status": "affected",
"version": "129776ac2e38231fa9c02ce20e116c99de291666",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/qaic/qaic_control.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Handle DBC deactivation if the owner went away\n\nWhen a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV\ntransaction to the host over the QAIC_CONTROL MHI channel. QAIC handles\nthis by calling decode_deactivate() to release the resources allocated for\nthat DBC. Since that handling is done in the qaic_manage_ioctl() context,\nif the user goes away before receiving and handling the deactivation, the\nhost will be out-of-sync with the DBCs available for use, and the DBC\nresources will not be freed unless the device is removed. If another user\nloads and requests to activate a network, then the device assigns the same\nDBC to that network, QAIC will \"indefinitely\" wait for dbc-\u003ein_use = false,\nleading the user process to hang.\n\nAs a solution to this, handle QAIC_TRANS_DEACTIVATE_FROM_DEV transactions\nthat are received after the user has gone away."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:15:54.042Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2dd67966f39a2abf8ccb4865031c722e40e01b7f"
},
{
"url": "https://git.kernel.org/stable/c/08021f2d4a557d6491e3bcc288e96425f50aa3cf"
},
{
"url": "https://git.kernel.org/stable/c/f403094d9075d7c565a3d81002b781c325cb3c07"
},
{
"url": "https://git.kernel.org/stable/c/ee0180e77e6c8482644569632065411de844c515"
},
{
"url": "https://git.kernel.org/stable/c/2feec5ae5df785658924ab6bd91280dc3926507c"
}
],
"title": "accel/qaic: Handle DBC deactivation if the owner went away",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43007",
"datePublished": "2026-05-01T14:15:14.914Z",
"dateReserved": "2026-05-01T14:12:55.974Z",
"dateUpdated": "2026-05-11T22:15:54.042Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31619 (GCVE-0-2026-31619)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: fireworks: bound device-supplied status before string array lookup
The status field in an EFW response is a 32-bit value supplied by the
firewire device. efr_status_names[] has 17 entries so a status value
outside that range goes off into the weeds when looking at the %s value.
Even worse, the status could return EFR_STATUS_INCOMPLETE which is
0x80000000, and is obviously not in that array of potential strings.
Fix this up by properly bounding the index against the array size and
printing "unknown" if it's not recognized.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bde8a8f23bbe6db51fa4e81644273af18fef3d7a Version: bde8a8f23bbe6db51fa4e81644273af18fef3d7a Version: bde8a8f23bbe6db51fa4e81644273af18fef3d7a Version: bde8a8f23bbe6db51fa4e81644273af18fef3d7a Version: bde8a8f23bbe6db51fa4e81644273af18fef3d7a Version: bde8a8f23bbe6db51fa4e81644273af18fef3d7a Version: bde8a8f23bbe6db51fa4e81644273af18fef3d7a Version: bde8a8f23bbe6db51fa4e81644273af18fef3d7a Version: bde8a8f23bbe6db51fa4e81644273af18fef3d7a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/firewire/fireworks/fireworks_command.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "183aa0de0f680496b9feb85c9d182681ad4600dd",
"status": "affected",
"version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a",
"versionType": "git"
},
{
"lessThan": "62fcb273fbee5b2a0e7ed41cc914c8d7d1a5d285",
"status": "affected",
"version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a",
"versionType": "git"
},
{
"lessThan": "327f8e730e3c65ec97df9d3b07de66aeb3dc932d",
"status": "affected",
"version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a",
"versionType": "git"
},
{
"lessThan": "f856f4b6efd51be7950e4b84c06cd961961ca41c",
"status": "affected",
"version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a",
"versionType": "git"
},
{
"lessThan": "e103f98f6615ed2934e9cf340654f0cad9eb8a8a",
"status": "affected",
"version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a",
"versionType": "git"
},
{
"lessThan": "67cfd14074cdafab5de3f7cfc0952c1a9b653e5d",
"status": "affected",
"version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a",
"versionType": "git"
},
{
"lessThan": "cc624b3d2be13297100539b64ad950695188e046",
"status": "affected",
"version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a",
"versionType": "git"
},
{
"lessThan": "682d8accf0d83a871e8c327b95c81f53902c922b",
"status": "affected",
"version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a",
"versionType": "git"
},
{
"lessThan": "07704bbf36f57e4379e4cadf96410dab14621e3b",
"status": "affected",
"version": "bde8a8f23bbe6db51fa4e81644273af18fef3d7a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/firewire/fireworks/fireworks_command.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: fireworks: bound device-supplied status before string array lookup\n\nThe status field in an EFW response is a 32-bit value supplied by the\nfirewire device. efr_status_names[] has 17 entries so a status value\noutside that range goes off into the weeds when looking at the %s value.\n\nEven worse, the status could return EFR_STATUS_INCOMPLETE which is\n0x80000000, and is obviously not in that array of potential strings.\n\nFix this up by properly bounding the index against the array size and\nprinting \"unknown\" if it\u0027s not recognized."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:43:05.168Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/183aa0de0f680496b9feb85c9d182681ad4600dd"
},
{
"url": "https://git.kernel.org/stable/c/62fcb273fbee5b2a0e7ed41cc914c8d7d1a5d285"
},
{
"url": "https://git.kernel.org/stable/c/327f8e730e3c65ec97df9d3b07de66aeb3dc932d"
},
{
"url": "https://git.kernel.org/stable/c/f856f4b6efd51be7950e4b84c06cd961961ca41c"
},
{
"url": "https://git.kernel.org/stable/c/e103f98f6615ed2934e9cf340654f0cad9eb8a8a"
},
{
"url": "https://git.kernel.org/stable/c/67cfd14074cdafab5de3f7cfc0952c1a9b653e5d"
},
{
"url": "https://git.kernel.org/stable/c/cc624b3d2be13297100539b64ad950695188e046"
},
{
"url": "https://git.kernel.org/stable/c/682d8accf0d83a871e8c327b95c81f53902c922b"
},
{
"url": "https://git.kernel.org/stable/c/07704bbf36f57e4379e4cadf96410dab14621e3b"
}
],
"title": "ALSA: fireworks: bound device-supplied status before string array lookup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31619",
"datePublished": "2026-04-24T14:42:37.944Z",
"dateReserved": "2026-03-09T15:48:24.123Z",
"dateUpdated": "2026-06-14T17:43:05.168Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52964 (GCVE-0-2026-52964)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-06-24 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans
The USB MIDI 2.0 endpoint parser has the same descriptor walking
pattern as the legacy MIDI parser. It validates bLength against
bNumGrpTrmBlock before reading baAssoGrpTrmBlkID[], but not against the
remaining bytes in the endpoint-extra scan.
A malformed device can therefore make later baAssoGrpTrmBlkID[] reads
consume bytes past the walked descriptor.
Reject zero-length and overlong descriptors while walking endpoint
extras.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/midi2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fafc97bd01e4c737eaeafadfdadb1af4bbfa7307",
"status": "affected",
"version": "ff49d1df79aef7580fe3ac99d17c3f886655d080",
"versionType": "git"
},
{
"lessThan": "a310b4bebda5e4a1b26520c0cc5145ccd6d617e2",
"status": "affected",
"version": "ff49d1df79aef7580fe3ac99d17c3f886655d080",
"versionType": "git"
},
{
"lessThan": "f9c184a83574549a36ea69b755f650e57d164c78",
"status": "affected",
"version": "ff49d1df79aef7580fe3ac99d17c3f886655d080",
"versionType": "git"
},
{
"lessThan": "17e76b19de1aff5ff4de64d269290bd1b07a01d3",
"status": "affected",
"version": "ff49d1df79aef7580fe3ac99d17c3f886655d080",
"versionType": "git"
},
{
"lessThan": "918be519c7876329e1b6e2ea1c59f0b75e792dca",
"status": "affected",
"version": "ff49d1df79aef7580fe3ac99d17c3f886655d080",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/midi2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans\n\nThe USB MIDI 2.0 endpoint parser has the same descriptor walking\npattern as the legacy MIDI parser. It validates bLength against\nbNumGrpTrmBlock before reading baAssoGrpTrmBlkID[], but not against the\nremaining bytes in the endpoint-extra scan.\n\nA malformed device can therefore make later baAssoGrpTrmBlkID[] reads\nconsume bytes past the walked descriptor.\n\nReject zero-length and overlong descriptors while walking endpoint\nextras."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:28:44.345Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fafc97bd01e4c737eaeafadfdadb1af4bbfa7307"
},
{
"url": "https://git.kernel.org/stable/c/a310b4bebda5e4a1b26520c0cc5145ccd6d617e2"
},
{
"url": "https://git.kernel.org/stable/c/f9c184a83574549a36ea69b755f650e57d164c78"
},
{
"url": "https://git.kernel.org/stable/c/17e76b19de1aff5ff4de64d269290bd1b07a01d3"
},
{
"url": "https://git.kernel.org/stable/c/918be519c7876329e1b6e2ea1c59f0b75e792dca"
}
],
"title": "ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52964",
"datePublished": "2026-06-24T16:28:44.345Z",
"dateReserved": "2026-06-09T07:44:35.374Z",
"dateUpdated": "2026-06-24T16:28:44.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52957 (GCVE-0-2026-52957)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential null-ptr-deref in decode_choose_args()
A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself
contains a CRUSH map. When decoding this CRUSH map in crush_decode(), an
array of max_buckets CRUSH buckets is decoded, where some indices may
not refer to actual buckets and are therefore set to NULL. The received
CRUSH map may optionally contain choose_args that get decoded in
decode_choose_args(). When decoding a crush_choose_arg_map, a series of
choose_args for different buckets is decoded, with the bucket_index
being read from the incoming message. It is only checked that the bucket
index does not exceed max_buckets, but not that it doesn't point to an
index with a NULL bucket. If a (potentially corrupted) message contains
a crush_choose_arg_map including such a bucket_index, a null pointer
dereference may occur in the subsequent processing when attempting to
access the bucket with the given index.
This patch fixes the issue by extending the affected check. Now, it is
only attempted to access the bucket if it is not NULL.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 Version: c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 Version: c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 Version: c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 Version: c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 Version: c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 Version: c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 Version: c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d55ffad8d422b5d1cc44dad32bd3d25f4471cd9f",
"status": "affected",
"version": "c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5",
"versionType": "git"
},
{
"lessThan": "301286c0ccd37d66b0e40786fd35a4f19cdbd88a",
"status": "affected",
"version": "c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5",
"versionType": "git"
},
{
"lessThan": "7169f326a23d0f547fcd90e68b72fd387622e126",
"status": "affected",
"version": "c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5",
"versionType": "git"
},
{
"lessThan": "d7a65a34d2453f8cd3e0cc0e1319740af7e24276",
"status": "affected",
"version": "c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5",
"versionType": "git"
},
{
"lessThan": "312ec973efac0efb9b9ed64214235910e9ecbaa8",
"status": "affected",
"version": "c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5",
"versionType": "git"
},
{
"lessThan": "f2f95e6d4b97e70bb876139b0583fc8079983f85",
"status": "affected",
"version": "c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5",
"versionType": "git"
},
{
"lessThan": "a20e16ebfe2fa65348eb4b2dc7deac330ce03e9c",
"status": "affected",
"version": "c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5",
"versionType": "git"
},
{
"lessThan": "28b0a2ab8c82d0bbdeb8013029c67c978ce6e4bf",
"status": "affected",
"version": "c7ed1a4bf4b446317eefa0f4916d94b1f6d3ada5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential null-ptr-deref in decode_choose_args()\n\nA message of type CEPH_MSG_OSD_MAP contains an OSD map that itself\ncontains a CRUSH map. When decoding this CRUSH map in crush_decode(), an\narray of max_buckets CRUSH buckets is decoded, where some indices may\nnot refer to actual buckets and are therefore set to NULL. The received\nCRUSH map may optionally contain choose_args that get decoded in\ndecode_choose_args(). When decoding a crush_choose_arg_map, a series of\nchoose_args for different buckets is decoded, with the bucket_index\nbeing read from the incoming message. It is only checked that the bucket\nindex does not exceed max_buckets, but not that it doesn\u0027t point to an\nindex with a NULL bucket. If a (potentially corrupted) message contains\na crush_choose_arg_map including such a bucket_index, a null pointer\ndereference may occur in the subsequent processing when attempting to\naccess the bucket with the given index.\n\nThis patch fixes the issue by extending the affected check. Now, it is\nonly attempted to access the bucket if it is not NULL."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - CEPH_MSG_OSD_MAP is received over Ceph monitor or OSD network connections and decoded by the kernel client. The vulnerable path is network message processing: messenger receive -\u003e ceph_osdc_handle_map() -\u003e ceph_osdmap_decode()/osdmap_apply_incremental() -\u003e crush_decode() -\u003e decode_choose_args().\nAC:L - The attacker-controlled map can directly select a bucket_index within max_buckets whose bucket slot was decoded as NULL and set ids_size nonzero. No race or condition outside the sending peer\u0027s control is required.\nPR:N - The message must pass the established Ceph connection/authentication and FSID gates, but a malicious or compromised Ceph peer needs no privileges on the vulnerable Linux system. Auth-none deployments and attacker-controlled Ceph peers make PR:N the highest defensible choice.\nUI:N - Once the kernel client is connected to the Ceph cluster, OSD map updates are processed asynchronously without a user opening a file or performing another action. A malicious peer can send the malformed map as normal cluster traffic.\nS:U - The impact is within the same vulnerable kernel security authority. This is not a VM escape, IOMMU bypass, or cross-scope sandbox escape.\nC:N - The bug is a NULL pointer dereference while reading c-\u003ebuckets[bucket_index]-\u003esize. It does not provide a data disclosure primitive.\nI:N - The vulnerable operation is not a write, UAF, type confusion, or controllable memory corruption. No integrity impact is supported beyond crashing the kernel.\nA:H - Dereferencing the NULL bucket pointer can trigger a kernel oops or panic while processing a malformed OSD/CRUSH map. That is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:07.425Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d55ffad8d422b5d1cc44dad32bd3d25f4471cd9f"
},
{
"url": "https://git.kernel.org/stable/c/301286c0ccd37d66b0e40786fd35a4f19cdbd88a"
},
{
"url": "https://git.kernel.org/stable/c/7169f326a23d0f547fcd90e68b72fd387622e126"
},
{
"url": "https://git.kernel.org/stable/c/d7a65a34d2453f8cd3e0cc0e1319740af7e24276"
},
{
"url": "https://git.kernel.org/stable/c/312ec973efac0efb9b9ed64214235910e9ecbaa8"
},
{
"url": "https://git.kernel.org/stable/c/f2f95e6d4b97e70bb876139b0583fc8079983f85"
},
{
"url": "https://git.kernel.org/stable/c/a20e16ebfe2fa65348eb4b2dc7deac330ce03e9c"
},
{
"url": "https://git.kernel.org/stable/c/28b0a2ab8c82d0bbdeb8013029c67c978ce6e4bf"
}
],
"title": "libceph: Fix potential null-ptr-deref in decode_choose_args()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52957",
"datePublished": "2026-06-24T16:28:39.066Z",
"dateReserved": "2026-06-09T07:44:35.373Z",
"dateUpdated": "2026-08-05T12:32:07.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43283 (GCVE-0-2026-43283)
Vulnerability from cvelistv5
Published
2026-05-06 11:29
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle
dma_free_coherent() in error path takes priv->rx_buf.alloc_len as
the dma handle. This would lead to improper unmapping of the buffer.
Change the dma handle to priv->rx_buf.alloc_phys.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6af55ff52b02d492d45db88df3e461fa51a6f753 Version: 6af55ff52b02d492d45db88df3e461fa51a6f753 Version: 6af55ff52b02d492d45db88df3e461fa51a6f753 Version: 6af55ff52b02d492d45db88df3e461fa51a6f753 Version: 6af55ff52b02d492d45db88df3e461fa51a6f753 Version: 6af55ff52b02d492d45db88df3e461fa51a6f753 Version: 6af55ff52b02d492d45db88df3e461fa51a6f753 Version: 6af55ff52b02d492d45db88df3e461fa51a6f753 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/ec_bhf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f589ee54fd6d76d3f75e745f7f12c64cbd749e5",
"status": "affected",
"version": "6af55ff52b02d492d45db88df3e461fa51a6f753",
"versionType": "git"
},
{
"lessThan": "accd0599bc8e73b962247c6c6c70ca7aa1f8e8d0",
"status": "affected",
"version": "6af55ff52b02d492d45db88df3e461fa51a6f753",
"versionType": "git"
},
{
"lessThan": "8320727be7ff704e07c87624efc2a4a75f54b3ce",
"status": "affected",
"version": "6af55ff52b02d492d45db88df3e461fa51a6f753",
"versionType": "git"
},
{
"lessThan": "1e300c33ef3cc544c2b9c693778fe9490cfe9184",
"status": "affected",
"version": "6af55ff52b02d492d45db88df3e461fa51a6f753",
"versionType": "git"
},
{
"lessThan": "1b1371cd4032ae859838ebc74215f569987bb197",
"status": "affected",
"version": "6af55ff52b02d492d45db88df3e461fa51a6f753",
"versionType": "git"
},
{
"lessThan": "1b1d3c5d58a80a19d017a409aa2308162bab5bbf",
"status": "affected",
"version": "6af55ff52b02d492d45db88df3e461fa51a6f753",
"versionType": "git"
},
{
"lessThan": "7e54ff938bebb173822b4c38b33fc164c1cabf92",
"status": "affected",
"version": "6af55ff52b02d492d45db88df3e461fa51a6f753",
"versionType": "git"
},
{
"lessThan": "ffe68c3766997d82e9ccaf1cdbd47eba269c4aa2",
"status": "affected",
"version": "6af55ff52b02d492d45db88df3e461fa51a6f753",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/ec_bhf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ec_bhf: Fix dma_free_coherent() dma handle\n\ndma_free_coherent() in error path takes priv-\u003erx_buf.alloc_len as\nthe dma handle. This would lead to improper unmapping of the buffer.\n\nChange the dma handle to priv-\u003erx_buf.alloc_phys."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached by local netdevice administration via RTM_SETLINK or SIOCSIFFLAGS setting IFF_UP, which calls ec_bhf_open(). Received EtherCAT packets do not directly reach the bad dma_free_coherent() error path.\nAC:L - An attacker who can administer the netdev can repeatedly attempt link-up under memory pressure until TX coherent allocation fails after RX allocation succeeds. No race or external timing condition is required.\nPR:L - The path requires CAP_NET_ADMIN in the owning network namespace, and this physical netdev is movable because the driver does not mark it netns_immutable. In a reasonable delegated/container netns deployment, namespace admin privileges are sufficient.\nUI:N - No separate victim interaction is needed once the attacker has access to the local netlink/ioctl control path. The attacker can trigger the open error path directly with link-up attempts.\nS:C - The wrong DMA handle can leave a stale DMA/IOMMU mapping or free the wrong physical pages, allowing device DMA beyond the intended lifetime of the RX buffer. This crosses the intended DMA isolation boundary.\nC:H - Stale DMA access or freeing the wrong in-use pages can expose reused kernel memory through memory corruption. As a DMA lifetime/memory corruption issue, high confidentiality impact is defensible.\nI:H - The bug can let the device write received data into freed or incorrectly freed kernel memory, creating a kernel memory corruption primitive. Such corruption is potentially usable for arbitrary kernel memory modification or code execution.\nA:H - Passing an invalid DMA handle to dma_free_coherent() can corrupt allocator/IOMMU state or free the wrong pages. At minimum this can cause kernel warnings, oopses, or panics."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:03.376Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f589ee54fd6d76d3f75e745f7f12c64cbd749e5"
},
{
"url": "https://git.kernel.org/stable/c/accd0599bc8e73b962247c6c6c70ca7aa1f8e8d0"
},
{
"url": "https://git.kernel.org/stable/c/8320727be7ff704e07c87624efc2a4a75f54b3ce"
},
{
"url": "https://git.kernel.org/stable/c/1e300c33ef3cc544c2b9c693778fe9490cfe9184"
},
{
"url": "https://git.kernel.org/stable/c/1b1371cd4032ae859838ebc74215f569987bb197"
},
{
"url": "https://git.kernel.org/stable/c/1b1d3c5d58a80a19d017a409aa2308162bab5bbf"
},
{
"url": "https://git.kernel.org/stable/c/7e54ff938bebb173822b4c38b33fc164c1cabf92"
},
{
"url": "https://git.kernel.org/stable/c/ffe68c3766997d82e9ccaf1cdbd47eba269c4aa2"
}
],
"title": "net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43283",
"datePublished": "2026-05-06T11:29:03.726Z",
"dateReserved": "2026-05-01T14:12:55.998Z",
"dateUpdated": "2026-08-05T12:27:03.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46037 (GCVE-0-2026-46037)
Vulnerability from cvelistv5
Published
2026-05-27 12:56
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: icmp: validate reply type before using icmp_pointers
Extended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type.
That value is outside the range covered by icmp_pointers[], which only
describes the traditional ICMP types up to NR_ICMP_TYPES.
Avoid consulting icmp_pointers[] for reply types outside that range, and
use array_index_nospec() for the remaining in-range lookup. Normal ICMP
replies keep their existing behavior unchanged.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d329ea5bd8845f0b196bf41b18b6173340d6e0e4 Version: d329ea5bd8845f0b196bf41b18b6173340d6e0e4 Version: d329ea5bd8845f0b196bf41b18b6173340d6e0e4 Version: d329ea5bd8845f0b196bf41b18b6173340d6e0e4 Version: d329ea5bd8845f0b196bf41b18b6173340d6e0e4 Version: d329ea5bd8845f0b196bf41b18b6173340d6e0e4 Version: d329ea5bd8845f0b196bf41b18b6173340d6e0e4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/icmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b3a88fc5ae024d43c5ecf653f3bbe837e4a6dc99",
"status": "affected",
"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4",
"versionType": "git"
},
{
"lessThan": "93df2af4f491de33827550b9d420f01808c0706b",
"status": "affected",
"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4",
"versionType": "git"
},
{
"lessThan": "92e7c209036dcc0e8ffdf806fdfd3645b263bea5",
"status": "affected",
"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4",
"versionType": "git"
},
{
"lessThan": "bc64a66e0b9ad937d3d49934242ee62b01ba9a94",
"status": "affected",
"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4",
"versionType": "git"
},
{
"lessThan": "c2178ff1c70ebfc2ab9651b230c58a34683db759",
"status": "affected",
"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4",
"versionType": "git"
},
{
"lessThan": "d700c34a5d186b9ba0715bcb19e0ff80ffbfbfc1",
"status": "affected",
"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4",
"versionType": "git"
},
{
"lessThan": "67bf002a2d7387a6312138210d0bd06e3cf4879b",
"status": "affected",
"version": "d329ea5bd8845f0b196bf41b18b6173340d6e0e4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/icmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: icmp: validate reply type before using icmp_pointers\n\nExtended echo replies use ICMP_EXT_ECHOREPLY as the outbound reply type.\nThat value is outside the range covered by icmp_pointers[], which only\ndescribes the traditional ICMP types up to NR_ICMP_TYPES.\n\nAvoid consulting icmp_pointers[] for reply types outside that range, and\nuse array_index_nospec() for the remaining in-range lookup. Normal ICMP\nreplies keep their existing behavior unchanged."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is reached by processing an inbound ICMP Extended Echo Request packet in the IPv4 ICMP receive path (icmp_rcv \u2192 icmp_echo \u2192 icmp_reply \u2192 icmp_glue_bits), so any remote host on the network can trigger it.\nAC:L - In the assumed worst-case deployment (RFC 8335 probe responses enabled), a single crafted ICMP Extended Echo Request with the L-bit set deterministically drives the reply type to 43 and triggers the fixed out-of-bounds read; no race or attacker-uncontrollable condition is involved.\nPR:N - Sending an ICMP packet requires no authentication or privileges on the target; the path runs entirely in packet receive before any credential check.\nUI:N - The target only needs to receive the attacker\u0027s packet; no victim action is required.\nS:U - The out-of-bounds access stays within the kernel\u0027s own memory and security authority, with no crossing of a VM/IOMMU/sandbox boundary.\nC:L - An out-of-bounds read of kernel .rodata occurs, but it is strictly bounded to a fixed 2-byte field at a constant offset and is not disclosed to the attacker, fitting a small bounded read rather than arbitrary disclosure.\nI:N - The bug performs only a read; there is no out-of-bounds write or attacker-meaningful modification of kernel data.\nA:H - The out-of-bounds array access can crash the kernel (e.g., KASAN/panic_on_warn configurations) via a single unauthenticated, repeatable remote packet, yielding a denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:16.933Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b3a88fc5ae024d43c5ecf653f3bbe837e4a6dc99"
},
{
"url": "https://git.kernel.org/stable/c/93df2af4f491de33827550b9d420f01808c0706b"
},
{
"url": "https://git.kernel.org/stable/c/92e7c209036dcc0e8ffdf806fdfd3645b263bea5"
},
{
"url": "https://git.kernel.org/stable/c/bc64a66e0b9ad937d3d49934242ee62b01ba9a94"
},
{
"url": "https://git.kernel.org/stable/c/c2178ff1c70ebfc2ab9651b230c58a34683db759"
},
{
"url": "https://git.kernel.org/stable/c/d700c34a5d186b9ba0715bcb19e0ff80ffbfbfc1"
},
{
"url": "https://git.kernel.org/stable/c/67bf002a2d7387a6312138210d0bd06e3cf4879b"
}
],
"title": "ipv4: icmp: validate reply type before using icmp_pointers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46037",
"datePublished": "2026-05-27T12:56:47.795Z",
"dateReserved": "2026-05-13T15:03:33.093Z",
"dateUpdated": "2026-08-05T12:29:16.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43105 (GCVE-0-2026-43105)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-06-01 16:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Fix memory leak of BO array in hang state
The hang state's BO array is allocated separately with kzalloc() in
vc4_save_hang_state() but never freed in vc4_free_hang_state(). Add the
missing kfree() for the BO array before freeing the hang state struct.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 214613656b5179f0daab6e0a080814b5100d45f0 Version: 214613656b5179f0daab6e0a080814b5100d45f0 Version: 214613656b5179f0daab6e0a080814b5100d45f0 Version: 214613656b5179f0daab6e0a080814b5100d45f0 Version: 214613656b5179f0daab6e0a080814b5100d45f0 Version: 214613656b5179f0daab6e0a080814b5100d45f0 Version: 214613656b5179f0daab6e0a080814b5100d45f0 Version: 214613656b5179f0daab6e0a080814b5100d45f0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_gem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7235fc096ece53211bd2c0e958c65f9b802aeb98",
"status": "affected",
"version": "214613656b5179f0daab6e0a080814b5100d45f0",
"versionType": "git"
},
{
"lessThan": "686bb2fce082f043db50db02b5de5c64ca4dc4c4",
"status": "affected",
"version": "214613656b5179f0daab6e0a080814b5100d45f0",
"versionType": "git"
},
{
"lessThan": "9c092941fc1d00933bcb46ecac1cb930db3abf5d",
"status": "affected",
"version": "214613656b5179f0daab6e0a080814b5100d45f0",
"versionType": "git"
},
{
"lessThan": "a812008fe3a0aebb778d277b35717f64e23d0302",
"status": "affected",
"version": "214613656b5179f0daab6e0a080814b5100d45f0",
"versionType": "git"
},
{
"lessThan": "0d3c014a84396a147705f523a8fd6fc873e76502",
"status": "affected",
"version": "214613656b5179f0daab6e0a080814b5100d45f0",
"versionType": "git"
},
{
"lessThan": "421cea4f71f7cf65abaae878562ee4aa2b684628",
"status": "affected",
"version": "214613656b5179f0daab6e0a080814b5100d45f0",
"versionType": "git"
},
{
"lessThan": "b8138567c4a80fd76a647849ebd4284996cf4b17",
"status": "affected",
"version": "214613656b5179f0daab6e0a080814b5100d45f0",
"versionType": "git"
},
{
"lessThan": "f4dfd6847b3e5d24e336bca6057485116d17aea4",
"status": "affected",
"version": "214613656b5179f0daab6e0a080814b5100d45f0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_gem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Fix memory leak of BO array in hang state\n\nThe hang state\u0027s BO array is allocated separately with kzalloc() in\nvc4_save_hang_state() but never freed in vc4_free_hang_state(). Add the\nmissing kfree() for the BO array before freeing the hang state struct."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T16:14:55.616Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7235fc096ece53211bd2c0e958c65f9b802aeb98"
},
{
"url": "https://git.kernel.org/stable/c/686bb2fce082f043db50db02b5de5c64ca4dc4c4"
},
{
"url": "https://git.kernel.org/stable/c/9c092941fc1d00933bcb46ecac1cb930db3abf5d"
},
{
"url": "https://git.kernel.org/stable/c/a812008fe3a0aebb778d277b35717f64e23d0302"
},
{
"url": "https://git.kernel.org/stable/c/0d3c014a84396a147705f523a8fd6fc873e76502"
},
{
"url": "https://git.kernel.org/stable/c/421cea4f71f7cf65abaae878562ee4aa2b684628"
},
{
"url": "https://git.kernel.org/stable/c/b8138567c4a80fd76a647849ebd4284996cf4b17"
},
{
"url": "https://git.kernel.org/stable/c/f4dfd6847b3e5d24e336bca6057485116d17aea4"
}
],
"title": "drm/vc4: Fix memory leak of BO array in hang state",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43105",
"datePublished": "2026-05-06T07:40:33.706Z",
"dateReserved": "2026-05-01T14:12:55.984Z",
"dateUpdated": "2026-06-01T16:14:55.616Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31617 (GCVE-0-2026-31617)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-08-06 12:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()
The block_len read from the host-supplied NTB header is checked against
ntb_max but has no lower bound. When block_len is smaller than
opts->ndp_size, the bounds check of:
ndp_index > (block_len - opts->ndp_size)
will underflow producing a huge unsigned value that ndp_index can never
exceed, defeating the check entirely.
The same underflow occurs in the datagram index checks against block_len
- opts->dpe_size. With those checks neutered, a malicious USB host can
choose ndp_index and datagram offsets that point past the actual
transfer, and the skb_put_data() copies adjacent kernel memory into the
network skb.
Fix this by rejecting block lengths that cannot hold at least the NTB
header plus one NDP. This will make block_len - opts->ndp_size and
block_len - opts->dpe_size both well-defined.
Commit 8d2b1a1ec9f5 ("CDC-NCM: avoid overflow in sanity checking") fixed
a related class of issues on the host side of NCM.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 Version: 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 Version: 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 Version: 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 Version: 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 Version: 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 Version: 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 Version: 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 Version: 2b74b0a04d3e9f9f08ff026e5663dce88ff94e52 Version: f7e0611e207d8908c4f2858e244370529a76dbf7 Version: b88ad6e714284b33a47834f5f2a294c2b37c66aa Version: 471b23586387a32857778c511be60ab31c98dcfd Version: 4f529c4d1e436230d3af7c09a3239677a14d2b46 Version: ae6a5394d9fbe118bc95cfe376d6a9d91d7547e8 Version: 4.9.235 ≤ Version: 4.14.196 ≤ Version: 4.19.143 ≤ Version: 5.4.62 ≤ Version: 5.8.6 ≤ |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s USB Network Control Model (NCM) gadget driver. A malicious USB host could exploit an integer underflow vulnerability when processing Network Transfer Block (NTB) headers. This allows the host to manipulate internal data pointers, causing adjacent kernel memory to be copied into network buffers. This issue can lead to information disclosure from the kernel."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T12:08:53.324Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-31617"
},
{
"name": "RHBZ#2461448",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461448"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31617.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_ncm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "068a7f2749fff6462a0a908ec415b885fe430f50",
"status": "affected",
"version": "2b74b0a04d3e9f9f08ff026e5663dce88ff94e52",
"versionType": "git"
},
{
"lessThan": "1425655c2870054c3ab4712e2b6dbdd331597ada",
"status": "affected",
"version": "2b74b0a04d3e9f9f08ff026e5663dce88ff94e52",
"versionType": "git"
},
{
"lessThan": "8b3b7bd3c02f98634baaf36c7fc7ac915f6517ca",
"status": "affected",
"version": "2b74b0a04d3e9f9f08ff026e5663dce88ff94e52",
"versionType": "git"
},
{
"lessThan": "0f156bb5334e588034ca68ac2ee92b23f66e56e7",
"status": "affected",
"version": "2b74b0a04d3e9f9f08ff026e5663dce88ff94e52",
"versionType": "git"
},
{
"lessThan": "8757a2593631443648218244b9788e193ae0fdc1",
"status": "affected",
"version": "2b74b0a04d3e9f9f08ff026e5663dce88ff94e52",
"versionType": "git"
},
{
"lessThan": "6762f8a95772265dd0c2ffe7f400493f3115b135",
"status": "affected",
"version": "2b74b0a04d3e9f9f08ff026e5663dce88ff94e52",
"versionType": "git"
},
{
"lessThan": "d58ba8f6546232f8414f396c189297dbee03f1a7",
"status": "affected",
"version": "2b74b0a04d3e9f9f08ff026e5663dce88ff94e52",
"versionType": "git"
},
{
"lessThan": "74908b0318d1df1188457040b8714ff4d4b68126",
"status": "affected",
"version": "2b74b0a04d3e9f9f08ff026e5663dce88ff94e52",
"versionType": "git"
},
{
"lessThan": "8f993d30b95dc9557a8a96ceca11abed674c8acb",
"status": "affected",
"version": "2b74b0a04d3e9f9f08ff026e5663dce88ff94e52",
"versionType": "git"
},
{
"status": "affected",
"version": "f7e0611e207d8908c4f2858e244370529a76dbf7",
"versionType": "git"
},
{
"status": "affected",
"version": "b88ad6e714284b33a47834f5f2a294c2b37c66aa",
"versionType": "git"
},
{
"status": "affected",
"version": "471b23586387a32857778c511be60ab31c98dcfd",
"versionType": "git"
},
{
"status": "affected",
"version": "4f529c4d1e436230d3af7c09a3239677a14d2b46",
"versionType": "git"
},
{
"status": "affected",
"version": "ae6a5394d9fbe118bc95cfe376d6a9d91d7547e8",
"versionType": "git"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.235",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.196",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.143",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.62",
"versionType": "semver"
},
{
"lessThan": "5.9",
"status": "affected",
"version": "5.8.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_ncm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.235",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.196",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.143",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.8.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()\n\nThe block_len read from the host-supplied NTB header is checked against\nntb_max but has no lower bound. When block_len is smaller than\nopts-\u003endp_size, the bounds check of:\n\tndp_index \u003e (block_len - opts-\u003endp_size)\nwill underflow producing a huge unsigned value that ndp_index can never\nexceed, defeating the check entirely.\n\nThe same underflow occurs in the datagram index checks against block_len\n- opts-\u003edpe_size. With those checks neutered, a malicious USB host can\nchoose ndp_index and datagram offsets that point past the actual\ntransfer, and the skb_put_data() copies adjacent kernel memory into the\nnetwork skb.\n\nFix this by rejecting block lengths that cannot hold at least the NTB\nheader plus one NDP. This will make block_len - opts-\u003endp_size and\nblock_len - opts-\u003edpe_size both well-defined.\n\nCommit 8d2b1a1ec9f5 (\"CDC-NCM: avoid overflow in sanity checking\") fixed\na related class of issues on the host side of NCM."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:43:02.575Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/068a7f2749fff6462a0a908ec415b885fe430f50"
},
{
"url": "https://git.kernel.org/stable/c/1425655c2870054c3ab4712e2b6dbdd331597ada"
},
{
"url": "https://git.kernel.org/stable/c/8b3b7bd3c02f98634baaf36c7fc7ac915f6517ca"
},
{
"url": "https://git.kernel.org/stable/c/0f156bb5334e588034ca68ac2ee92b23f66e56e7"
},
{
"url": "https://git.kernel.org/stable/c/8757a2593631443648218244b9788e193ae0fdc1"
},
{
"url": "https://git.kernel.org/stable/c/6762f8a95772265dd0c2ffe7f400493f3115b135"
},
{
"url": "https://git.kernel.org/stable/c/d58ba8f6546232f8414f396c189297dbee03f1a7"
},
{
"url": "https://git.kernel.org/stable/c/74908b0318d1df1188457040b8714ff4d4b68126"
},
{
"url": "https://git.kernel.org/stable/c/8f993d30b95dc9557a8a96ceca11abed674c8acb"
}
],
"title": "usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31617",
"datePublished": "2026-04-24T14:42:36.191Z",
"dateReserved": "2026-03-09T15:48:24.123Z",
"dateUpdated": "2026-08-06T12:08:53.324Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43207 (GCVE-0-2026-43207)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: mtk-mdp: Fix error handling in probe function
Add mtk_mdp_unregister_m2m_device() on the error handling path to prevent
resource leak.
Add check for the return value of vpu_get_plat_device() to prevent null
pointer dereference. And vpu_get_plat_device() increases the reference
count of the returned platform device. Add platform_device_put() to
prevent reference leak.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a Version: c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a Version: c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a Version: c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a Version: c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a Version: c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a Version: c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a Version: c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/mediatek/mdp/mtk_mdp_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9d9c67976eda502edc6b3a148a1c5b6a18b69a98",
"status": "affected",
"version": "c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a",
"versionType": "git"
},
{
"lessThan": "0bc43eaf021347f8d5aba87712c36b799695eec6",
"status": "affected",
"version": "c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a",
"versionType": "git"
},
{
"lessThan": "9d7962d5c81d6cf3f8dbdb5c71c57600bac5772b",
"status": "affected",
"version": "c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a",
"versionType": "git"
},
{
"lessThan": "12cafc15d24611bfb43c82877b1bbb7454a85d5a",
"status": "affected",
"version": "c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a",
"versionType": "git"
},
{
"lessThan": "c8737d33d4e8ffae87e5d5edac17f8a705235cc2",
"status": "affected",
"version": "c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a",
"versionType": "git"
},
{
"lessThan": "b3fc99fe5b25613dd61c57bc70b8479adff4f60d",
"status": "affected",
"version": "c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a",
"versionType": "git"
},
{
"lessThan": "2e8f53a7382943411557e370f1a4f3946624a30e",
"status": "affected",
"version": "c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a",
"versionType": "git"
},
{
"lessThan": "8a8a3232abac5b972058a5f2cb3e33199d2a8648",
"status": "affected",
"version": "c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/mediatek/mdp/mtk_mdp_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mtk-mdp: Fix error handling in probe function\n\nAdd mtk_mdp_unregister_m2m_device() on the error handling path to prevent\nresource leak.\n\nAdd check for the return value of vpu_get_plat_device() to prevent null\npointer dereference. And vpu_get_plat_device() increases the reference\ncount of the returned platform device. Add platform_device_put() to\nprevent reference leak."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is in the MediaTek MDP platform-driver probe/error path and the leaked V4L2 mem2mem device is reachable through local `/dev/video*` access, not through network, adjacent radio, or physical hotplug input.\nAC:L - There is no race or probabilistic trigger; once the VPU lookup/registration error condition occurs, the old probe path deterministically dereferences NULL or leaves the registered video device without proper cleanup.\nPR:L - A low-privileged local user with access to the exposed V4L2 device can open/ioctl the leaked node after probe failure. Although an administrator can also induce the probe failure via driver binding/module state, the higher-severity reasonable scenario is local exploitation of an already leaked device node.\nUI:N - No victim action is needed after the vulnerable device state exists; the attacker directly triggers the local device operation.\nS:U - The impact remains within the kernel/device security authority and does not cross a VM, IOMMU, or separate trust-boundary scope.\nC:H - The missing `mtk_mdp_unregister_m2m_device()` can leave a V4L2 device pointing at probe-owned `mtk_mdp_dev` state that is released on probe failure, creating a use-after-free style primitive. Per kernel CVSS guidance, such memory corruption is scored as high confidentiality impact.\nI:H - The dangling V4L2 path can write through freed/reused kernel structures during open and later mem2mem operations, making control-flow or data corruption plausible. Per kernel CVSS guidance, UAF-style memory corruption is high integrity impact.\nA:H - The direct NULL dereference in `vpu_wdt_reg_handler(NULL, ...)` can crash the kernel, and the leaked dangling video device can also produce kernel oopses. Kernel crash/oops conditions are high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:34.312Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9d9c67976eda502edc6b3a148a1c5b6a18b69a98"
},
{
"url": "https://git.kernel.org/stable/c/0bc43eaf021347f8d5aba87712c36b799695eec6"
},
{
"url": "https://git.kernel.org/stable/c/9d7962d5c81d6cf3f8dbdb5c71c57600bac5772b"
},
{
"url": "https://git.kernel.org/stable/c/12cafc15d24611bfb43c82877b1bbb7454a85d5a"
},
{
"url": "https://git.kernel.org/stable/c/c8737d33d4e8ffae87e5d5edac17f8a705235cc2"
},
{
"url": "https://git.kernel.org/stable/c/b3fc99fe5b25613dd61c57bc70b8479adff4f60d"
},
{
"url": "https://git.kernel.org/stable/c/2e8f53a7382943411557e370f1a4f3946624a30e"
},
{
"url": "https://git.kernel.org/stable/c/8a8a3232abac5b972058a5f2cb3e33199d2a8648"
}
],
"title": "media: mtk-mdp: Fix error handling in probe function",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43207",
"datePublished": "2026-05-06T11:28:11.601Z",
"dateReserved": "2026-05-01T14:12:55.993Z",
"dateUpdated": "2026-08-05T12:26:34.312Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53339 (GCVE-0-2026-53339)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-07-01 13:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()
On all modern platforms Qualcomm CCI controller provides two I2C masters,
and on particular boards only one I2C master may be initialized, and in
such cases the device unbinding or driver removal causes a NULL pointer
dereference, because cci_halt() is called for all two I2C masters, but
a completion is initialized only for the single enabled master:
% rmmod i2c-qcom-cci
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
<snip>
Call trace:
__wait_for_common+0x194/0x1a8 (P)
wait_for_completion_timeout+0x20/0x2c
cci_remove+0xc4/0x138 [i2c_qcom_cci]
platform_remove+0x20/0x30
device_remove+0x4c/0x80
device_release_driver_internal+0x1c8/0x224
driver_detach+0x50/0x98
bus_remove_driver+0x6c/0xbc
driver_unregister+0x30/0x60
platform_driver_unregister+0x14/0x20
qcom_cci_driver_exit+0x18/0x1008 [i2c_qcom_cci]
....
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e517526195de400158e05a08764d1fb61d579105 Version: e517526195de400158e05a08764d1fb61d579105 Version: e517526195de400158e05a08764d1fb61d579105 Version: e517526195de400158e05a08764d1fb61d579105 Version: e517526195de400158e05a08764d1fb61d579105 Version: e517526195de400158e05a08764d1fb61d579105 Version: e517526195de400158e05a08764d1fb61d579105 Version: e517526195de400158e05a08764d1fb61d579105 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-qcom-cci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e8669d12da0ade52adfe0abe96cd99e708abc9bd",
"status": "affected",
"version": "e517526195de400158e05a08764d1fb61d579105",
"versionType": "git"
},
{
"lessThan": "4d2b4a9cda6837e5ee1de1290f2e773a713b71e9",
"status": "affected",
"version": "e517526195de400158e05a08764d1fb61d579105",
"versionType": "git"
},
{
"lessThan": "a50b8adb9cdb9a495b0b45583956897b7411ed7a",
"status": "affected",
"version": "e517526195de400158e05a08764d1fb61d579105",
"versionType": "git"
},
{
"lessThan": "7107627b8b35015027201e7a095a3f6e30b4a46f",
"status": "affected",
"version": "e517526195de400158e05a08764d1fb61d579105",
"versionType": "git"
},
{
"lessThan": "4cd206c1d57a9370d5219f7b1fc45169d7bdf951",
"status": "affected",
"version": "e517526195de400158e05a08764d1fb61d579105",
"versionType": "git"
},
{
"lessThan": "a162a260c8c4db7501c65220e76913e8e351f823",
"status": "affected",
"version": "e517526195de400158e05a08764d1fb61d579105",
"versionType": "git"
},
{
"lessThan": "8ce7ff721a5e9d06d53ef65d01c89fce6d26d6ff",
"status": "affected",
"version": "e517526195de400158e05a08764d1fb61d579105",
"versionType": "git"
},
{
"lessThan": "729ac5a4b966aac42e08a94dea966f4429008548",
"status": "affected",
"version": "e517526195de400158e05a08764d1fb61d579105",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-qcom-cci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: qcom-cci: Fix NULL pointer dereference in cci_remove()\n\nOn all modern platforms Qualcomm CCI controller provides two I2C masters,\nand on particular boards only one I2C master may be initialized, and in\nsuch cases the device unbinding or driver removal causes a NULL pointer\ndereference, because cci_halt() is called for all two I2C masters, but\na completion is initialized only for the single enabled master:\n\n % rmmod i2c-qcom-cci\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n \u003csnip\u003e\n Call trace:\n __wait_for_common+0x194/0x1a8 (P)\n wait_for_completion_timeout+0x20/0x2c\n cci_remove+0xc4/0x138 [i2c_qcom_cci]\n platform_remove+0x20/0x30\n device_remove+0x4c/0x80\n device_release_driver_internal+0x1c8/0x224\n driver_detach+0x50/0x98\n bus_remove_driver+0x6c/0xbc\n driver_unregister+0x30/0x60\n platform_driver_unregister+0x14/0x20\n qcom_cci_driver_exit+0x18/0x1008 [i2c_qcom_cci]\n ...."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T13:32:21.709Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e8669d12da0ade52adfe0abe96cd99e708abc9bd"
},
{
"url": "https://git.kernel.org/stable/c/4d2b4a9cda6837e5ee1de1290f2e773a713b71e9"
},
{
"url": "https://git.kernel.org/stable/c/a50b8adb9cdb9a495b0b45583956897b7411ed7a"
},
{
"url": "https://git.kernel.org/stable/c/7107627b8b35015027201e7a095a3f6e30b4a46f"
},
{
"url": "https://git.kernel.org/stable/c/4cd206c1d57a9370d5219f7b1fc45169d7bdf951"
},
{
"url": "https://git.kernel.org/stable/c/a162a260c8c4db7501c65220e76913e8e351f823"
},
{
"url": "https://git.kernel.org/stable/c/8ce7ff721a5e9d06d53ef65d01c89fce6d26d6ff"
},
{
"url": "https://git.kernel.org/stable/c/729ac5a4b966aac42e08a94dea966f4429008548"
}
],
"title": "i2c: qcom-cci: Fix NULL pointer dereference in cci_remove()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53339",
"datePublished": "2026-07-01T13:32:21.709Z",
"dateReserved": "2026-06-09T07:44:35.399Z",
"dateUpdated": "2026-07-01T13:32:21.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45921 (GCVE-0-2026-45921)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-27 12:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()
The function mtd_parser_tplink_safeloader_parse() allocates buf via
mtd_parser_tplink_safeloader_read_table(). If the allocation for
parts[idx].name fails inside the loop, the code jumps to the err_free
label without freeing buf, leading to a memory leak.
Fix this by freeing the temporary buffer buf in the err_free label.
Compile tested only. Issue found using a prototype static analysis tool
and code review.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mtd/parsers/tplink_safeloader.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f5e62ea5c43146eacdc6861cb1022ffae1b79bc",
"status": "affected",
"version": "00a3588084bee6f37bb2b1d343f96900cfe049bc",
"versionType": "git"
},
{
"lessThan": "e97f5fac8ce9a6b9ec724c97d86b0985e915fdca",
"status": "affected",
"version": "00a3588084bee6f37bb2b1d343f96900cfe049bc",
"versionType": "git"
},
{
"lessThan": "ec121ad626c319085f6d40a52cd04e99b4554926",
"status": "affected",
"version": "00a3588084bee6f37bb2b1d343f96900cfe049bc",
"versionType": "git"
},
{
"lessThan": "971e9c53aed82f17a9c6a65daa4e21cc15eba5b1",
"status": "affected",
"version": "00a3588084bee6f37bb2b1d343f96900cfe049bc",
"versionType": "git"
},
{
"lessThan": "980ce2b02dd06a4fdf5fee38b2e14becf9cf7b8b",
"status": "affected",
"version": "00a3588084bee6f37bb2b1d343f96900cfe049bc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mtd/parsers/tplink_safeloader.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()\n\nThe function mtd_parser_tplink_safeloader_parse() allocates buf via\nmtd_parser_tplink_safeloader_read_table(). If the allocation for\nparts[idx].name fails inside the loop, the code jumps to the err_free\nlabel without freeing buf, leading to a memory leak.\n\nFix this by freeing the temporary buffer buf in the err_free label.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:17:40.032Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f5e62ea5c43146eacdc6861cb1022ffae1b79bc"
},
{
"url": "https://git.kernel.org/stable/c/e97f5fac8ce9a6b9ec724c97d86b0985e915fdca"
},
{
"url": "https://git.kernel.org/stable/c/ec121ad626c319085f6d40a52cd04e99b4554926"
},
{
"url": "https://git.kernel.org/stable/c/971e9c53aed82f17a9c6a65daa4e21cc15eba5b1"
},
{
"url": "https://git.kernel.org/stable/c/980ce2b02dd06a4fdf5fee38b2e14becf9cf7b8b"
}
],
"title": "mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45921",
"datePublished": "2026-05-27T12:17:40.032Z",
"dateReserved": "2026-05-13T15:03:33.085Z",
"dateUpdated": "2026-05-27T12:17:40.032Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43171 (GCVE-0-2026-43171)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
EFI/CPER: don't dump the entire memory region
The current logic at cper_print_fw_err() doesn't check if the
error record length is big enough to handle offset. On a bad firmware,
if the ofset is above the actual record, length -= offset will
underflow, making it dump the entire memory.
The end result can be:
- the logic taking a lot of time dumping large regions of memory;
- data disclosure due to the memory dumps;
- an OOPS, if it tries to dump an unmapped memory region.
Fix it by checking if the section length is too small before doing
a hex dump.
[ rjw: Subject tweaks ]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3d8c11efd528d56972d44ed0de51c4e11a9a4fa9 Version: 3d8c11efd528d56972d44ed0de51c4e11a9a4fa9 Version: 3d8c11efd528d56972d44ed0de51c4e11a9a4fa9 Version: 3d8c11efd528d56972d44ed0de51c4e11a9a4fa9 Version: 3d8c11efd528d56972d44ed0de51c4e11a9a4fa9 Version: 3d8c11efd528d56972d44ed0de51c4e11a9a4fa9 Version: 3d8c11efd528d56972d44ed0de51c4e11a9a4fa9 Version: 3d8c11efd528d56972d44ed0de51c4e11a9a4fa9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/efi/cper.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "02de64ab54b4bb0f1b21bb324aeff3b08612be33",
"status": "affected",
"version": "3d8c11efd528d56972d44ed0de51c4e11a9a4fa9",
"versionType": "git"
},
{
"lessThan": "0e09b522f2622841389c3b2f9ac4969e35c0809d",
"status": "affected",
"version": "3d8c11efd528d56972d44ed0de51c4e11a9a4fa9",
"versionType": "git"
},
{
"lessThan": "64ae5aaa7ac93c83da456039e8ec747bfa8a7cff",
"status": "affected",
"version": "3d8c11efd528d56972d44ed0de51c4e11a9a4fa9",
"versionType": "git"
},
{
"lessThan": "5a9b1dda8481b82851a655c3bcc5b44879b95334",
"status": "affected",
"version": "3d8c11efd528d56972d44ed0de51c4e11a9a4fa9",
"versionType": "git"
},
{
"lessThan": "7780c0bad2a3a70a8c0113a33c02f4151d901eb3",
"status": "affected",
"version": "3d8c11efd528d56972d44ed0de51c4e11a9a4fa9",
"versionType": "git"
},
{
"lessThan": "a8419f5f2c5f2d80848ddabb2b95cf0da84a5f91",
"status": "affected",
"version": "3d8c11efd528d56972d44ed0de51c4e11a9a4fa9",
"versionType": "git"
},
{
"lessThan": "54e131db4cdffd946db890ff33ff2647053fd4f6",
"status": "affected",
"version": "3d8c11efd528d56972d44ed0de51c4e11a9a4fa9",
"versionType": "git"
},
{
"lessThan": "55cc6fe5716f678f06bcb95140882dfa684464ec",
"status": "affected",
"version": "3d8c11efd528d56972d44ed0de51c4e11a9a4fa9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/efi/cper.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nEFI/CPER: don\u0027t dump the entire memory region\n\nThe current logic at cper_print_fw_err() doesn\u0027t check if the\nerror record length is big enough to handle offset. On a bad firmware,\nif the ofset is above the actual record, length -= offset will\nunderflow, making it dump the entire memory.\n\nThe end result can be:\n\n - the logic taking a lot of time dumping large regions of memory;\n - data disclosure due to the memory dumps;\n - an OOPS, if it tries to dump an unmapped memory region.\n\nFix it by checking if the section length is too small before doing\na hex dump.\n\n[ rjw: Subject tweaks ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:19:09.627Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/02de64ab54b4bb0f1b21bb324aeff3b08612be33"
},
{
"url": "https://git.kernel.org/stable/c/0e09b522f2622841389c3b2f9ac4969e35c0809d"
},
{
"url": "https://git.kernel.org/stable/c/64ae5aaa7ac93c83da456039e8ec747bfa8a7cff"
},
{
"url": "https://git.kernel.org/stable/c/5a9b1dda8481b82851a655c3bcc5b44879b95334"
},
{
"url": "https://git.kernel.org/stable/c/7780c0bad2a3a70a8c0113a33c02f4151d901eb3"
},
{
"url": "https://git.kernel.org/stable/c/a8419f5f2c5f2d80848ddabb2b95cf0da84a5f91"
},
{
"url": "https://git.kernel.org/stable/c/54e131db4cdffd946db890ff33ff2647053fd4f6"
},
{
"url": "https://git.kernel.org/stable/c/55cc6fe5716f678f06bcb95140882dfa684464ec"
}
],
"title": "EFI/CPER: don\u0027t dump the entire memory region",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43171",
"datePublished": "2026-05-06T11:27:46.698Z",
"dateReserved": "2026-05-01T14:12:55.990Z",
"dateUpdated": "2026-05-11T22:19:09.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43496 (GCVE-0-2026-43496)
Vulnerability from cvelistv5
Published
2026-05-21 12:12
Modified
2026-06-14 17:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked
When red qdisc has children (eg qfq qdisc) whose peek() callback is
qdisc_peek_dequeued(), we could get a kernel panic. When the parent of such
qdiscs (eg illustrated in patch #3 as tbf) wants to retrieve an skb from
its child (red in this case), it will do the following:
1a. do a peek() - and when sensing there's an skb the child can offer, then
- the child in this case(red) calls its child's (qfq) peek.
qfq does the right thing and will return the gso_skb queue packet.
Note: if there wasnt a gso_skb entry then qfq will store it there.
1b. invoke a dequeue() on the child (red). And herein lies the problem.
- red will call the child's dequeue() which will essentially just
try to grab something of qfq's queue.
[ 78.667668][ T363] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]
[ 78.667927][ T363] CPU: 1 UID: 0 PID: 363 Comm: ping Not tainted 7.1.0-rc1-00033-g46f74a3f7d57-dirty #790 PREEMPT(full)
[ 78.668263][ T363] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 78.668486][ T363] RIP: 0010:qfq_dequeue+0x446/0xc90 [sch_qfq]
[ 78.668718][ T363] Code: 54 c0 e8 dd 90 00 f1 48 c7 c7 e0 03 54 c0 48 89 de e8 ce 90 00 f1 48 8d 7b 48 b8 ff ff 37 00 48 89 fa 48 c1 e0 2a 48 c1 ea 03 <80> 3c 02 00 74 05 e8 ef a1 e1 f1 48 8b 7b 48 48 8d 54 24 58 48 8d
[ 78.669312][ T363] RSP: 0018:ffff88810de573e0 EFLAGS: 00010216
[ 78.669533][ T363] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 78.669790][ T363] RDX: 0000000000000009 RSI: 0000000000000004 RDI: 0000000000000048
[ 78.670044][ T363] RBP: ffff888110dc4000 R08: ffffffffb1b0885a R09: fffffbfff6ba9078
[ 78.670297][ T363] R10: 0000000000000003 R11: ffff888110e31c80 R12: 0000001880000000
[ 78.670560][ T363] R13: ffff888110dc4150 R14: ffff888110dc42b8 R15: 0000000000000200
[ 78.670814][ T363] FS: 00007f66a8f09c40(0000) GS:ffff888163428000(0000) knlGS:0000000000000000
[ 78.671110][ T363] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 78.671324][ T363] CR2: 000055db4c6a30a8 CR3: 000000010da67000 CR4: 0000000000750ef0
[ 78.671585][ T363] PKRU: 55555554
[ 78.671713][ T363] Call Trace:
[ 78.671843][ T363] <TASK>
[ 78.671936][ T363] ? __pfx_qfq_dequeue+0x10/0x10 [sch_qfq]
[ 78.672148][ T363] ? __pfx__printk+0x10/0x10
[ 78.672322][ T363] ? srso_alias_return_thunk+0x5/0xfbef5
[ 78.672496][ T363] ? lockdep_hardirqs_on_prepare+0xa8/0x1a0
[ 78.672706][ T363] ? srso_alias_return_thunk+0x5/0xfbef5
[ 78.672875][ T363] ? trace_hardirqs_on+0x19/0x1a0
[ 78.673047][ T363] red_dequeue+0x65/0x270 [sch_red]
[ 78.673217][ T363] ? srso_alias_return_thunk+0x5/0xfbef5
[ 78.673385][ T363] tbf_dequeue.cold+0xb0/0x70c [sch_tbf]
[ 78.673566][ T363] __qdisc_run+0x169/0x1900
The right thing to do in #1b is to grab the skb off gso_skb queue.
This patchset fixes that issue by changing #1b to use qdisc_dequeue_peeked()
method instead.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 Version: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 Version: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 Version: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 Version: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 Version: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 Version: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 Version: 77be155cba4e163e8bba9fd27222a8b6189ec4f7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/sch_red.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "03b0aaeba082ae981a0dfe96cdd03d02050537a1",
"status": "affected",
"version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
"versionType": "git"
},
{
"lessThan": "c7335f4dc0fa21f7015b910c6fc2f4d599732328",
"status": "affected",
"version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
"versionType": "git"
},
{
"lessThan": "45cd83c5c470ba49fe261489c8358ad7b9df7c45",
"status": "affected",
"version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
"versionType": "git"
},
{
"lessThan": "36aa34f42cb6842cf371f3a2d3e855d24fd57a50",
"status": "affected",
"version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
"versionType": "git"
},
{
"lessThan": "ce051eede433f876d322ac3550a36a3c6fc4c231",
"status": "affected",
"version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
"versionType": "git"
},
{
"lessThan": "8d09618840b99ef00154d3e731ce9b11e096196d",
"status": "affected",
"version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
"versionType": "git"
},
{
"lessThan": "587dcf970a525f543d8b5855d9f37a4ca97b76ef",
"status": "affected",
"version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
"versionType": "git"
},
{
"lessThan": "458d5615272d3de535748342eb68ca492343048c",
"status": "affected",
"version": "77be155cba4e163e8bba9fd27222a8b6189ec4f7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/sch_red.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked\n\nWhen red qdisc has children (eg qfq qdisc) whose peek() callback is\nqdisc_peek_dequeued(), we could get a kernel panic. When the parent of such\nqdiscs (eg illustrated in patch #3 as tbf) wants to retrieve an skb from\nits child (red in this case), it will do the following:\n 1a. do a peek() - and when sensing there\u0027s an skb the child can offer, then\n - the child in this case(red) calls its child\u0027s (qfq) peek.\n qfq does the right thing and will return the gso_skb queue packet.\n Note: if there wasnt a gso_skb entry then qfq will store it there.\n 1b. invoke a dequeue() on the child (red). And herein lies the problem.\n - red will call the child\u0027s dequeue() which will essentially just\n try to grab something of qfq\u0027s queue.\n\n[ 78.667668][ T363] KASAN: null-ptr-deref in range [0x0000000000000048-0x000000000000004f]\n[ 78.667927][ T363] CPU: 1 UID: 0 PID: 363 Comm: ping Not tainted 7.1.0-rc1-00033-g46f74a3f7d57-dirty #790 PREEMPT(full)\n[ 78.668263][ T363] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n[ 78.668486][ T363] RIP: 0010:qfq_dequeue+0x446/0xc90 [sch_qfq]\n[ 78.668718][ T363] Code: 54 c0 e8 dd 90 00 f1 48 c7 c7 e0 03 54 c0 48 89 de e8 ce 90 00 f1 48 8d 7b 48 b8 ff ff 37 00 48 89 fa 48 c1 e0 2a 48 c1 ea 03 \u003c80\u003e 3c 02 00 74 05 e8 ef a1 e1 f1 48 8b 7b 48 48 8d 54 24 58 48 8d\n[ 78.669312][ T363] RSP: 0018:ffff88810de573e0 EFLAGS: 00010216\n[ 78.669533][ T363] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[ 78.669790][ T363] RDX: 0000000000000009 RSI: 0000000000000004 RDI: 0000000000000048\n[ 78.670044][ T363] RBP: ffff888110dc4000 R08: ffffffffb1b0885a R09: fffffbfff6ba9078\n[ 78.670297][ T363] R10: 0000000000000003 R11: ffff888110e31c80 R12: 0000001880000000\n[ 78.670560][ T363] R13: ffff888110dc4150 R14: ffff888110dc42b8 R15: 0000000000000200\n[ 78.670814][ T363] FS: 00007f66a8f09c40(0000) GS:ffff888163428000(0000) knlGS:0000000000000000\n[ 78.671110][ T363] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 78.671324][ T363] CR2: 000055db4c6a30a8 CR3: 000000010da67000 CR4: 0000000000750ef0\n[ 78.671585][ T363] PKRU: 55555554\n[ 78.671713][ T363] Call Trace:\n[ 78.671843][ T363] \u003cTASK\u003e\n[ 78.671936][ T363] ? __pfx_qfq_dequeue+0x10/0x10 [sch_qfq]\n[ 78.672148][ T363] ? __pfx__printk+0x10/0x10\n[ 78.672322][ T363] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 78.672496][ T363] ? lockdep_hardirqs_on_prepare+0xa8/0x1a0\n[ 78.672706][ T363] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 78.672875][ T363] ? trace_hardirqs_on+0x19/0x1a0\n[ 78.673047][ T363] red_dequeue+0x65/0x270 [sch_red]\n[ 78.673217][ T363] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 78.673385][ T363] tbf_dequeue.cold+0xb0/0x70c [sch_tbf]\n[ 78.673566][ T363] __qdisc_run+0x169/0x1900\n\nThe right thing to do in #1b is to grab the skb off gso_skb queue.\nThis patchset fixes that issue by changing #1b to use qdisc_dequeue_peeked()\nmethod instead."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:45:26.779Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/03b0aaeba082ae981a0dfe96cdd03d02050537a1"
},
{
"url": "https://git.kernel.org/stable/c/c7335f4dc0fa21f7015b910c6fc2f4d599732328"
},
{
"url": "https://git.kernel.org/stable/c/45cd83c5c470ba49fe261489c8358ad7b9df7c45"
},
{
"url": "https://git.kernel.org/stable/c/36aa34f42cb6842cf371f3a2d3e855d24fd57a50"
},
{
"url": "https://git.kernel.org/stable/c/ce051eede433f876d322ac3550a36a3c6fc4c231"
},
{
"url": "https://git.kernel.org/stable/c/8d09618840b99ef00154d3e731ce9b11e096196d"
},
{
"url": "https://git.kernel.org/stable/c/587dcf970a525f543d8b5855d9f37a4ca97b76ef"
},
{
"url": "https://git.kernel.org/stable/c/458d5615272d3de535748342eb68ca492343048c"
}
],
"title": "net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43496",
"datePublished": "2026-05-21T12:12:46.584Z",
"dateReserved": "2026-05-01T14:12:56.013Z",
"dateUpdated": "2026-06-14T17:45:26.779Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31751 (GCVE-0-2026-31751)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-05-11 22:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
comedi: dt2815: add hardware detection to prevent crash
The dt2815 driver crashes when attached to I/O ports without actual
hardware present. This occurs because syzkaller or users can attach
the driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl.
When no hardware exists at the specified port, inb() operations return
0xff (floating bus), but outb() operations can trigger page faults due
to undefined behavior, especially under race conditions:
BUG: unable to handle page fault for address: 000000007fffff90
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
RIP: 0010:dt2815_attach+0x6e0/0x1110
Add hardware detection by reading the status register before attempting
any write operations. If the read returns 0xff, assume no hardware is
present and fail the attach with -ENODEV. This prevents crashes from
outb() operations on non-existent hardware.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d6a929b7608ae157cef86d00cc580d1038f0b985 Version: d6a929b7608ae157cef86d00cc580d1038f0b985 Version: d6a929b7608ae157cef86d00cc580d1038f0b985 Version: d6a929b7608ae157cef86d00cc580d1038f0b985 Version: d6a929b7608ae157cef86d00cc580d1038f0b985 Version: d6a929b7608ae157cef86d00cc580d1038f0b985 Version: d6a929b7608ae157cef86d00cc580d1038f0b985 Version: d6a929b7608ae157cef86d00cc580d1038f0b985 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/comedi/drivers/dt2815.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8d63161837f1bf8810dbcd2a583c2bbf5ca6d733",
"status": "affected",
"version": "d6a929b7608ae157cef86d00cc580d1038f0b985",
"versionType": "git"
},
{
"lessThan": "d2a786efdb9971f2a647724625da5bbecc994dc9",
"status": "affected",
"version": "d6a929b7608ae157cef86d00cc580d1038f0b985",
"versionType": "git"
},
{
"lessThan": "0dcf33994b8dcf3db36530fb7e2cf9f89e5cbac3",
"status": "affected",
"version": "d6a929b7608ae157cef86d00cc580d1038f0b985",
"versionType": "git"
},
{
"lessThan": "d5d9df8b08d68d083ac57abc2c887dfb1f31af63",
"status": "affected",
"version": "d6a929b7608ae157cef86d00cc580d1038f0b985",
"versionType": "git"
},
{
"lessThan": "65c528fbeddd88478c210052f6c7b21be4973156",
"status": "affected",
"version": "d6a929b7608ae157cef86d00cc580d1038f0b985",
"versionType": "git"
},
{
"lessThan": "34c8b3a91bdfbe4573650b4cd750ef639101fdc5",
"status": "affected",
"version": "d6a929b7608ae157cef86d00cc580d1038f0b985",
"versionType": "git"
},
{
"lessThan": "34b13250c618d7441508c6ef369144aa8a9b9bfa",
"status": "affected",
"version": "d6a929b7608ae157cef86d00cc580d1038f0b985",
"versionType": "git"
},
{
"lessThan": "93853512f565e625df2397f0d8050d6aafd7c3ad",
"status": "affected",
"version": "d6a929b7608ae157cef86d00cc580d1038f0b985",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/comedi/drivers/dt2815.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: dt2815: add hardware detection to prevent crash\n\nThe dt2815 driver crashes when attached to I/O ports without actual\nhardware present. This occurs because syzkaller or users can attach\nthe driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl.\n\nWhen no hardware exists at the specified port, inb() operations return\n0xff (floating bus), but outb() operations can trigger page faults due\nto undefined behavior, especially under race conditions:\n\n BUG: unable to handle page fault for address: 000000007fffff90\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n RIP: 0010:dt2815_attach+0x6e0/0x1110\n\nAdd hardware detection by reading the status register before attempting\nany write operations. If the read returns 0xff, assume no hardware is\npresent and fail the attach with -ENODEV. This prevents crashes from\noutb() operations on non-existent hardware."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:15:06.157Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8d63161837f1bf8810dbcd2a583c2bbf5ca6d733"
},
{
"url": "https://git.kernel.org/stable/c/d2a786efdb9971f2a647724625da5bbecc994dc9"
},
{
"url": "https://git.kernel.org/stable/c/0dcf33994b8dcf3db36530fb7e2cf9f89e5cbac3"
},
{
"url": "https://git.kernel.org/stable/c/d5d9df8b08d68d083ac57abc2c887dfb1f31af63"
},
{
"url": "https://git.kernel.org/stable/c/65c528fbeddd88478c210052f6c7b21be4973156"
},
{
"url": "https://git.kernel.org/stable/c/34c8b3a91bdfbe4573650b4cd750ef639101fdc5"
},
{
"url": "https://git.kernel.org/stable/c/34b13250c618d7441508c6ef369144aa8a9b9bfa"
},
{
"url": "https://git.kernel.org/stable/c/93853512f565e625df2397f0d8050d6aafd7c3ad"
}
],
"title": "comedi: dt2815: add hardware detection to prevent crash",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31751",
"datePublished": "2026-05-01T14:14:43.551Z",
"dateReserved": "2026-03-09T15:48:24.139Z",
"dateUpdated": "2026-05-11T22:15:06.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31568 (GCVE-0-2026-31568)
Vulnerability from cvelistv5
Published
2026-04-24 14:35
Modified
2026-05-11 22:11
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/mm: Add missing secure storage access fixups for donated memory
There are special cases where secure storage access exceptions happen
in a kernel context for pages that don't have the PG_arch_1 bit
set. That bit is set for non-exported guest secure storage (memory)
but is absent on storage donated to the Ultravisor since the kernel
isn't allowed to export donated pages.
Prior to this patch we would try to export the page by calling
arch_make_folio_accessible() which would instantly return since the
arch bit is absent signifying that the page was already exported and
no further action is necessary. This leads to secure storage access
exception loops which can never be resolved.
With this patch we unconditionally try to export and if that fails we
fixup.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/mm/fault.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b36b0e804aee5f20c6798dbeaeaa7cfdb7c6cf88",
"status": "affected",
"version": "084ea4d611a3d00ee3930400b262240e10895900",
"versionType": "git"
},
{
"lessThan": "43ac2d18db1131df0a89993f709131ebfc29f3bd",
"status": "affected",
"version": "084ea4d611a3d00ee3930400b262240e10895900",
"versionType": "git"
},
{
"lessThan": "b00be77302d7ec4ad0367bb236494fce7172b730",
"status": "affected",
"version": "084ea4d611a3d00ee3930400b262240e10895900",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/mm/fault.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/mm: Add missing secure storage access fixups for donated memory\n\nThere are special cases where secure storage access exceptions happen\nin a kernel context for pages that don\u0027t have the PG_arch_1 bit\nset. That bit is set for non-exported guest secure storage (memory)\nbut is absent on storage donated to the Ultravisor since the kernel\nisn\u0027t allowed to export donated pages.\n\nPrior to this patch we would try to export the page by calling\narch_make_folio_accessible() which would instantly return since the\narch bit is absent signifying that the page was already exported and\nno further action is necessary. This leads to secure storage access\nexception loops which can never be resolved.\n\nWith this patch we unconditionally try to export and if that fails we\nfixup."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:11:18.354Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b36b0e804aee5f20c6798dbeaeaa7cfdb7c6cf88"
},
{
"url": "https://git.kernel.org/stable/c/43ac2d18db1131df0a89993f709131ebfc29f3bd"
},
{
"url": "https://git.kernel.org/stable/c/b00be77302d7ec4ad0367bb236494fce7172b730"
}
],
"title": "s390/mm: Add missing secure storage access fixups for donated memory",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31568",
"datePublished": "2026-04-24T14:35:48.125Z",
"dateReserved": "2026-03-09T15:48:24.117Z",
"dateUpdated": "2026-05-11T22:11:18.354Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46211 (GCVE-0-2026-46211)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-06-14 18:03
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()
msm_ioctl_gem_info_get_metadata() always returns 0 regardless of
errors. When copy_to_user() fails or the user buffer is too small,
the error code stored in ret is ignored because the function
unconditionally returns 0. This causes userspace to believe the
ioctl succeeded when it did not.
Additionally, kmemdup() can return NULL on allocation failure, but
the return value is not checked. This leads to a NULL pointer
dereference in the subsequent copy_to_user() call.
Add the missing NULL check for kmemdup() and return ret instead of 0.
Note that the SET counterpart (msm_ioctl_gem_info_set_metadata)
correctly returns ret.
Patchwork: https://patchwork.freedesktop.org/patch/714478/
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "697e1a9559f6962f999cc4c748c2ffffcc0a7a7a",
"status": "affected",
"version": "9902cb999e4e913d98e8afe4b36c08e4a793e1ce",
"versionType": "git"
},
{
"lessThan": "c57c861956b89f2e2528e6384d51e2dedd915809",
"status": "affected",
"version": "9902cb999e4e913d98e8afe4b36c08e4a793e1ce",
"versionType": "git"
},
{
"lessThan": "b079e85c91f446f29e808d8291189e897f1884ff",
"status": "affected",
"version": "9902cb999e4e913d98e8afe4b36c08e4a793e1ce",
"versionType": "git"
},
{
"lessThan": "47cbfe2608314b833ad61a65827d8fb363bc2d2d",
"status": "affected",
"version": "9902cb999e4e913d98e8afe4b36c08e4a793e1ce",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()\n\nmsm_ioctl_gem_info_get_metadata() always returns 0 regardless of\nerrors. When copy_to_user() fails or the user buffer is too small,\nthe error code stored in ret is ignored because the function\nunconditionally returns 0. This causes userspace to believe the\nioctl succeeded when it did not.\n\nAdditionally, kmemdup() can return NULL on allocation failure, but\nthe return value is not checked. This leads to a NULL pointer\ndereference in the subsequent copy_to_user() call.\n\nAdd the missing NULL check for kmemdup() and return ret instead of 0.\n\nNote that the SET counterpart (msm_ioctl_gem_info_set_metadata)\ncorrectly returns ret.\n\nPatchwork: https://patchwork.freedesktop.org/patch/714478/"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:03:02.808Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/697e1a9559f6962f999cc4c748c2ffffcc0a7a7a"
},
{
"url": "https://git.kernel.org/stable/c/c57c861956b89f2e2528e6384d51e2dedd915809"
},
{
"url": "https://git.kernel.org/stable/c/b079e85c91f446f29e808d8291189e897f1884ff"
},
{
"url": "https://git.kernel.org/stable/c/47cbfe2608314b833ad61a65827d8fb363bc2d2d"
}
],
"title": "drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46211",
"datePublished": "2026-05-28T09:40:28.890Z",
"dateReserved": "2026-05-13T15:03:33.105Z",
"dateUpdated": "2026-06-14T18:03:02.808Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43199 (GCVE-0-2026-43199)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query
Fix a "scheduling while atomic" bug in mlx5e_ipsec_init_macs() by
replacing mlx5_query_mac_address() with ether_addr_copy() to get the
local MAC address directly from netdev->dev_addr.
The issue occurs because mlx5_query_mac_address() queries the hardware
which involves mlx5_cmd_exec() that can sleep, but it is called from
the mlx5e_ipsec_handle_event workqueue which runs in atomic context.
The MAC address is already available in netdev->dev_addr, so no need
to query hardware. This avoids the sleeping call and resolves the bug.
Call trace:
BUG: scheduling while atomic: kworker/u112:2/69344/0x00000200
__schedule+0x7ab/0xa20
schedule+0x1c/0xb0
schedule_timeout+0x6e/0xf0
__wait_for_common+0x91/0x1b0
cmd_exec+0xa85/0xff0 [mlx5_core]
mlx5_cmd_exec+0x1f/0x50 [mlx5_core]
mlx5_query_nic_vport_mac_address+0x7b/0xd0 [mlx5_core]
mlx5_query_mac_address+0x19/0x30 [mlx5_core]
mlx5e_ipsec_init_macs+0xc1/0x720 [mlx5_core]
mlx5e_ipsec_build_accel_xfrm_attrs+0x422/0x670 [mlx5_core]
mlx5e_ipsec_handle_event+0x2b9/0x460 [mlx5_core]
process_one_work+0x178/0x2e0
worker_thread+0x2ea/0x430
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e1407fb7c337373dfaaae2445d828b0b9ae26a29",
"status": "affected",
"version": "cee137a634318bfbda18ee5af45d300153b57fa5",
"versionType": "git"
},
{
"lessThan": "57957bc7f1865778ec9b1618e15515feb6df7eb4",
"status": "affected",
"version": "cee137a634318bfbda18ee5af45d300153b57fa5",
"versionType": "git"
},
{
"lessThan": "546de94e41e92e1f7dc6213615fb7c794d05db98",
"status": "affected",
"version": "cee137a634318bfbda18ee5af45d300153b57fa5",
"versionType": "git"
},
{
"lessThan": "859380694f434597407632c29f30fdb5e763e6cc",
"status": "affected",
"version": "cee137a634318bfbda18ee5af45d300153b57fa5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix \"scheduling while atomic\" in IPsec MAC address query\n\nFix a \"scheduling while atomic\" bug in mlx5e_ipsec_init_macs() by\nreplacing mlx5_query_mac_address() with ether_addr_copy() to get the\nlocal MAC address directly from netdev-\u003edev_addr.\n\nThe issue occurs because mlx5_query_mac_address() queries the hardware\nwhich involves mlx5_cmd_exec() that can sleep, but it is called from\nthe mlx5e_ipsec_handle_event workqueue which runs in atomic context.\n\nThe MAC address is already available in netdev-\u003edev_addr, so no need\nto query hardware. This avoids the sleeping call and resolves the bug.\n\nCall trace:\n BUG: scheduling while atomic: kworker/u112:2/69344/0x00000200\n __schedule+0x7ab/0xa20\n schedule+0x1c/0xb0\n schedule_timeout+0x6e/0xf0\n __wait_for_common+0x91/0x1b0\n cmd_exec+0xa85/0xff0 [mlx5_core]\n mlx5_cmd_exec+0x1f/0x50 [mlx5_core]\n mlx5_query_nic_vport_mac_address+0x7b/0xd0 [mlx5_core]\n mlx5_query_mac_address+0x19/0x30 [mlx5_core]\n mlx5e_ipsec_init_macs+0xc1/0x720 [mlx5_core]\n mlx5e_ipsec_build_accel_xfrm_attrs+0x422/0x670 [mlx5_core]\n mlx5e_ipsec_handle_event+0x2b9/0x460 [mlx5_core]\n process_one_work+0x178/0x2e0\n worker_thread+0x2ea/0x430"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable path runs in mlx5 IPsec packet offload event handling, which can be driven by traffic on an exposed IPsec tunnel. A remote peer can cause the NIC ESN object-change event without local execution on the target.\nAC:L - There is no attacker-controlled race to win; once a packet-offload tunnel SA with ESN is present, the event path deterministically reaches the atomic-sleep bug. Traffic volume/sequence advancement is attacker-influenced.\nPR:N - The SA setup is a normal deployment precondition for the affected IPsec offload service, not a privilege the attacker must hold on the target. The packet sender needs no local account or target-side administrative capability.\nUI:N - No victim user action is needed after the susceptible IPsec offload configuration exists. The trigger is packet/event driven.\nS:U - The impact is within the kernel and the mlx5/IPsec networking subsystem on the same host. It does not cross a VM, IOMMU, or other separate security authority boundary.\nC:N - The bug is a sleeping firmware MAC query while holding a spinlock, not an out-of-bounds access, UAF, or information disclosure primitive. No kernel memory is exposed.\nI:N - The vulnerable call does not corrupt memory or provide an attacker-controlled write. It only performs a blocking command from atomic context.\nA:H - The kernel reports BUG: scheduling while atomic and the scheduler path can panic via panic-on-warn or destabilize the worker/kernel state. The trigger can be repeated, making denial of service high impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:30.810Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e1407fb7c337373dfaaae2445d828b0b9ae26a29"
},
{
"url": "https://git.kernel.org/stable/c/57957bc7f1865778ec9b1618e15515feb6df7eb4"
},
{
"url": "https://git.kernel.org/stable/c/546de94e41e92e1f7dc6213615fb7c794d05db98"
},
{
"url": "https://git.kernel.org/stable/c/859380694f434597407632c29f30fdb5e763e6cc"
}
],
"title": "net/mlx5e: Fix \"scheduling while atomic\" in IPsec MAC address query",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43199",
"datePublished": "2026-05-06T11:28:06.232Z",
"dateReserved": "2026-05-01T14:12:55.992Z",
"dateUpdated": "2026-08-05T12:26:30.810Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53053 (GCVE-0-2026-53053)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Fix clone_alias() to use the original device's devid
Currently clone_alias() assumes first argument (pdev) is always the
original device pointer. This function is called by
pci_for_each_dma_alias() which based on topology decides to send
original or alias device details in first argument.
This meant that the source devid used to look up and copy the DTE
may be incorrect, leading to wrong or stale DTE entries being
propagated to alias device.
Fix this by passing the original pdev as the opaque data argument to
both the direct clone_alias() call and pci_for_each_dma_alias(). Inside
clone_alias(), retrieve the original device from data and compute devid
from it.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3332364e4ebc0581d133a334645a20fd13b580f1 Version: 3332364e4ebc0581d133a334645a20fd13b580f1 Version: 3332364e4ebc0581d133a334645a20fd13b580f1 Version: 3332364e4ebc0581d133a334645a20fd13b580f1 Version: 1f03a258f20f1699ede29bb40804074db9398a0d Version: 5.4.17 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/amd/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dbd76a537d8cb814e7f5b795ab21ecb7949c821d",
"status": "affected",
"version": "3332364e4ebc0581d133a334645a20fd13b580f1",
"versionType": "git"
},
{
"lessThan": "20b3c566e2702e5d4d0545be8a97029a2eebcc0e",
"status": "affected",
"version": "3332364e4ebc0581d133a334645a20fd13b580f1",
"versionType": "git"
},
{
"lessThan": "dae251ff11d2d2208a029f98923756831cefec46",
"status": "affected",
"version": "3332364e4ebc0581d133a334645a20fd13b580f1",
"versionType": "git"
},
{
"lessThan": "faad224fe0f0857a04ff2eb3c90f0de57f47d0f3",
"status": "affected",
"version": "3332364e4ebc0581d133a334645a20fd13b580f1",
"versionType": "git"
},
{
"status": "affected",
"version": "1f03a258f20f1699ede29bb40804074db9398a0d",
"versionType": "git"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.17",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/amd/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Fix clone_alias() to use the original device\u0027s devid\n\nCurrently clone_alias() assumes first argument (pdev) is always the\noriginal device pointer. This function is called by\npci_for_each_dma_alias() which based on topology decides to send\noriginal or alias device details in first argument.\n\nThis meant that the source devid used to look up and copy the DTE\nmay be incorrect, leading to wrong or stale DTE entries being\npropagated to alias device.\n\nFix this by passing the original pdev as the opaque data argument to\nboth the direct clone_alias() call and pci_for_each_dma_alias(). Inside\nclone_alias(), retrieve the original device from data and compute devid\nfrom it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local PCI/IOMMU domain setup and updates, including VFIO/IOMMUFD or VM device-passthrough attach paths for a delegated device. It is not directly reachable by remote packets, but a local tenant or process controlling the assigned device can exercise the affected DMA alias state.\nAC:L - Once the system has an AMD IOMMU and a PCI topology/device with DMA aliases, the wrong DTE clone occurs deterministically during alias setup or domain attach. There is no race or timing condition required.\nPR:L - Exploitation requires control of, or access to, an assigned/owned PCI device or its IOMMUFD/VFIO context, but not host-root privileges in the target host kernel. In delegated passthrough deployments this is reachable by a low-privileged tenant context.\nUI:N - No victim user action is needed after the vulnerable device/topology is present and the device is attached or used. The attacker can trigger DMA behavior through the assigned device context.\nS:C - The bug can violate the IOMMU/DMA isolation boundary by applying a wrong or stale device-table entry to an alias requester ID. Per kernel guidance, IOMMU/DMA boundary bypass changes scope.\nC:H - A wrong/stale DTE can give an alias requester ID DMA access under the wrong page table or domain, enabling reads of memory outside the intended DMA isolation boundary. This supports high confidentiality impact in the most severe reasonable passthrough scenario.\nI:H - The DTE contains DMA translation and read/write permission state, so propagating the wrong entry can allow DMA writes to memory outside the intended domain. That can corrupt host or peer-domain memory and supports high integrity impact.\nA:H - Wrong DMA translations can produce repeated IOMMU faults, device failure, or memory corruption leading to kernel instability or crash. This supports high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:57.238Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dbd76a537d8cb814e7f5b795ab21ecb7949c821d"
},
{
"url": "https://git.kernel.org/stable/c/20b3c566e2702e5d4d0545be8a97029a2eebcc0e"
},
{
"url": "https://git.kernel.org/stable/c/dae251ff11d2d2208a029f98923756831cefec46"
},
{
"url": "https://git.kernel.org/stable/c/faad224fe0f0857a04ff2eb3c90f0de57f47d0f3"
}
],
"title": "iommu/amd: Fix clone_alias() to use the original device\u0027s devid",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53053",
"datePublished": "2026-06-24T16:29:59.093Z",
"dateReserved": "2026-06-09T07:44:35.381Z",
"dateUpdated": "2026-08-05T12:32:57.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43327 (GCVE-0-2026-43327)
Vulnerability from cvelistv5
Published
2026-05-08 13:31
Modified
2026-05-23 16:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: dummy-hcd: Fix locking/synchronization error
Syzbot testing was able to provoke an addressing exception and crash
in the usb_gadget_udc_reset() routine in
drivers/usb/gadgets/udc/core.c, resulting from the fact that the
routine was called with a second ("driver") argument of NULL. The bad
caller was set_link_state() in dummy_hcd.c, and the problem arose
because of a race between a USB reset and driver unbind.
These sorts of races were not supposed to be possible; commit
7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous synchronization change"),
along with a few followup commits, was written specifically to prevent
them. As it turns out, there are (at least) two errors remaining in
the code. Another patch will address the second error; this one is
concerned with the first.
The error responsible for the syzbot crash occurred because the
stop_activity() routine will sometimes drop and then re-acquire the
dum->lock spinlock. A call to stop_activity() occurs in
set_link_state() when handling an emulated USB reset, after the test
of dum->ints_enabled and before the increment of dum->callback_usage.
This allowed another thread (doing a driver unbind) to sneak in and
grab the spinlock, and then clear dum->ints_enabled and dum->driver.
Normally this other thread would have to wait for dum->callback_usage
to go down to 0 before it would clear dum->driver, but in this case it
didn't have to wait since dum->callback_usage had not yet been
incremented.
The fix is to increment dum->callback_usage _before_ calling
stop_activity() instead of after. Then the thread doing the unbind
will not clear dum->driver until after the call to
usb_gadget_udc_reset() safely returns and dum->callback_usage has been
decremented again.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 Version: 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 Version: 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 Version: 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 Version: 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 Version: 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 Version: 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 Version: 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 Version: 7b416b9dac6ede26d4ca0c1a88b448b543623ff3 Version: 8590bc1da625dd4a589eac0fc3aa3cf4f400424d Version: a867d5b932ac4911d3f8a1e63505061b0c81f889 Version: e84b4a008365b7edbd842a063ae28d040a98db25 Version: e39b17143a5b5aac81f066d455e5d3a9877eb3ae Version: 4f8ae1fcb0dfbb72a7678f81bf01fb7fc85c6715 Version: 3.2.97 ≤ Version: 3.16.52 ≤ Version: 4.1.46 ≤ Version: 4.4.92 ≤ Version: 4.9.55 ≤ Version: 4.13.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/udc/dummy_hcd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6350c7dd33ab481ef41c931a238361490c32d15c",
"status": "affected",
"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
"versionType": "git"
},
{
"lessThan": "cc97fb5969177cccce2e23b31298df220fc7570d",
"status": "affected",
"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
"versionType": "git"
},
{
"lessThan": "218886b2ef2dea7627d3700ab0abaf4bf9d1161f",
"status": "affected",
"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
"versionType": "git"
},
{
"lessThan": "791966f85b439b261bf19865cf1c07c065ffb4b4",
"status": "affected",
"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
"versionType": "git"
},
{
"lessThan": "805b1833d6ed6da5086e610578a28e71bb54fbbb",
"status": "affected",
"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
"versionType": "git"
},
{
"lessThan": "efbd9441f1e769a7aae1813d497cec09cbdff031",
"status": "affected",
"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
"versionType": "git"
},
{
"lessThan": "69ab97a693251d6a6093e630060a3c744fd58524",
"status": "affected",
"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
"versionType": "git"
},
{
"lessThan": "616a63ff495df12863692ab3f9f7b84e3fa7a66d",
"status": "affected",
"version": "7dbd8f4cabd96db5a50513de9d83a8105a5ffc81",
"versionType": "git"
},
{
"status": "affected",
"version": "7b416b9dac6ede26d4ca0c1a88b448b543623ff3",
"versionType": "git"
},
{
"status": "affected",
"version": "8590bc1da625dd4a589eac0fc3aa3cf4f400424d",
"versionType": "git"
},
{
"status": "affected",
"version": "a867d5b932ac4911d3f8a1e63505061b0c81f889",
"versionType": "git"
},
{
"status": "affected",
"version": "e84b4a008365b7edbd842a063ae28d040a98db25",
"versionType": "git"
},
{
"status": "affected",
"version": "e39b17143a5b5aac81f066d455e5d3a9877eb3ae",
"versionType": "git"
},
{
"status": "affected",
"version": "4f8ae1fcb0dfbb72a7678f81bf01fb7fc85c6715",
"versionType": "git"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.97",
"versionType": "semver"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.52",
"versionType": "semver"
},
{
"lessThan": "4.2",
"status": "affected",
"version": "4.1.46",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.92",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.55",
"versionType": "semver"
},
{
"lessThan": "4.14",
"status": "affected",
"version": "4.13.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/udc/dummy_hcd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.1.46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.13.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: dummy-hcd: Fix locking/synchronization error\n\nSyzbot testing was able to provoke an addressing exception and crash\nin the usb_gadget_udc_reset() routine in\ndrivers/usb/gadgets/udc/core.c, resulting from the fact that the\nroutine was called with a second (\"driver\") argument of NULL. The bad\ncaller was set_link_state() in dummy_hcd.c, and the problem arose\nbecause of a race between a USB reset and driver unbind.\n\nThese sorts of races were not supposed to be possible; commit\n7dbd8f4cabd9 (\"USB: dummy-hcd: Fix erroneous synchronization change\"),\nalong with a few followup commits, was written specifically to prevent\nthem. As it turns out, there are (at least) two errors remaining in\nthe code. Another patch will address the second error; this one is\nconcerned with the first.\n\nThe error responsible for the syzbot crash occurred because the\nstop_activity() routine will sometimes drop and then re-acquire the\ndum-\u003elock spinlock. A call to stop_activity() occurs in\nset_link_state() when handling an emulated USB reset, after the test\nof dum-\u003eints_enabled and before the increment of dum-\u003ecallback_usage.\nThis allowed another thread (doing a driver unbind) to sneak in and\ngrab the spinlock, and then clear dum-\u003eints_enabled and dum-\u003edriver.\nNormally this other thread would have to wait for dum-\u003ecallback_usage\nto go down to 0 before it would clear dum-\u003edriver, but in this case it\ndidn\u0027t have to wait since dum-\u003ecallback_usage had not yet been\nincremented.\n\nThe fix is to increment dum-\u003ecallback_usage _before_ calling\nstop_activity() instead of after. Then the thread doing the unbind\nwill not clear dum-\u003edriver until after the call to\nusb_gadget_udc_reset() safely returns and dum-\u003ecallback_usage has been\ndecremented again."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:06:42.428Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6350c7dd33ab481ef41c931a238361490c32d15c"
},
{
"url": "https://git.kernel.org/stable/c/cc97fb5969177cccce2e23b31298df220fc7570d"
},
{
"url": "https://git.kernel.org/stable/c/218886b2ef2dea7627d3700ab0abaf4bf9d1161f"
},
{
"url": "https://git.kernel.org/stable/c/791966f85b439b261bf19865cf1c07c065ffb4b4"
},
{
"url": "https://git.kernel.org/stable/c/805b1833d6ed6da5086e610578a28e71bb54fbbb"
},
{
"url": "https://git.kernel.org/stable/c/efbd9441f1e769a7aae1813d497cec09cbdff031"
},
{
"url": "https://git.kernel.org/stable/c/69ab97a693251d6a6093e630060a3c744fd58524"
},
{
"url": "https://git.kernel.org/stable/c/616a63ff495df12863692ab3f9f7b84e3fa7a66d"
}
],
"title": "USB: dummy-hcd: Fix locking/synchronization error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43327",
"datePublished": "2026-05-08T13:31:12.896Z",
"dateReserved": "2026-05-01T14:12:56.002Z",
"dateUpdated": "2026-05-23T16:06:42.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53216 (GCVE-0-2026-53216)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: mvpp2: limit XDP frame size to the RX buffer
mvpp2 has short and long BM pools, and short pool buffers can be smaller
than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with
PAGE_SIZE as frame size.
XDP helpers use frame_sz to validate tail growth and to derive the hard
end of the data area. Advertising PAGE_SIZE for short buffers can let
bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting
memory or later tripping skb tailroom checks.
Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches
the actual buffer backing the packet.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 07dd0a7aae7f72af7cec18909581c2bb570edddc Version: 07dd0a7aae7f72af7cec18909581c2bb570edddc Version: 07dd0a7aae7f72af7cec18909581c2bb570edddc Version: 07dd0a7aae7f72af7cec18909581c2bb570edddc Version: 07dd0a7aae7f72af7cec18909581c2bb570edddc Version: 07dd0a7aae7f72af7cec18909581c2bb570edddc Version: 07dd0a7aae7f72af7cec18909581c2bb570edddc |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a3ee9231ccec6ec3be2de89c56f897055fd9eab1",
"status": "affected",
"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
"versionType": "git"
},
{
"lessThan": "ec8e1e5842bc0dbd4c272761f4db3651eecd0339",
"status": "affected",
"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
"versionType": "git"
},
{
"lessThan": "3b8b0c3631b19faee53f0d15a49924129b063eec",
"status": "affected",
"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
"versionType": "git"
},
{
"lessThan": "994bd2b58d2bd08aa97ec0836cc813cfcb00d749",
"status": "affected",
"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
"versionType": "git"
},
{
"lessThan": "910617a4e67dbdd5fdb39d9dc6a51e491e1b2c3e",
"status": "affected",
"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
"versionType": "git"
},
{
"lessThan": "9545cc5ef18ca22d031f2f47c157192460652359",
"status": "affected",
"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
"versionType": "git"
},
{
"lessThan": "f3c6aa078927e6fe8121c9c591ddee8716c5305a",
"status": "affected",
"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: limit XDP frame size to the RX buffer\n\nmvpp2 has short and long BM pools, and short pool buffers can be smaller\nthan PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with\nPAGE_SIZE as frame size.\n\nXDP helpers use frame_sz to validate tail growth and to derive the hard\nend of the data area. Advertising PAGE_SIZE for short buffers can let\nbpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting\nmemory or later tripping skb tailroom checks.\n\nInitialize the XDP buffer with bm_pool-\u003efrag_size so XDP tailroom matches\nthe actual buffer backing the packet."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable mvpp2 RX/XDP path is reached by packets arriving on a network interface, and in a plausible XDP-enabled router/firewall deployment a remote peer can trigger it with crafted traffic.\nAC:L - There is no race; once XDP tail growth is present, packet size and repeated delivery are attacker-controllable and the short-buffer condition is deterministic.\nPR:N - In the highest reasonable deployment, the XDP program is already part of the exposed dataplane, so the packet sender needs no local account or authentication. Administrative privilege is needed to install XDP, but not to trigger the vulnerable receive path.\nUI:N - No victim user action is required after the affected interface and XDP dataplane are running.\nS:U - The corruption occurs within the kernel/network-driver security authority and does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - This is kernel memory corruption from writing past the real RX buffer; such corruption can reasonably be leveraged for information disclosure.\nI:H - bpf_xdp_adjust_tail() can write beyond the allocated buffer due to the false PAGE_SIZE frame limit, making this an out-of-bounds kernel write.\nA:H - The bug can corrupt adjacent memory or trip skb tailroom checks, making kernel crashes or persistent receive-path failure plausible."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:12.526Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a3ee9231ccec6ec3be2de89c56f897055fd9eab1"
},
{
"url": "https://git.kernel.org/stable/c/ec8e1e5842bc0dbd4c272761f4db3651eecd0339"
},
{
"url": "https://git.kernel.org/stable/c/3b8b0c3631b19faee53f0d15a49924129b063eec"
},
{
"url": "https://git.kernel.org/stable/c/994bd2b58d2bd08aa97ec0836cc813cfcb00d749"
},
{
"url": "https://git.kernel.org/stable/c/910617a4e67dbdd5fdb39d9dc6a51e491e1b2c3e"
},
{
"url": "https://git.kernel.org/stable/c/9545cc5ef18ca22d031f2f47c157192460652359"
},
{
"url": "https://git.kernel.org/stable/c/f3c6aa078927e6fe8121c9c591ddee8716c5305a"
}
],
"title": "net: mvpp2: limit XDP frame size to the RX buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53216",
"datePublished": "2026-06-25T08:39:19.529Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-08-05T12:34:12.526Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31625 (GCVE-0-2026-31625)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: alps: fix NULL pointer dereference in alps_raw_event()
Commit ecfa6f34492c ("HID: Add HID_CLAIMED_INPUT guards in raw_event
callbacks missing them") attempted to fix up the HID drivers that had
missed the previous fix that was done in 2ff5baa9b527 ("HID: appleir:
Fix potential NULL dereference at raw event handle"), but the alps
driver was missed.
Fix this up by properly checking in the hid-alps driver that it had been
claimed correctly before attempting to process the raw event.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 73196ebe134d11a68a2e27814c489d685cfc8b03 Version: 73196ebe134d11a68a2e27814c489d685cfc8b03 Version: 73196ebe134d11a68a2e27814c489d685cfc8b03 Version: 73196ebe134d11a68a2e27814c489d685cfc8b03 Version: 73196ebe134d11a68a2e27814c489d685cfc8b03 Version: 73196ebe134d11a68a2e27814c489d685cfc8b03 Version: 73196ebe134d11a68a2e27814c489d685cfc8b03 Version: 73196ebe134d11a68a2e27814c489d685cfc8b03 Version: 73196ebe134d11a68a2e27814c489d685cfc8b03 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-alps.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "56850666bb5dcf7a13d76c5d02864813e17ee537",
"status": "affected",
"version": "73196ebe134d11a68a2e27814c489d685cfc8b03",
"versionType": "git"
},
{
"lessThan": "72516a8d7fe247fd895424bab87952f105a0c255",
"status": "affected",
"version": "73196ebe134d11a68a2e27814c489d685cfc8b03",
"versionType": "git"
},
{
"lessThan": "cc411e4823d8bfa23327d9989a0fa4e0ce76aebe",
"status": "affected",
"version": "73196ebe134d11a68a2e27814c489d685cfc8b03",
"versionType": "git"
},
{
"lessThan": "c8cc765253ad89ccc106a7bdeb5aeac6cf963078",
"status": "affected",
"version": "73196ebe134d11a68a2e27814c489d685cfc8b03",
"versionType": "git"
},
{
"lessThan": "8eed7bce7a4c41ab28ee4891103623a12fd41611",
"status": "affected",
"version": "73196ebe134d11a68a2e27814c489d685cfc8b03",
"versionType": "git"
},
{
"lessThan": "0091dfa542a362c178a7e9393097138a57d327d1",
"status": "affected",
"version": "73196ebe134d11a68a2e27814c489d685cfc8b03",
"versionType": "git"
},
{
"lessThan": "4b618248d2307a219d9431a730cfe1156c8e3386",
"status": "affected",
"version": "73196ebe134d11a68a2e27814c489d685cfc8b03",
"versionType": "git"
},
{
"lessThan": "ee2cb3ddfdca949dbc0c3f796ed5a439f0efc9f6",
"status": "affected",
"version": "73196ebe134d11a68a2e27814c489d685cfc8b03",
"versionType": "git"
},
{
"lessThan": "1badfc4319224820d5d890f8eab6aa52e4e83339",
"status": "affected",
"version": "73196ebe134d11a68a2e27814c489d685cfc8b03",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-alps.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: alps: fix NULL pointer dereference in alps_raw_event()\n\nCommit ecfa6f34492c (\"HID: Add HID_CLAIMED_INPUT guards in raw_event\ncallbacks missing them\") attempted to fix up the HID drivers that had\nmissed the previous fix that was done in 2ff5baa9b527 (\"HID: appleir:\nFix potential NULL dereference at raw event handle\"), but the alps\ndriver was missed.\n\nFix this up by properly checking in the hid-alps driver that it had been\nclaimed correctly before attempting to process the raw event."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:43:14.080Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/56850666bb5dcf7a13d76c5d02864813e17ee537"
},
{
"url": "https://git.kernel.org/stable/c/72516a8d7fe247fd895424bab87952f105a0c255"
},
{
"url": "https://git.kernel.org/stable/c/cc411e4823d8bfa23327d9989a0fa4e0ce76aebe"
},
{
"url": "https://git.kernel.org/stable/c/c8cc765253ad89ccc106a7bdeb5aeac6cf963078"
},
{
"url": "https://git.kernel.org/stable/c/8eed7bce7a4c41ab28ee4891103623a12fd41611"
},
{
"url": "https://git.kernel.org/stable/c/0091dfa542a362c178a7e9393097138a57d327d1"
},
{
"url": "https://git.kernel.org/stable/c/4b618248d2307a219d9431a730cfe1156c8e3386"
},
{
"url": "https://git.kernel.org/stable/c/ee2cb3ddfdca949dbc0c3f796ed5a439f0efc9f6"
},
{
"url": "https://git.kernel.org/stable/c/1badfc4319224820d5d890f8eab6aa52e4e83339"
}
],
"title": "HID: alps: fix NULL pointer dereference in alps_raw_event()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31625",
"datePublished": "2026-04-24T14:42:42.481Z",
"dateReserved": "2026-03-09T15:48:24.124Z",
"dateUpdated": "2026-06-14T17:43:14.080Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43092 (GCVE-0-2026-43092)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-05-11 22:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xsk: validate MTU against usable frame size on bind
AF_XDP bind currently accepts zero-copy pool configurations without
verifying that the device MTU fits into the usable frame space provided
by the UMEM chunk.
This becomes a problem since we started to respect tailroom which is
subtracted from chunk_size (among with headroom). 2k chunk size might
not provide enough space for standard 1500 MTU, so let us catch such
settings at bind time. Furthermore, validate whether underlying HW will
be able to satisfy configured MTU wrt XSK's frame size multiplied by
supported Rx buffer chain length (that is exposed via
net_device::xdp_zc_max_segs).
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xdp/xsk_buff_pool.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a55793e5a97d4e39bdb380873a9780fe0010bff6",
"status": "affected",
"version": "24ea50127ecf0efe819c1f6230add27abc6ca9d9",
"versionType": "git"
},
{
"lessThan": "f669d60db11dbabb96279f2b20f9d1cba43cddb2",
"status": "affected",
"version": "24ea50127ecf0efe819c1f6230add27abc6ca9d9",
"versionType": "git"
},
{
"lessThan": "25e1e91a8da819924df0b16e3812d7b24c8ce133",
"status": "affected",
"version": "24ea50127ecf0efe819c1f6230add27abc6ca9d9",
"versionType": "git"
},
{
"lessThan": "b2f4daa6422fd6cc0cec969794dab4a88ea4cea1",
"status": "affected",
"version": "24ea50127ecf0efe819c1f6230add27abc6ca9d9",
"versionType": "git"
},
{
"lessThan": "36ee60b569ba0dfb6f961333b90d19ab5b323fa9",
"status": "affected",
"version": "24ea50127ecf0efe819c1f6230add27abc6ca9d9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xdp/xsk_buff_pool.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: validate MTU against usable frame size on bind\n\nAF_XDP bind currently accepts zero-copy pool configurations without\nverifying that the device MTU fits into the usable frame space provided\nby the UMEM chunk.\n\nThis becomes a problem since we started to respect tailroom which is\nsubtracted from chunk_size (among with headroom). 2k chunk size might\nnot provide enough space for standard 1500 MTU, so let us catch such\nsettings at bind time. Furthermore, validate whether underlying HW will\nbe able to satisfy configured MTU wrt XSK\u0027s frame size multiplied by\nsupported Rx buffer chain length (that is exposed via\nnet_device::xdp_zc_max_segs)."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:17:34.476Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a55793e5a97d4e39bdb380873a9780fe0010bff6"
},
{
"url": "https://git.kernel.org/stable/c/f669d60db11dbabb96279f2b20f9d1cba43cddb2"
},
{
"url": "https://git.kernel.org/stable/c/25e1e91a8da819924df0b16e3812d7b24c8ce133"
},
{
"url": "https://git.kernel.org/stable/c/b2f4daa6422fd6cc0cec969794dab4a88ea4cea1"
},
{
"url": "https://git.kernel.org/stable/c/36ee60b569ba0dfb6f961333b90d19ab5b323fa9"
}
],
"title": "xsk: validate MTU against usable frame size on bind",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43092",
"datePublished": "2026-05-06T07:40:24.619Z",
"dateReserved": "2026-05-01T14:12:55.984Z",
"dateUpdated": "2026-05-11T22:17:34.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43037 (GCVE-0-2026-43037)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-08-24 12:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
Oskar Kjos reported the following problem.
ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written
by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes
IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region
as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff
at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr
value. __ip_options_echo() then reads optlen from attacker-controlled
packet data at sptr[rr+1] and copies that many bytes into dopt->__data,
a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).
To fix this we clear skb2->cb[], as suggested by Oskar Kjos.
Also add minimal IPv4 header validation (version == 4, ihl >= 5).
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c4d3efafcc933fd2ffd169d7dc4f980393a13796 Version: c4d3efafcc933fd2ffd169d7dc4f980393a13796 Version: c4d3efafcc933fd2ffd169d7dc4f980393a13796 Version: c4d3efafcc933fd2ffd169d7dc4f980393a13796 Version: c4d3efafcc933fd2ffd169d7dc4f980393a13796 Version: c4d3efafcc933fd2ffd169d7dc4f980393a13796 Version: c4d3efafcc933fd2ffd169d7dc4f980393a13796 Version: c4d3efafcc933fd2ffd169d7dc4f980393a13796 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_nvidia:10::el10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "NVIDIA for RHEL 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-212.10.el10nv",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-231.12.el10nv",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.22.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.77.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.6.32-754.61.1.el6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_extras_rt_els:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.10.0-1160.155.1.rt56.1307.el7",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.10.0-1160.153.1.el7",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.132.1.rt7.473.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.132.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.194.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.194.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.195.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.195.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.145.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.145.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.15.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.174.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.174.1.rt14.459.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:9.2"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.129.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:9.4"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.119.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus:9.6"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.12::el8"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "412.86.202606140301-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.13::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.13",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "413.92.202606160406-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.14::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "414.92.202606231112-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.15::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "415.92.202606200237-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.16::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "416.94.202606051757-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.17::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.17",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "417.94.202606250942-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.18::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "418.94.202606051320-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.19::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.19.9.6.202606100451-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.20::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.20",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.20.9.6.202606101223-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.21::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.21",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.21.9.6.202606101139-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.22.9.8.202607220526-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "libkrun",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s IPv6 tunnel implementation. A remote attacker could exploit this flaw by sending malicious ICMPv6 error messages to cause a stack-based buffer overflow in the kernel\u0027s IPv4-over-IPv6 tunnel error handling code. This could result in a kernel crash (denial of service) or potentially allow arbitrary code execution with kernel privileges."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Critical"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T12:07:11.732Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-43037"
},
{
"name": "RHBZ#2464351",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464351"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43037.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25534"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33486"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27719"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27729"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41236"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26528"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26542"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28887"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28962"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25044"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34098"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25181"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25200"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25193"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25186"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:44232"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24343"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25191"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22940"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23237"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23224"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25217"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28742"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25121"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28749"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26535"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25533"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22964"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28748"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28750"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28738"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28740"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28741"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25120"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22900"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:25534: NVIDIA for RHEL 10"
},
{
"lang": "en",
"value": "RHSA-2026:33486: NVIDIA for RHEL 10"
},
{
"lang": "en",
"value": "RHSA-2026:27719: Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION), Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)"
},
{
"lang": "en",
"value": "RHSA-2026:27729: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:41236: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:26528: Red Hat OpenShift Container Platform 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:26542: Red Hat OpenShift Container Platform 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:28887: Red Hat OpenShift Container Platform 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:28962: Red Hat OpenShift Container Platform 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:25044: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:34098: Red Hat OpenShift Container Platform 4.17"
},
{
"lang": "en",
"value": "RHSA-2026:25181: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:25200: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:25193: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:25186: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:44232: Red Hat OpenShift Container Platform 4.22"
},
{
"lang": "en",
"value": "RHSA-2026:24343: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:25191: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:22940: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:23237: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:23224: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:25217: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:28742: Red Hat Enterprise Linux BaseOS (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:25121: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:28749: Red Hat Enterprise Linux BaseOS (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:26535: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:25533: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:22964: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:28748: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:28750: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:28738: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:28740: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:28741: Red Hat Enterprise Linux BaseOS (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:25120: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:22900: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-01T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-01T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: ip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err()",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is to skip loading the affected module `ip6_tunnel` onto the system till we have a fix available, this can be done by a blacklist mechanism, this will ensure the driver is not loaded at the boot time.\n~~~\nHow do I blacklist a kernel module to prevent it from loading automatically? \nhttps://access.redhat.com/solutions/41278 \n~~~\n\nWe may also want to detection and monitoring an affected system as below:\n~~~\nMonitor for exploitation attempts:\n\n# Enable kernel audit for IPv6 tunnel operations\nauditctl -a always,exit -F arch=b64 -S socket -F a0=10 -F a1=3 -k ipv6_tunnel\n\n# Monitor system logs for kernel panics/crashes\njournalctl -k -p err -f | grep -i \"ip6_tunnel\\|icmp\\|stack\"\n~~~"
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_tunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ea9f65b27c8404e164848ebff1443310fd187629",
"status": "affected",
"version": "c4d3efafcc933fd2ffd169d7dc4f980393a13796",
"versionType": "git"
},
{
"lessThan": "d6621f60192fe10c047a4487be42a6f4c150707f",
"status": "affected",
"version": "c4d3efafcc933fd2ffd169d7dc4f980393a13796",
"versionType": "git"
},
{
"lessThan": "2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5",
"status": "affected",
"version": "c4d3efafcc933fd2ffd169d7dc4f980393a13796",
"versionType": "git"
},
{
"lessThan": "a0c4ce9900a108eaf55d0f3b399cb55999647d39",
"status": "affected",
"version": "c4d3efafcc933fd2ffd169d7dc4f980393a13796",
"versionType": "git"
},
{
"lessThan": "1063515ce15ff31065c4e7f8265f4c2fd3c54876",
"status": "affected",
"version": "c4d3efafcc933fd2ffd169d7dc4f980393a13796",
"versionType": "git"
},
{
"lessThan": "590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3",
"status": "affected",
"version": "c4d3efafcc933fd2ffd169d7dc4f980393a13796",
"versionType": "git"
},
{
"lessThan": "4a622658f384b03560834cbe8ffcfe69a278f7c8",
"status": "affected",
"version": "c4d3efafcc933fd2ffd169d7dc4f980393a13796",
"versionType": "git"
},
{
"lessThan": "2edfa31769a4add828a7e604b21cb82aaaa05925",
"status": "affected",
"version": "c4d3efafcc933fd2ffd169d7dc4f980393a13796",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_tunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.22"
},
{
"lessThan": "2.6.22",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err()\n\nOskar Kjos reported the following problem.\n\nip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written\nby the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes\nIPCB(skb2) to __ip_options_echo(), which interprets that cb[] region\nas struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff\nat offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr\nvalue. __ip_options_echo() then reads optlen from attacker-controlled\npacket data at sptr[rr+1] and copies that many bytes into dopt-\u003e__data,\na fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE).\n\nTo fix this we clear skb2-\u003ecb[], as suggested by Oskar Kjos.\n\nAlso add minimal IPv4 header validation (version == 4, ihl \u003e= 5)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote IPv6 peer can send a crafted ICMPv6 error packet to an IPv6 tunnel endpoint and reach `icmpv6_rcv()` -\u003e `icmpv6_notify()` -\u003e `tunnel46_err()` -\u003e `ip4ip6_err()` without local execution. The vulnerable code processes network packet contents in the kernel network stack.\nAC:L - Triggering is deterministic once an IPv4-over-IPv6 tunnel endpoint exists: the attacker controls the ICMPv6 error, IPv6 extension-header-derived control block state, and quoted inner IPv4 bytes used by `__ip_options_echo()`. There is no race or hard-to-influence condition.\nPR:N - The exploit packet is unauthenticated network input and does not require the attacker to have an account or capabilities on the target. Tunnel configuration requires administration, but exploitation of an already deployed tunnel endpoint does not.\nUI:N - No victim user action is required; receipt and processing of the crafted ICMPv6 packet is enough. The path is normal kernel packet handling.\nS:U - The corruption occurs inside the kernel network stack and impacts the same kernel security authority. This is not a VM escape or cross-scope boundary bypass.\nC:H - The bug is an attacker-controlled kernel stack buffer overflow in `__ip_options_echo()` via a bogus IPv4 option length copied into a fixed 40-byte buffer. Kernel memory corruption of this kind can plausibly be leveraged for high-impact information disclosure.\nI:H - The overflow copies attacker-controlled packet data onto the kernel stack and can plausibly corrupt control data or adjacent state. Under the required higher-severity rule, this supports high integrity impact.\nA:H - Even without full code execution, the kernel stack overflow can trigger an oops, panic, or other fatal corruption. The crafted packet can be sent remotely and repeatedly against a vulnerable tunnel endpoint."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:27.160Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ea9f65b27c8404e164848ebff1443310fd187629"
},
{
"url": "https://git.kernel.org/stable/c/d6621f60192fe10c047a4487be42a6f4c150707f"
},
{
"url": "https://git.kernel.org/stable/c/2cc6e3b0fe0f0242d1f530a93a4924f48ab85ba5"
},
{
"url": "https://git.kernel.org/stable/c/a0c4ce9900a108eaf55d0f3b399cb55999647d39"
},
{
"url": "https://git.kernel.org/stable/c/1063515ce15ff31065c4e7f8265f4c2fd3c54876"
},
{
"url": "https://git.kernel.org/stable/c/590f622669b97eaf7b57a1de7b0a6e68c5d8b2c3"
},
{
"url": "https://git.kernel.org/stable/c/4a622658f384b03560834cbe8ffcfe69a278f7c8"
},
{
"url": "https://git.kernel.org/stable/c/2edfa31769a4add828a7e604b21cb82aaaa05925"
}
],
"title": "ip6_tunnel: clear skb2-\u003ecb[] in ip4ip6_err()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43037",
"datePublished": "2026-05-01T14:15:35.314Z",
"dateReserved": "2026-05-01T14:12:55.978Z",
"dateUpdated": "2026-08-24T12:07:11.732Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43211 (GCVE-0-2026-43211)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: Fix pci_slot_trylock() error handling
Commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()")
delegates the bridge device's pci_dev_trylock() to pci_bus_trylock() in
pci_slot_trylock(), but it forgets to remove the corresponding
pci_dev_unlock() when pci_bus_trylock() fails.
Before a4e772898f8b, the code did:
if (!pci_dev_trylock(dev)) /* <- lock bridge device */
goto unlock;
if (dev->subordinate) {
if (!pci_bus_trylock(dev->subordinate)) {
pci_dev_unlock(dev); /* <- unlock bridge device */
goto unlock;
}
}
After a4e772898f8b the bridge-device lock is no longer taken, but the
pci_dev_unlock(dev) on the failure path was left in place, leading to the
bug.
This yields one of two errors:
1. A warning that the lock is being unlocked when no one holds it.
2. An incorrect unlock of a lock that belongs to another thread.
Fix it by removing the now-redundant pci_dev_unlock(dev) on the failure
path.
[Same patch later posted by Keith at
https://patch.msgid.link/20260116184150.3013258-1-kbusch@meta.com]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e2355d513b89a2cb511b4ded0deb426cdb01acd0 Version: 04e85a3285b0e5c5af6fd2c0fd6e95ffecc01945 Version: 7253b4fed46471cc247c6cacefac890a8472c083 Version: 78c6e39fef5c428960aff742149bba302dd46f5a Version: a4e772898f8bf2e7e1cf661a12c60a5612c4afab Version: a4e772898f8bf2e7e1cf661a12c60a5612c4afab Version: a4e772898f8bf2e7e1cf661a12c60a5612c4afab Version: a4e772898f8bf2e7e1cf661a12c60a5612c4afab Version: 0790b89c7e911003b8c50ae50e3ac7645de1fae9 Version: df77a678c33871a6e4ac5b54a71662f1d702335b Version: 81c68e218ab883dfa368460a59b674084c0240da Version: 5.10.226 ≤ Version: 5.15.167 ≤ Version: 6.1.110 ≤ Version: 6.6.51 ≤ Version: 4.19.322 ≤ Version: 5.4.284 ≤ Version: 6.10.10 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ebb27b7399ab8b9eb1f792b329aa5f6250c590d4",
"status": "affected",
"version": "e2355d513b89a2cb511b4ded0deb426cdb01acd0",
"versionType": "git"
},
{
"lessThan": "fbe06a3058114bf95a17a4941b205f4b321c6f0a",
"status": "affected",
"version": "04e85a3285b0e5c5af6fd2c0fd6e95ffecc01945",
"versionType": "git"
},
{
"lessThan": "943ed56606a7ab2fe5a99cad572dd17d484310c7",
"status": "affected",
"version": "7253b4fed46471cc247c6cacefac890a8472c083",
"versionType": "git"
},
{
"lessThan": "a19b61fdb958ffadbba85b43c991eb9fc70c1c1c",
"status": "affected",
"version": "78c6e39fef5c428960aff742149bba302dd46f5a",
"versionType": "git"
},
{
"lessThan": "0425aaf20b407d2f2cf3bf469808e4a35f9abb8b",
"status": "affected",
"version": "a4e772898f8bf2e7e1cf661a12c60a5612c4afab",
"versionType": "git"
},
{
"lessThan": "bd435f4b738130d732ef64e0e57e45185f77165d",
"status": "affected",
"version": "a4e772898f8bf2e7e1cf661a12c60a5612c4afab",
"versionType": "git"
},
{
"lessThan": "8b08ea9690b212b7bf7f12414039259cf34b1aa0",
"status": "affected",
"version": "a4e772898f8bf2e7e1cf661a12c60a5612c4afab",
"versionType": "git"
},
{
"lessThan": "9368d1ee62829b08aa31836b3ca003803caf0b72",
"status": "affected",
"version": "a4e772898f8bf2e7e1cf661a12c60a5612c4afab",
"versionType": "git"
},
{
"status": "affected",
"version": "0790b89c7e911003b8c50ae50e3ac7645de1fae9",
"versionType": "git"
},
{
"status": "affected",
"version": "df77a678c33871a6e4ac5b54a71662f1d702335b",
"versionType": "git"
},
{
"status": "affected",
"version": "81c68e218ab883dfa368460a59b674084c0240da",
"versionType": "git"
},
{
"lessThan": "5.10.252",
"status": "affected",
"version": "5.10.226",
"versionType": "semver"
},
{
"lessThan": "5.15.202",
"status": "affected",
"version": "5.15.167",
"versionType": "semver"
},
{
"lessThan": "6.1.165",
"status": "affected",
"version": "6.1.110",
"versionType": "semver"
},
{
"lessThan": "6.6.128",
"status": "affected",
"version": "6.6.51",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.322",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.284",
"versionType": "semver"
},
{
"lessThan": "6.11",
"status": "affected",
"version": "6.10.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "5.10.226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.15.167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.1.110",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.6.51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.322",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.284",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Fix pci_slot_trylock() error handling\n\nCommit a4e772898f8b (\"PCI: Add missing bridge lock to pci_bus_lock()\")\ndelegates the bridge device\u0027s pci_dev_trylock() to pci_bus_trylock() in\npci_slot_trylock(), but it forgets to remove the corresponding\npci_dev_unlock() when pci_bus_trylock() fails.\n\nBefore a4e772898f8b, the code did:\n\n if (!pci_dev_trylock(dev)) /* \u003c- lock bridge device */\n goto unlock;\n if (dev-\u003esubordinate) {\n if (!pci_bus_trylock(dev-\u003esubordinate)) {\n pci_dev_unlock(dev); /* \u003c- unlock bridge device */\n goto unlock;\n }\n }\n\nAfter a4e772898f8b the bridge-device lock is no longer taken, but the\npci_dev_unlock(dev) on the failure path was left in place, leading to the\nbug.\n\nThis yields one of two errors:\n\n 1. A warning that the lock is being unlocked when no one holds it.\n 2. An incorrect unlock of a lock that belongs to another thread.\n\nFix it by removing the now-redundant pci_dev_unlock(dev) on the failure\npath.\n\n[Same patch later posted by Keith at\nhttps://patch.msgid.link/20260116184150.3013258-1-kbusch@meta.com]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local PCI reset interfaces, most plausibly VFIO PCI hot reset on an assigned device or privileged PCI reset paths. It is not exposed through network packet processing or an adjacent/physical protocol parser.\nAC:L - The failure path requires lock contention, but a local attacker with access to reset-capable PCI interfaces can create concurrent reset/config-lock activity with repeated attempts. Under the required higher-severity rule, this is treated as attacker-controlled race complexity.\nPR:L - Although some sysfs PCI reset paths require real administrative control, VFIO PCI device access can be delegated to a non-root local user or VM management process without CAP_SYS_ADMIN in the vulnerable ioctl path. Therefore the highest defensible scenario is low privileges rather than high.\nUI:N - Once the attacker has access to the local PCI/VFIO reset interface, exploitation only requires issuing concurrent operations. No separate victim user action is needed.\nS:U - The bug corrupts kernel PCI locking state within the same host kernel security authority. This is treated as standard local kernel compromise/DoS rather than a demonstrated cross-scope escape.\nC:H - The incorrect unlock can release a PCI device/config-access lock held by another thread, breaking kernel mutual exclusion during reset and driver callbacks. Given the possibility of repeated controlled races and kernel state corruption, confidentiality impact is scored high under the higher-severity rule.\nI:H - Incorrectly unlocking another thread\u0027s PCI device lock can allow concurrent modification of PCI device, driver, and reset state while code assumes exclusive access. This can plausibly lead to kernel state corruption or control-flow-relevant corruption, so integrity is high.\nA:H - The documented immediate outcomes include WARN conditions and invalid lock ownership/unlock behavior, which can oops, panic, deadlock, or destabilize PCI reset paths. Repeated triggering can cause host kernel availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:36.454Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ebb27b7399ab8b9eb1f792b329aa5f6250c590d4"
},
{
"url": "https://git.kernel.org/stable/c/fbe06a3058114bf95a17a4941b205f4b321c6f0a"
},
{
"url": "https://git.kernel.org/stable/c/943ed56606a7ab2fe5a99cad572dd17d484310c7"
},
{
"url": "https://git.kernel.org/stable/c/a19b61fdb958ffadbba85b43c991eb9fc70c1c1c"
},
{
"url": "https://git.kernel.org/stable/c/0425aaf20b407d2f2cf3bf469808e4a35f9abb8b"
},
{
"url": "https://git.kernel.org/stable/c/bd435f4b738130d732ef64e0e57e45185f77165d"
},
{
"url": "https://git.kernel.org/stable/c/8b08ea9690b212b7bf7f12414039259cf34b1aa0"
},
{
"url": "https://git.kernel.org/stable/c/9368d1ee62829b08aa31836b3ca003803caf0b72"
}
],
"title": "PCI: Fix pci_slot_trylock() error handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43211",
"datePublished": "2026-05-06T11:28:14.423Z",
"dateReserved": "2026-05-01T14:12:55.993Z",
"dateUpdated": "2026-08-05T12:26:36.454Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53255 (GCVE-0-2026-53255)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: validate advertising TLV before type checks
tlv_data_is_valid() reads each advertising data field length from
data[i], then inspects data[i + 1] for managed EIR types before
checking that the current field still fits inside the supplied buffer.
A malformed field whose length byte is the last byte of the buffer can
therefore make the parser read one byte past the advertising data.
KASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISING
request reached that path:
BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid()
Read of size 1
Call trace:
tlv_data_is_valid()
add_advertising()
hci_mgmt_cmd()
hci_sock_sendmsg()
Move the existing element-length check before any type-octet inspection
so each non-empty element is proven to contain its type byte before the
parser looks at data[i + 1].
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2bb36870e8cb29949ef9acec37129cd8e70f1857 Version: 2bb36870e8cb29949ef9acec37129cd8e70f1857 Version: 2bb36870e8cb29949ef9acec37129cd8e70f1857 Version: 2bb36870e8cb29949ef9acec37129cd8e70f1857 Version: 2bb36870e8cb29949ef9acec37129cd8e70f1857 Version: 2bb36870e8cb29949ef9acec37129cd8e70f1857 Version: 2bb36870e8cb29949ef9acec37129cd8e70f1857 Version: 2bb36870e8cb29949ef9acec37129cd8e70f1857 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "13ad995071a06570668dd8daab3616c247c72080",
"status": "affected",
"version": "2bb36870e8cb29949ef9acec37129cd8e70f1857",
"versionType": "git"
},
{
"lessThan": "06fcbd79c3c360a50f9be9d370769bbd738d0976",
"status": "affected",
"version": "2bb36870e8cb29949ef9acec37129cd8e70f1857",
"versionType": "git"
},
{
"lessThan": "f7093ac233c1e7f51d125534f46067772a113175",
"status": "affected",
"version": "2bb36870e8cb29949ef9acec37129cd8e70f1857",
"versionType": "git"
},
{
"lessThan": "74c08e4db35a476c3462aeb65846f955be732626",
"status": "affected",
"version": "2bb36870e8cb29949ef9acec37129cd8e70f1857",
"versionType": "git"
},
{
"lessThan": "18fea1cb0c2599752e908c8217490f73ddd33e00",
"status": "affected",
"version": "2bb36870e8cb29949ef9acec37129cd8e70f1857",
"versionType": "git"
},
{
"lessThan": "1a3c8ffbb469859b076445af44bdfa6a711d483e",
"status": "affected",
"version": "2bb36870e8cb29949ef9acec37129cd8e70f1857",
"versionType": "git"
},
{
"lessThan": "2a3f3ed9e198ae23c15859ace2f9ca6cfdc35b57",
"status": "affected",
"version": "2bb36870e8cb29949ef9acec37129cd8e70f1857",
"versionType": "git"
},
{
"lessThan": "de23fb62259aa01d294f77238ae3b835eb674413",
"status": "affected",
"version": "2bb36870e8cb29949ef9acec37129cd8e70f1857",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate advertising TLV before type checks\n\ntlv_data_is_valid() reads each advertising data field length from\ndata[i], then inspects data[i + 1] for managed EIR types before\nchecking that the current field still fits inside the supplied buffer.\n\nA malformed field whose length byte is the last byte of the buffer can\ntherefore make the parser read one byte past the advertising data.\n\nKASAN reported the following when a malformed MGMT_OP_ADD_ADVERTISING\nrequest reached that path:\n\n BUG: KASAN: vmalloc-out-of-bounds in tlv_data_is_valid()\n Read of size 1\n Call trace:\n tlv_data_is_valid()\n add_advertising()\n hci_mgmt_cmd()\n hci_sock_sendmsg()\n\nMove the existing element-length check before any type-octet inspection\nso each non-empty element is proven to contain its type byte before the\nparser looks at data[i + 1]."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:45.934Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/13ad995071a06570668dd8daab3616c247c72080"
},
{
"url": "https://git.kernel.org/stable/c/06fcbd79c3c360a50f9be9d370769bbd738d0976"
},
{
"url": "https://git.kernel.org/stable/c/f7093ac233c1e7f51d125534f46067772a113175"
},
{
"url": "https://git.kernel.org/stable/c/74c08e4db35a476c3462aeb65846f955be732626"
},
{
"url": "https://git.kernel.org/stable/c/18fea1cb0c2599752e908c8217490f73ddd33e00"
},
{
"url": "https://git.kernel.org/stable/c/1a3c8ffbb469859b076445af44bdfa6a711d483e"
},
{
"url": "https://git.kernel.org/stable/c/2a3f3ed9e198ae23c15859ace2f9ca6cfdc35b57"
},
{
"url": "https://git.kernel.org/stable/c/de23fb62259aa01d294f77238ae3b835eb674413"
}
],
"title": "Bluetooth: MGMT: validate advertising TLV before type checks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53255",
"datePublished": "2026-06-25T08:39:45.934Z",
"dateReserved": "2026-06-09T07:44:35.394Z",
"dateUpdated": "2026-06-25T08:39:45.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46186 (GCVE-0-2026-46186)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-06-14 18:01
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: virtio_bt: validate rx pkt_type header length
virtbt_rx_handle() reads the leading pkt_type byte from the RX skb
and forwards the remainder to hci_recv_frame() for every
event/ACL/SCO/ISO type, without checking that the remaining payload
is at least the fixed HCI header for that type.
After the preceding patch bounds the backend-supplied used.len to
[1, VIRTBT_RX_BUF_SIZE], a one-byte completion still reaches
hci_recv_frame() with skb->len already pulled to 0. If the byte
happened to be HCI_ACLDATA_PKT, the ACL-vs-ISO classification
fast-path in hci_dev_classify_pkt_type() dereferences
hci_acl_hdr(skb)->handle whenever the HCI device has an active
CIS_LINK, BIS_LINK, or PA_LINK connection, reading two bytes of
uninitialized RX-buffer data. The same hazard exists for every
packet type the driver accepts because none of the switch cases in
virtbt_rx_handle() check skb->len against the per-type minimum HCI
header size before handing the frame to the core.
After stripping pkt_type, require skb->len to cover the fixed
header size for the selected type (event 2, ACL 4, SCO 3, ISO 4)
before calling hci_recv_frame(); drop ratelimited otherwise.
Unknown pkt_type values still take the original kfree_skb() default
path.
Use bt_dev_err_ratelimited() because both the length and pkt_type
values come from an untrusted backend that can otherwise flood the
kernel log.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cf2719a21fdb9d4c8e9c834d279163609bef575d Version: 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be Version: 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be Version: 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be Version: 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be Version: 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be Version: 160fbcf3bfb93c3c086427f9f4c8bc70f217e9be Version: 9b67438e315b925a699f0178f4a48baf3d2d6ef4 Version: 5.15.78 ≤ Version: 6.0.8 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/virtio_bt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "149cfb42ad69c7964fd9f2c43831da9152007129",
"status": "affected",
"version": "cf2719a21fdb9d4c8e9c834d279163609bef575d",
"versionType": "git"
},
{
"lessThan": "7b2d4c04816cdc887f472caaf7fc966cfc107e40",
"status": "affected",
"version": "160fbcf3bfb93c3c086427f9f4c8bc70f217e9be",
"versionType": "git"
},
{
"lessThan": "1e1e509b6fd2a42421745bbcd98bd16daad20904",
"status": "affected",
"version": "160fbcf3bfb93c3c086427f9f4c8bc70f217e9be",
"versionType": "git"
},
{
"lessThan": "2c1143564c71e7497b42d8360a8379ccbb011d3c",
"status": "affected",
"version": "160fbcf3bfb93c3c086427f9f4c8bc70f217e9be",
"versionType": "git"
},
{
"lessThan": "3485c7236c59c8c34a41af1c4b52982437554e79",
"status": "affected",
"version": "160fbcf3bfb93c3c086427f9f4c8bc70f217e9be",
"versionType": "git"
},
{
"lessThan": "f743eab6486965f276c7e3f1700895f014fdc6db",
"status": "affected",
"version": "160fbcf3bfb93c3c086427f9f4c8bc70f217e9be",
"versionType": "git"
},
{
"lessThan": "daf23014e5d975e72ea9c02b5160d3fcf070ea47",
"status": "affected",
"version": "160fbcf3bfb93c3c086427f9f4c8bc70f217e9be",
"versionType": "git"
},
{
"status": "affected",
"version": "9b67438e315b925a699f0178f4a48baf3d2d6ef4",
"versionType": "git"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.78",
"versionType": "semver"
},
{
"lessThan": "6.1",
"status": "affected",
"version": "6.0.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/virtio_bt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: virtio_bt: validate rx pkt_type header length\n\nvirtbt_rx_handle() reads the leading pkt_type byte from the RX skb\nand forwards the remainder to hci_recv_frame() for every\nevent/ACL/SCO/ISO type, without checking that the remaining payload\nis at least the fixed HCI header for that type.\n\nAfter the preceding patch bounds the backend-supplied used.len to\n[1, VIRTBT_RX_BUF_SIZE], a one-byte completion still reaches\nhci_recv_frame() with skb-\u003elen already pulled to 0. If the byte\nhappened to be HCI_ACLDATA_PKT, the ACL-vs-ISO classification\nfast-path in hci_dev_classify_pkt_type() dereferences\nhci_acl_hdr(skb)-\u003ehandle whenever the HCI device has an active\nCIS_LINK, BIS_LINK, or PA_LINK connection, reading two bytes of\nuninitialized RX-buffer data. The same hazard exists for every\npacket type the driver accepts because none of the switch cases in\nvirtbt_rx_handle() check skb-\u003elen against the per-type minimum HCI\nheader size before handing the frame to the core.\n\nAfter stripping pkt_type, require skb-\u003elen to cover the fixed\nheader size for the selected type (event 2, ACL 4, SCO 3, ISO 4)\nbefore calling hci_recv_frame(); drop ratelimited otherwise.\nUnknown pkt_type values still take the original kfree_skb() default\npath.\n\nUse bt_dev_err_ratelimited() because both the length and pkt_type\nvalues come from an untrusted backend that can otherwise flood the\nkernel log."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:01:09.675Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/149cfb42ad69c7964fd9f2c43831da9152007129"
},
{
"url": "https://git.kernel.org/stable/c/7b2d4c04816cdc887f472caaf7fc966cfc107e40"
},
{
"url": "https://git.kernel.org/stable/c/1e1e509b6fd2a42421745bbcd98bd16daad20904"
},
{
"url": "https://git.kernel.org/stable/c/2c1143564c71e7497b42d8360a8379ccbb011d3c"
},
{
"url": "https://git.kernel.org/stable/c/3485c7236c59c8c34a41af1c4b52982437554e79"
},
{
"url": "https://git.kernel.org/stable/c/f743eab6486965f276c7e3f1700895f014fdc6db"
},
{
"url": "https://git.kernel.org/stable/c/daf23014e5d975e72ea9c02b5160d3fcf070ea47"
}
],
"title": "Bluetooth: virtio_bt: validate rx pkt_type header length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46186",
"datePublished": "2026-05-28T09:36:40.349Z",
"dateReserved": "2026-05-13T15:03:33.103Z",
"dateUpdated": "2026-06-14T18:01:09.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53266 (GCVE-0-2026-53266)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: make ebt_snat ARP rewrite writable
The ebtables SNAT target keeps the Ethernet source address rewrite
behind skb_ensure_writable(skb, 0). This is intentional: at the bridge
ebtables hooks the Ethernet header is addressed through
skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet
payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check
the payload, not the Ethernet header, and would reintroduce the small
packet regression fixed by commit 63137bc5882a.
However, the optional ARP sender hardware address rewrite is different.
It writes through skb_store_bits() at an offset relative to skb->data:
skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN)
skb_header_pointer() only safely reads the ARP header; it does not make
the later sender hardware address range writable. If that range is
still held in a nonlinear skb fragment backed by a splice-imported file
page, skb_store_bits() maps the frag page and copies the new MAC address
directly into it.
Ensure the ARP SHA range is writable before reading the ARP header and
before calling skb_store_bits().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 63137bc5882a1882c553d389fdeeeace86ee1741 Version: 63137bc5882a1882c553d389fdeeeace86ee1741 Version: 63137bc5882a1882c553d389fdeeeace86ee1741 Version: 63137bc5882a1882c553d389fdeeeace86ee1741 Version: 63137bc5882a1882c553d389fdeeeace86ee1741 Version: 63137bc5882a1882c553d389fdeeeace86ee1741 Version: 63137bc5882a1882c553d389fdeeeace86ee1741 Version: 63137bc5882a1882c553d389fdeeeace86ee1741 Version: 2f3839075a5f8dcf116c1abe35b36b018ac62445 Version: 51ba2945a8ef65ae437c8f9ba05f0343aa82ae5b Version: b7d23c2c87584eb429f115c078ed511be8b18e29 Version: 5.4.73 ≤ Version: 5.8.17 ≤ Version: 5.9.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/netfilter/ebt_snat.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87",
"status": "affected",
"version": "63137bc5882a1882c553d389fdeeeace86ee1741",
"versionType": "git"
},
{
"lessThan": "76280b78cc9f23bdc6438e10ad6dff148ef8375b",
"status": "affected",
"version": "63137bc5882a1882c553d389fdeeeace86ee1741",
"versionType": "git"
},
{
"lessThan": "b7e91939ba9be805a62a257fa4e227dffbb88fa0",
"status": "affected",
"version": "63137bc5882a1882c553d389fdeeeace86ee1741",
"versionType": "git"
},
{
"lessThan": "afd64b59c3de9bbbdd3759e834fdc55cda716e0b",
"status": "affected",
"version": "63137bc5882a1882c553d389fdeeeace86ee1741",
"versionType": "git"
},
{
"lessThan": "153ea96c806aea395daba907a4f88480b6ad5093",
"status": "affected",
"version": "63137bc5882a1882c553d389fdeeeace86ee1741",
"versionType": "git"
},
{
"lessThan": "b18675263db1147c8e1cab625400c13a0d87bd2d",
"status": "affected",
"version": "63137bc5882a1882c553d389fdeeeace86ee1741",
"versionType": "git"
},
{
"lessThan": "c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5",
"status": "affected",
"version": "63137bc5882a1882c553d389fdeeeace86ee1741",
"versionType": "git"
},
{
"lessThan": "67ba971ae02514d85818fe0c32549ab4bfa3bf49",
"status": "affected",
"version": "63137bc5882a1882c553d389fdeeeace86ee1741",
"versionType": "git"
},
{
"status": "affected",
"version": "2f3839075a5f8dcf116c1abe35b36b018ac62445",
"versionType": "git"
},
{
"status": "affected",
"version": "51ba2945a8ef65ae437c8f9ba05f0343aa82ae5b",
"versionType": "git"
},
{
"status": "affected",
"version": "b7d23c2c87584eb429f115c078ed511be8b18e29",
"versionType": "git"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.73",
"versionType": "semver"
},
{
"lessThan": "5.9",
"status": "affected",
"version": "5.8.17",
"versionType": "semver"
},
{
"lessThan": "5.10",
"status": "affected",
"version": "5.9.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/netfilter/ebt_snat.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.8.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.9.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: make ebt_snat ARP rewrite writable\n\nThe ebtables SNAT target keeps the Ethernet source address rewrite\nbehind skb_ensure_writable(skb, 0). This is intentional: at the bridge\nebtables hooks the Ethernet header is addressed through\nskb_mac_header()/eth_hdr(), while skb-\u003edata points at the Ethernet\npayload. Asking skb_ensure_writable() for ETH_HLEN bytes would check\nthe payload, not the Ethernet header, and would reintroduce the small\npacket regression fixed by commit 63137bc5882a.\n\nHowever, the optional ARP sender hardware address rewrite is different.\nIt writes through skb_store_bits() at an offset relative to skb-\u003edata:\n\n skb_store_bits(skb, sizeof(struct arphdr), info-\u003emac, ETH_ALEN)\n\nskb_header_pointer() only safely reads the ARP header; it does not make\nthe later sender hardware address range writable. If that range is\nstill held in a nonlinear skb fragment backed by a splice-imported file\npage, skb_store_bits() maps the frag page and copies the new MAC address\ndirectly into it.\n\nEnsure the ARP SHA range is writable before reading the ARP header and\nbefore calling skb_store_bits()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local control of bridge/ebtables configuration and arranging an skb with shared non-linear backing memory; remote ARP traffic alone cannot create the splice-backed page condition.\nAC:L - There is no race or rare external timing condition; the attacker can control the rule, ARP frame layout, and shared-frag setup needed to reach the write.\nPR:L - The ebtables rule path requires CAP_NET_ADMIN, but this is reachable with namespace-local privileges via user/network namespaces rather than requiring init-namespace root.\nUI:N - No victim action is required once the attacker can configure the namespace and send the crafted traffic through the bridge path.\nS:C - The bug can let namespace-local network privileges corrupt file-backed/page-cache memory outside the bridge/netfilter security boundary, plausibly crossing a sandbox or namespace boundary.\nC:H - The shared-page corruption can be leveraged toward privilege escalation or code execution, which can expose high-value system data.\nI:H - skb_store_bits() writes attacker-chosen MAC bytes into shared backing pages, giving a controlled corruption primitive against file-backed memory.\nA:H - Controlled corruption of shared/file-backed pages can damage critical files or executable contents and can be repeated to cause severe system availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:43.383Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87"
},
{
"url": "https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b"
},
{
"url": "https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0"
},
{
"url": "https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b"
},
{
"url": "https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093"
},
{
"url": "https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d"
},
{
"url": "https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5"
},
{
"url": "https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49"
}
],
"title": "netfilter: bridge: make ebt_snat ARP rewrite writable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53266",
"datePublished": "2026-06-25T08:39:53.190Z",
"dateReserved": "2026-06-09T07:44:35.395Z",
"dateUpdated": "2026-08-05T12:34:43.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45835 (GCVE-0-2026-45835)
Vulnerability from cvelistv5
Published
2026-05-26 16:14
Modified
2026-06-14 17:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()
Add the same NULL guard already present in
l2cap_sock_resume_cb() and l2cap_sock_ready_cb().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 80808e431e1ef25856457de82ce141bed6a6313a Version: 80808e431e1ef25856457de82ce141bed6a6313a Version: 80808e431e1ef25856457de82ce141bed6a6313a Version: 80808e431e1ef25856457de82ce141bed6a6313a Version: 80808e431e1ef25856457de82ce141bed6a6313a Version: 80808e431e1ef25856457de82ce141bed6a6313a Version: 80808e431e1ef25856457de82ce141bed6a6313a Version: 80808e431e1ef25856457de82ce141bed6a6313a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "140b63cb46f2855ac4ec8fba2f1e974a9c2974e8",
"status": "affected",
"version": "80808e431e1ef25856457de82ce141bed6a6313a",
"versionType": "git"
},
{
"lessThan": "2422eaed0925973c0f318c94eb13e76f14c7381e",
"status": "affected",
"version": "80808e431e1ef25856457de82ce141bed6a6313a",
"versionType": "git"
},
{
"lessThan": "684a1f9ee2325437ae18ac5371884e4c6a25ae73",
"status": "affected",
"version": "80808e431e1ef25856457de82ce141bed6a6313a",
"versionType": "git"
},
{
"lessThan": "ab77c8bc30269bee15d917059a66bea48909f5f0",
"status": "affected",
"version": "80808e431e1ef25856457de82ce141bed6a6313a",
"versionType": "git"
},
{
"lessThan": "bc3bb9f40da8e53896abc2d29c6d0c6686fe4ab9",
"status": "affected",
"version": "80808e431e1ef25856457de82ce141bed6a6313a",
"versionType": "git"
},
{
"lessThan": "741e6024e31587b0c021b6616a9e428a4ea0b64a",
"status": "affected",
"version": "80808e431e1ef25856457de82ce141bed6a6313a",
"versionType": "git"
},
{
"lessThan": "76083fb80f5a38ac13326b2d810f66bd07771eea",
"status": "affected",
"version": "80808e431e1ef25856457de82ce141bed6a6313a",
"versionType": "git"
},
{
"lessThan": "0a120d96166301d7a95be75b52f843837dbd1219",
"status": "affected",
"version": "80808e431e1ef25856457de82ce141bed6a6313a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.1"
},
{
"lessThan": "3.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()\n\nAdd the same NULL guard already present in\nl2cap_sock_resume_cb() and l2cap_sock_ready_cb()."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:45:55.302Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/140b63cb46f2855ac4ec8fba2f1e974a9c2974e8"
},
{
"url": "https://git.kernel.org/stable/c/2422eaed0925973c0f318c94eb13e76f14c7381e"
},
{
"url": "https://git.kernel.org/stable/c/684a1f9ee2325437ae18ac5371884e4c6a25ae73"
},
{
"url": "https://git.kernel.org/stable/c/ab77c8bc30269bee15d917059a66bea48909f5f0"
},
{
"url": "https://git.kernel.org/stable/c/bc3bb9f40da8e53896abc2d29c6d0c6686fe4ab9"
},
{
"url": "https://git.kernel.org/stable/c/741e6024e31587b0c021b6616a9e428a4ea0b64a"
},
{
"url": "https://git.kernel.org/stable/c/76083fb80f5a38ac13326b2d810f66bd07771eea"
},
{
"url": "https://git.kernel.org/stable/c/0a120d96166301d7a95be75b52f843837dbd1219"
}
],
"title": "Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45835",
"datePublished": "2026-05-26T16:14:12.195Z",
"dateReserved": "2026-05-13T15:03:33.077Z",
"dateUpdated": "2026-06-14T17:45:55.302Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53021 (GCVE-0-2026-53021)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: core: Fix integer overflow in UNMAP bounds check
sbc_execute_unmap() checks LBA + range does not exceed the device capacity,
but does not guard against LBA + range wrapping around on 64-bit overflow.
Add an overflow check matching the pattern already used for WRITE_SAME in
the same file.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 86d7182985d25900929adce14fffd729cc8c6fb8 Version: 86d7182985d25900929adce14fffd729cc8c6fb8 Version: 86d7182985d25900929adce14fffd729cc8c6fb8 Version: 86d7182985d25900929adce14fffd729cc8c6fb8 Version: 86d7182985d25900929adce14fffd729cc8c6fb8 Version: 86d7182985d25900929adce14fffd729cc8c6fb8 Version: 86d7182985d25900929adce14fffd729cc8c6fb8 Version: 86d7182985d25900929adce14fffd729cc8c6fb8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_sbc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c08ab702c4699c6efb9d60bdb15b73e7a627ee7e",
"status": "affected",
"version": "86d7182985d25900929adce14fffd729cc8c6fb8",
"versionType": "git"
},
{
"lessThan": "2e1ed9a7b6ea5bfefb5d80a02b1c71c7dee1f0dd",
"status": "affected",
"version": "86d7182985d25900929adce14fffd729cc8c6fb8",
"versionType": "git"
},
{
"lessThan": "5efc3ef4758f8d98c257419fa21daca3227de61a",
"status": "affected",
"version": "86d7182985d25900929adce14fffd729cc8c6fb8",
"versionType": "git"
},
{
"lessThan": "d7aef29573c7c5cdb2dfad939253287a6329c2a4",
"status": "affected",
"version": "86d7182985d25900929adce14fffd729cc8c6fb8",
"versionType": "git"
},
{
"lessThan": "3facdecc3fcf115cc4f9b3d8f118d6705e2456a8",
"status": "affected",
"version": "86d7182985d25900929adce14fffd729cc8c6fb8",
"versionType": "git"
},
{
"lessThan": "51075df70c46e60a9773f2dcd28299e40dac36fb",
"status": "affected",
"version": "86d7182985d25900929adce14fffd729cc8c6fb8",
"versionType": "git"
},
{
"lessThan": "02115986d027ade793e7f6be87e91d6a796d0aa3",
"status": "affected",
"version": "86d7182985d25900929adce14fffd729cc8c6fb8",
"versionType": "git"
},
{
"lessThan": "2bf2d65f76697820dbc4227d13866293576dd90a",
"status": "affected",
"version": "86d7182985d25900929adce14fffd729cc8c6fb8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_sbc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: core: Fix integer overflow in UNMAP bounds check\n\nsbc_execute_unmap() checks LBA + range does not exceed the device capacity,\nbut does not guard against LBA + range wrapping around on 64-bit overflow.\n\nAdd an overflow check matching the pattern already used for WRITE_SAME in\nthe same file."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:30.671Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c08ab702c4699c6efb9d60bdb15b73e7a627ee7e"
},
{
"url": "https://git.kernel.org/stable/c/2e1ed9a7b6ea5bfefb5d80a02b1c71c7dee1f0dd"
},
{
"url": "https://git.kernel.org/stable/c/5efc3ef4758f8d98c257419fa21daca3227de61a"
},
{
"url": "https://git.kernel.org/stable/c/d7aef29573c7c5cdb2dfad939253287a6329c2a4"
},
{
"url": "https://git.kernel.org/stable/c/3facdecc3fcf115cc4f9b3d8f118d6705e2456a8"
},
{
"url": "https://git.kernel.org/stable/c/51075df70c46e60a9773f2dcd28299e40dac36fb"
},
{
"url": "https://git.kernel.org/stable/c/02115986d027ade793e7f6be87e91d6a796d0aa3"
},
{
"url": "https://git.kernel.org/stable/c/2bf2d65f76697820dbc4227d13866293576dd90a"
}
],
"title": "scsi: target: core: Fix integer overflow in UNMAP bounds check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53021",
"datePublished": "2026-06-24T16:29:30.671Z",
"dateReserved": "2026-06-09T07:44:35.379Z",
"dateUpdated": "2026-06-24T16:29:30.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43124 (GCVE-0-2026-43124)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-23 16:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
pstore: ram_core: fix incorrect success return when vmap() fails
In persistent_ram_vmap(), vmap() may return NULL on failure.
If offset is non-zero, adding offset_in_page(start) causes the function
to return a non-NULL pointer even though the mapping failed.
persistent_ram_buffer_map() therefore incorrectly returns success.
Subsequent access to prz->buffer may dereference an invalid address
and cause crashes.
Add proper NULL checking for vmap() failures.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 831b624df1b420c8f9281ed1307a8db23afb72df Version: 831b624df1b420c8f9281ed1307a8db23afb72df Version: 831b624df1b420c8f9281ed1307a8db23afb72df Version: 831b624df1b420c8f9281ed1307a8db23afb72df Version: 831b624df1b420c8f9281ed1307a8db23afb72df Version: 831b624df1b420c8f9281ed1307a8db23afb72df Version: 831b624df1b420c8f9281ed1307a8db23afb72df Version: 831b624df1b420c8f9281ed1307a8db23afb72df Version: 9095f19baae92afb978f8df77d19280fe291b337 Version: 36a9916189b46b78dbf4fa542739b464444f0537 Version: 1cd01dba1355e291f636555b1920625ed58c1623 Version: 7026e2457c5b0c0e8a81e65a8209b8420a437b4d Version: 1e5b387747ba285a64348b9a96b246d0b9d52b03 Version: d0028f48b33086cf6d8f87831a650866107b5785 Version: 3.16.62 ≤ Version: 3.18.123 ≤ Version: 4.4.158 ≤ Version: 4.9.129 ≤ Version: 4.14.72 ≤ Version: 4.18.10 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/pstore/ram_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d47234840aeb4182ed3ee795c578b1dfa9cbd25b",
"status": "affected",
"version": "831b624df1b420c8f9281ed1307a8db23afb72df",
"versionType": "git"
},
{
"lessThan": "49918dd52615097529811d21ec6074dd02ebe77c",
"status": "affected",
"version": "831b624df1b420c8f9281ed1307a8db23afb72df",
"versionType": "git"
},
{
"lessThan": "8baa234181f632cabacf73e4834a910859e9fcc9",
"status": "affected",
"version": "831b624df1b420c8f9281ed1307a8db23afb72df",
"versionType": "git"
},
{
"lessThan": "1da904e84de608907662ad8a51ba9c571d61e003",
"status": "affected",
"version": "831b624df1b420c8f9281ed1307a8db23afb72df",
"versionType": "git"
},
{
"lessThan": "8d849adfbc3e98417fb541620568db1a759ef441",
"status": "affected",
"version": "831b624df1b420c8f9281ed1307a8db23afb72df",
"versionType": "git"
},
{
"lessThan": "2c99326dc1c79b7ce3c8dd92929b5ce724ff70eb",
"status": "affected",
"version": "831b624df1b420c8f9281ed1307a8db23afb72df",
"versionType": "git"
},
{
"lessThan": "88d5b28f63c7aac1271784e3b800ed405d1cde75",
"status": "affected",
"version": "831b624df1b420c8f9281ed1307a8db23afb72df",
"versionType": "git"
},
{
"lessThan": "05363abc7625cf18c96e67f50673cd07f11da5e9",
"status": "affected",
"version": "831b624df1b420c8f9281ed1307a8db23afb72df",
"versionType": "git"
},
{
"status": "affected",
"version": "9095f19baae92afb978f8df77d19280fe291b337",
"versionType": "git"
},
{
"status": "affected",
"version": "36a9916189b46b78dbf4fa542739b464444f0537",
"versionType": "git"
},
{
"status": "affected",
"version": "1cd01dba1355e291f636555b1920625ed58c1623",
"versionType": "git"
},
{
"status": "affected",
"version": "7026e2457c5b0c0e8a81e65a8209b8420a437b4d",
"versionType": "git"
},
{
"status": "affected",
"version": "1e5b387747ba285a64348b9a96b246d0b9d52b03",
"versionType": "git"
},
{
"status": "affected",
"version": "d0028f48b33086cf6d8f87831a650866107b5785",
"versionType": "git"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.62",
"versionType": "semver"
},
{
"lessThan": "3.19",
"status": "affected",
"version": "3.18.123",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.158",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.129",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.72",
"versionType": "semver"
},
{
"lessThan": "4.19",
"status": "affected",
"version": "4.18.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/pstore/ram_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.158",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.129",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.18.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npstore: ram_core: fix incorrect success return when vmap() fails\n\nIn persistent_ram_vmap(), vmap() may return NULL on failure.\n\nIf offset is non-zero, adding offset_in_page(start) causes the function\nto return a non-NULL pointer even though the mapping failed.\npersistent_ram_buffer_map() therefore incorrectly returns success.\n\nSubsequent access to prz-\u003ebuffer may dereference an invalid address\nand cause crashes.\n\nAdd proper NULL checking for vmap() failures."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:06:20.362Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d47234840aeb4182ed3ee795c578b1dfa9cbd25b"
},
{
"url": "https://git.kernel.org/stable/c/49918dd52615097529811d21ec6074dd02ebe77c"
},
{
"url": "https://git.kernel.org/stable/c/8baa234181f632cabacf73e4834a910859e9fcc9"
},
{
"url": "https://git.kernel.org/stable/c/1da904e84de608907662ad8a51ba9c571d61e003"
},
{
"url": "https://git.kernel.org/stable/c/8d849adfbc3e98417fb541620568db1a759ef441"
},
{
"url": "https://git.kernel.org/stable/c/2c99326dc1c79b7ce3c8dd92929b5ce724ff70eb"
},
{
"url": "https://git.kernel.org/stable/c/88d5b28f63c7aac1271784e3b800ed405d1cde75"
},
{
"url": "https://git.kernel.org/stable/c/05363abc7625cf18c96e67f50673cd07f11da5e9"
}
],
"title": "pstore: ram_core: fix incorrect success return when vmap() fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43124",
"datePublished": "2026-05-06T11:27:10.221Z",
"dateReserved": "2026-05-01T14:12:55.987Z",
"dateUpdated": "2026-05-23T16:06:20.362Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43342 (GCVE-0-2026-43342)
Vulnerability from cvelistv5
Published
2026-05-08 13:37
Modified
2026-05-11 22:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_rndis: Protect RNDIS options with mutex
The class/subclass/protocol options are suspectible to race conditions
as they can be accessed concurrently through configfs.
Use existing mutex to protect these options. This issue was identified
during code inspection.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 73517cf49bd449122b615d2b7a6bb835f02252e5 Version: 73517cf49bd449122b615d2b7a6bb835f02252e5 Version: 73517cf49bd449122b615d2b7a6bb835f02252e5 Version: 73517cf49bd449122b615d2b7a6bb835f02252e5 Version: 73517cf49bd449122b615d2b7a6bb835f02252e5 Version: 73517cf49bd449122b615d2b7a6bb835f02252e5 Version: 73517cf49bd449122b615d2b7a6bb835f02252e5 Version: 73517cf49bd449122b615d2b7a6bb835f02252e5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_rndis.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0a75d97c53477a59c0aa1c65f69038c719f9c5b8",
"status": "affected",
"version": "73517cf49bd449122b615d2b7a6bb835f02252e5",
"versionType": "git"
},
{
"lessThan": "c1b3d5b0acb194efe20fc5864ee03439fa7bd45c",
"status": "affected",
"version": "73517cf49bd449122b615d2b7a6bb835f02252e5",
"versionType": "git"
},
{
"lessThan": "65b7dbf80a1627667c241fff7c1c224f3118014f",
"status": "affected",
"version": "73517cf49bd449122b615d2b7a6bb835f02252e5",
"versionType": "git"
},
{
"lessThan": "cb5316b37288ab8791584e32f114c4f41ad45b67",
"status": "affected",
"version": "73517cf49bd449122b615d2b7a6bb835f02252e5",
"versionType": "git"
},
{
"lessThan": "7d8fa3b8783ab95a46e20d97fbeeede719b2efda",
"status": "affected",
"version": "73517cf49bd449122b615d2b7a6bb835f02252e5",
"versionType": "git"
},
{
"lessThan": "446f1842cda929c40d4697722bfdcfb334bc9692",
"status": "affected",
"version": "73517cf49bd449122b615d2b7a6bb835f02252e5",
"versionType": "git"
},
{
"lessThan": "209decd3f7901df9842b83f2540dc8685e344a07",
"status": "affected",
"version": "73517cf49bd449122b615d2b7a6bb835f02252e5",
"versionType": "git"
},
{
"lessThan": "8d8c68b1fc06ece60cf43e1306ff0f4ac121547e",
"status": "affected",
"version": "73517cf49bd449122b615d2b7a6bb835f02252e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_rndis.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_rndis: Protect RNDIS options with mutex\n\nThe class/subclass/protocol options are suspectible to race conditions\nas they can be accessed concurrently through configfs.\n\nUse existing mutex to protect these options. This issue was identified\nduring code inspection."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:22:43.032Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0a75d97c53477a59c0aa1c65f69038c719f9c5b8"
},
{
"url": "https://git.kernel.org/stable/c/c1b3d5b0acb194efe20fc5864ee03439fa7bd45c"
},
{
"url": "https://git.kernel.org/stable/c/65b7dbf80a1627667c241fff7c1c224f3118014f"
},
{
"url": "https://git.kernel.org/stable/c/cb5316b37288ab8791584e32f114c4f41ad45b67"
},
{
"url": "https://git.kernel.org/stable/c/7d8fa3b8783ab95a46e20d97fbeeede719b2efda"
},
{
"url": "https://git.kernel.org/stable/c/446f1842cda929c40d4697722bfdcfb334bc9692"
},
{
"url": "https://git.kernel.org/stable/c/209decd3f7901df9842b83f2540dc8685e344a07"
},
{
"url": "https://git.kernel.org/stable/c/8d8c68b1fc06ece60cf43e1306ff0f4ac121547e"
}
],
"title": "usb: gadget: f_rndis: Protect RNDIS options with mutex",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43342",
"datePublished": "2026-05-08T13:37:19.920Z",
"dateReserved": "2026-05-01T14:12:56.003Z",
"dateUpdated": "2026-05-11T22:22:43.032Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31524 (GCVE-0-2026-31524)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-05-11 22:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: asus: avoid memory leak in asus_report_fixup()
The asus_report_fixup() function was returning a newly allocated
kmemdup()-allocated buffer, but never freeing it. Switch to
devm_kzalloc() to ensure the memory is managed and freed automatically
when the device is removed.
The caller of report_fixup() does not take ownership of the returned
pointer, but it is permitted to return a pointer whose lifetime is at
least that of the input buffer.
Also fix a harmless out-of-bounds read by copying only the original
descriptor size.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5703e52cc711bc01e72cf12b86a126909c79d213 Version: 5703e52cc711bc01e72cf12b86a126909c79d213 Version: 5703e52cc711bc01e72cf12b86a126909c79d213 Version: 5703e52cc711bc01e72cf12b86a126909c79d213 Version: 5703e52cc711bc01e72cf12b86a126909c79d213 Version: 5703e52cc711bc01e72cf12b86a126909c79d213 Version: 5703e52cc711bc01e72cf12b86a126909c79d213 Version: 5703e52cc711bc01e72cf12b86a126909c79d213 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-asus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "726765b43deb2b4723869d673cc5fc6f7a3b2059",
"status": "affected",
"version": "5703e52cc711bc01e72cf12b86a126909c79d213",
"versionType": "git"
},
{
"lessThan": "ede95cfcab8064d9a08813fbd7ed42cea8843dcf",
"status": "affected",
"version": "5703e52cc711bc01e72cf12b86a126909c79d213",
"versionType": "git"
},
{
"lessThan": "2e4fe6b15c2f390c023b20d728b1a3fe7ea4f973",
"status": "affected",
"version": "5703e52cc711bc01e72cf12b86a126909c79d213",
"versionType": "git"
},
{
"lessThan": "f20f17cffbe34fb330267e0f8084f5565f807444",
"status": "affected",
"version": "5703e52cc711bc01e72cf12b86a126909c79d213",
"versionType": "git"
},
{
"lessThan": "7a6d6e4d8af044f94fa97e97af5ff2771e1fbebd",
"status": "affected",
"version": "5703e52cc711bc01e72cf12b86a126909c79d213",
"versionType": "git"
},
{
"lessThan": "a41cc7c1668e44ff2c2d36f9a6353253ffc43e3c",
"status": "affected",
"version": "5703e52cc711bc01e72cf12b86a126909c79d213",
"versionType": "git"
},
{
"lessThan": "84724ac4821a160d47b84289adf139023027bdbb",
"status": "affected",
"version": "5703e52cc711bc01e72cf12b86a126909c79d213",
"versionType": "git"
},
{
"lessThan": "2bad24c17742fc88973d6aea526ce1353f5334a3",
"status": "affected",
"version": "5703e52cc711bc01e72cf12b86a126909c79d213",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-asus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: asus: avoid memory leak in asus_report_fixup()\n\nThe asus_report_fixup() function was returning a newly allocated\nkmemdup()-allocated buffer, but never freeing it. Switch to\ndevm_kzalloc() to ensure the memory is managed and freed automatically\nwhen the device is removed.\n\nThe caller of report_fixup() does not take ownership of the returned\npointer, but it is permitted to return a pointer whose lifetime is at\nleast that of the input buffer.\n\nAlso fix a harmless out-of-bounds read by copying only the original\ndescriptor size."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:10:27.784Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/726765b43deb2b4723869d673cc5fc6f7a3b2059"
},
{
"url": "https://git.kernel.org/stable/c/ede95cfcab8064d9a08813fbd7ed42cea8843dcf"
},
{
"url": "https://git.kernel.org/stable/c/2e4fe6b15c2f390c023b20d728b1a3fe7ea4f973"
},
{
"url": "https://git.kernel.org/stable/c/f20f17cffbe34fb330267e0f8084f5565f807444"
},
{
"url": "https://git.kernel.org/stable/c/7a6d6e4d8af044f94fa97e97af5ff2771e1fbebd"
},
{
"url": "https://git.kernel.org/stable/c/a41cc7c1668e44ff2c2d36f9a6353253ffc43e3c"
},
{
"url": "https://git.kernel.org/stable/c/84724ac4821a160d47b84289adf139023027bdbb"
},
{
"url": "https://git.kernel.org/stable/c/2bad24c17742fc88973d6aea526ce1353f5334a3"
}
],
"title": "HID: asus: avoid memory leak in asus_report_fixup()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31524",
"datePublished": "2026-04-22T13:54:38.389Z",
"dateReserved": "2026-03-09T15:48:24.110Z",
"dateUpdated": "2026-05-11T22:10:27.784Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31674 (GCVE-0-2026-31674)
Vulnerability from cvelistv5
Published
2026-04-25 08:46
Modified
2026-08-05 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
Reject rt match rules whose addrnr exceeds IP6T_RT_HOPS.
rt_mt6() expects addrnr to stay within the bounds of rtinfo->addrs[].
Validate addrnr during rule installation so malformed rules are rejected
before the match logic can use an out-of-range value.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:39.303Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter/ip6t_rt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "13e3e30ed3b5b67cc1db2bd58a5d09b0f07debfa",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "af9b7e2b765966457f4ec23be5bd34a141f89574",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "29ea965a1353bc8303877422f79c8211e9ba9c55",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c6a503a9f4debc654e3a6a7ca1f7fce6a9953c59",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ded71f5684df16fa645cca5bf4fe6b0cd8a46119",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d8795fde1f78669a87c87ac29fceab2f104daa8c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a28ebf6f99de270d6338ccdc3b49f3e818f99b7b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9d3f027327c2fa265f7f85ead41294792c3296ed",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter/ip6t_rt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()\n\nReject rt match rules whose addrnr exceeds IP6T_RT_HOPS.\n\nrt_mt6() expects addrnr to stay within the bounds of rtinfo-\u003eaddrs[].\nValidate addrnr during rule installation so malformed rules are rejected\nbefore the match logic can use an out-of-range value."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable match is installed through the IPv6 iptables setsockopt path, so the attacker must execute local code to submit a malformed rule. Packets only trigger the bad read after that local rule installation step.\nAC:L - No race or external timing condition is required; the attacker controls the malformed `addrnr` value and can generate an IPv6 routing-header packet with enough addresses to reach the out-of-bounds access. The required netfilter match configuration is the affected component rather than an exploitation complexity barrier.\nPR:L - Rule replacement requires `CAP_NET_ADMIN`, but the check is against `sock_net(sk)-\u003euser_ns`, making it reachable to an unprivileged local user who can create a user and network namespace. This is Low rather than High under the kernel guidance.\nUI:N - After the attacker installs the malformed rule, triggering occurs by sending traffic through the affected netfilter hook. No victim user action is required.\nS:U - The bug is in kernel netfilter rule evaluation and impacts the same kernel security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - `addrnr` indexes beyond `rtinfo-\u003eaddrs[]`, causing an out-of-bounds kernel memory read during packet matching. The overread can extend well beyond a few bytes, so confidentiality impact is High.\nI:N - The vulnerable operation is an out-of-bounds read used for address comparison, with no write or direct memory modification primitive. It does not by itself provide kernel memory corruption or control-flow modification.\nA:H - The out-of-bounds read can reach beyond the allocated xtables rule blob, especially with attacker-shaped tables and oversized routing-header address counts. Such kernel invalid memory access is capable of causing an oops or panic, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:21.417Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/13e3e30ed3b5b67cc1db2bd58a5d09b0f07debfa"
},
{
"url": "https://git.kernel.org/stable/c/af9b7e2b765966457f4ec23be5bd34a141f89574"
},
{
"url": "https://git.kernel.org/stable/c/29ea965a1353bc8303877422f79c8211e9ba9c55"
},
{
"url": "https://git.kernel.org/stable/c/c6a503a9f4debc654e3a6a7ca1f7fce6a9953c59"
},
{
"url": "https://git.kernel.org/stable/c/ded71f5684df16fa645cca5bf4fe6b0cd8a46119"
},
{
"url": "https://git.kernel.org/stable/c/d8795fde1f78669a87c87ac29fceab2f104daa8c"
},
{
"url": "https://git.kernel.org/stable/c/a28ebf6f99de270d6338ccdc3b49f3e818f99b7b"
},
{
"url": "https://git.kernel.org/stable/c/9d3f027327c2fa265f7f85ead41294792c3296ed"
}
],
"title": "netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31674",
"datePublished": "2026-04-25T08:46:50.180Z",
"dateReserved": "2026-03-09T15:48:24.130Z",
"dateUpdated": "2026-08-05T12:24:21.417Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43386 (GCVE-0-2026-43386)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-05-11 22:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
The current code checks 'i + 5 < in_len' at the end of the if statement.
However, it accesses 'in_ie[i + 5]' before that check, which can lead
to an out-of-bounds read. Move the length check to the beginning of the
conditional to ensure the index is within bounds before accessing the
array.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6ff2243d5e05a5239e39d4ba61d96b0ea3bf7259",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "12cc6e8f8d4245b7b5a408c6fc8ab1d098d67020",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "209644e25757c499e1c1f08c071ea0386d4448b6",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "768f25613a9fe6766d15a4a72979657adfc1c6d8",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "e14a1148f02e8cf1ca380d57e4b95ca36c97f45d",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "4dd2d9cf563c54e09d5f7eacf95c5b8f538b513b",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "d97fc1b29513010b60fde874c7f0ba816744e18c",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "a75281626fc8fa6dc6c9cc314ee423e8bc45203b",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie\n\nThe current code checks \u0027i + 5 \u003c in_len\u0027 at the end of the if statement.\nHowever, it accesses \u0027in_ie[i + 5]\u0027 before that check, which can lead\nto an out-of-bounds read. Move the length check to the beginning of the\nconditional to ensure the index is within bounds before accessing the\narray."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:23:35.007Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6ff2243d5e05a5239e39d4ba61d96b0ea3bf7259"
},
{
"url": "https://git.kernel.org/stable/c/12cc6e8f8d4245b7b5a408c6fc8ab1d098d67020"
},
{
"url": "https://git.kernel.org/stable/c/209644e25757c499e1c1f08c071ea0386d4448b6"
},
{
"url": "https://git.kernel.org/stable/c/768f25613a9fe6766d15a4a72979657adfc1c6d8"
},
{
"url": "https://git.kernel.org/stable/c/e14a1148f02e8cf1ca380d57e4b95ca36c97f45d"
},
{
"url": "https://git.kernel.org/stable/c/4dd2d9cf563c54e09d5f7eacf95c5b8f538b513b"
},
{
"url": "https://git.kernel.org/stable/c/d97fc1b29513010b60fde874c7f0ba816744e18c"
},
{
"url": "https://git.kernel.org/stable/c/a75281626fc8fa6dc6c9cc314ee423e8bc45203b"
}
],
"title": "staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43386",
"datePublished": "2026-05-08T14:21:32.646Z",
"dateReserved": "2026-05-01T14:12:56.006Z",
"dateUpdated": "2026-05-11T22:23:35.007Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46103 (GCVE-0-2026-46103)
Vulnerability from cvelistv5
Published
2026-05-27 12:59
Modified
2026-06-19 11:59
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: ucan: fix devres lifetime
USB drivers bind to USB interfaces and any device managed resources
should have their lifetime tied to the interface rather than parent USB
device. This avoids issues like memory leaks when drivers are unbound
without their devices being physically disconnected (e.g. on probe
deferral or configuration changes).
Fix the control message buffer lifetime so that it is released on driver
unbind.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9f2d3eae88d26c29d96e42983b755940d9169cd9 Version: 9f2d3eae88d26c29d96e42983b755940d9169cd9 Version: 9f2d3eae88d26c29d96e42983b755940d9169cd9 Version: 9f2d3eae88d26c29d96e42983b755940d9169cd9 Version: 9f2d3eae88d26c29d96e42983b755940d9169cd9 Version: 9f2d3eae88d26c29d96e42983b755940d9169cd9 Version: 9f2d3eae88d26c29d96e42983b755940d9169cd9 Version: 9f2d3eae88d26c29d96e42983b755940d9169cd9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/ucan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a90f0815aaa9c629ac4750e7c71c357dd7f231d7",
"status": "affected",
"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9",
"versionType": "git"
},
{
"lessThan": "cb2e41e87a2893345859440017e7178bf7a4c70d",
"status": "affected",
"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9",
"versionType": "git"
},
{
"lessThan": "3df5b9110ac08f67ccfe382fc172bfee95688eec",
"status": "affected",
"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9",
"versionType": "git"
},
{
"lessThan": "4b7d07747400cfd7eff1ba7b8b5a7c8d5a58f705",
"status": "affected",
"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9",
"versionType": "git"
},
{
"lessThan": "10b7b676b78a7bd888d19729b459aad7fc1f428b",
"status": "affected",
"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9",
"versionType": "git"
},
{
"lessThan": "c524c124e3094d2de12235a513854c03d06a2b58",
"status": "affected",
"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9",
"versionType": "git"
},
{
"lessThan": "c0d3ccc6929e4509076df8f30a4fb1dc5018b0ae",
"status": "affected",
"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9",
"versionType": "git"
},
{
"lessThan": "fed4626501c871890da287bec62a96e52da1af89",
"status": "affected",
"version": "9f2d3eae88d26c29d96e42983b755940d9169cd9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/can/usb/ucan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: ucan: fix devres lifetime\n\nUSB drivers bind to USB interfaces and any device managed resources\nshould have their lifetime tied to the interface rather than parent USB\ndevice. This avoids issues like memory leaks when drivers are unbound\nwithout their devices being physically disconnected (e.g. on probe\ndeferral or configuration changes).\n\nFix the control message buffer lifetime so that it is released on driver\nunbind."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-19T11:59:29.306Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a90f0815aaa9c629ac4750e7c71c357dd7f231d7"
},
{
"url": "https://git.kernel.org/stable/c/cb2e41e87a2893345859440017e7178bf7a4c70d"
},
{
"url": "https://git.kernel.org/stable/c/3df5b9110ac08f67ccfe382fc172bfee95688eec"
},
{
"url": "https://git.kernel.org/stable/c/4b7d07747400cfd7eff1ba7b8b5a7c8d5a58f705"
},
{
"url": "https://git.kernel.org/stable/c/10b7b676b78a7bd888d19729b459aad7fc1f428b"
},
{
"url": "https://git.kernel.org/stable/c/c524c124e3094d2de12235a513854c03d06a2b58"
},
{
"url": "https://git.kernel.org/stable/c/c0d3ccc6929e4509076df8f30a4fb1dc5018b0ae"
},
{
"url": "https://git.kernel.org/stable/c/fed4626501c871890da287bec62a96e52da1af89"
}
],
"title": "can: ucan: fix devres lifetime",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46103",
"datePublished": "2026-05-27T12:59:11.533Z",
"dateReserved": "2026-05-13T15:03:33.097Z",
"dateUpdated": "2026-06-19T11:59:29.306Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52982 (GCVE-0-2026-52982)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit()
when accessing skb->len for tx statistics after usb_submit_urb() has
been called:
BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x760
drivers/net/usb/rtl8150.c:712
Read of size 4 at addr ffff88810eb7a930 by task kworker/0:4/5226
The URB completion handler write_bulk_callback() frees the skb via
dev_kfree_skb_irq(dev->tx_skb). The URB may complete on another CPU
in softirq context before usb_submit_urb() returns in the submitter,
so by the time the submitter reads skb->len the skb has already been
queued to the per-CPU completion_queue and freed by net_tx_action():
CPU A (xmit) CPU B (USB completion softirq)
------------ ------------------------------
dev->tx_skb = skb;
usb_submit_urb() --+
|-------> write_bulk_callback()
| dev_kfree_skb_irq(dev->tx_skb)
| net_tx_action()
| napi_skb_cache_put() <-- free
netdev->stats.tx_bytes |
+= skb->len; <-- UAF read
Fix it by caching skb->len before submitting the URB and using the
cached value when updating the tx_bytes counter.
The pre-existing tx_bytes semantics are preserved: the counter tracks
the original frame length (skb->len), not the ETH_ZLEN/USB-alignment
padded "count" value that is handed to the device. Changing that
would be a user-visible accounting change and is out of scope for
this UAF fix.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/rtl8150.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5af290c86fa81ddbc86a08d54229af5daa40c6a4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "24831b0b2ada9fef18d1f486b7b7c444ee5ba637",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "423b5b86e14e190f6e3161eb5f2ea5f908295ba7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5db090ca07b28a63fb1499690cf19a3f3adafacb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "30cf9829d09ca958279c937af8e35495cd2f1e09",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6999d70e0eda39af029fa1891c48f0a8832b09d5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4dd7eb94f79486b77ca6b4c8676aedbc465dc802",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "23f0e34c64acba15cad4d23e50f41f533da195fa",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/rtl8150.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()\n\nsyzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit()\nwhen accessing skb-\u003elen for tx statistics after usb_submit_urb() has\nbeen called:\n\n BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x760\n drivers/net/usb/rtl8150.c:712\n Read of size 4 at addr ffff88810eb7a930 by task kworker/0:4/5226\n\nThe URB completion handler write_bulk_callback() frees the skb via\ndev_kfree_skb_irq(dev-\u003etx_skb). The URB may complete on another CPU\nin softirq context before usb_submit_urb() returns in the submitter,\nso by the time the submitter reads skb-\u003elen the skb has already been\nqueued to the per-CPU completion_queue and freed by net_tx_action():\n\n CPU A (xmit) CPU B (USB completion softirq)\n ------------ ------------------------------\n dev-\u003etx_skb = skb;\n usb_submit_urb() --+\n |-------\u003e write_bulk_callback()\n | dev_kfree_skb_irq(dev-\u003etx_skb)\n | net_tx_action()\n | napi_skb_cache_put() \u003c-- free\n netdev-\u003estats.tx_bytes |\n += skb-\u003elen; \u003c-- UAF read\n\nFix it by caching skb-\u003elen before submitting the URB and using the\ncached value when updating the tx_bytes counter.\n\nThe pre-existing tx_bytes semantics are preserved: the counter tracks\nthe original frame length (skb-\u003elen), not the ETH_ZLEN/USB-alignment\npadded \"count\" value that is handed to the device. Changing that\nwould be a user-visible accounting change and is out of scope for\nthis UAF fix."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A remote peer can cause the host to transmit packets through an affected rtl8150 interface via normal network responses such as ICMP replies or TCP resets/ACKs, reaching rtl8150_start_xmit(). Choosing the higher-severity defensible path, this is network-reachable.\nAC:L - The transmit path is repeatable and has no unusual prerequisite beyond traffic through the affected interface; the UAF is a normal asynchronous URB completion lifetime bug. Under the required guidance, UAF/race uncertainty is scored low complexity unless clearly beyond attacker influence.\nPR:N - Network-triggered host replies require no local account or authentication. Even the local sendto() path has no driver privilege check, but the network path supports PR:N.\nUI:N - No victim action is needed once the affected interface is present and configured. Packets or induced replies can repeatedly drive the transmit path.\nS:U - The corruption occurs within the kernel networking/USB driver security authority. There is no VM escape, IOMMU bypass, or cross-scope boundary identified.\nC:H - This is a slab use-after-free on an skb after the completion path can free it. Per the required kernel guidance, UAFs are scored as high confidentiality impact because freed object reuse can enable information disclosure.\nI:H - Use-after-free memory lifetime bugs can be shaped through heap reuse and may provide write/control-flow primitives. Per the required guidance, UAFs are high integrity impact.\nA:H - The reported bug is a KASAN slab-use-after-free in kernel transmit code and can crash or destabilize the kernel when triggered repeatedly. Per the required guidance, UAFs have high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:20.308Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5af290c86fa81ddbc86a08d54229af5daa40c6a4"
},
{
"url": "https://git.kernel.org/stable/c/24831b0b2ada9fef18d1f486b7b7c444ee5ba637"
},
{
"url": "https://git.kernel.org/stable/c/423b5b86e14e190f6e3161eb5f2ea5f908295ba7"
},
{
"url": "https://git.kernel.org/stable/c/5db090ca07b28a63fb1499690cf19a3f3adafacb"
},
{
"url": "https://git.kernel.org/stable/c/30cf9829d09ca958279c937af8e35495cd2f1e09"
},
{
"url": "https://git.kernel.org/stable/c/6999d70e0eda39af029fa1891c48f0a8832b09d5"
},
{
"url": "https://git.kernel.org/stable/c/4dd7eb94f79486b77ca6b4c8676aedbc465dc802"
},
{
"url": "https://git.kernel.org/stable/c/23f0e34c64acba15cad4d23e50f41f533da195fa"
}
],
"title": "net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52982",
"datePublished": "2026-06-24T16:28:57.763Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-08-05T12:32:20.308Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53060 (GCVE-0-2026-53060)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm cache metadata: fix memory leak on metadata abort retry
When failing to acquire the root_lock in dm_cache_metadata_abort because
the block_manager is read-only, the temporary block_manager created
outside the root_lock is not properly released, causing a memory leak.
Reproduce steps:
This can be reproduced by reloading a new table while the metadata
is read-only. While the second call to dm_cache_metadata_abort is
caused by lack of support for table preload in dm-cache, mentioned
in commit 9b1cc9f251af ("dm cache: share cache-metadata object across
inactive and active DM tables"), it exposes the memory leak in
dm_cache_metadata_abort when the function is called multiple times.
Specifically, dm-cache fails to sync the new cache object's mode during
preresume, creating the reproducer condition.
This issue could also occur through concurrent metadata_operation_failed
calls due to races in cache mode updates, but the table preload scenario
below provides a reliable reproducer.
1. Create a cache device with some faulty trailing metadata blocks
dmsetup create cmeta <<EOF
0 200 linear /dev/sdc 0
200 7992 error
EOF
dmsetup create cdata --table "0 131072 linear /dev/sdc 8192"
dmsetup create corig --table "0 262144 linear /dev/sdc 262144"
dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct
dmsetup create cache --table "0 131072 cache /dev/mapper/cmeta \
/dev/mapper/cdata /dev/mapper/corig 128 1 writethrough smq 0"
2. Suspend and resume the cache to start a new metadata transaction and
trigger metadata io errors on the next metadata commit.
dmsetup suspend cache
dmsetup resume cache
3. Write to the cache device to update metadata
fio --filename=/dev/mapper/cache --name test --rw=randwrite --bs=4k \
--randrepeat=0 --direct=1 --size 64k
4. Preload the same table
dmsetup reload cache --table "$(dmsetup table cache)"
5. Resume the new table. This triggers the memory leak.
dmsetup suspend cache
dmsetup resume cache
kmemleak logs:
<snip>
unreferenced object 0xffff8880080c2010 (size 16):
comm "dmsetup", pid 132, jiffies 4294982580
hex dump (first 16 bytes):
00 38 b9 07 80 88 ff ff 6a 6b 6b 6b 6b 6b 6b a5 ...
backtrace (crc 3118f31c):
kmemleak_alloc+0x28/0x40
__kmalloc_cache_noprof+0x3d9/0x510
dm_block_manager_create+0x51/0x140
dm_cache_metadata_abort+0x85/0x320
metadata_operation_failed+0x103/0x1e0
cache_preresume+0xacd/0xe70
dm_table_resume_targets+0xd3/0x320
__dm_resume+0x1b/0xf0
dm_resume+0x127/0x170
<snip>
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b45e77b79215405bd039a690f5b06cc03e8ed27d Version: 28d307f380df88a598bc0186d527462902d9bda1 Version: f74b7c5a85e22cd9091845e0d62a1dd89d0f855f Version: 352b837a5541690d4f843819028cf2b8be83d424 Version: 352b837a5541690d4f843819028cf2b8be83d424 Version: 352b837a5541690d4f843819028cf2b8be83d424 Version: 352b837a5541690d4f843819028cf2b8be83d424 Version: 352b837a5541690d4f843819028cf2b8be83d424 Version: 6e237cacda8b4e976849e7bff9fe7dff0e968586 Version: 3972ae47d0ee9b5b434af5d0cca6cdfd1e239d4f Version: 9958f5ffc44530b650fb4cc9038a4d167fa4f5c1 Version: f472bfc95d9c9653172dbdad39219b32fabf9b92 Version: bdd4e106929ac943f3226d8f03754b480701e97b Version: 5.10.163 ≤ Version: 5.15.87 ≤ Version: 6.1.4 ≤ Version: 4.9.337 ≤ Version: 4.14.303 ≤ Version: 4.19.270 ≤ Version: 5.4.229 ≤ Version: 6.0.18 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-metadata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "14f60e957f34f95a626caec76a8fae88cf4c397f",
"status": "affected",
"version": "b45e77b79215405bd039a690f5b06cc03e8ed27d",
"versionType": "git"
},
{
"lessThan": "6b97cc7a42905755c56bbddc33aa8b792205caee",
"status": "affected",
"version": "28d307f380df88a598bc0186d527462902d9bda1",
"versionType": "git"
},
{
"lessThan": "d1a79620c419a0af1911f99c873014b30740e303",
"status": "affected",
"version": "f74b7c5a85e22cd9091845e0d62a1dd89d0f855f",
"versionType": "git"
},
{
"lessThan": "15c30997dca681f90dbf2d45ee629c1828bf0c0d",
"status": "affected",
"version": "352b837a5541690d4f843819028cf2b8be83d424",
"versionType": "git"
},
{
"lessThan": "b0bd35535bdb6f58505f3a30ee5793986943997a",
"status": "affected",
"version": "352b837a5541690d4f843819028cf2b8be83d424",
"versionType": "git"
},
{
"lessThan": "322a3b70368d49e39591fe9fc6c07d262128b05f",
"status": "affected",
"version": "352b837a5541690d4f843819028cf2b8be83d424",
"versionType": "git"
},
{
"lessThan": "4311ca59a1891d33c4c8b7946f98c34f167fe833",
"status": "affected",
"version": "352b837a5541690d4f843819028cf2b8be83d424",
"versionType": "git"
},
{
"lessThan": "044ca491d4086dc5bf233e9fcb71db52df32f633",
"status": "affected",
"version": "352b837a5541690d4f843819028cf2b8be83d424",
"versionType": "git"
},
{
"status": "affected",
"version": "6e237cacda8b4e976849e7bff9fe7dff0e968586",
"versionType": "git"
},
{
"status": "affected",
"version": "3972ae47d0ee9b5b434af5d0cca6cdfd1e239d4f",
"versionType": "git"
},
{
"status": "affected",
"version": "9958f5ffc44530b650fb4cc9038a4d167fa4f5c1",
"versionType": "git"
},
{
"status": "affected",
"version": "f472bfc95d9c9653172dbdad39219b32fabf9b92",
"versionType": "git"
},
{
"status": "affected",
"version": "bdd4e106929ac943f3226d8f03754b480701e97b",
"versionType": "git"
},
{
"lessThan": "5.10.258",
"status": "affected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.87",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.4",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.337",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.303",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.270",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThan": "6.1",
"status": "affected",
"version": "6.0.18",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-metadata.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10.163",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.337",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.303",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.270",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.229",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache metadata: fix memory leak on metadata abort retry\n\nWhen failing to acquire the root_lock in dm_cache_metadata_abort because\nthe block_manager is read-only, the temporary block_manager created\noutside the root_lock is not properly released, causing a memory leak.\n\nReproduce steps:\n\nThis can be reproduced by reloading a new table while the metadata\nis read-only. While the second call to dm_cache_metadata_abort is\ncaused by lack of support for table preload in dm-cache, mentioned\nin commit 9b1cc9f251af (\"dm cache: share cache-metadata object across\ninactive and active DM tables\"), it exposes the memory leak in\ndm_cache_metadata_abort when the function is called multiple times.\nSpecifically, dm-cache fails to sync the new cache object\u0027s mode during\npreresume, creating the reproducer condition.\n\nThis issue could also occur through concurrent metadata_operation_failed\ncalls due to races in cache mode updates, but the table preload scenario\nbelow provides a reliable reproducer.\n\n1. Create a cache device with some faulty trailing metadata blocks\n\ndmsetup create cmeta \u003c\u003cEOF\n0 200 linear /dev/sdc 0\n200 7992 error\nEOF\ndmsetup create cdata --table \"0 131072 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 262144 linear /dev/sdc 262144\"\ndd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\ndmsetup create cache --table \"0 131072 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 1 writethrough smq 0\"\n\n2. Suspend and resume the cache to start a new metadata transaction and\n trigger metadata io errors on the next metadata commit.\n\ndmsetup suspend cache\ndmsetup resume cache\n\n3. Write to the cache device to update metadata\n\nfio --filename=/dev/mapper/cache --name test --rw=randwrite --bs=4k \\\n--randrepeat=0 --direct=1 --size 64k\n\n4. Preload the same table\n\ndmsetup reload cache --table \"$(dmsetup table cache)\"\n\n5. Resume the new table. This triggers the memory leak.\n\ndmsetup suspend cache\ndmsetup resume cache\n\nkmemleak logs:\n\n\u003csnip\u003e\nunreferenced object 0xffff8880080c2010 (size 16):\n comm \"dmsetup\", pid 132, jiffies 4294982580\n hex dump (first 16 bytes):\n 00 38 b9 07 80 88 ff ff 6a 6b 6b 6b 6b 6b 6b a5 ...\n backtrace (crc 3118f31c):\n kmemleak_alloc+0x28/0x40\n __kmalloc_cache_noprof+0x3d9/0x510\n dm_block_manager_create+0x51/0x140\n dm_cache_metadata_abort+0x85/0x320\n metadata_operation_failed+0x103/0x1e0\n cache_preresume+0xacd/0xe70\n dm_table_resume_targets+0xd3/0x320\n __dm_resume+0x1b/0xf0\n dm_resume+0x127/0x170\n\u003csnip\u003e"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:04.872Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/14f60e957f34f95a626caec76a8fae88cf4c397f"
},
{
"url": "https://git.kernel.org/stable/c/6b97cc7a42905755c56bbddc33aa8b792205caee"
},
{
"url": "https://git.kernel.org/stable/c/d1a79620c419a0af1911f99c873014b30740e303"
},
{
"url": "https://git.kernel.org/stable/c/15c30997dca681f90dbf2d45ee629c1828bf0c0d"
},
{
"url": "https://git.kernel.org/stable/c/b0bd35535bdb6f58505f3a30ee5793986943997a"
},
{
"url": "https://git.kernel.org/stable/c/322a3b70368d49e39591fe9fc6c07d262128b05f"
},
{
"url": "https://git.kernel.org/stable/c/4311ca59a1891d33c4c8b7946f98c34f167fe833"
},
{
"url": "https://git.kernel.org/stable/c/044ca491d4086dc5bf233e9fcb71db52df32f633"
}
],
"title": "dm cache metadata: fix memory leak on metadata abort retry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53060",
"datePublished": "2026-06-24T16:30:04.872Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-06-24T16:30:04.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23451 (GCVE-0-2026-23451)
Vulnerability from cvelistv5
Published
2026-04-03 15:15
Modified
2026-08-05 12:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bonding: prevent potential infinite loop in bond_header_parse()
bond_header_parse() can loop if a stack of two bonding devices is setup,
because skb->dev always points to the hierarchy top.
Add new "const struct net_device *dev" parameter to
(struct header_ops)->parse() method to make sure the recursion
is bounded, and that the final leaf parse method is called.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firewire/net.c",
"drivers/net/bonding/bond_main.c",
"include/linux/etherdevice.h",
"include/linux/if_ether.h",
"include/linux/netdevice.h",
"net/ethernet/eth.c",
"net/ipv4/ip_gre.c",
"net/mac802154/iface.c",
"net/phonet/af_phonet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9532d0d0ad1d726c06f807e8f0f1ec93cbabb452",
"status": "affected",
"version": "5d0fb9806ab6cf2c3cfba0e1b8c701da65e25af8",
"versionType": "git"
},
{
"lessThan": "946bb6cacf0ccada7bc80f1cfa07c1ed79511c1c",
"status": "affected",
"version": "9baf26a91565b7bb2b1d9f99aaf884a2b28c2f6d",
"versionType": "git"
},
{
"lessThan": "4172a7901cf43fe1cc63ef7a2ef33735ff7b7d13",
"status": "affected",
"version": "6ac890f1d60ac3707ee8dae15a67d9a833e49956",
"versionType": "git"
},
{
"lessThan": "9b49c854f14f5e2d493e562a1e28d2e57fe37371",
"status": "affected",
"version": "95597d11dc8bddb2b9a051c9232000bfbb5e43ba",
"versionType": "git"
},
{
"lessThan": "b7405dcf7385445e10821777143f18c3ce20fa04",
"status": "affected",
"version": "950803f7254721c1c15858fbbfae3deaaeeecb11",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firewire/net.c",
"drivers/net/bonding/bond_main.c",
"include/linux/etherdevice.h",
"include/linux/if_ether.h",
"include/linux/netdevice.h",
"net/ethernet/eth.c",
"net/ipv4/ip_gre.c",
"net/mac802154/iface.c",
"net/phonet/af_phonet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.18.20",
"status": "affected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThan": "6.19.10",
"status": "affected",
"version": "6.19.9",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "6.18.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "6.19.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: prevent potential infinite loop in bond_header_parse()\n\nbond_header_parse() can loop if a stack of two bonding devices is setup,\nbecause skb-\u003edev always points to the hierarchy top.\n\nAdd new \"const struct net_device *dev\" parameter to\n(struct header_ops)-\u003eparse() method to make sure the recursion\nis bounded, and that the final leaf parse method is called."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - In a reasonable affected deployment, a remote peer can send a packet, including GRE traffic, that arrives through a stacked bonding hierarchy and triggers AF_PACKET/NFLOG/NFQUEUE hardware-address parsing on the top bond. The vulnerable code is reached from network packet receive processing, not from a physical or purely local-only interface.\nAC:L - Once the stacked bond and packet metadata consumer exist, a single matching received packet deterministically enters `dev_parse_header()` and recurses indefinitely. There is no race, timing window, heap shaping, or attacker-uncontrolled probabilistic condition needed to trigger the denial of service.\nPR:N - The network-triggered path does not require the remote attacker to authenticate or hold local privileges; they only need to send traffic to the affected interface/tunnel. Although local namespace users can also create a reproducer with CAP_NET_ADMIN/CAP_NET_RAW in their namespace, the highest reasonable scenario requires no attacker privileges.\nUI:N - No victim action is required at exploit time when the affected bond stack and packet logging/capture path are already active. The packet alone triggers the vulnerable parse path.\nS:U - The impact remains within the kernel/networking security authority of the vulnerable system. There is no VM escape, sandbox boundary crossing, or separate security scope affected.\nC:N - The bug is an unbounded recursive call caused by using the top-level `skb-\u003edev`; it does not create an information disclosure or controlled read primitive.\nI:N - The vulnerable path does not corrupt attacker-selected data or provide a write/control-flow primitive; the final lower-device parser is never reached. The observed consequence is recursion leading to denial of service.\nA:H - The infinite recursion can hang kernel packet processing and lead to stack overflow/lockdep exhaustion or kernel crash. This is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:21:51.936Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9532d0d0ad1d726c06f807e8f0f1ec93cbabb452"
},
{
"url": "https://git.kernel.org/stable/c/946bb6cacf0ccada7bc80f1cfa07c1ed79511c1c"
},
{
"url": "https://git.kernel.org/stable/c/4172a7901cf43fe1cc63ef7a2ef33735ff7b7d13"
},
{
"url": "https://git.kernel.org/stable/c/9b49c854f14f5e2d493e562a1e28d2e57fe37371"
},
{
"url": "https://git.kernel.org/stable/c/b7405dcf7385445e10821777143f18c3ce20fa04"
}
],
"title": "bonding: prevent potential infinite loop in bond_header_parse()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23451",
"datePublished": "2026-04-03T15:15:33.776Z",
"dateReserved": "2026-01-13T15:37:46.020Z",
"dateUpdated": "2026-08-05T12:21:51.936Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31581 (GCVE-0-2026-31581)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: 6fire: fix use-after-free on disconnect
In usb6fire_chip_abort(), the chip struct is allocated as the card's
private data (via snd_card_new with sizeof(struct sfire_chip)). When
snd_card_free_when_closed() is called and no file handles are open, the
card and embedded chip are freed synchronously. The subsequent
chip->card = NULL write then hits freed slab memory.
Call trace:
usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline]
usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182
usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458
...
hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953
Fix by moving the card lifecycle out of usb6fire_chip_abort() and into
usb6fire_chip_disconnect(). The card pointer is saved in a local
before any teardown, snd_card_disconnect() is called first to prevent
new opens, URBs are aborted while chip is still valid, and
snd_card_free_when_closed() is called last so chip is never accessed
after the card may be freed.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f2d06d4e129e2508e356136f99bb20a332ff1a00 Version: b889a7d68d7e76b8795b754a75c91a2d561d5e8c Version: ea8cc56db659cf0ae57073e32a4735ead7bd7ee3 Version: b754e831a94f82f2593af806741392903f359168 Version: 57860a80f03f9dc69a34a5c37b0941ad032a0a8c Version: a0810c3d6dd2d29a9b92604d682eacd2902ce947 Version: a0810c3d6dd2d29a9b92604d682eacd2902ce947 Version: a0810c3d6dd2d29a9b92604d682eacd2902ce947 Version: a0810c3d6dd2d29a9b92604d682eacd2902ce947 Version: 74357d0b5cd3ef544752bc9f21cbeee4902fae6c Version: 273eec23467dfbfbd0e4c10302579ba441fb1e13 Version: 0df7f4b5cc10f5adf98be0845372e9eef7bb5b09 Version: 5.10.231 ≤ Version: 5.15.174 ≤ Version: 6.1.120 ≤ Version: 6.6.64 ≤ Version: 6.12.2 ≤ Version: 4.19.325 ≤ Version: 5.4.287 ≤ Version: 6.11.11 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/6fire/chip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e719232f4552e29de8027a83918ea94434be87af",
"status": "affected",
"version": "f2d06d4e129e2508e356136f99bb20a332ff1a00",
"versionType": "git"
},
{
"lessThan": "e247a0e01d15ed420f77ec5e2335721bf430a5b3",
"status": "affected",
"version": "b889a7d68d7e76b8795b754a75c91a2d561d5e8c",
"versionType": "git"
},
{
"lessThan": "ba88461f7653636c48321ca993006a74724c2f41",
"status": "affected",
"version": "ea8cc56db659cf0ae57073e32a4735ead7bd7ee3",
"versionType": "git"
},
{
"lessThan": "e88354b381e2006de63d6b052ed7005c9a47d00e",
"status": "affected",
"version": "b754e831a94f82f2593af806741392903f359168",
"versionType": "git"
},
{
"lessThan": "af75b486f7e883e3422ece23c8d727e6815144a0",
"status": "affected",
"version": "57860a80f03f9dc69a34a5c37b0941ad032a0a8c",
"versionType": "git"
},
{
"lessThan": "d21e8a2af4869b5890b34e081d5aeadc93e9cd5c",
"status": "affected",
"version": "a0810c3d6dd2d29a9b92604d682eacd2902ce947",
"versionType": "git"
},
{
"lessThan": "3dc20d1981d6a67d8184498a5da272942dde1e65",
"status": "affected",
"version": "a0810c3d6dd2d29a9b92604d682eacd2902ce947",
"versionType": "git"
},
{
"lessThan": "51f6532790b74ffdd6970bc848358a2838c1c185",
"status": "affected",
"version": "a0810c3d6dd2d29a9b92604d682eacd2902ce947",
"versionType": "git"
},
{
"lessThan": "b9c826916fdce6419b94eb0cd8810fdac18c2386",
"status": "affected",
"version": "a0810c3d6dd2d29a9b92604d682eacd2902ce947",
"versionType": "git"
},
{
"status": "affected",
"version": "74357d0b5cd3ef544752bc9f21cbeee4902fae6c",
"versionType": "git"
},
{
"status": "affected",
"version": "273eec23467dfbfbd0e4c10302579ba441fb1e13",
"versionType": "git"
},
{
"status": "affected",
"version": "0df7f4b5cc10f5adf98be0845372e9eef7bb5b09",
"versionType": "git"
},
{
"lessThan": "5.10.258",
"status": "affected",
"version": "5.10.231",
"versionType": "semver"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThan": "6.6.136",
"status": "affected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThan": "6.12.83",
"status": "affected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.325",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.287",
"versionType": "semver"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/6fire/chip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10.231",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.174",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "6.6.64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "6.12.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.325",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.287",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: 6fire: fix use-after-free on disconnect\n\nIn usb6fire_chip_abort(), the chip struct is allocated as the card\u0027s\nprivate data (via snd_card_new with sizeof(struct sfire_chip)). When\nsnd_card_free_when_closed() is called and no file handles are open, the\ncard and embedded chip are freed synchronously. The subsequent\nchip-\u003ecard = NULL write then hits freed slab memory.\n\nCall trace:\n usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline]\n usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182\n usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458\n ...\n hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953\n\nFix by moving the card lifecycle out of usb6fire_chip_abort() and into\nusb6fire_chip_disconnect(). The card pointer is saved in a local\nbefore any teardown, snd_card_disconnect() is called first to prevent\nnew opens, URBs are aborted while chip is still valid, and\nsnd_card_free_when_closed() is called last so chip is never accessed\nafter the card may be freed."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:42:07.970Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e719232f4552e29de8027a83918ea94434be87af"
},
{
"url": "https://git.kernel.org/stable/c/e247a0e01d15ed420f77ec5e2335721bf430a5b3"
},
{
"url": "https://git.kernel.org/stable/c/ba88461f7653636c48321ca993006a74724c2f41"
},
{
"url": "https://git.kernel.org/stable/c/e88354b381e2006de63d6b052ed7005c9a47d00e"
},
{
"url": "https://git.kernel.org/stable/c/af75b486f7e883e3422ece23c8d727e6815144a0"
},
{
"url": "https://git.kernel.org/stable/c/d21e8a2af4869b5890b34e081d5aeadc93e9cd5c"
},
{
"url": "https://git.kernel.org/stable/c/3dc20d1981d6a67d8184498a5da272942dde1e65"
},
{
"url": "https://git.kernel.org/stable/c/51f6532790b74ffdd6970bc848358a2838c1c185"
},
{
"url": "https://git.kernel.org/stable/c/b9c826916fdce6419b94eb0cd8810fdac18c2386"
}
],
"title": "ALSA: 6fire: fix use-after-free on disconnect",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31581",
"datePublished": "2026-04-24T14:42:11.557Z",
"dateReserved": "2026-03-09T15:48:24.119Z",
"dateUpdated": "2026-06-14T17:42:07.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43284 (GCVE-0-2026-43284)
Vulnerability from cvelistv5
Published
2026-05-08 07:21
Modified
2026-08-24 12:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: esp: avoid in-place decrypt on shared skb frags
MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP
marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(),
so later paths that may modify packet data can first make a private
copy. The IPv4/IPv6 datagram append paths did not set this flag when
splicing pages into UDP skbs.
That leaves an ESP-in-UDP packet made from shared pipe pages looking
like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW
fast path for uncloned skbs without a frag_list and decrypts in place
over data that is not owned privately by the skb.
Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching
TCP. Also make ESP input fall back to skb_cow_data() when the flag is
present, so ESP does not decrypt externally backed frags in place.
Private nonlinear skb frags still use the existing fast path.
This intentionally does not change ESP output. In esp_output_head(),
the path that appends the ESP trailer to existing skb tailroom without
calling skb_cow_data() is not reachable for nonlinear skbs:
skb_tailroom() returns zero when skb->data_len is nonzero, while ESP
tailen is positive. Thus ESP output will either use the separate
destination-frag path or fall back to skb_cow_data().
References
| URL | Tags | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cac2661c53f35cbe651bef9b07026a5a05ab8ce0 Version: cac2661c53f35cbe651bef9b07026a5a05ab8ce0 Version: cac2661c53f35cbe651bef9b07026a5a05ab8ce0 Version: cac2661c53f35cbe651bef9b07026a5a05ab8ce0 Version: cac2661c53f35cbe651bef9b07026a5a05ab8ce0 Version: cac2661c53f35cbe651bef9b07026a5a05ab8ce0 Version: cac2661c53f35cbe651bef9b07026a5a05ab8ce0 Version: cac2661c53f35cbe651bef9b07026a5a05ab8ce0 Version: cac2661c53f35cbe651bef9b07026a5a05ab8ce0 Version: cac2661c53f35cbe651bef9b07026a5a05ab8ce0 |
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-05-26T17:32:27.236Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/05/08/7"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/05/13/6"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/05/14/2"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/05/14/4"
},
{
"url": "https://www.vicarius.io/vsociety/posts/cve-2026-43284-detection-script-dirty-frag-linux-kernel-local-privilege-escalation"
},
{
"url": "https://www.vicarius.io/vsociety/posts/cve-2026-43284-mitigation-script-dirty-frag-linux-kernel-local-privilege-escalation"
}
],
"title": "CVE Program Container",
"x_generator": {
"engine": "ADPogram 0.0.1"
}
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-43284",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-123",
"description": "CWE-123 Write-what-where Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-09T03:55:46.272Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/V4bel/dirtyfrag"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_nvidia:10::el10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "NVIDIA for RHEL 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.7.el10nv",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-231.12.el10nv",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.1",
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-124.56.1.el10_1",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.16.1.el10_2",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.7.3.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.73.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.124.1.rt7.465.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.124.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.191.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.191.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.192.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.192.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.192.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.6"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.140.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.140.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-611.55.1.el9_7",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.10.1.el9_8",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.5.3.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-70.179.1.el9_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-70.179.1.rt21.251.el9_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:9.0"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.170.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.170.1.rt14.455.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:9.2"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.125.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus:9.4"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.113.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus:9.6"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.12::el8"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "412.86.202605111404-0",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "412.86.202605271418-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.13::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.13",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "413.92.202606160406-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.14::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "414.92.202605111427-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.15::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "415.92.202606030318-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.16::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "416.94.202605101426-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.17::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.17",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "417.94.202606250942-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.18::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "418.94.202605101521-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.19::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.19.9.6.202605110225-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.20::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.20",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.20.9.6.202605110206-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.21::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.21",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.21.9.6.202605110143-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The xfrm-ESP variant requires unprivileged user or network namespace creation, while the RxRPC variant depends on the rxrpc module being available on the target system."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-123",
"description": "Write-what-where Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T12:07:05.163Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-43284"
},
{
"name": "RHBZ#2467771",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467771"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43284.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17795"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33486"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16180"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21695"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26542"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16176"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23233"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16171"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34098"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16160"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16161"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16157"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16155"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16314"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16062"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19569"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19074"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16202"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16328"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16100"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16312"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16206"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19568"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19225"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16195"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19574"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16201"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16204"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19564"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16061"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19572"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19575"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19573"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19577"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:18025"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16196"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16203"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:16254"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:17795: NVIDIA for RHEL 10"
},
{
"lang": "en",
"value": "RHSA-2026:33486: NVIDIA for RHEL 10"
},
{
"lang": "en",
"value": "RHSA-2026:16180: Red Hat OpenShift Container Platform 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:21695: Red Hat OpenShift Container Platform 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:26542: Red Hat OpenShift Container Platform 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:16176: Red Hat OpenShift Container Platform 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:23233: Red Hat OpenShift Container Platform 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:16171: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:34098: Red Hat OpenShift Container Platform 4.17"
},
{
"lang": "en",
"value": "RHSA-2026:16160: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:16161: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:16157: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:16155: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:16314: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:16062: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19569: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19074: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:16202: Red Hat Enterprise Linux AppStream E4S (v.9.0), Red Hat Enterprise Linux BaseOS E4S (v.9.0)"
},
{
"lang": "en",
"value": "RHSA-2026:16328: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:16100: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux BaseOS EUS (v.9.4), Red Hat Enterprise Linux Real Time EUS (v.9.4), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:16312: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:16206: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:19568: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:19225: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:16195: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:19574: Red Hat Enterprise Linux BaseOS (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:16201: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:16204: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS E4S (v.8.6), Red Hat Enterprise Linux BaseOS TUS (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:19564: Red Hat Enterprise Linux BaseOS E4S (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:16061: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:19572: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:19575: Red Hat Enterprise Linux BaseOS E4S (v.9.0)"
},
{
"lang": "en",
"value": "RHSA-2026:19573: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:19577: Red Hat Enterprise Linux BaseOS EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:18025: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:16196: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:16203: Red Hat Enterprise Linux NFV E4S (v.9.0), Red Hat Enterprise Linux Real Time E4S (v.9.0)"
},
{
"lang": "en",
"value": "RHSA-2026:16254: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-07T15:56:04.044Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-07T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: \"Dirty Frag\" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel",
"workarounds": [
{
"lang": "en",
"value": "See the security bulletin for a detailed mitigation procedure."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:49:14.720Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/esp4.c",
"net/ipv4/ip_output.c",
"net/ipv6/esp6.c",
"net/ipv6/ip6_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a6cb440f274a22456ef3e86b457344f1678f38f9",
"status": "affected",
"version": "cac2661c53f35cbe651bef9b07026a5a05ab8ce0",
"versionType": "git"
},
{
"lessThan": "ab8b995323e5237041472d07e5055f5f7dcdf15b",
"status": "affected",
"version": "cac2661c53f35cbe651bef9b07026a5a05ab8ce0",
"versionType": "git"
},
{
"lessThan": "fe785bb3a8096dffcc4048a85cd0c83337eeecad",
"status": "affected",
"version": "cac2661c53f35cbe651bef9b07026a5a05ab8ce0",
"versionType": "git"
},
{
"lessThan": "5d55c7336f8032d434adcc5fab987ccc93a44aec",
"status": "affected",
"version": "cac2661c53f35cbe651bef9b07026a5a05ab8ce0",
"versionType": "git"
},
{
"lessThan": "8253aab4659ca16116b522203c2a6b18dccacea7",
"status": "affected",
"version": "cac2661c53f35cbe651bef9b07026a5a05ab8ce0",
"versionType": "git"
},
{
"lessThan": "50ed1e7873100f77abad20fd31c51029bc49cd03",
"status": "affected",
"version": "cac2661c53f35cbe651bef9b07026a5a05ab8ce0",
"versionType": "git"
},
{
"lessThan": "b54edf1e9a3fd3491bdcb82a21f8d21315271e0d",
"status": "affected",
"version": "cac2661c53f35cbe651bef9b07026a5a05ab8ce0",
"versionType": "git"
},
{
"lessThan": "71a1d9d985d26716f74d21f18ee8cac821b06e97",
"status": "affected",
"version": "cac2661c53f35cbe651bef9b07026a5a05ab8ce0",
"versionType": "git"
},
{
"lessThan": "52646cbd00e765a6db9c3afe9535f26218276034",
"status": "affected",
"version": "cac2661c53f35cbe651bef9b07026a5a05ab8ce0",
"versionType": "git"
},
{
"lessThan": "f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4",
"status": "affected",
"version": "cac2661c53f35cbe651bef9b07026a5a05ab8ce0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/esp4.c",
"net/ipv4/ip_output.c",
"net/ipv6/esp6.c",
"net/ipv6/ip6_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.255",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.205",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.206",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.171",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.172",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.138",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.87",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.28",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.255",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.205",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.206",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.171",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.172",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.138",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.87",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.28",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.5",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: esp: avoid in-place decrypt on shared skb frags\n\nMSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP\nmarks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(),\nso later paths that may modify packet data can first make a private\ncopy. The IPv4/IPv6 datagram append paths did not set this flag when\nsplicing pages into UDP skbs.\n\nThat leaves an ESP-in-UDP packet made from shared pipe pages looking\nlike an ordinary uncloned nonlinear skb. ESP input then takes the no-COW\nfast path for uncloned skbs without a frag_list and decrypts in place\nover data that is not owned privately by the skb.\n\nMark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching\nTCP. Also make ESP input fall back to skb_cow_data() when the flag is\npresent, so ESP does not decrypt externally backed frags in place.\nPrivate nonlinear skb frags still use the existing fast path.\n\nThis intentionally does not change ESP output. In esp_output_head(),\nthe path that appends the ESP trailer to existing skb tailroom without\ncalling skb_cow_data() is not reachable for nonlinear skbs:\nskb_tailroom() returns zero when skb-\u003edata_len is nonzero, while ESP\ntailen is positive. Thus ESP output will either use the separate\ndestination-frag path or fall back to skb_cow_data()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Triggering requires local system access to use splice/UDP sockets and configure a local ESP-in-UDP xfrm path; a remote packet alone cannot supply the shared pipe/page-cache backed skb frag.\nAC:L - The exploit path is deterministic: the attacker controls the pipe/page-cache frag, ESP packet layout, SA parameters, and sequence-high write value, with no race or victim timing requirement.\nPR:L - XFRM SA setup requires CAP_NET_ADMIN, but this is reachable by an unprivileged local user inside a new user and network namespace on systems allowing user namespaces.\nUI:N - No victim action is required; the attacker can create the namespace, xfrm state, sockets, pipe contents, and loopback traffic independently.\nS:C - Exploitation from a user/net namespace can corrupt page-cache-backed privileged host files and escape that namespace/sandbox boundary into host root execution.\nC:H - The page-cache write primitive can be used to execute setuid-root code, giving full access to confidential system data.\nI:H - The vulnerability provides attacker-controlled page-cache writes to files the attacker can only read, enabling arbitrary modification of privileged executable content in memory.\nA:H - The same unauthorized in-place crypto writes can corrupt executable or system file cache contents and can plausibly crash or destabilize affected workloads or the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:04.452Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a6cb440f274a22456ef3e86b457344f1678f38f9"
},
{
"url": "https://git.kernel.org/stable/c/ab8b995323e5237041472d07e5055f5f7dcdf15b"
},
{
"url": "https://git.kernel.org/stable/c/fe785bb3a8096dffcc4048a85cd0c83337eeecad"
},
{
"url": "https://git.kernel.org/stable/c/5d55c7336f8032d434adcc5fab987ccc93a44aec"
},
{
"url": "https://git.kernel.org/stable/c/8253aab4659ca16116b522203c2a6b18dccacea7"
},
{
"url": "https://git.kernel.org/stable/c/50ed1e7873100f77abad20fd31c51029bc49cd03"
},
{
"url": "https://git.kernel.org/stable/c/b54edf1e9a3fd3491bdcb82a21f8d21315271e0d"
},
{
"url": "https://git.kernel.org/stable/c/71a1d9d985d26716f74d21f18ee8cac821b06e97"
},
{
"url": "https://git.kernel.org/stable/c/52646cbd00e765a6db9c3afe9535f26218276034"
},
{
"url": "https://git.kernel.org/stable/c/f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4"
}
],
"title": "xfrm: esp: avoid in-place decrypt on shared skb frags",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43284",
"datePublished": "2026-05-08T07:21:47.524Z",
"dateReserved": "2026-05-01T14:12:55.998Z",
"dateUpdated": "2026-08-24T12:07:05.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46058 (GCVE-0-2026-46058)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: amphion: Fix race between m2m job_abort and device_run
Fix kernel panic caused by race condition where v4l2_m2m_ctx_release()
frees m2m_ctx while v4l2_m2m_try_run() is about to call device_run
with the same context.
Race sequence:
v4l2_m2m_try_run(): v4l2_m2m_ctx_release():
lock/unlock v4l2_m2m_cancel_job()
job_abort()
v4l2_m2m_job_finish()
kfree(m2m_ctx) <- frees ctx
device_run() <- use-after-free crash at 0x538
Crash trace:
Unable to handle kernel read from unreadable memory at virtual address
0000000000000538
v4l2_m2m_try_run+0x78/0x138
v4l2_m2m_device_run_work+0x14/0x20
The amphion vpu driver does not rely on the m2m framework's device_run
callback to perform encode/decode operations.
Fix the race by preventing m2m framework job scheduling entirely:
- Add job_ready callback returning 0 (no jobs ready for m2m framework)
- Remove job_abort callback to avoid the race condition
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3cd084519c6f91cbef9d604bcf26844fa81d4922 Version: 3cd084519c6f91cbef9d604bcf26844fa81d4922 Version: 3cd084519c6f91cbef9d604bcf26844fa81d4922 Version: 3cd084519c6f91cbef9d604bcf26844fa81d4922 Version: 3cd084519c6f91cbef9d604bcf26844fa81d4922 Version: 3cd084519c6f91cbef9d604bcf26844fa81d4922 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/amphion/vpu_v4l2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "516467052fdfc6a13eadc70d43420ae57436bf3c",
"status": "affected",
"version": "3cd084519c6f91cbef9d604bcf26844fa81d4922",
"versionType": "git"
},
{
"lessThan": "42dc622776f3ce1a6c31b13bdc686f7295e3b323",
"status": "affected",
"version": "3cd084519c6f91cbef9d604bcf26844fa81d4922",
"versionType": "git"
},
{
"lessThan": "da4f46c5cf1d26e6b09418ad453e152f2e75a02c",
"status": "affected",
"version": "3cd084519c6f91cbef9d604bcf26844fa81d4922",
"versionType": "git"
},
{
"lessThan": "fdc150dac1adb9a98be9d6956cff0348838b024a",
"status": "affected",
"version": "3cd084519c6f91cbef9d604bcf26844fa81d4922",
"versionType": "git"
},
{
"lessThan": "6be2cb75bc1300080cfc8051579f22efae9401f7",
"status": "affected",
"version": "3cd084519c6f91cbef9d604bcf26844fa81d4922",
"versionType": "git"
},
{
"lessThan": "8cd35ceadcfc8c5da2eb7f7ce24525ce9d4ee62e",
"status": "affected",
"version": "3cd084519c6f91cbef9d604bcf26844fa81d4922",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/amphion/vpu_v4l2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: amphion: Fix race between m2m job_abort and device_run\n\nFix kernel panic caused by race condition where v4l2_m2m_ctx_release()\nfrees m2m_ctx while v4l2_m2m_try_run() is about to call device_run\nwith the same context.\n\nRace sequence:\n v4l2_m2m_try_run(): v4l2_m2m_ctx_release():\n lock/unlock v4l2_m2m_cancel_job()\n job_abort()\n v4l2_m2m_job_finish()\n kfree(m2m_ctx) \u003c- frees ctx\n device_run() \u003c- use-after-free crash at 0x538\n\nCrash trace:\n Unable to handle kernel read from unreadable memory at virtual address\n 0000000000000538\n v4l2_m2m_try_run+0x78/0x138\n v4l2_m2m_device_run_work+0x14/0x20\n\nThe amphion vpu driver does not rely on the m2m framework\u0027s device_run\ncallback to perform encode/decode operations.\n\nFix the race by preventing m2m framework job scheduling entirely:\n- Add job_ready callback returning 0 (no jobs ready for m2m framework)\n- Remove job_abort callback to avoid the race condition"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The amphion VPU is a V4L2 mem2mem device reached only through a local `/dev/videoN` device file via open/ioctl/close; there is no network or remote path to this code.\nAC:L - The flaw is a race the attacker fully controls by running one thread that streams/queues buffers (scheduling a job) and another that closes the fd (triggering release); it can be retried in a loop until won.\nPR:L - Exploitation requires a local unprivileged user with access to the V4L2 device node (typically granted via the video group or logged-in session ACL); no root is needed.\nUI:N - The attacker performs all steps (open, stream, concurrent close) itself; no action by any other user is required.\nS:U - The vulnerability and its impact are confined to the kernel\u0027s own security authority with no crossing of a VM/IOMMU/sandbox boundary.\nC:H - The freed `m2m_ctx` is dereferenced after `kfree` (use-after-free per the fix), and a UAF over a slab object the attacker can groom/reallocate is treated as enabling arbitrary read of freed contents.\nI:H - The use-after-free on the freed context permits heap grooming/reallocation of the object that is then dereferenced, providing a write/control primitive consistent with kernel UAF integrity impact.\nA:H - The race reliably faults on an invalid pointer in `v4l2_m2m_try_run`, producing a kernel oops/panic and denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:25.621Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/516467052fdfc6a13eadc70d43420ae57436bf3c"
},
{
"url": "https://git.kernel.org/stable/c/42dc622776f3ce1a6c31b13bdc686f7295e3b323"
},
{
"url": "https://git.kernel.org/stable/c/da4f46c5cf1d26e6b09418ad453e152f2e75a02c"
},
{
"url": "https://git.kernel.org/stable/c/fdc150dac1adb9a98be9d6956cff0348838b024a"
},
{
"url": "https://git.kernel.org/stable/c/6be2cb75bc1300080cfc8051579f22efae9401f7"
},
{
"url": "https://git.kernel.org/stable/c/8cd35ceadcfc8c5da2eb7f7ce24525ce9d4ee62e"
}
],
"title": "media: amphion: Fix race between m2m job_abort and device_run",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46058",
"datePublished": "2026-05-27T12:57:17.853Z",
"dateReserved": "2026-05-13T15:03:33.095Z",
"dateUpdated": "2026-08-05T12:29:25.621Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53147 (GCVE-0-2026-53147)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Validate XDomain request packet size before type cast
tb_xdp_handle_request() casts the received packet buffer to
protocol-specific structs without verifying that the allocation
is large enough for the target type. A peer can send a minimal
XDomain packet that passes the generic header length check but is
shorter than the struct accessed after the cast, causing out-of-
bounds reads from the kmemdup allocation.
Plumb the packet length through xdomain_request_work and validate
it against the expected struct size before each cast.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/xdomain.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a770e62923090d7572f1f5a8507ae551d354a057",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "0dd61ba03d05187726ecdf9c0e2175a81b9b24f6",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "79235c8add5da4bf27a12f5a5dbb579f300c059e",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "46da5c3ea011e884028a91cf913db093920a915b",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "07cd2787cdf8942d24a1a3ef81aa89b526fb6381",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "a504b9f2797b739e0304d537e8aa4ce883ecce39",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/xdomain.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Validate XDomain request packet size before type cast\n\ntb_xdp_handle_request() casts the received packet buffer to\nprotocol-specific structs without verifying that the allocation\nis large enough for the target type. A peer can send a minimal\nXDomain packet that passes the generic header length check but is\nshorter than the struct accessed after the cast, causing out-of-\nbounds reads from the kmemdup allocation.\n\nPlumb the packet length through xdomain_request_work and validate\nit against the expected struct size before each cast."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable parser handles XDomain control packets from a directly connected Thunderbolt/USB4 peer on the same local fabric, not from a routable network. A malicious connected host, dock, or in-line device can send the malformed request packets.\nAC:L - The attacker controls the packet type, declared length, checksum, and payload size, and the generic header check accepts packets shorter than the later protocol-specific struct accesses. No race or condition outside attacker control is required once an XDomain peer is connected.\nPR:N - No target-system account or kernel capability is required; the packet is accepted from the external XDomain peer before any user credential check. XDomain must be enabled/allowed, but that is a platform configuration gate rather than attacker privilege.\nUI:N - After the malicious peer is connected, exploitation is driven entirely by packets sent over the Thunderbolt/USB4 control channel. No victim action such as opening a file or authorizing a user operation is required for the vulnerable parsing path.\nS:U - The impact is within the host kernel that processes the malformed XDomain packet. This is not a VM escape, IOMMU bypass, or cross-authority scope change.\nC:H - Short PROPERTIES_REQUEST packets cause reads past the kmemdup-allocated packet into adjacent kernel heap data, including UUID/offset fields used by the response logic. Under the required higher-severity rule for out-of-bounds reads, this is high confidentiality impact.\nI:N - The fixed bug is an out-of-bounds read before type-specific casts, not an out-of-bounds write or direct overwrite primitive. The affected paths may use the read value for response/link-state handling, but they do not provide attacker-controlled kernel memory modification.\nA:H - The malformed packet can drive kernel out-of-bounds heap reads from the control-channel workqueue and can be sent repeatedly by the peer. Such reads can fault or trigger kernel hardening/KASAN failures, so availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:30.626Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a770e62923090d7572f1f5a8507ae551d354a057"
},
{
"url": "https://git.kernel.org/stable/c/0dd61ba03d05187726ecdf9c0e2175a81b9b24f6"
},
{
"url": "https://git.kernel.org/stable/c/79235c8add5da4bf27a12f5a5dbb579f300c059e"
},
{
"url": "https://git.kernel.org/stable/c/46da5c3ea011e884028a91cf913db093920a915b"
},
{
"url": "https://git.kernel.org/stable/c/07cd2787cdf8942d24a1a3ef81aa89b526fb6381"
},
{
"url": "https://git.kernel.org/stable/c/a504b9f2797b739e0304d537e8aa4ce883ecce39"
}
],
"title": "thunderbolt: Validate XDomain request packet size before type cast",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53147",
"datePublished": "2026-06-25T08:38:33.547Z",
"dateReserved": "2026-06-09T07:44:35.387Z",
"dateUpdated": "2026-08-05T12:33:30.626Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45840 (GCVE-0-2026-45840)
Vulnerability from cvelistv5
Published
2026-05-27 09:24
Modified
2026-06-14 17:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: cap upcall PID array size and pre-size vport replies
The vport netlink reply helpers allocate a fixed-size skb with
nlmsg_new(NLMSG_DEFAULT_SIZE, ...) but serialize the full upcall PID
array via ovs_vport_get_upcall_portids(). Since
ovs_vport_set_upcall_portids() accepts any non-zero multiple of
sizeof(u32) with no upper bound, a CAP_NET_ADMIN user can install a PID
array large enough to overflow the reply buffer, causing nla_put() to
fail with -EMSGSIZE and hitting BUG_ON(err < 0). On systems with
unprivileged user namespaces enabled (e.g., Ubuntu default), this is
reachable via unshare -Urn since OVS vport mutation operations use
GENL_UNS_ADMIN_PERM.
kernel BUG at net/openvswitch/datapath.c:2414!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 65 Comm: poc Not tainted 7.0.0-rc7-00195-geb216e422044 #1
RIP: 0010:ovs_vport_cmd_set+0x34c/0x400
Call Trace:
<TASK>
genl_family_rcv_msg_doit (net/netlink/genetlink.c:1116)
genl_rcv_msg (net/netlink/genetlink.c:1194)
netlink_rcv_skb (net/netlink/af_netlink.c:2550)
genl_rcv (net/netlink/genetlink.c:1219)
netlink_unicast (net/netlink/af_netlink.c:1344)
netlink_sendmsg (net/netlink/af_netlink.c:1894)
__sys_sendto (net/socket.c:2206)
__x64_sys_sendto (net/socket.c:2209)
do_syscall_64 (arch/x86/entry/syscall_64.c:63)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
</TASK>
Kernel panic - not syncing: Fatal exception
Reject attempts to set more PIDs than nr_cpu_ids in
ovs_vport_set_upcall_portids(), and pre-compute the worst-case reply
size in ovs_vport_cmd_msg_size() based on that bound, similar to the
existing ovs_dp_cmd_msg_size(). nr_cpu_ids matches the cap already
used by the per-CPU dispatch configuration on the datapath side
(ovs_dp_cmd_fill_info() serialises at most nr_cpu_ids PIDs), so the
two sides stay consistent.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5cd667b0a4567048bb555927d6ee564f4e5620a9 Version: 5cd667b0a4567048bb555927d6ee564f4e5620a9 Version: 5cd667b0a4567048bb555927d6ee564f4e5620a9 Version: 5cd667b0a4567048bb555927d6ee564f4e5620a9 Version: 5cd667b0a4567048bb555927d6ee564f4e5620a9 Version: 5cd667b0a4567048bb555927d6ee564f4e5620a9 Version: 5cd667b0a4567048bb555927d6ee564f4e5620a9 Version: 5cd667b0a4567048bb555927d6ee564f4e5620a9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/datapath.c",
"net/openvswitch/vport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8d59b80e69dddb665eb2de36e62859ab2073470e",
"status": "affected",
"version": "5cd667b0a4567048bb555927d6ee564f4e5620a9",
"versionType": "git"
},
{
"lessThan": "d9e47e29aacb9f8a9d59feb6ab5b128a9bbb40b0",
"status": "affected",
"version": "5cd667b0a4567048bb555927d6ee564f4e5620a9",
"versionType": "git"
},
{
"lessThan": "b39f763d720d623218bc1d95ace6855d7b474e81",
"status": "affected",
"version": "5cd667b0a4567048bb555927d6ee564f4e5620a9",
"versionType": "git"
},
{
"lessThan": "f9ef3db77a383d66847fd082c2b437d8ae4d9c63",
"status": "affected",
"version": "5cd667b0a4567048bb555927d6ee564f4e5620a9",
"versionType": "git"
},
{
"lessThan": "f99ac36b5d7c719d08a69fcdecce40f78a874e15",
"status": "affected",
"version": "5cd667b0a4567048bb555927d6ee564f4e5620a9",
"versionType": "git"
},
{
"lessThan": "fa6e90bc443bed8dc0d55bc5ea5b27ffdfe37704",
"status": "affected",
"version": "5cd667b0a4567048bb555927d6ee564f4e5620a9",
"versionType": "git"
},
{
"lessThan": "1d6c02b86329883aa467a3a61f8d34369db73a2f",
"status": "affected",
"version": "5cd667b0a4567048bb555927d6ee564f4e5620a9",
"versionType": "git"
},
{
"lessThan": "2091c6aa0df6aba47deb5c8ab232b1cb60af3519",
"status": "affected",
"version": "5cd667b0a4567048bb555927d6ee564f4e5620a9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/datapath.c",
"net/openvswitch/vport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: cap upcall PID array size and pre-size vport replies\n\nThe vport netlink reply helpers allocate a fixed-size skb with\nnlmsg_new(NLMSG_DEFAULT_SIZE, ...) but serialize the full upcall PID\narray via ovs_vport_get_upcall_portids(). Since\novs_vport_set_upcall_portids() accepts any non-zero multiple of\nsizeof(u32) with no upper bound, a CAP_NET_ADMIN user can install a PID\narray large enough to overflow the reply buffer, causing nla_put() to\nfail with -EMSGSIZE and hitting BUG_ON(err \u003c 0). On systems with\nunprivileged user namespaces enabled (e.g., Ubuntu default), this is\nreachable via unshare -Urn since OVS vport mutation operations use\nGENL_UNS_ADMIN_PERM.\n\n kernel BUG at net/openvswitch/datapath.c:2414!\n Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n CPU: 1 UID: 0 PID: 65 Comm: poc Not tainted 7.0.0-rc7-00195-geb216e422044 #1\n RIP: 0010:ovs_vport_cmd_set+0x34c/0x400\n Call Trace:\n \u003cTASK\u003e\n genl_family_rcv_msg_doit (net/netlink/genetlink.c:1116)\n genl_rcv_msg (net/netlink/genetlink.c:1194)\n netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n genl_rcv (net/netlink/genetlink.c:1219)\n netlink_unicast (net/netlink/af_netlink.c:1344)\n netlink_sendmsg (net/netlink/af_netlink.c:1894)\n __sys_sendto (net/socket.c:2206)\n __x64_sys_sendto (net/socket.c:2209)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n \u003c/TASK\u003e\n Kernel panic - not syncing: Fatal exception\n\nReject attempts to set more PIDs than nr_cpu_ids in\novs_vport_set_upcall_portids(), and pre-compute the worst-case reply\nsize in ovs_vport_cmd_msg_size() based on that bound, similar to the\nexisting ovs_dp_cmd_msg_size(). nr_cpu_ids matches the cap already\nused by the per-CPU dispatch configuration on the datapath side\n(ovs_dp_cmd_fill_info() serialises at most nr_cpu_ids PIDs), so the\ntwo sides stay consistent."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:46:11.287Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8d59b80e69dddb665eb2de36e62859ab2073470e"
},
{
"url": "https://git.kernel.org/stable/c/d9e47e29aacb9f8a9d59feb6ab5b128a9bbb40b0"
},
{
"url": "https://git.kernel.org/stable/c/b39f763d720d623218bc1d95ace6855d7b474e81"
},
{
"url": "https://git.kernel.org/stable/c/f9ef3db77a383d66847fd082c2b437d8ae4d9c63"
},
{
"url": "https://git.kernel.org/stable/c/f99ac36b5d7c719d08a69fcdecce40f78a874e15"
},
{
"url": "https://git.kernel.org/stable/c/fa6e90bc443bed8dc0d55bc5ea5b27ffdfe37704"
},
{
"url": "https://git.kernel.org/stable/c/1d6c02b86329883aa467a3a61f8d34369db73a2f"
},
{
"url": "https://git.kernel.org/stable/c/2091c6aa0df6aba47deb5c8ab232b1cb60af3519"
}
],
"title": "openvswitch: cap upcall PID array size and pre-size vport replies",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45840",
"datePublished": "2026-05-27T09:24:39.478Z",
"dateReserved": "2026-05-13T15:03:33.077Z",
"dateUpdated": "2026-06-14T17:46:11.287Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43403 (GCVE-0-2026-43403)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nsfs: tighten permission checks for ns iteration ioctls
Even privileged services should not necessarily be able to see other
privileged service's namespaces so they can't leak information to each
other. Use may_see_all_namespaces() helper that centralizes this policy
until the nstree adapts.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nsfs.c",
"include/linux/ns_common.h",
"kernel/nscommon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3376b345df155ca36d8611857b41ff7d5183fc38",
"status": "affected",
"version": "a1d220d9dafa8d76ba60a784a1016c3134e6a1e8",
"versionType": "git"
},
{
"lessThan": "2f3dea284c761c890d676f77d5e55c0c496b4ef4",
"status": "affected",
"version": "a1d220d9dafa8d76ba60a784a1016c3134e6a1e8",
"versionType": "git"
},
{
"lessThan": "0ad650e60150eda789deca5e78a6a09d26bf8fc9",
"status": "affected",
"version": "a1d220d9dafa8d76ba60a784a1016c3134e6a1e8",
"versionType": "git"
},
{
"lessThan": "e6b899f08066e744f89df16ceb782e06868bd148",
"status": "affected",
"version": "a1d220d9dafa8d76ba60a784a1016c3134e6a1e8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nsfs.c",
"include/linux/ns_common.h",
"kernel/nscommon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnsfs: tighten permission checks for ns iteration ioctls\n\nEven privileged services should not necessarily be able to see other\nprivileged service\u0027s namespaces so they can\u0027t leak information to each\nother. Use may_see_all_namespaces() helper that centralizes this policy\nuntil the nstree adapts."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached by a local `ioctl()` on an nsfs mount-namespace file descriptor, such as one obtained from `/proc/self/ns/mnt` or pidfd namespace ioctls. There is no network, adjacent, or physical attack path.\nAC:L - Triggering is deterministic: open a mount namespace fd and issue `NS_MNT_GET_NEXT` or `NS_MNT_GET_PREV`. There is no race or special memory-layout condition required.\nPR:L - The pre-fix check only required `CAP_SYS_ADMIN` in the target mount namespace\u0027s owning user namespace, which can be satisfied through user namespaces in plausible deployments. Under the higher-severity rule, this is Low rather than High.\nUI:N - No victim interaction is needed once the attacker has local execution and the relevant namespace capability. The attacker directly invokes the ioctl.\nS:C - The bug lets one namespace-confined service obtain file descriptors for other mount namespaces, bypassing the intended namespace visibility boundary. That can cross container or service isolation boundaries.\nC:H - The returned namespace fd and mount namespace id allow enumeration with `listmount()` and `statmount()`, exposing mount topology, paths, sources, options, and related metadata from another namespace. In plausible privileged-container scenarios, the fd can also enable `setns()` into the target mount namespace and expose sensitive filesystem contents.\nI:H - With the leaked mount namespace fd and the same namespace capabilities required by the vulnerable path, an attacker can plausibly `setns()` into another mount namespace and modify writable files or mount state there. This can compromise integrity across the namespace boundary.\nA:H - After obtaining and entering another mount namespace in a privileged scenario, the attacker can disrupt that namespace by altering or unmounting resources or damaging writable files. This can cause high availability impact to the affected service or container."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:47.212Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3376b345df155ca36d8611857b41ff7d5183fc38"
},
{
"url": "https://git.kernel.org/stable/c/2f3dea284c761c890d676f77d5e55c0c496b4ef4"
},
{
"url": "https://git.kernel.org/stable/c/0ad650e60150eda789deca5e78a6a09d26bf8fc9"
},
{
"url": "https://git.kernel.org/stable/c/e6b899f08066e744f89df16ceb782e06868bd148"
}
],
"title": "nsfs: tighten permission checks for ns iteration ioctls",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43403",
"datePublished": "2026-05-08T14:21:44.204Z",
"dateReserved": "2026-05-01T14:12:56.007Z",
"dateUpdated": "2026-08-05T12:27:47.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31497 (GCVE-0-2026-31497)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-05-11 22:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btusb: clamp SCO altsetting table indices
btusb_work() maps the number of active SCO links to USB alternate
settings through a three-entry lookup table when CVSD traffic uses
transparent voice settings. The lookup currently indexes alts[] with
data->sco_num - 1 without first constraining sco_num to the number of
available table entries.
While the table only defines alternate settings for up to three SCO
links, data->sco_num comes from hci_conn_num() and is used directly.
Cap the lookup to the last table entry before indexing it so the
driver keeps selecting the highest supported alternate setting without
reading past alts[].
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 Version: baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 Version: baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 Version: baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 Version: baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 Version: baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 Version: baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 Version: baac6276c0a9f36f1fe1f00590ef00d2ba5ba626 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "312c4450fe23014665c163f480edd5ad2e27bbb8",
"status": "affected",
"version": "baac6276c0a9f36f1fe1f00590ef00d2ba5ba626",
"versionType": "git"
},
{
"lessThan": "9dd13a8641de79bc1bc93da55cdd35259a002683",
"status": "affected",
"version": "baac6276c0a9f36f1fe1f00590ef00d2ba5ba626",
"versionType": "git"
},
{
"lessThan": "476c9262b430c38c6a701a3b8176a3f48689085b",
"status": "affected",
"version": "baac6276c0a9f36f1fe1f00590ef00d2ba5ba626",
"versionType": "git"
},
{
"lessThan": "6fba3c3d48c927e55611a0f5ea34da88138ed0ff",
"status": "affected",
"version": "baac6276c0a9f36f1fe1f00590ef00d2ba5ba626",
"versionType": "git"
},
{
"lessThan": "834cf890d2c3d29cbfa1ee2376c40469c28ec297",
"status": "affected",
"version": "baac6276c0a9f36f1fe1f00590ef00d2ba5ba626",
"versionType": "git"
},
{
"lessThan": "1019028eb124564cf7bca58a16f1df8a1ca30726",
"status": "affected",
"version": "baac6276c0a9f36f1fe1f00590ef00d2ba5ba626",
"versionType": "git"
},
{
"lessThan": "21c254202f9d78abe0fcd642a92966deb92bd226",
"status": "affected",
"version": "baac6276c0a9f36f1fe1f00590ef00d2ba5ba626",
"versionType": "git"
},
{
"lessThan": "129fa608b6ad08b8ab7178eeb2ec272c993aaccc",
"status": "affected",
"version": "baac6276c0a9f36f1fe1f00590ef00d2ba5ba626",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btusb: clamp SCO altsetting table indices\n\nbtusb_work() maps the number of active SCO links to USB alternate\nsettings through a three-entry lookup table when CVSD traffic uses\ntransparent voice settings. The lookup currently indexes alts[] with\ndata-\u003esco_num - 1 without first constraining sco_num to the number of\navailable table entries.\n\nWhile the table only defines alternate settings for up to three SCO\nlinks, data-\u003esco_num comes from hci_conn_num() and is used directly.\nCap the lookup to the last table entry before indexing it so the\ndriver keeps selecting the highest supported alternate setting without\nreading past alts[]."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:09:53.017Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/312c4450fe23014665c163f480edd5ad2e27bbb8"
},
{
"url": "https://git.kernel.org/stable/c/9dd13a8641de79bc1bc93da55cdd35259a002683"
},
{
"url": "https://git.kernel.org/stable/c/476c9262b430c38c6a701a3b8176a3f48689085b"
},
{
"url": "https://git.kernel.org/stable/c/6fba3c3d48c927e55611a0f5ea34da88138ed0ff"
},
{
"url": "https://git.kernel.org/stable/c/834cf890d2c3d29cbfa1ee2376c40469c28ec297"
},
{
"url": "https://git.kernel.org/stable/c/1019028eb124564cf7bca58a16f1df8a1ca30726"
},
{
"url": "https://git.kernel.org/stable/c/21c254202f9d78abe0fcd642a92966deb92bd226"
},
{
"url": "https://git.kernel.org/stable/c/129fa608b6ad08b8ab7178eeb2ec272c993aaccc"
}
],
"title": "Bluetooth: btusb: clamp SCO altsetting table indices",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31497",
"datePublished": "2026-04-22T13:54:19.051Z",
"dateReserved": "2026-03-09T15:48:24.102Z",
"dateUpdated": "2026-05-11T22:09:53.017Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43074 (GCVE-0-2026-43074)
Vulnerability from cvelistv5
Published
2026-05-06 07:21
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
eventpoll: defer struct eventpoll free to RCU grace period
In certain situations, ep_free() in eventpoll.c will kfree the epi->ep
eventpoll struct while it still being used by another concurrent thread.
Defer the kfree() to an RCU callback to prevent UAF.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f2451def095c1743adcfcb0cb5dadc86034e162a Version: a1f93804449d13f97dabd4b996817de4bf1ed67a Version: 58c9b016e12855286370dfb704c08498edbc857a Version: 58c9b016e12855286370dfb704c08498edbc857a Version: 58c9b016e12855286370dfb704c08498edbc857a Version: 58c9b016e12855286370dfb704c08498edbc857a Version: 58c9b016e12855286370dfb704c08498edbc857a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/eventpoll.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "902120be4f44947df6311002addc7faf69bdbff1",
"status": "affected",
"version": "f2451def095c1743adcfcb0cb5dadc86034e162a",
"versionType": "git"
},
{
"lessThan": "a6d57084372161f86660bc4607784420e00efe2c",
"status": "affected",
"version": "a1f93804449d13f97dabd4b996817de4bf1ed67a",
"versionType": "git"
},
{
"lessThan": "a6566cd33f6f967a7651ebf2ce0dd31572e319cf",
"status": "affected",
"version": "58c9b016e12855286370dfb704c08498edbc857a",
"versionType": "git"
},
{
"lessThan": "5b1173b165421561db29f30afc7e97d940a398a9",
"status": "affected",
"version": "58c9b016e12855286370dfb704c08498edbc857a",
"versionType": "git"
},
{
"lessThan": "7e8083f5eeedab0f460063b9c2c14c9a4e71a427",
"status": "affected",
"version": "58c9b016e12855286370dfb704c08498edbc857a",
"versionType": "git"
},
{
"lessThan": "ae0bb9c1fb7c2594519aeeb096cf2c3b7837b322",
"status": "affected",
"version": "58c9b016e12855286370dfb704c08498edbc857a",
"versionType": "git"
},
{
"lessThan": "07712db80857d5d09ae08f3df85a708ecfc3b61f",
"status": "affected",
"version": "58c9b016e12855286370dfb704c08498edbc857a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/eventpoll.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: defer struct eventpoll free to RCU grace period\n\nIn certain situations, ep_free() in eventpoll.c will kfree the epi-\u003eep\neventpoll struct while it still being used by another concurrent thread.\nDefer the kfree() to an RCU callback to prevent UAF."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local epoll syscalls, primarily `epoll_ctl(EPOLL_CTL_ADD)` on nested epoll descriptors racing with descriptor close/release. Network input is not sufficient to reach the lifetime bug without local control of epoll file descriptors.\nAC:L - The race is attacker-controlled: an unprivileged local process can create the epoll graph and run concurrent threads performing nested `epoll_ctl()` and close/release operations. No rare external state or victim timing is required beyond winning a race the attacker can repeatedly drive.\nPR:L - Creating epoll descriptors and calling `epoll_ctl()` require only ordinary local user privileges. No capability check gates the vulnerable nested epoll path; the only capability-related logic masks `EPOLLWAKEUP` and is not relevant.\nUI:N - Exploitation does not require another user to open files, mount anything, or perform any action. The attacking process can create, nest, and close all relevant descriptors itself.\nS:U - The impact is within the kernel security authority as a local kernel memory corruption or privilege escalation. There is no VM escape, IOMMU bypass, or cross-authority boundary change shown by this bug.\nC:H - This is a use-after-free of `struct eventpoll` during an RCU walk, and the stale pointer can be dereferenced after the object is freed and potentially reallocated. Per kernel CVSS guidance, a UAF is treated as enabling high confidentiality impact through exploitable memory corruption.\nI:H - The stale `struct eventpoll` is not only read but also written via fields such as `gen` and `loop_check_depth` after free, making heap corruption plausible if the memory is reallocated. Per kernel CVSS guidance, UAF memory corruption supports high integrity impact.\nA:H - At minimum, dereferencing or writing a freed `struct eventpoll` can crash or corrupt the kernel. A local attacker can repeatedly trigger the race, so availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:45.708Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/902120be4f44947df6311002addc7faf69bdbff1"
},
{
"url": "https://git.kernel.org/stable/c/a6d57084372161f86660bc4607784420e00efe2c"
},
{
"url": "https://git.kernel.org/stable/c/a6566cd33f6f967a7651ebf2ce0dd31572e319cf"
},
{
"url": "https://git.kernel.org/stable/c/5b1173b165421561db29f30afc7e97d940a398a9"
},
{
"url": "https://git.kernel.org/stable/c/7e8083f5eeedab0f460063b9c2c14c9a4e71a427"
},
{
"url": "https://git.kernel.org/stable/c/ae0bb9c1fb7c2594519aeeb096cf2c3b7837b322"
},
{
"url": "https://git.kernel.org/stable/c/07712db80857d5d09ae08f3df85a708ecfc3b61f"
}
],
"title": "eventpoll: defer struct eventpoll free to RCU grace period",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43074",
"datePublished": "2026-05-06T07:21:58.210Z",
"dateReserved": "2026-05-01T14:12:55.982Z",
"dateUpdated": "2026-08-05T12:25:45.708Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43058 (GCVE-0-2026-43058)
Vulnerability from cvelistv5
Published
2026-05-02 06:11
Modified
2026-06-14 17:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: vidtv: fix pass-by-value structs causing MSAN warnings
vidtv_ts_null_write_into() and vidtv_ts_pcr_write_into() take their
argument structs by value, causing MSAN to report uninit-value warnings.
While only vidtv_ts_null_write_into() has triggered a report so far,
both functions share the same issue.
Fix by passing both structs by const pointer instead, avoiding the
stack copy of the struct along with its MSAN shadow and origin metadata.
The functions do not modify the structs, which is enforced by the const
qualifier.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/test-drivers/vidtv/vidtv_mux.c",
"drivers/media/test-drivers/vidtv/vidtv_ts.c",
"drivers/media/test-drivers/vidtv/vidtv_ts.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a876d72ceba7fe5444005239f363c105767e0ecf",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "a73f84a30975e6c4ae06efd500d31c82564dba10",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "c034d8094fee474eb94142c17643eee2919079b7",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "e3957eb26a3d570aefc6bb184fa8b8a1e9a4e508",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "be57e52e27c7cbfb400a8f255e475cbcff242baa",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "6d75a9ec5bdb8cf8382eaf8f8fe831ba7d58a9d4",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "57b01d945ed68cebe486d495dadc4901a96d3aaa",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "1b2820c8a9887981634020db19f1a2425558b88e",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "5f8e73bde67e931468bc2a1860d78d72f0c6ba41",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/test-drivers/vidtv/vidtv_mux.c",
"drivers/media/test-drivers/vidtv/vidtv_ts.c",
"drivers/media/test-drivers/vidtv/vidtv_ts.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vidtv: fix pass-by-value structs causing MSAN warnings\n\nvidtv_ts_null_write_into() and vidtv_ts_pcr_write_into() take their\nargument structs by value, causing MSAN to report uninit-value warnings.\nWhile only vidtv_ts_null_write_into() has triggered a report so far,\nboth functions share the same issue.\n\nFix by passing both structs by const pointer instead, avoiding the\nstack copy of the struct along with its MSAN shadow and origin metadata.\nThe functions do not modify the structs, which is enforced by the const\nqualifier."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:44:43.464Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a876d72ceba7fe5444005239f363c105767e0ecf"
},
{
"url": "https://git.kernel.org/stable/c/a73f84a30975e6c4ae06efd500d31c82564dba10"
},
{
"url": "https://git.kernel.org/stable/c/c034d8094fee474eb94142c17643eee2919079b7"
},
{
"url": "https://git.kernel.org/stable/c/e3957eb26a3d570aefc6bb184fa8b8a1e9a4e508"
},
{
"url": "https://git.kernel.org/stable/c/be57e52e27c7cbfb400a8f255e475cbcff242baa"
},
{
"url": "https://git.kernel.org/stable/c/6d75a9ec5bdb8cf8382eaf8f8fe831ba7d58a9d4"
},
{
"url": "https://git.kernel.org/stable/c/57b01d945ed68cebe486d495dadc4901a96d3aaa"
},
{
"url": "https://git.kernel.org/stable/c/1b2820c8a9887981634020db19f1a2425558b88e"
},
{
"url": "https://git.kernel.org/stable/c/5f8e73bde67e931468bc2a1860d78d72f0c6ba41"
}
],
"title": "media: vidtv: fix pass-by-value structs causing MSAN warnings",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43058",
"datePublished": "2026-05-02T06:11:50.870Z",
"dateReserved": "2026-05-01T14:12:55.981Z",
"dateUpdated": "2026-06-14T17:44:43.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43345 (GCVE-0-2026-43345)
Vulnerability from cvelistv5
Published
2026-05-08 13:39
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ipa: fix event ring index not programmed for IPA v5.0+
For IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to
CH_C_CNTXT_1. The v5.0 register definition intended to define this
field in the CH_C_CNTXT_1 fmask array but used the old identifier of
ERINDEX instead of CH_ERINDEX.
Without a valid event ring, GSI channels could never signal transfer
completions. This caused gsi_channel_trans_quiesce() to block
forever in wait_for_completion().
At least for IPA v5.2 this resolves an issue seen where runtime
suspend, system suspend, and remoteproc stop all hanged forever. It
also meant the IPA data path was completely non functional.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ipa/reg/gsi_reg-v5.0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae8343a19ccb051d519dbb3a9082ddea9f0551d3",
"status": "affected",
"version": "faf0678ec8a0aa9039d8b188d012206abd67dd5c",
"versionType": "git"
},
{
"lessThan": "2bf18b643c4656413f7cfd5615af60a6b4e261da",
"status": "affected",
"version": "faf0678ec8a0aa9039d8b188d012206abd67dd5c",
"versionType": "git"
},
{
"lessThan": "2d2dc166d55148cfcf8ae67b415f8d6d110e6fca",
"status": "affected",
"version": "faf0678ec8a0aa9039d8b188d012206abd67dd5c",
"versionType": "git"
},
{
"lessThan": "34c988bb04cbdf093d2134e179433da49ffcd044",
"status": "affected",
"version": "faf0678ec8a0aa9039d8b188d012206abd67dd5c",
"versionType": "git"
},
{
"lessThan": "56007972c0b1e783ca714d6f1f4d6e66e531d21f",
"status": "affected",
"version": "faf0678ec8a0aa9039d8b188d012206abd67dd5c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ipa/reg/gsi_reg-v5.0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipa: fix event ring index not programmed for IPA v5.0+\n\nFor IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to\nCH_C_CNTXT_1. The v5.0 register definition intended to define this\nfield in the CH_C_CNTXT_1 fmask array but used the old identifier of\nERINDEX instead of CH_ERINDEX.\n\nWithout a valid event ring, GSI channels could never signal transfer\ncompletions. This caused gsi_channel_trans_quiesce() to block\nforever in wait_for_completion().\n\nAt least for IPA v5.2 this resolves an issue seen where runtime\nsuspend, system suspend, and remoteproc stop all hanged forever. It\nalso meant the IPA data path was completely non functional."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The affected IPA/GSI channels are the Qualcomm modem/RMNet network data path, including AP receive channels driven by packets arriving from the cellular/network side. A remote peer can send traffic to a configured affected device without reaching any ioctl or local-only control interface.\nAC:L - The failure is deterministic on IPA v5.0+ hardware because the channel event-ring index is never encoded into CH_C_CNTXT_1. No race, heap shaping, or attacker-uncontrolled timing is needed once the affected channel is programmed and used.\nPR:N - For the remote packet/data-path scenario, the attacker does not need local credentials or kernel capabilities. The relevant receive path is packet-driven after the device and modem interface are configured by the system.\nUI:N - No victim action is required beyond the affected device being online with its IPA modem data path configured. Traffic or normal power-management transitions can exercise the broken completion path.\nS:U - The impact remains within the same kernel/device security authority. This is not a VM escape, IOMMU bypass, or cross-sandbox boundary violation.\nC:N - The bug is an incorrect hardware register field mask that prevents completion signaling; I found no out-of-bounds access, use-after-free, or attacker-readable memory exposure. The event rings are driver-allocated DMA rings, not an arbitrary disclosure primitive.\nI:N - The observed and code-supported impact is loss of completion signaling and broken data-path operation, not attacker-controlled modification of kernel memory or persistent data. There is no evident arbitrary write or control-flow corruption primitive.\nA:H - Missing completions cause waits such as gsi_channel_trans_quiesce() to block forever, hanging runtime suspend, system suspend, and remoteproc stop. The IPA data path can also become completely nonfunctional, so availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:22.811Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae8343a19ccb051d519dbb3a9082ddea9f0551d3"
},
{
"url": "https://git.kernel.org/stable/c/2bf18b643c4656413f7cfd5615af60a6b4e261da"
},
{
"url": "https://git.kernel.org/stable/c/2d2dc166d55148cfcf8ae67b415f8d6d110e6fca"
},
{
"url": "https://git.kernel.org/stable/c/34c988bb04cbdf093d2134e179433da49ffcd044"
},
{
"url": "https://git.kernel.org/stable/c/56007972c0b1e783ca714d6f1f4d6e66e531d21f"
}
],
"title": "net: ipa: fix event ring index not programmed for IPA v5.0+",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43345",
"datePublished": "2026-05-08T13:39:31.222Z",
"dateReserved": "2026-05-01T14:12:56.003Z",
"dateUpdated": "2026-08-05T12:27:22.811Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46236 (GCVE-0-2026-46236)
Vulnerability from cvelistv5
Published
2026-05-28 09:41
Modified
2026-06-14 18:04
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: rc: xbox_remote: heed DMA restrictions
The buffer for IO must not be part of the device structure
because that violates the DMA coherency rules.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 02d32bdad3123d7376244256936a6b3b6ee434e8 Version: 02d32bdad3123d7376244256936a6b3b6ee434e8 Version: 02d32bdad3123d7376244256936a6b3b6ee434e8 Version: 02d32bdad3123d7376244256936a6b3b6ee434e8 Version: 02d32bdad3123d7376244256936a6b3b6ee434e8 Version: 02d32bdad3123d7376244256936a6b3b6ee434e8 Version: 02d32bdad3123d7376244256936a6b3b6ee434e8 Version: 02d32bdad3123d7376244256936a6b3b6ee434e8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/rc/xbox_remote.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "465d27ab83692167f06a6f917bdfd0a0d4fc8ff3",
"status": "affected",
"version": "02d32bdad3123d7376244256936a6b3b6ee434e8",
"versionType": "git"
},
{
"lessThan": "e0301883ec779c21158a3923b2eb666074fa976e",
"status": "affected",
"version": "02d32bdad3123d7376244256936a6b3b6ee434e8",
"versionType": "git"
},
{
"lessThan": "0ea67a135335e51be50e83ee4cc99560b8b89c25",
"status": "affected",
"version": "02d32bdad3123d7376244256936a6b3b6ee434e8",
"versionType": "git"
},
{
"lessThan": "0cc9251833bf02c8c7863404157c94dab5928fcf",
"status": "affected",
"version": "02d32bdad3123d7376244256936a6b3b6ee434e8",
"versionType": "git"
},
{
"lessThan": "48a668c22e8f92637bc496e84d1cf06900f74a5c",
"status": "affected",
"version": "02d32bdad3123d7376244256936a6b3b6ee434e8",
"versionType": "git"
},
{
"lessThan": "63a960b39de9c51f29ca19aa5067934f865c0bc7",
"status": "affected",
"version": "02d32bdad3123d7376244256936a6b3b6ee434e8",
"versionType": "git"
},
{
"lessThan": "0bd8ac88ec5f74cd0f4b8cfc54f4cc0827007249",
"status": "affected",
"version": "02d32bdad3123d7376244256936a6b3b6ee434e8",
"versionType": "git"
},
{
"lessThan": "e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff",
"status": "affected",
"version": "02d32bdad3123d7376244256936a6b3b6ee434e8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/rc/xbox_remote.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rc: xbox_remote: heed DMA restrictions\n\nThe buffer for IO must not be part of the device structure\nbecause that violates the DMA coherency rules."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:04:50.463Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/465d27ab83692167f06a6f917bdfd0a0d4fc8ff3"
},
{
"url": "https://git.kernel.org/stable/c/e0301883ec779c21158a3923b2eb666074fa976e"
},
{
"url": "https://git.kernel.org/stable/c/0ea67a135335e51be50e83ee4cc99560b8b89c25"
},
{
"url": "https://git.kernel.org/stable/c/0cc9251833bf02c8c7863404157c94dab5928fcf"
},
{
"url": "https://git.kernel.org/stable/c/48a668c22e8f92637bc496e84d1cf06900f74a5c"
},
{
"url": "https://git.kernel.org/stable/c/63a960b39de9c51f29ca19aa5067934f865c0bc7"
},
{
"url": "https://git.kernel.org/stable/c/0bd8ac88ec5f74cd0f4b8cfc54f4cc0827007249"
},
{
"url": "https://git.kernel.org/stable/c/e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff"
}
],
"title": "media: rc: xbox_remote: heed DMA restrictions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46236",
"datePublished": "2026-05-28T09:41:05.230Z",
"dateReserved": "2026-05-13T15:03:33.106Z",
"dateUpdated": "2026-06-14T18:04:50.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43137 (GCVE-0-2026-43137)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-23 11:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Intel: hda: Fix NULL pointer dereference
If there's a mismatch between the DAI links in the machine driver and
the topology, it is possible that the playback/capture widget is not
set, especially in the case of loopback capture for echo reference
where we use the dummy DAI link. Return the error when the widget is not
set to avoid a null pointer dereference like below when the topology is
broken.
RIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common]
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/intel/hda-dai.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a1d4f3d3c0dc86527da6a19f6901a6a48375500d",
"status": "affected",
"version": "0acb48dd31e39b617bb12ca546b4fecd6ccb2972",
"versionType": "git"
},
{
"lessThan": "10411f1f2c76be67103b1f95822ff629aa25e2aa",
"status": "affected",
"version": "0acb48dd31e39b617bb12ca546b4fecd6ccb2972",
"versionType": "git"
},
{
"lessThan": "42068f7dd42b559c4eeae645e1455ff36518866a",
"status": "affected",
"version": "0acb48dd31e39b617bb12ca546b4fecd6ccb2972",
"versionType": "git"
},
{
"lessThan": "7750d78b4014902bc0ac03d4bb30faa076a913ab",
"status": "affected",
"version": "0acb48dd31e39b617bb12ca546b4fecd6ccb2972",
"versionType": "git"
},
{
"lessThan": "16c589567a956d46a7c1363af3f64de3d420af20",
"status": "affected",
"version": "0acb48dd31e39b617bb12ca546b4fecd6ccb2972",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/intel/hda-dai.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: Intel: hda: Fix NULL pointer dereference\n\nIf there\u0027s a mismatch between the DAI links in the machine driver and\nthe topology, it is possible that the playback/capture widget is not\nset, especially in the case of loopback capture for echo reference\nwhere we use the dummy DAI link. Return the error when the widget is not\nset to avoid a null pointer dereference like below when the topology is\nbroken.\n\nRIP: 0010:hda_dai_get_ops.isra.0+0x14/0xa0 [snd_sof_intel_hda_common]"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T11:25:56.128Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a1d4f3d3c0dc86527da6a19f6901a6a48375500d"
},
{
"url": "https://git.kernel.org/stable/c/10411f1f2c76be67103b1f95822ff629aa25e2aa"
},
{
"url": "https://git.kernel.org/stable/c/42068f7dd42b559c4eeae645e1455ff36518866a"
},
{
"url": "https://git.kernel.org/stable/c/7750d78b4014902bc0ac03d4bb30faa076a913ab"
},
{
"url": "https://git.kernel.org/stable/c/16c589567a956d46a7c1363af3f64de3d420af20"
}
],
"title": "ASoC: SOF: Intel: hda: Fix NULL pointer dereference",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43137",
"datePublished": "2026-05-06T11:27:23.592Z",
"dateReserved": "2026-05-01T14:12:55.988Z",
"dateUpdated": "2026-05-23T11:25:56.128Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43314 (GCVE-0-2026-43314)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-05-11 22:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm: remove fake timeout to avoid leak request
Since commit 15f73f5b3e59 ("blk-mq: move failure injection out of
blk_mq_complete_request"), drivers are responsible for calling
blk_should_fake_timeout() at appropriate code paths and opportunities.
However, the dm driver does not implement its own timeout handler and
relies on the timeout handling of its slave devices.
If an io-timeout-fail error is injected to a dm device, the request
will be leaked and never completed, causing tasks to hang indefinitely.
Reproduce:
1. prepare dm which has iscsi slave device
2. inject io-timeout-fail to dm
echo 1 >/sys/class/block/dm-0/io-timeout-fail
echo 100 >/sys/kernel/debug/fail_io_timeout/probability
echo 10 >/sys/kernel/debug/fail_io_timeout/times
3. read/write dm
4. iscsiadm -m node -u
Result: hang task like below
[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds.
[ 862.244133] Tainted: G E 6.19.0-rc1+ #51
[ 862.244337] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000
[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi]
[ 862.245264] Call Trace:
[ 862.245587] <TASK>
[ 862.245814] __schedule+0x810/0x15c0
[ 862.246557] schedule+0x69/0x180
[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120
[ 862.247688] elevator_change+0x16d/0x460
[ 862.247893] elevator_set_none+0x87/0xf0
[ 862.248798] blk_unregister_queue+0x12e/0x2a0
[ 862.248995] __del_gendisk+0x231/0x7e0
[ 862.250143] del_gendisk+0x12f/0x1d0
[ 862.250339] sd_remove+0x85/0x130 [sd_mod]
[ 862.250650] device_release_driver_internal+0x36d/0x530
[ 862.250849] bus_remove_device+0x1dd/0x3f0
[ 862.251042] device_del+0x38a/0x930
[ 862.252095] __scsi_remove_device+0x293/0x360
[ 862.252291] scsi_remove_target+0x486/0x760
[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi]
[ 862.252886] process_one_work+0x633/0xe50
[ 862.253101] worker_thread+0x6df/0xf10
[ 862.253647] kthread+0x36d/0x720
[ 862.254533] ret_from_fork+0x2a6/0x470
[ 862.255852] ret_from_fork_asm+0x1a/0x30
[ 862.256037] </TASK>
Remove the blk_should_fake_timeout() check from dm, as dm has no
native timeout handling and should not attempt to fake timeouts.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e6ee8c0b767540f59e20da3ced282601db8aa502 Version: e6ee8c0b767540f59e20da3ced282601db8aa502 Version: e6ee8c0b767540f59e20da3ced282601db8aa502 Version: e6ee8c0b767540f59e20da3ced282601db8aa502 Version: e6ee8c0b767540f59e20da3ced282601db8aa502 Version: e6ee8c0b767540f59e20da3ced282601db8aa502 Version: e6ee8c0b767540f59e20da3ced282601db8aa502 Version: e6ee8c0b767540f59e20da3ced282601db8aa502 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-rq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ece6720de9403260088209b0b92d45e0b49ff856",
"status": "affected",
"version": "e6ee8c0b767540f59e20da3ced282601db8aa502",
"versionType": "git"
},
{
"lessThan": "8200fca818c1e2f65bc6cb16d934ff6049302197",
"status": "affected",
"version": "e6ee8c0b767540f59e20da3ced282601db8aa502",
"versionType": "git"
},
{
"lessThan": "b307b6307f6459841312432bd4bc9519cbac97f5",
"status": "affected",
"version": "e6ee8c0b767540f59e20da3ced282601db8aa502",
"versionType": "git"
},
{
"lessThan": "4f9e7ca933a9fbf9912a384b061a00c77332cbf0",
"status": "affected",
"version": "e6ee8c0b767540f59e20da3ced282601db8aa502",
"versionType": "git"
},
{
"lessThan": "cf2d06c9fd4b6521ea5b7f73c99c64c2c6f5e224",
"status": "affected",
"version": "e6ee8c0b767540f59e20da3ced282601db8aa502",
"versionType": "git"
},
{
"lessThan": "6cdb21e0c9fdee484feba14fc9e72e9d07daf9f3",
"status": "affected",
"version": "e6ee8c0b767540f59e20da3ced282601db8aa502",
"versionType": "git"
},
{
"lessThan": "c8a23d4c995ef4227bd4de64cd3910637ee6162e",
"status": "affected",
"version": "e6ee8c0b767540f59e20da3ced282601db8aa502",
"versionType": "git"
},
{
"lessThan": "f3a9c95a15d2f4466acad5c68faeff79ca5e9f47",
"status": "affected",
"version": "e6ee8c0b767540f59e20da3ced282601db8aa502",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-rq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: remove fake timeout to avoid leak request\n\nSince commit 15f73f5b3e59 (\"blk-mq: move failure injection out of\nblk_mq_complete_request\"), drivers are responsible for calling\nblk_should_fake_timeout() at appropriate code paths and opportunities.\n\nHowever, the dm driver does not implement its own timeout handler and\nrelies on the timeout handling of its slave devices.\n\nIf an io-timeout-fail error is injected to a dm device, the request\nwill be leaked and never completed, causing tasks to hang indefinitely.\n\nReproduce:\n1. prepare dm which has iscsi slave device\n2. inject io-timeout-fail to dm\n echo 1 \u003e/sys/class/block/dm-0/io-timeout-fail\n echo 100 \u003e/sys/kernel/debug/fail_io_timeout/probability\n echo 10 \u003e/sys/kernel/debug/fail_io_timeout/times\n3. read/write dm\n4. iscsiadm -m node -u\n\nResult: hang task like below\n[ 862.243768] INFO: task kworker/u514:2:151 blocked for more than 122 seconds.\n[ 862.244133] Tainted: G E 6.19.0-rc1+ #51\n[ 862.244337] \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n[ 862.244718] task:kworker/u514:2 state:D stack:0 pid:151 tgid:151 ppid:2 task_flags:0x4288060 flags:0x00080000\n[ 862.245024] Workqueue: iscsi_ctrl_3:1 __iscsi_unbind_session [scsi_transport_iscsi]\n[ 862.245264] Call Trace:\n[ 862.245587] \u003cTASK\u003e\n[ 862.245814] __schedule+0x810/0x15c0\n[ 862.246557] schedule+0x69/0x180\n[ 862.246760] blk_mq_freeze_queue_wait+0xde/0x120\n[ 862.247688] elevator_change+0x16d/0x460\n[ 862.247893] elevator_set_none+0x87/0xf0\n[ 862.248798] blk_unregister_queue+0x12e/0x2a0\n[ 862.248995] __del_gendisk+0x231/0x7e0\n[ 862.250143] del_gendisk+0x12f/0x1d0\n[ 862.250339] sd_remove+0x85/0x130 [sd_mod]\n[ 862.250650] device_release_driver_internal+0x36d/0x530\n[ 862.250849] bus_remove_device+0x1dd/0x3f0\n[ 862.251042] device_del+0x38a/0x930\n[ 862.252095] __scsi_remove_device+0x293/0x360\n[ 862.252291] scsi_remove_target+0x486/0x760\n[ 862.252654] __iscsi_unbind_session+0x18a/0x3e0 [scsi_transport_iscsi]\n[ 862.252886] process_one_work+0x633/0xe50\n[ 862.253101] worker_thread+0x6df/0xf10\n[ 862.253647] kthread+0x36d/0x720\n[ 862.254533] ret_from_fork+0x2a6/0x470\n[ 862.255852] ret_from_fork_asm+0x1a/0x30\n[ 862.256037] \u003c/TASK\u003e\n\nRemove the blk_should_fake_timeout() check from dm, as dm has no\nnative timeout handling and should not attempt to fake timeouts."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:22:09.779Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ece6720de9403260088209b0b92d45e0b49ff856"
},
{
"url": "https://git.kernel.org/stable/c/8200fca818c1e2f65bc6cb16d934ff6049302197"
},
{
"url": "https://git.kernel.org/stable/c/b307b6307f6459841312432bd4bc9519cbac97f5"
},
{
"url": "https://git.kernel.org/stable/c/4f9e7ca933a9fbf9912a384b061a00c77332cbf0"
},
{
"url": "https://git.kernel.org/stable/c/cf2d06c9fd4b6521ea5b7f73c99c64c2c6f5e224"
},
{
"url": "https://git.kernel.org/stable/c/6cdb21e0c9fdee484feba14fc9e72e9d07daf9f3"
},
{
"url": "https://git.kernel.org/stable/c/c8a23d4c995ef4227bd4de64cd3910637ee6162e"
},
{
"url": "https://git.kernel.org/stable/c/f3a9c95a15d2f4466acad5c68faeff79ca5e9f47"
}
],
"title": "dm: remove fake timeout to avoid leak request",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43314",
"datePublished": "2026-05-08T13:11:31.068Z",
"dateReserved": "2026-05-01T14:12:56.001Z",
"dateUpdated": "2026-05-11T22:22:09.779Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45857 (GCVE-0-2026-45857)
Vulnerability from cvelistv5
Published
2026-05-27 12:15
Modified
2026-05-27 12:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: csiostor: Fix dereference of null pointer rn
The error exit path when rn is NULL ends up deferencing the null pointer rn
via the use of the macro CSIO_INC_STATS. Fix this by adding a new error
return path label after the use of the macro to avoid the deference.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a3667aaed5698b84bad2f1b3f71adc86499f4bc6 Version: a3667aaed5698b84bad2f1b3f71adc86499f4bc6 Version: a3667aaed5698b84bad2f1b3f71adc86499f4bc6 Version: a3667aaed5698b84bad2f1b3f71adc86499f4bc6 Version: a3667aaed5698b84bad2f1b3f71adc86499f4bc6 Version: a3667aaed5698b84bad2f1b3f71adc86499f4bc6 Version: a3667aaed5698b84bad2f1b3f71adc86499f4bc6 Version: a3667aaed5698b84bad2f1b3f71adc86499f4bc6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/csiostor/csio_scsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "16ccbfddcb32365138c806cf572e69b42a193c5c",
"status": "affected",
"version": "a3667aaed5698b84bad2f1b3f71adc86499f4bc6",
"versionType": "git"
},
{
"lessThan": "44ef9f81392de885883f73b9f5c43936a82ae9d7",
"status": "affected",
"version": "a3667aaed5698b84bad2f1b3f71adc86499f4bc6",
"versionType": "git"
},
{
"lessThan": "526ea3c0ccd495b0079db3e28fdddd51c1bf01f7",
"status": "affected",
"version": "a3667aaed5698b84bad2f1b3f71adc86499f4bc6",
"versionType": "git"
},
{
"lessThan": "25d623f0d77c11a256a54e860d00c239aa9a2583",
"status": "affected",
"version": "a3667aaed5698b84bad2f1b3f71adc86499f4bc6",
"versionType": "git"
},
{
"lessThan": "6037124dbf675fbd0a6248aaf04cf07387b8c323",
"status": "affected",
"version": "a3667aaed5698b84bad2f1b3f71adc86499f4bc6",
"versionType": "git"
},
{
"lessThan": "25ab5e97d3c5f3ed594b4a65d1cc99dc24756681",
"status": "affected",
"version": "a3667aaed5698b84bad2f1b3f71adc86499f4bc6",
"versionType": "git"
},
{
"lessThan": "3bbbab7b6949c76df64210348adbefedaabbf549",
"status": "affected",
"version": "a3667aaed5698b84bad2f1b3f71adc86499f4bc6",
"versionType": "git"
},
{
"lessThan": "1982257570b84dc33753d536dd969fd357a014e9",
"status": "affected",
"version": "a3667aaed5698b84bad2f1b3f71adc86499f4bc6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/csiostor/csio_scsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: csiostor: Fix dereference of null pointer rn\n\nThe error exit path when rn is NULL ends up deferencing the null pointer rn\nvia the use of the macro CSIO_INC_STATS. Fix this by adding a new error\nreturn path label after the use of the macro to avoid the deference."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:15:35.967Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/16ccbfddcb32365138c806cf572e69b42a193c5c"
},
{
"url": "https://git.kernel.org/stable/c/44ef9f81392de885883f73b9f5c43936a82ae9d7"
},
{
"url": "https://git.kernel.org/stable/c/526ea3c0ccd495b0079db3e28fdddd51c1bf01f7"
},
{
"url": "https://git.kernel.org/stable/c/25d623f0d77c11a256a54e860d00c239aa9a2583"
},
{
"url": "https://git.kernel.org/stable/c/6037124dbf675fbd0a6248aaf04cf07387b8c323"
},
{
"url": "https://git.kernel.org/stable/c/25ab5e97d3c5f3ed594b4a65d1cc99dc24756681"
},
{
"url": "https://git.kernel.org/stable/c/3bbbab7b6949c76df64210348adbefedaabbf549"
},
{
"url": "https://git.kernel.org/stable/c/1982257570b84dc33753d536dd969fd357a014e9"
}
],
"title": "scsi: csiostor: Fix dereference of null pointer rn",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45857",
"datePublished": "2026-05-27T12:15:35.967Z",
"dateReserved": "2026-05-13T15:03:33.079Z",
"dateUpdated": "2026-05-27T12:15:35.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46267 (GCVE-0-2026-46267)
Vulnerability from cvelistv5
Published
2026-06-03 15:50
Modified
2026-06-03 15:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfc: hci: shdlc: Stop timers and work before freeing context
llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc
structure while its timers and state machine work may still be active.
Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state
and the skb queues. If teardown happens in parallel with a queued/running
work item, it can lead to UAF and other shutdown races.
Stop all SHDLC timers and cancel sm_work synchronously before purging the
queues and freeing the context.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4a61cd6687fc6348d08724676d34e38160d6cf9b Version: 4a61cd6687fc6348d08724676d34e38160d6cf9b Version: 4a61cd6687fc6348d08724676d34e38160d6cf9b Version: 4a61cd6687fc6348d08724676d34e38160d6cf9b Version: 4a61cd6687fc6348d08724676d34e38160d6cf9b Version: 4a61cd6687fc6348d08724676d34e38160d6cf9b Version: 4a61cd6687fc6348d08724676d34e38160d6cf9b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/nfc/hci/llc_shdlc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c60f41022eaad2a1dafecd3ae6f249a3bd6d4b6e",
"status": "affected",
"version": "4a61cd6687fc6348d08724676d34e38160d6cf9b",
"versionType": "git"
},
{
"lessThan": "a24a676329d40481b2331bfa1418a679577dfd3a",
"status": "affected",
"version": "4a61cd6687fc6348d08724676d34e38160d6cf9b",
"versionType": "git"
},
{
"lessThan": "77eef9f2eef045c3c37a3df82d3e661afb866b98",
"status": "affected",
"version": "4a61cd6687fc6348d08724676d34e38160d6cf9b",
"versionType": "git"
},
{
"lessThan": "cf70cedce327833296ebe6043364d1e44b76a2ab",
"status": "affected",
"version": "4a61cd6687fc6348d08724676d34e38160d6cf9b",
"versionType": "git"
},
{
"lessThan": "276820278e9717cc7d4bb32381892dd3ddf418d4",
"status": "affected",
"version": "4a61cd6687fc6348d08724676d34e38160d6cf9b",
"versionType": "git"
},
{
"lessThan": "1cb97b1225450af3f7b728777929ba50c6a58ced",
"status": "affected",
"version": "4a61cd6687fc6348d08724676d34e38160d6cf9b",
"versionType": "git"
},
{
"lessThan": "c9efde1e537baed7648a94022b43836a348a074f",
"status": "affected",
"version": "4a61cd6687fc6348d08724676d34e38160d6cf9b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/nfc/hci/llc_shdlc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: hci: shdlc: Stop timers and work before freeing context\n\nllc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc\nstructure while its timers and state machine work may still be active.\n\nTimer callbacks can schedule sm_work, and sm_work accesses SHDLC state\nand the skb queues. If teardown happens in parallel with a queued/running\nwork item, it can lead to UAF and other shutdown races.\n\nStop all SHDLC timers and cancel sm_work synchronously before purging the\nqueues and freeing the context.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T15:50:09.035Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c60f41022eaad2a1dafecd3ae6f249a3bd6d4b6e"
},
{
"url": "https://git.kernel.org/stable/c/a24a676329d40481b2331bfa1418a679577dfd3a"
},
{
"url": "https://git.kernel.org/stable/c/77eef9f2eef045c3c37a3df82d3e661afb866b98"
},
{
"url": "https://git.kernel.org/stable/c/cf70cedce327833296ebe6043364d1e44b76a2ab"
},
{
"url": "https://git.kernel.org/stable/c/276820278e9717cc7d4bb32381892dd3ddf418d4"
},
{
"url": "https://git.kernel.org/stable/c/1cb97b1225450af3f7b728777929ba50c6a58ced"
},
{
"url": "https://git.kernel.org/stable/c/c9efde1e537baed7648a94022b43836a348a074f"
}
],
"title": "nfc: hci: shdlc: Stop timers and work before freeing context",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46267",
"datePublished": "2026-06-03T15:50:09.035Z",
"dateReserved": "2026-05-13T15:03:33.108Z",
"dateUpdated": "2026-06-03T15:50:09.035Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31576 (GCVE-0-2026-31576)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: hackrf: fix to not free memory after the device is registered in hackrf_probe()
In hackrf driver, the following race condition occurs:
```
CPU0 CPU1
hackrf_probe()
kzalloc(); // alloc hackrf_dev
....
v4l2_device_register();
....
fd = sys_open("/path/to/dev"); // open hackrf fd
....
v4l2_device_unregister();
....
kfree(); // free hackrf_dev
....
sys_ioctl(fd, ...);
v4l2_ioctl();
video_is_registered() // UAF!!
....
sys_close(fd);
v4l2_release() // UAF!!
hackrf_video_release()
kfree(); // DFB!!
```
When a V4L2 or video device is unregistered, the device node is removed so
new open() calls are blocked.
However, file descriptors that are already open-and any in-flight I/O-do
not terminate immediately; they remain valid until the last reference is
dropped and the driver's release() is invoked.
Therefore, freeing device memory on the error path after hackrf_probe()
has registered dev it will lead to a race to use-after-free vuln, since
those already-open handles haven't been released yet.
And since release() free memory too, race to use-after-free and
double-free vuln occur.
To prevent this, if device is registered from probe(), it should be
modified to free memory only through release() rather than calling
kfree() directly.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8bc4a9ed85046c214458c9e82aea75d2f46cfffd Version: 8bc4a9ed85046c214458c9e82aea75d2f46cfffd Version: 8bc4a9ed85046c214458c9e82aea75d2f46cfffd Version: 8bc4a9ed85046c214458c9e82aea75d2f46cfffd Version: 8bc4a9ed85046c214458c9e82aea75d2f46cfffd Version: 8bc4a9ed85046c214458c9e82aea75d2f46cfffd Version: 8bc4a9ed85046c214458c9e82aea75d2f46cfffd Version: 8bc4a9ed85046c214458c9e82aea75d2f46cfffd Version: 8bc4a9ed85046c214458c9e82aea75d2f46cfffd |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/usb/hackrf/hackrf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "87b9685cca91ed715c39ba544715832d26a7f4b4",
"status": "affected",
"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd",
"versionType": "git"
},
{
"lessThan": "131ec9046e1c8af101aebdaec4e8095e05f3312b",
"status": "affected",
"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd",
"versionType": "git"
},
{
"lessThan": "67fd62e3efdc9dce01f76d95a745212f4feb38e6",
"status": "affected",
"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd",
"versionType": "git"
},
{
"lessThan": "45cbaf5c7cdc5386d86377f0daf94a17a007fed0",
"status": "affected",
"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd",
"versionType": "git"
},
{
"lessThan": "98a0a81ce78020c2522e0046f49d200de9778cb9",
"status": "affected",
"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd",
"versionType": "git"
},
{
"lessThan": "07e9e674b6146b1f6fc41b1f54b8968bf2802824",
"status": "affected",
"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd",
"versionType": "git"
},
{
"lessThan": "2145c71a8044362e82e9923f001ba2aeb771b848",
"status": "affected",
"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd",
"versionType": "git"
},
{
"lessThan": "fcd1d70792a35c8a97414fe429f48311e41269c2",
"status": "affected",
"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd",
"versionType": "git"
},
{
"lessThan": "3b7da2b4d0fe014eff181ed37e3bf832eb8ed258",
"status": "affected",
"version": "8bc4a9ed85046c214458c9e82aea75d2f46cfffd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/usb/hackrf/hackrf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: hackrf: fix to not free memory after the device is registered in hackrf_probe()\n\nIn hackrf driver, the following race condition occurs:\n```\n\t\tCPU0\t\t\t\t\t\tCPU1\nhackrf_probe()\n kzalloc(); // alloc hackrf_dev\n ....\n v4l2_device_register();\n ....\n\t\t\t\t\t\tfd = sys_open(\"/path/to/dev\"); // open hackrf fd\n\t\t\t\t\t\t....\n v4l2_device_unregister();\n ....\n kfree(); // free hackrf_dev\n ....\n\t\t\t\t\t\tsys_ioctl(fd, ...);\n\t\t\t\t\t\t v4l2_ioctl();\n\t\t\t\t\t\t video_is_registered() // UAF!!\n\t\t\t\t\t\t....\n\t\t\t\t\t\tsys_close(fd);\n\t\t\t\t\t\t v4l2_release() // UAF!!\n\t\t\t\t\t\t hackrf_video_release()\n\t\t\t\t\t\t kfree(); // DFB!!\n```\n\nWhen a V4L2 or video device is unregistered, the device node is removed so\nnew open() calls are blocked.\n\nHowever, file descriptors that are already open-and any in-flight I/O-do\nnot terminate immediately; they remain valid until the last reference is\ndropped and the driver\u0027s release() is invoked.\n\nTherefore, freeing device memory on the error path after hackrf_probe()\nhas registered dev it will lead to a race to use-after-free vuln, since\nthose already-open handles haven\u0027t been released yet.\n\nAnd since release() free memory too, race to use-after-free and\ndouble-free vuln occur.\n\nTo prevent this, if device is registered from probe(), it should be\nmodified to free memory only through release() rather than calling\nkfree() directly."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:42:00.110Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/87b9685cca91ed715c39ba544715832d26a7f4b4"
},
{
"url": "https://git.kernel.org/stable/c/131ec9046e1c8af101aebdaec4e8095e05f3312b"
},
{
"url": "https://git.kernel.org/stable/c/67fd62e3efdc9dce01f76d95a745212f4feb38e6"
},
{
"url": "https://git.kernel.org/stable/c/45cbaf5c7cdc5386d86377f0daf94a17a007fed0"
},
{
"url": "https://git.kernel.org/stable/c/98a0a81ce78020c2522e0046f49d200de9778cb9"
},
{
"url": "https://git.kernel.org/stable/c/07e9e674b6146b1f6fc41b1f54b8968bf2802824"
},
{
"url": "https://git.kernel.org/stable/c/2145c71a8044362e82e9923f001ba2aeb771b848"
},
{
"url": "https://git.kernel.org/stable/c/fcd1d70792a35c8a97414fe429f48311e41269c2"
},
{
"url": "https://git.kernel.org/stable/c/3b7da2b4d0fe014eff181ed37e3bf832eb8ed258"
}
],
"title": "media: hackrf: fix to not free memory after the device is registered in hackrf_probe()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31576",
"datePublished": "2026-04-24T14:42:08.188Z",
"dateReserved": "2026-03-09T15:48:24.119Z",
"dateUpdated": "2026-06-14T17:42:00.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53263 (GCVE-0-2026-53263)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
6lowpan: fix off-by-one in multicast context address compression
The second memcpy in lowpan_iphc_mcast_ctx_addr_compress() uses
&data[1] as destination and &ipaddr->s6_addr[11] as source, but
both should be offset by one: &data[2] and &ipaddr->s6_addr[12]
respectively.
This off-by-one has two consequences:
1. data[1] is overwritten with s6_addr[11], corrupting the RIID
field in the compressed multicast address
2. data[5] is never written, so uninitialized kernel stack memory
is transmitted over the network via lowpan_push_hc_data(),
leaking kernel stack contents
The correct inline data layout must match what the decompression
function lowpan_uncompress_multicast_ctx_daddr() expects:
data[0..1] = s6_addr[1..2] (flags/scope + RIID)
data[2..5] = s6_addr[12..15] (group ID)
Also zero-initialize the data array as a defensive measure against
similar bugs in the future.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5609c185f24dffca5f6a9c127106869da150be03 Version: 5609c185f24dffca5f6a9c127106869da150be03 Version: 5609c185f24dffca5f6a9c127106869da150be03 Version: 5609c185f24dffca5f6a9c127106869da150be03 Version: 5609c185f24dffca5f6a9c127106869da150be03 Version: 5609c185f24dffca5f6a9c127106869da150be03 Version: 5609c185f24dffca5f6a9c127106869da150be03 Version: 5609c185f24dffca5f6a9c127106869da150be03 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/6lowpan/iphc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f24a58c72a45f4c109f3557a760cc4b60b7a6037",
"status": "affected",
"version": "5609c185f24dffca5f6a9c127106869da150be03",
"versionType": "git"
},
{
"lessThan": "da8cbb64b47e9066b40af0de170901caf17b768c",
"status": "affected",
"version": "5609c185f24dffca5f6a9c127106869da150be03",
"versionType": "git"
},
{
"lessThan": "4485d79617520d84ba5a14515e2b5136007d6deb",
"status": "affected",
"version": "5609c185f24dffca5f6a9c127106869da150be03",
"versionType": "git"
},
{
"lessThan": "06ce6fc106b16dec9b535950db626261be865e5b",
"status": "affected",
"version": "5609c185f24dffca5f6a9c127106869da150be03",
"versionType": "git"
},
{
"lessThan": "dcb1bec1c32ee5c3878354e087cf5dbee2b7c7af",
"status": "affected",
"version": "5609c185f24dffca5f6a9c127106869da150be03",
"versionType": "git"
},
{
"lessThan": "c32f30ef5e66adbfa102348e2e8a23776eb007cb",
"status": "affected",
"version": "5609c185f24dffca5f6a9c127106869da150be03",
"versionType": "git"
},
{
"lessThan": "da8808463882c3f3c357b072e25053c2121f1419",
"status": "affected",
"version": "5609c185f24dffca5f6a9c127106869da150be03",
"versionType": "git"
},
{
"lessThan": "2a58899d11009bffc7b4b32a571858f381121837",
"status": "affected",
"version": "5609c185f24dffca5f6a9c127106869da150be03",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/6lowpan/iphc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\n6lowpan: fix off-by-one in multicast context address compression\n\nThe second memcpy in lowpan_iphc_mcast_ctx_addr_compress() uses\n\u0026data[1] as destination and \u0026ipaddr-\u003es6_addr[11] as source, but\nboth should be offset by one: \u0026data[2] and \u0026ipaddr-\u003es6_addr[12]\nrespectively.\n\nThis off-by-one has two consequences:\n1. data[1] is overwritten with s6_addr[11], corrupting the RIID\n field in the compressed multicast address\n2. data[5] is never written, so uninitialized kernel stack memory\n is transmitted over the network via lowpan_push_hc_data(),\n leaking kernel stack contents\n\nThe correct inline data layout must match what the decompression\nfunction lowpan_uncompress_multicast_ctx_daddr() expects:\n data[0..1] = s6_addr[1..2] (flags/scope + RIID)\n data[2..5] = s6_addr[12..15] (group ID)\n\nAlso zero-initialize the data array as a defensive measure against\nsimilar bugs in the future."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:51.215Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f24a58c72a45f4c109f3557a760cc4b60b7a6037"
},
{
"url": "https://git.kernel.org/stable/c/da8cbb64b47e9066b40af0de170901caf17b768c"
},
{
"url": "https://git.kernel.org/stable/c/4485d79617520d84ba5a14515e2b5136007d6deb"
},
{
"url": "https://git.kernel.org/stable/c/06ce6fc106b16dec9b535950db626261be865e5b"
},
{
"url": "https://git.kernel.org/stable/c/dcb1bec1c32ee5c3878354e087cf5dbee2b7c7af"
},
{
"url": "https://git.kernel.org/stable/c/c32f30ef5e66adbfa102348e2e8a23776eb007cb"
},
{
"url": "https://git.kernel.org/stable/c/da8808463882c3f3c357b072e25053c2121f1419"
},
{
"url": "https://git.kernel.org/stable/c/2a58899d11009bffc7b4b32a571858f381121837"
}
],
"title": "6lowpan: fix off-by-one in multicast context address compression",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53263",
"datePublished": "2026-06-25T08:39:51.215Z",
"dateReserved": "2026-06-09T07:44:35.394Z",
"dateUpdated": "2026-06-25T08:39:51.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43161 (GCVE-0-2026-43161)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-23 16:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode
PCIe endpoints with ATS enabled and passed through to userspace
(e.g., QEMU, DPDK) can hard-lock the host when their link drops,
either by surprise removal or by a link fault.
Commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation
request when device is disconnected") adds pci_dev_is_disconnected()
to devtlb_invalidation_with_pasid() so ATS invalidation is skipped
only when the device is being safely removed, but it applies only
when Intel IOMMU scalable mode is enabled.
With scalable mode disabled or unsupported, a system hard-lock
occurs when a PCIe endpoint's link drops because the Intel IOMMU
waits indefinitely for an ATS invalidation that cannot complete.
Call Trace:
qi_submit_sync
qi_flush_dev_iotlb
__context_flush_dev_iotlb.part.0
domain_context_clear_one_cb
pci_for_each_dma_alias
device_block_translation
blocking_domain_attach_dev
iommu_deinit_device
__iommu_group_remove_device
iommu_release_device
iommu_bus_notifier
blocking_notifier_call_chain
bus_notify
device_del
pci_remove_bus_device
pci_stop_and_remove_bus_device
pciehp_unconfigure_device
pciehp_disable_slot
pciehp_handle_presence_or_link_change
pciehp_ist
Commit 81e921fd3216 ("iommu/vt-d: Fix NULL domain on device release")
adds intel_pasid_teardown_sm_context() to intel_iommu_release_device(),
which calls qi_flush_dev_iotlb() and can also hard-lock the system
when a PCIe endpoint's link drops.
Call Trace:
qi_submit_sync
qi_flush_dev_iotlb
__context_flush_dev_iotlb.part.0
intel_context_flush_no_pasid
device_pasid_table_teardown
pci_pasid_table_teardown
pci_for_each_dma_alias
intel_pasid_teardown_sm_context
intel_iommu_release_device
iommu_deinit_device
__iommu_group_remove_device
iommu_release_device
iommu_bus_notifier
blocking_notifier_call_chain
bus_notify
device_del
pci_remove_bus_device
pci_stop_and_remove_bus_device
pciehp_unconfigure_device
pciehp_disable_slot
pciehp_handle_presence_or_link_change
pciehp_ist
Sometimes the endpoint loses connection without a link-down event
(e.g., due to a link fault); killing the process (virsh destroy)
then hard-locks the host.
Call Trace:
qi_submit_sync
qi_flush_dev_iotlb
__context_flush_dev_iotlb.part.0
domain_context_clear_one_cb
pci_for_each_dma_alias
device_block_translation
blocking_domain_attach_dev
__iommu_attach_device
__iommu_device_set_domain
__iommu_group_set_domain_internal
iommu_detach_group
vfio_iommu_type1_detach_group
vfio_group_detach_container
vfio_group_fops_release
__fput
pci_dev_is_disconnected() only covers safe-removal paths;
pci_device_is_present() tests accessibility by reading
vendor/device IDs and internally calls pci_dev_is_disconnected().
On a ConnectX-5 (8 GT/s, x2) this costs ~70 µs.
Since __context_flush_dev_iotlb() is only called on
{attach,release}_dev paths (not hot), add pci_device_is_present()
there to skip inaccessible devices and avoid the hard-lock.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 37764b952e1b39053defc7ebe5dcd8c4e3e78de9 Version: 37764b952e1b39053defc7ebe5dcd8c4e3e78de9 Version: 37764b952e1b39053defc7ebe5dcd8c4e3e78de9 Version: 37764b952e1b39053defc7ebe5dcd8c4e3e78de9 Version: 99301a53a1378f8863ac7850b9589f997bb0e125 Version: 948ec6d003280d49aca49b366aa5cb140f87434d Version: 5.12.19 ≤ Version: 5.13.4 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/pasid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "48b3f08e68b29a79527869cdde7298ca2a9b9646",
"status": "affected",
"version": "37764b952e1b39053defc7ebe5dcd8c4e3e78de9",
"versionType": "git"
},
{
"lessThan": "e70d5feb10c5ba2bbf7ca400b8f39a2f82d653e8",
"status": "affected",
"version": "37764b952e1b39053defc7ebe5dcd8c4e3e78de9",
"versionType": "git"
},
{
"lessThan": "bc0490ad9edf5c6f98e39fbbee2877b85261a5ae",
"status": "affected",
"version": "37764b952e1b39053defc7ebe5dcd8c4e3e78de9",
"versionType": "git"
},
{
"lessThan": "42662d19839f34735b718129ea200e3734b07e50",
"status": "affected",
"version": "37764b952e1b39053defc7ebe5dcd8c4e3e78de9",
"versionType": "git"
},
{
"status": "affected",
"version": "99301a53a1378f8863ac7850b9589f997bb0e125",
"versionType": "git"
},
{
"status": "affected",
"version": "948ec6d003280d49aca49b366aa5cb140f87434d",
"versionType": "git"
},
{
"lessThan": "5.13",
"status": "affected",
"version": "5.12.19",
"versionType": "semver"
},
{
"lessThan": "5.14",
"status": "affected",
"version": "5.13.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/pasid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.12.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.13.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode\n\nPCIe endpoints with ATS enabled and passed through to userspace\n(e.g., QEMU, DPDK) can hard-lock the host when their link drops,\neither by surprise removal or by a link fault.\n\nCommit 4fc82cd907ac (\"iommu/vt-d: Don\u0027t issue ATS Invalidation\nrequest when device is disconnected\") adds pci_dev_is_disconnected()\nto devtlb_invalidation_with_pasid() so ATS invalidation is skipped\nonly when the device is being safely removed, but it applies only\nwhen Intel IOMMU scalable mode is enabled.\n\nWith scalable mode disabled or unsupported, a system hard-lock\noccurs when a PCIe endpoint\u0027s link drops because the Intel IOMMU\nwaits indefinitely for an ATS invalidation that cannot complete.\n\nCall Trace:\n qi_submit_sync\n qi_flush_dev_iotlb\n __context_flush_dev_iotlb.part.0\n domain_context_clear_one_cb\n pci_for_each_dma_alias\n device_block_translation\n blocking_domain_attach_dev\n iommu_deinit_device\n __iommu_group_remove_device\n iommu_release_device\n iommu_bus_notifier\n blocking_notifier_call_chain\n bus_notify\n device_del\n pci_remove_bus_device\n pci_stop_and_remove_bus_device\n pciehp_unconfigure_device\n pciehp_disable_slot\n pciehp_handle_presence_or_link_change\n pciehp_ist\n\nCommit 81e921fd3216 (\"iommu/vt-d: Fix NULL domain on device release\")\nadds intel_pasid_teardown_sm_context() to intel_iommu_release_device(),\nwhich calls qi_flush_dev_iotlb() and can also hard-lock the system\nwhen a PCIe endpoint\u0027s link drops.\n\nCall Trace:\n qi_submit_sync\n qi_flush_dev_iotlb\n __context_flush_dev_iotlb.part.0\n intel_context_flush_no_pasid\n device_pasid_table_teardown\n pci_pasid_table_teardown\n pci_for_each_dma_alias\n intel_pasid_teardown_sm_context\n intel_iommu_release_device\n iommu_deinit_device\n __iommu_group_remove_device\n iommu_release_device\n iommu_bus_notifier\n blocking_notifier_call_chain\n bus_notify\n device_del\n pci_remove_bus_device\n pci_stop_and_remove_bus_device\n pciehp_unconfigure_device\n pciehp_disable_slot\n pciehp_handle_presence_or_link_change\n pciehp_ist\n\nSometimes the endpoint loses connection without a link-down event\n(e.g., due to a link fault); killing the process (virsh destroy)\nthen hard-locks the host.\n\nCall Trace:\n qi_submit_sync\n qi_flush_dev_iotlb\n __context_flush_dev_iotlb.part.0\n domain_context_clear_one_cb\n pci_for_each_dma_alias\n device_block_translation\n blocking_domain_attach_dev\n __iommu_attach_device\n __iommu_device_set_domain\n __iommu_group_set_domain_internal\n iommu_detach_group\n vfio_iommu_type1_detach_group\n vfio_group_detach_container\n vfio_group_fops_release\n __fput\n\npci_dev_is_disconnected() only covers safe-removal paths;\npci_device_is_present() tests accessibility by reading\nvendor/device IDs and internally calls pci_dev_is_disconnected().\nOn a ConnectX-5 (8 GT/s, x2) this costs ~70 \u00b5s.\n\nSince __context_flush_dev_iotlb() is only called on\n{attach,release}_dev paths (not hot), add pci_device_is_present()\nthere to skip inaccessible devices and avoid the hard-lock."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:06:27.637Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/48b3f08e68b29a79527869cdde7298ca2a9b9646"
},
{
"url": "https://git.kernel.org/stable/c/e70d5feb10c5ba2bbf7ca400b8f39a2f82d653e8"
},
{
"url": "https://git.kernel.org/stable/c/bc0490ad9edf5c6f98e39fbbee2877b85261a5ae"
},
{
"url": "https://git.kernel.org/stable/c/42662d19839f34735b718129ea200e3734b07e50"
}
],
"title": "iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43161",
"datePublished": "2026-05-06T11:27:39.881Z",
"dateReserved": "2026-05-01T14:12:55.990Z",
"dateUpdated": "2026-05-23T16:06:27.637Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46128 (GCVE-0-2026-46128)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-06-14 17:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipmi: Check event message buffer response for bad data
The event message buffer response data size got checked later when
processing, but check it right after the response comes back. It
appears some BMCs may return an empty message instead of an error
when fetching events.
There are apparently some new BMCs that make this error, so we need to
compensate.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_si_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cf1ef30c42a7079e5bad863cd01c52aa3a17c3ac",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "474e53d4397087913a5b9c9eb90fa068da4808bf",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "01f8387fa5b796f13cf50014c171f6da7abc46ea",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2418e4b21fb1355504d095da5d5f0a210564a43d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7f7ada72c07a83b46045ddfeee526bd9e2e3c8f0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "42432b579a594b66ac32e5e7b7c26e6bc578ec89",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "24269264c3d59a49eb09b10af2c75b14f2931482",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "36920f30e78e69df01f9691c470b6f3ba8aebf98",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_si_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: Check event message buffer response for bad data\n\nThe event message buffer response data size got checked later when\nprocessing, but check it right after the response comes back. It\nappears some BMCs may return an empty message instead of an error\nwhen fetching events.\n\nThere are apparently some new BMCs that make this error, so we need to\ncompensate."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:56:32.120Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cf1ef30c42a7079e5bad863cd01c52aa3a17c3ac"
},
{
"url": "https://git.kernel.org/stable/c/474e53d4397087913a5b9c9eb90fa068da4808bf"
},
{
"url": "https://git.kernel.org/stable/c/01f8387fa5b796f13cf50014c171f6da7abc46ea"
},
{
"url": "https://git.kernel.org/stable/c/2418e4b21fb1355504d095da5d5f0a210564a43d"
},
{
"url": "https://git.kernel.org/stable/c/7f7ada72c07a83b46045ddfeee526bd9e2e3c8f0"
},
{
"url": "https://git.kernel.org/stable/c/42432b579a594b66ac32e5e7b7c26e6bc578ec89"
},
{
"url": "https://git.kernel.org/stable/c/24269264c3d59a49eb09b10af2c75b14f2931482"
},
{
"url": "https://git.kernel.org/stable/c/36920f30e78e69df01f9691c470b6f3ba8aebf98"
}
],
"title": "ipmi: Check event message buffer response for bad data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46128",
"datePublished": "2026-05-28T09:35:43.326Z",
"dateReserved": "2026-05-13T15:03:33.099Z",
"dateUpdated": "2026-06-14T17:56:32.120Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52976 (GCVE-0-2026-52976)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-10 12:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()
Two error handling issues exist in xe_exec_queue_create_ioctl():
1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps
to put_exec_queue which skips xe_exec_queue_kill(). If the VM is in
preempt fence mode, xe_vm_add_compute_exec_queue() has already added
the queue to the VM's compute exec queue list. Skipping the kill
leaves the queue on that list, leading to a dangling pointer after
the queue is freed.
2. When xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has
succeeded, the error path does not call
xe_hw_engine_group_del_exec_queue() to remove the queue from the hw
engine group list. The queue is then freed while still linked into
the hw engine group, causing a use-after-free.
Fix both by:
- Changing the xe_hw_engine_group_add_exec_queue() failure path to jump
to kill_exec_queue so that xe_exec_queue_kill() properly removes the
queue from the VM's compute list.
- Adding a del_hw_engine_group label before kill_exec_queue for the
xa_alloc() failure path, which removes the queue from the hw engine
group before proceeding with the rest of the cleanup.
(cherry picked from commit 37c831f401746a45d510b312b0ed7a77b1e06ec8)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.37.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.30.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel. Specifically, within the `drm/xe` graphics driver, two error handling issues in the `xe_exec_queue_create_ioctl()` function could lead to memory corruption. This could result in a dangling pointer or a use-after-free vulnerability. A local attacker could potentially exploit these issues to cause a system crash (denial of service) or gain elevated privileges."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-825",
"description": "Expired Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T12:05:53.541Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52976"
},
{
"name": "RHBZ#2492284",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492284"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52976.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:52764"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42919"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:52667"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:45192"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:52764: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:42919: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:52667: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:45192: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_exec_queue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f93b00161213a0fe9f7ff1d8498ee5ca9e0a5c43",
"status": "affected",
"version": "7970cb36966c9b9183255dc097ae0446300eebcf",
"versionType": "git"
},
{
"lessThan": "753b149d5a433eb19e0c1b0eb4526a6e26120d1f",
"status": "affected",
"version": "7970cb36966c9b9183255dc097ae0446300eebcf",
"versionType": "git"
},
{
"lessThan": "1be55646d8a2035343b012dcb12210db7bb8b056",
"status": "affected",
"version": "7970cb36966c9b9183255dc097ae0446300eebcf",
"versionType": "git"
},
{
"lessThan": "f3cc22d4df3ed58439ea7e21daa54c3608e03b78",
"status": "affected",
"version": "7970cb36966c9b9183255dc097ae0446300eebcf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_exec_queue.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()\n\nTwo error handling issues exist in xe_exec_queue_create_ioctl():\n\n1. When xe_hw_engine_group_add_exec_queue() fails, the error path jumps\n to put_exec_queue which skips xe_exec_queue_kill(). If the VM is in\n preempt fence mode, xe_vm_add_compute_exec_queue() has already added\n the queue to the VM\u0027s compute exec queue list. Skipping the kill\n leaves the queue on that list, leading to a dangling pointer after\n the queue is freed.\n\n2. When xa_alloc() fails after xe_hw_engine_group_add_exec_queue() has\n succeeded, the error path does not call\n xe_hw_engine_group_del_exec_queue() to remove the queue from the hw\n engine group list. The queue is then freed while still linked into\n the hw engine group, causing a use-after-free.\n\nFix both by:\n- Changing the xe_hw_engine_group_add_exec_queue() failure path to jump\n to kill_exec_queue so that xe_exec_queue_kill() properly removes the\n queue from the VM\u0027s compute list.\n- Adding a del_hw_engine_group label before kill_exec_queue for the\n xa_alloc() failure path, which removes the queue from the hw engine\n group before proceeding with the rest of the cleanup.\n\n(cherry picked from commit 37c831f401746a45d510b312b0ed7a77b1e06ec8)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through the local DRM Xe `XE_EXEC_QUEUE_CREATE` ioctl on a GPU device/render node. It is not reachable by remote network traffic or adjacent/physical input.\nAC:L - The attacker controls the ioctl sequence and can drive the relevant error cleanup paths through local resource pressure or interruptible operations. No uncontrollable race or rare victim state is required for the dangling queue pointer to be created and later exercised.\nPR:L - The ioctl is registered with `DRM_RENDER_ALLOW`, with no root, DRM master, or authentication requirement, so an unprivileged local GPU client that can open the render node can reach it. This is basic local user access, not real administrator privilege.\nUI:N - Exploitation only requires the attacker to issue ioctls from their own process. No victim user action is needed.\nS:U - The bug is within the kernel DRM Xe driver and impacts kernel resources under the same OS security authority. It does not cross a VM, hypervisor, or IOMMU security boundary by itself.\nC:H - The cleanup bug leaves a freed `struct xe_exec_queue` linked into VM or hardware-engine-group lists, creating a use-after-free. Under the required kernel scoring guidance, UAF memory corruption is treated as enabling high confidentiality impact.\nI:H - The stale list entry is later dereferenced through queue fields and operation pointers, making this kernel heap use-after-free potentially exploitable for control-flow or memory corruption. Under the required guidance, UAF implies high integrity impact.\nA:H - The dangling pointer can be reached by later VM or engine-group list traversal and can cause kernel oops, panic, or hang. A local attacker can trigger the condition repeatedly, so availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:18.172Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f93b00161213a0fe9f7ff1d8498ee5ca9e0a5c43"
},
{
"url": "https://git.kernel.org/stable/c/753b149d5a433eb19e0c1b0eb4526a6e26120d1f"
},
{
"url": "https://git.kernel.org/stable/c/1be55646d8a2035343b012dcb12210db7bb8b056"
},
{
"url": "https://git.kernel.org/stable/c/f3cc22d4df3ed58439ea7e21daa54c3608e03b78"
}
],
"title": "drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52976",
"datePublished": "2026-06-24T16:28:53.147Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-08-10T12:05:53.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52954 (GCVE-0-2026-52954)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: handle rbtree insertion error in decode_choose_args()
A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself
contains a CRUSH map. The received CRUSH map may optionally contain
choose_args that get decoded in decode_choose_args(). In this function,
num_choose_arg_maps is read from the message, and a corresponding number
of crush_choose_arg_maps gets decoded afterwards. Each
crush_choose_arg_map has a choose_args_index, which serves as the key
when inserting it into the choose_args rbtree of the decoded crush_map.
If a (potentially corrupted) message contains two crush_choose_arg_maps
with the same index, the assertion in insert_choose_arg_map() triggers a
kernel BUG when trying to insert the second crush_choose_arg_map.
This patch fixes the issue by switching to the non-asserting rbtree
insertion function and rejecting the message if the insertion fails.
[ idryomov: changelog ]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5cf9c4a9959b6273675310d14a834ef14fbca37c Version: 5cf9c4a9959b6273675310d14a834ef14fbca37c Version: 5cf9c4a9959b6273675310d14a834ef14fbca37c Version: 5cf9c4a9959b6273675310d14a834ef14fbca37c Version: 5cf9c4a9959b6273675310d14a834ef14fbca37c Version: 5cf9c4a9959b6273675310d14a834ef14fbca37c Version: 5cf9c4a9959b6273675310d14a834ef14fbca37c Version: 5cf9c4a9959b6273675310d14a834ef14fbca37c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c7bf7864e2924fa5508ac270b0e9364bc13d5a6c",
"status": "affected",
"version": "5cf9c4a9959b6273675310d14a834ef14fbca37c",
"versionType": "git"
},
{
"lessThan": "f47430fc1f815e87406e2d3b4e476eff1bc7fd9b",
"status": "affected",
"version": "5cf9c4a9959b6273675310d14a834ef14fbca37c",
"versionType": "git"
},
{
"lessThan": "0b6a3bcb91bc5bfeda39f0df3b71bab62c13e9da",
"status": "affected",
"version": "5cf9c4a9959b6273675310d14a834ef14fbca37c",
"versionType": "git"
},
{
"lessThan": "534ebc08df97c47d4c7596f336fa31ecbf91519c",
"status": "affected",
"version": "5cf9c4a9959b6273675310d14a834ef14fbca37c",
"versionType": "git"
},
{
"lessThan": "80c73bd1b2b04355d1d0c29be8ccbd25a380905d",
"status": "affected",
"version": "5cf9c4a9959b6273675310d14a834ef14fbca37c",
"versionType": "git"
},
{
"lessThan": "4d2b37abda9536808655830d683dc491d31741a8",
"status": "affected",
"version": "5cf9c4a9959b6273675310d14a834ef14fbca37c",
"versionType": "git"
},
{
"lessThan": "0a1265a9ab875f92b6a3ffb497404f46cf9d76a3",
"status": "affected",
"version": "5cf9c4a9959b6273675310d14a834ef14fbca37c",
"versionType": "git"
},
{
"lessThan": "d289478cfc0bcf81c7914200d6abdcb78bd04ded",
"status": "affected",
"version": "5cf9c4a9959b6273675310d14a834ef14fbca37c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: handle rbtree insertion error in decode_choose_args()\n\nA message of type CEPH_MSG_OSD_MAP contains an OSD map that itself\ncontains a CRUSH map. The received CRUSH map may optionally contain\nchoose_args that get decoded in decode_choose_args(). In this function,\nnum_choose_arg_maps is read from the message, and a corresponding number\nof crush_choose_arg_maps gets decoded afterwards. Each\ncrush_choose_arg_map has a choose_args_index, which serves as the key\nwhen inserting it into the choose_args rbtree of the decoded crush_map.\nIf a (potentially corrupted) message contains two crush_choose_arg_maps\nwith the same index, the assertion in insert_choose_arg_map() triggers a\nkernel BUG when trying to insert the second crush_choose_arg_map.\n\nThis patch fixes the issue by switching to the non-asserting rbtree\ninsertion function and rejecting the message if the insertion fails.\n\n[ idryomov: changelog ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable decoder processes CEPH_MSG_OSD_MAP data received over the Ceph network protocol from monitor or OSD peers.\nAC:L - An attacker controlling an accepted Ceph peer can deterministically include two choose_arg_maps with the same choose_args_index; no race or special memory state is required.\nPR:N - In the highest reasonable scenario, a malicious or compromised Ceph cluster endpoint sends the malformed map to an already connected client and needs no privileges on the victim system.\nUI:N - OSD map updates are processed asynchronously by the kernel client after the Ceph session exists; no victim action is needed to process the malicious message.\nS:U - The impact is within the same kernel security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The bug triggers a BUG() assertion on duplicate rbtree insertion and does not provide an information disclosure primitive.\nI:N - The vulnerable path does not perform attacker-controlled memory corruption; it aborts via BUG() before creating an integrity-impacting primitive.\nA:H - The duplicate choose_args_index triggers a kernel BUG/oops in the Ceph client decode path, causing a high-impact denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:04.179Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c7bf7864e2924fa5508ac270b0e9364bc13d5a6c"
},
{
"url": "https://git.kernel.org/stable/c/f47430fc1f815e87406e2d3b4e476eff1bc7fd9b"
},
{
"url": "https://git.kernel.org/stable/c/0b6a3bcb91bc5bfeda39f0df3b71bab62c13e9da"
},
{
"url": "https://git.kernel.org/stable/c/534ebc08df97c47d4c7596f336fa31ecbf91519c"
},
{
"url": "https://git.kernel.org/stable/c/80c73bd1b2b04355d1d0c29be8ccbd25a380905d"
},
{
"url": "https://git.kernel.org/stable/c/4d2b37abda9536808655830d683dc491d31741a8"
},
{
"url": "https://git.kernel.org/stable/c/0a1265a9ab875f92b6a3ffb497404f46cf9d76a3"
},
{
"url": "https://git.kernel.org/stable/c/d289478cfc0bcf81c7914200d6abdcb78bd04ded"
}
],
"title": "libceph: handle rbtree insertion error in decode_choose_args()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52954",
"datePublished": "2026-06-24T16:28:36.992Z",
"dateReserved": "2026-06-09T07:44:35.372Z",
"dateUpdated": "2026-08-05T12:32:04.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31603 (GCVE-0-2026-31603)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: sm750fb: fix division by zero in ps_to_hz()
ps_to_hz() is called from hw_sm750_crtc_set_mode() without validating
that pixclock is non-zero. A zero pixclock passed via FBIOPUT_VSCREENINFO
causes a division by zero.
Fix by rejecting zero pixclock in lynxfb_ops_check_var(), consistent
with other framebuffer drivers.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 81dee67e215b23f0c98182eece122b906d35765a Version: 81dee67e215b23f0c98182eece122b906d35765a Version: 81dee67e215b23f0c98182eece122b906d35765a Version: 81dee67e215b23f0c98182eece122b906d35765a Version: 81dee67e215b23f0c98182eece122b906d35765a Version: 81dee67e215b23f0c98182eece122b906d35765a Version: 81dee67e215b23f0c98182eece122b906d35765a Version: 81dee67e215b23f0c98182eece122b906d35765a Version: 81dee67e215b23f0c98182eece122b906d35765a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/sm750fb/sm750.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "124a43550db8a74eef080cd4573a4904efe67029",
"status": "affected",
"version": "81dee67e215b23f0c98182eece122b906d35765a",
"versionType": "git"
},
{
"lessThan": "b285a8f3bbb821a93eb37c2740a68ca1d7112a59",
"status": "affected",
"version": "81dee67e215b23f0c98182eece122b906d35765a",
"versionType": "git"
},
{
"lessThan": "3300b049693138852a4c6738b5f1194a1ee91ddd",
"status": "affected",
"version": "81dee67e215b23f0c98182eece122b906d35765a",
"versionType": "git"
},
{
"lessThan": "779412e0e391fd4a0d12e1d1adaa7bf043de62d7",
"status": "affected",
"version": "81dee67e215b23f0c98182eece122b906d35765a",
"versionType": "git"
},
{
"lessThan": "2f640c6043aeab31a2f607d7605271860c3b11df",
"status": "affected",
"version": "81dee67e215b23f0c98182eece122b906d35765a",
"versionType": "git"
},
{
"lessThan": "1412ba36597a82e928f20047f41d6c6582dafe8a",
"status": "affected",
"version": "81dee67e215b23f0c98182eece122b906d35765a",
"versionType": "git"
},
{
"lessThan": "6144895a4335a2491c282931f1f2fa610b86339f",
"status": "affected",
"version": "81dee67e215b23f0c98182eece122b906d35765a",
"versionType": "git"
},
{
"lessThan": "daf6733bd7c4c5015b431739ac29b0e29021096b",
"status": "affected",
"version": "81dee67e215b23f0c98182eece122b906d35765a",
"versionType": "git"
},
{
"lessThan": "75a1621e4f91310673c9acbcbb25c2a7ff821cd3",
"status": "affected",
"version": "81dee67e215b23f0c98182eece122b906d35765a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/sm750fb/sm750.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: sm750fb: fix division by zero in ps_to_hz()\n\nps_to_hz() is called from hw_sm750_crtc_set_mode() without validating\nthat pixclock is non-zero. A zero pixclock passed via FBIOPUT_VSCREENINFO\ncauses a division by zero.\n\nFix by rejecting zero pixclock in lynxfb_ops_check_var(), consistent\nwith other framebuffer drivers."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:42:44.030Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/124a43550db8a74eef080cd4573a4904efe67029"
},
{
"url": "https://git.kernel.org/stable/c/b285a8f3bbb821a93eb37c2740a68ca1d7112a59"
},
{
"url": "https://git.kernel.org/stable/c/3300b049693138852a4c6738b5f1194a1ee91ddd"
},
{
"url": "https://git.kernel.org/stable/c/779412e0e391fd4a0d12e1d1adaa7bf043de62d7"
},
{
"url": "https://git.kernel.org/stable/c/2f640c6043aeab31a2f607d7605271860c3b11df"
},
{
"url": "https://git.kernel.org/stable/c/1412ba36597a82e928f20047f41d6c6582dafe8a"
},
{
"url": "https://git.kernel.org/stable/c/6144895a4335a2491c282931f1f2fa610b86339f"
},
{
"url": "https://git.kernel.org/stable/c/daf6733bd7c4c5015b431739ac29b0e29021096b"
},
{
"url": "https://git.kernel.org/stable/c/75a1621e4f91310673c9acbcbb25c2a7ff821cd3"
}
],
"title": "staging: sm750fb: fix division by zero in ps_to_hz()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31603",
"datePublished": "2026-04-24T14:42:26.601Z",
"dateReserved": "2026-03-09T15:48:24.122Z",
"dateUpdated": "2026-06-14T17:42:44.030Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43177 (GCVE-0-2026-43177)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: ipu6: Fix RPM reference leak in probe error paths
Several error paths in ipu6_pci_probe() were jumping directly to
out_ipu6_bus_del_devices without releasing the runtime PM reference.
Add pm_runtime_put_sync() before cleaning up other resources.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/intel/ipu6/ipu6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fdc06d36dab7b28c2bdd16cb7ee4f25e0f55d9ac",
"status": "affected",
"version": "25fedc021985a66a357a599ab771d6b495b6f78c",
"versionType": "git"
},
{
"lessThan": "364759ccc3fb49754758c585c530407f96683030",
"status": "affected",
"version": "25fedc021985a66a357a599ab771d6b495b6f78c",
"versionType": "git"
},
{
"lessThan": "3cd9e7539a3010a83391fecade1186cf30e616c9",
"status": "affected",
"version": "25fedc021985a66a357a599ab771d6b495b6f78c",
"versionType": "git"
},
{
"lessThan": "6099f78e4c9223f4de4169d2fd1cded01279da1a",
"status": "affected",
"version": "25fedc021985a66a357a599ab771d6b495b6f78c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/intel/ipu6/ipu6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ipu6: Fix RPM reference leak in probe error paths\n\nSeveral error paths in ipu6_pci_probe() were jumping directly to\nout_ipu6_bus_del_devices without releasing the runtime PM reference.\nAdd pm_runtime_put_sync() before cleaning up other resources."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:19:16.753Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fdc06d36dab7b28c2bdd16cb7ee4f25e0f55d9ac"
},
{
"url": "https://git.kernel.org/stable/c/364759ccc3fb49754758c585c530407f96683030"
},
{
"url": "https://git.kernel.org/stable/c/3cd9e7539a3010a83391fecade1186cf30e616c9"
},
{
"url": "https://git.kernel.org/stable/c/6099f78e4c9223f4de4169d2fd1cded01279da1a"
}
],
"title": "media: ipu6: Fix RPM reference leak in probe error paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43177",
"datePublished": "2026-05-06T11:27:50.843Z",
"dateReserved": "2026-05-01T14:12:55.991Z",
"dateUpdated": "2026-05-11T22:19:16.753Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45965 (GCVE-0-2026-45965)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-05-27 12:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix invalid deref of rawdata when export_binary is unset
If the export_binary parameter is disabled on runtime, profiles that
were loaded before that will still have their rawdata stored in
apparmorfs, with a symbolic link to the rawdata on the policy
directory. When one of those profiles are replaced, the rawdata is set
to NULL, but when trying to resolve the symbolic links to rawdata for
that profile, it will try to dereference profile->rawdata->name when
profile->rawdata is now NULL causing an oops. Fix it by checking if
rawdata is set.
[ 168.653080] BUG: kernel NULL pointer dereference, address: 0000000000000088
[ 168.657420] #PF: supervisor read access in kernel mode
[ 168.660619] #PF: error_code(0x0000) - not-present page
[ 168.663613] PGD 0 P4D 0
[ 168.665450] Oops: Oops: 0000 [#1] SMP NOPTI
[ 168.667836] CPU: 1 UID: 0 PID: 1729 Comm: ls Not tainted 6.19.0-rc7+ #3 PREEMPT(voluntary)
[ 168.672308] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 168.679327] RIP: 0010:rawdata_get_link_base.isra.0+0x23/0x330
[ 168.682768] Code: 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 18 48 89 55 d0 48 85 ff 0f 84 e3 01 00 00 <48> 83 3c 25 88 00 00 00 00 0f 84 d4 01 00 00 49 89 f6 49 89 cc e8
[ 168.689818] RSP: 0018:ffffcdcb8200fb80 EFLAGS: 00010282
[ 168.690871] RAX: ffffffffaee74ec0 RBX: 0000000000000000 RCX: ffffffffb0120158
[ 168.692251] RDX: ffffcdcb8200fbe0 RSI: ffff88c187c9fa80 RDI: ffff88c186c98a80
[ 168.693593] RBP: ffffcdcb8200fbc0 R08: 0000000000000000 R09: 0000000000000000
[ 168.694941] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88c186c98a80
[ 168.696289] R13: 00007fff005aaa20 R14: 0000000000000080 R15: ffff88c188f4fce0
[ 168.697637] FS: 0000790e81c58280(0000) GS:ffff88c20a957000(0000) knlGS:0000000000000000
[ 168.699227] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 168.700349] CR2: 0000000000000088 CR3: 000000012fd3e000 CR4: 0000000000350ef0
[ 168.701696] Call Trace:
[ 168.702325] <TASK>
[ 168.702995] rawdata_get_link_data+0x1c/0x30
[ 168.704145] vfs_readlink+0xd4/0x160
[ 168.705152] do_readlinkat+0x114/0x180
[ 168.706214] __x64_sys_readlink+0x1e/0x30
[ 168.708653] x64_sys_call+0x1d77/0x26b0
[ 168.709525] do_syscall_64+0x81/0x500
[ 168.710348] ? do_statx+0x72/0xb0
[ 168.711109] ? putname+0x3e/0x80
[ 168.711845] ? __x64_sys_statx+0xb7/0x100
[ 168.712711] ? x64_sys_call+0x10fc/0x26b0
[ 168.713577] ? do_syscall_64+0xbf/0x500
[ 168.714412] ? do_user_addr_fault+0x1d2/0x8d0
[ 168.715404] ? irqentry_exit+0xb2/0x740
[ 168.716359] ? exc_page_fault+0x90/0x1b0
[ 168.717307] entry_SYSCALL_64_after_hwframe+0x76/0x7e
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1180b4c757aab5506f1be367000364dd5cf5cd02 Version: 1180b4c757aab5506f1be367000364dd5cf5cd02 Version: 1180b4c757aab5506f1be367000364dd5cf5cd02 Version: 1180b4c757aab5506f1be367000364dd5cf5cd02 Version: 1180b4c757aab5506f1be367000364dd5cf5cd02 Version: 1180b4c757aab5506f1be367000364dd5cf5cd02 Version: 1180b4c757aab5506f1be367000364dd5cf5cd02 Version: 1180b4c757aab5506f1be367000364dd5cf5cd02 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/apparmor/apparmorfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e6b2fc7e34d4e7ca6b8598c33a3d45d59e455d8d",
"status": "affected",
"version": "1180b4c757aab5506f1be367000364dd5cf5cd02",
"versionType": "git"
},
{
"lessThan": "6d8c180c825cbc73eeffaa79591f8e142dacae70",
"status": "affected",
"version": "1180b4c757aab5506f1be367000364dd5cf5cd02",
"versionType": "git"
},
{
"lessThan": "3c36b87fc2a4cf88eadea8cf13923bd2b4f9a3fa",
"status": "affected",
"version": "1180b4c757aab5506f1be367000364dd5cf5cd02",
"versionType": "git"
},
{
"lessThan": "b25298e89a297c42eb4c4d6f081d60375b820abb",
"status": "affected",
"version": "1180b4c757aab5506f1be367000364dd5cf5cd02",
"versionType": "git"
},
{
"lessThan": "19f2e4055626a58842ddec3282ad4465a80c6625",
"status": "affected",
"version": "1180b4c757aab5506f1be367000364dd5cf5cd02",
"versionType": "git"
},
{
"lessThan": "1d2b2b58fde9059a488bc25399e6c3d74e9b5548",
"status": "affected",
"version": "1180b4c757aab5506f1be367000364dd5cf5cd02",
"versionType": "git"
},
{
"lessThan": "1432ab0774cba43e8111be39989ff226531a9bac",
"status": "affected",
"version": "1180b4c757aab5506f1be367000364dd5cf5cd02",
"versionType": "git"
},
{
"lessThan": "df9ac55abd18628bd8cff687ea043660532a3654",
"status": "affected",
"version": "1180b4c757aab5506f1be367000364dd5cf5cd02",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/apparmor/apparmorfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix invalid deref of rawdata when export_binary is unset\n\nIf the export_binary parameter is disabled on runtime, profiles that\nwere loaded before that will still have their rawdata stored in\napparmorfs, with a symbolic link to the rawdata on the policy\ndirectory. When one of those profiles are replaced, the rawdata is set\nto NULL, but when trying to resolve the symbolic links to rawdata for\nthat profile, it will try to dereference profile-\u003erawdata-\u003ename when\nprofile-\u003erawdata is now NULL causing an oops. Fix it by checking if\nrawdata is set.\n\n[ 168.653080] BUG: kernel NULL pointer dereference, address: 0000000000000088\n[ 168.657420] #PF: supervisor read access in kernel mode\n[ 168.660619] #PF: error_code(0x0000) - not-present page\n[ 168.663613] PGD 0 P4D 0\n[ 168.665450] Oops: Oops: 0000 [#1] SMP NOPTI\n[ 168.667836] CPU: 1 UID: 0 PID: 1729 Comm: ls Not tainted 6.19.0-rc7+ #3 PREEMPT(voluntary)\n[ 168.672308] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[ 168.679327] RIP: 0010:rawdata_get_link_base.isra.0+0x23/0x330\n[ 168.682768] Code: 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 18 48 89 55 d0 48 85 ff 0f 84 e3 01 00 00 \u003c48\u003e 83 3c 25 88 00 00 00 00 0f 84 d4 01 00 00 49 89 f6 49 89 cc e8\n[ 168.689818] RSP: 0018:ffffcdcb8200fb80 EFLAGS: 00010282\n[ 168.690871] RAX: ffffffffaee74ec0 RBX: 0000000000000000 RCX: ffffffffb0120158\n[ 168.692251] RDX: ffffcdcb8200fbe0 RSI: ffff88c187c9fa80 RDI: ffff88c186c98a80\n[ 168.693593] RBP: ffffcdcb8200fbc0 R08: 0000000000000000 R09: 0000000000000000\n[ 168.694941] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88c186c98a80\n[ 168.696289] R13: 00007fff005aaa20 R14: 0000000000000080 R15: ffff88c188f4fce0\n[ 168.697637] FS: 0000790e81c58280(0000) GS:ffff88c20a957000(0000) knlGS:0000000000000000\n[ 168.699227] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 168.700349] CR2: 0000000000000088 CR3: 000000012fd3e000 CR4: 0000000000350ef0\n[ 168.701696] Call Trace:\n[ 168.702325] \u003cTASK\u003e\n[ 168.702995] rawdata_get_link_data+0x1c/0x30\n[ 168.704145] vfs_readlink+0xd4/0x160\n[ 168.705152] do_readlinkat+0x114/0x180\n[ 168.706214] __x64_sys_readlink+0x1e/0x30\n[ 168.708653] x64_sys_call+0x1d77/0x26b0\n[ 168.709525] do_syscall_64+0x81/0x500\n[ 168.710348] ? do_statx+0x72/0xb0\n[ 168.711109] ? putname+0x3e/0x80\n[ 168.711845] ? __x64_sys_statx+0xb7/0x100\n[ 168.712711] ? x64_sys_call+0x10fc/0x26b0\n[ 168.713577] ? do_syscall_64+0xbf/0x500\n[ 168.714412] ? do_user_addr_fault+0x1d2/0x8d0\n[ 168.715404] ? irqentry_exit+0xb2/0x740\n[ 168.716359] ? exc_page_fault+0x90/0x1b0\n[ 168.717307] entry_SYSCALL_64_after_hwframe+0x76/0x7e"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:18:23.170Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e6b2fc7e34d4e7ca6b8598c33a3d45d59e455d8d"
},
{
"url": "https://git.kernel.org/stable/c/6d8c180c825cbc73eeffaa79591f8e142dacae70"
},
{
"url": "https://git.kernel.org/stable/c/3c36b87fc2a4cf88eadea8cf13923bd2b4f9a3fa"
},
{
"url": "https://git.kernel.org/stable/c/b25298e89a297c42eb4c4d6f081d60375b820abb"
},
{
"url": "https://git.kernel.org/stable/c/19f2e4055626a58842ddec3282ad4465a80c6625"
},
{
"url": "https://git.kernel.org/stable/c/1d2b2b58fde9059a488bc25399e6c3d74e9b5548"
},
{
"url": "https://git.kernel.org/stable/c/1432ab0774cba43e8111be39989ff226531a9bac"
},
{
"url": "https://git.kernel.org/stable/c/df9ac55abd18628bd8cff687ea043660532a3654"
}
],
"title": "apparmor: fix invalid deref of rawdata when export_binary is unset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45965",
"datePublished": "2026-05-27T12:18:23.170Z",
"dateReserved": "2026-05-13T15:03:33.089Z",
"dateUpdated": "2026-05-27T12:18:23.170Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43243 (GCVE-0-2026-43243)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src
Trying to access link enc on a dpia link will cause a crash otherwise
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "23e7150afc70da615857f9f07b494ec58540f096",
"status": "affected",
"version": "70839da6360500a82e4d5f78499284474cbed7c1",
"versionType": "git"
},
{
"lessThan": "486b2909ac284185900c06f05ffc6eca895f38b8",
"status": "affected",
"version": "70839da6360500a82e4d5f78499284474cbed7c1",
"versionType": "git"
},
{
"lessThan": "e332112255afbce02db67760f5743a1b13aa8541",
"status": "affected",
"version": "70839da6360500a82e4d5f78499284474cbed7c1",
"versionType": "git"
},
{
"lessThan": "c979d8db7b0f293111f2e83795ea353c8ed75de9",
"status": "affected",
"version": "70839da6360500a82e4d5f78499284474cbed7c1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Add signal type check for dcn401 get_phyd32clk_src\n\nTrying to access link enc on a dpia link will cause a crash otherwise"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:20:46.641Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/23e7150afc70da615857f9f07b494ec58540f096"
},
{
"url": "https://git.kernel.org/stable/c/486b2909ac284185900c06f05ffc6eca895f38b8"
},
{
"url": "https://git.kernel.org/stable/c/e332112255afbce02db67760f5743a1b13aa8541"
},
{
"url": "https://git.kernel.org/stable/c/c979d8db7b0f293111f2e83795ea353c8ed75de9"
}
],
"title": "drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43243",
"datePublished": "2026-05-06T11:28:36.287Z",
"dateReserved": "2026-05-01T14:12:55.995Z",
"dateUpdated": "2026-05-11T22:20:46.641Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43445 (GCVE-0-2026-43445)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-11 22:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
e1000/e1000e: Fix leak in DMA error cleanup
If an error is encountered while mapping TX buffers, the driver should
unmap any buffers already mapped for that skb.
Because count is incremented after a successful mapping, it will always
match the correct number of unmappings needed when dma_error is reached.
Decrementing count before the while loop in dma_error causes an
off-by-one error. If any mapping was successful before an unsuccessful
mapping, exactly one DMA mapping would leak.
In these commits, a faulty while condition caused an infinite loop in
dma_error:
Commit 03b1320dfcee ("e1000e: remove use of skb_dma_map from e1000e
driver")
Commit 602c0554d7b0 ("e1000: remove use of skb_dma_map from e1000 driver")
Commit c1fa347f20f1 ("e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of
unsigned in *_tx_map()") fixed the infinite loop, but introduced the
off-by-one error.
This issue may still exist in the igbvf driver, but I did not address it
in this patch.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c1fa347f20f17f14a4a1575727fa24340e8a9117 Version: c1fa347f20f17f14a4a1575727fa24340e8a9117 Version: c1fa347f20f17f14a4a1575727fa24340e8a9117 Version: c1fa347f20f17f14a4a1575727fa24340e8a9117 Version: c1fa347f20f17f14a4a1575727fa24340e8a9117 Version: c1fa347f20f17f14a4a1575727fa24340e8a9117 Version: c1fa347f20f17f14a4a1575727fa24340e8a9117 Version: c1fa347f20f17f14a4a1575727fa24340e8a9117 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/e1000/e1000_main.c",
"drivers/net/ethernet/intel/e1000e/netdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7eaeb778bfaa3b2a804f89321c234d59c74569db",
"status": "affected",
"version": "c1fa347f20f17f14a4a1575727fa24340e8a9117",
"versionType": "git"
},
{
"lessThan": "0606c24a745bafd1be5d66c48361638cd9cad74b",
"status": "affected",
"version": "c1fa347f20f17f14a4a1575727fa24340e8a9117",
"versionType": "git"
},
{
"lessThan": "519051c711dfd239ef6e4b28878efee400a035f9",
"status": "affected",
"version": "c1fa347f20f17f14a4a1575727fa24340e8a9117",
"versionType": "git"
},
{
"lessThan": "0a1fc25deabab4efce64610e3c449485c4fa8f5f",
"status": "affected",
"version": "c1fa347f20f17f14a4a1575727fa24340e8a9117",
"versionType": "git"
},
{
"lessThan": "fa5ba9867a55e640df0dc79bf0199770fb043f03",
"status": "affected",
"version": "c1fa347f20f17f14a4a1575727fa24340e8a9117",
"versionType": "git"
},
{
"lessThan": "30e87ade8d678c25a8546cf38c0b498fa5cb27d3",
"status": "affected",
"version": "c1fa347f20f17f14a4a1575727fa24340e8a9117",
"versionType": "git"
},
{
"lessThan": "10b5e65959e955a1c8894e0a5413944b5a70204a",
"status": "affected",
"version": "c1fa347f20f17f14a4a1575727fa24340e8a9117",
"versionType": "git"
},
{
"lessThan": "e94eaef11142b01f77bf8ba4d0b59720b7858109",
"status": "affected",
"version": "c1fa347f20f17f14a4a1575727fa24340e8a9117",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/e1000/e1000_main.c",
"drivers/net/ethernet/intel/e1000e/netdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.33"
},
{
"lessThan": "2.6.33",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ne1000/e1000e: Fix leak in DMA error cleanup\n\nIf an error is encountered while mapping TX buffers, the driver should\nunmap any buffers already mapped for that skb.\n\nBecause count is incremented after a successful mapping, it will always\nmatch the correct number of unmappings needed when dma_error is reached.\nDecrementing count before the while loop in dma_error causes an\noff-by-one error. If any mapping was successful before an unsuccessful\nmapping, exactly one DMA mapping would leak.\n\nIn these commits, a faulty while condition caused an infinite loop in\ndma_error:\nCommit 03b1320dfcee (\"e1000e: remove use of skb_dma_map from e1000e\ndriver\")\nCommit 602c0554d7b0 (\"e1000: remove use of skb_dma_map from e1000 driver\")\n\nCommit c1fa347f20f1 (\"e1000/e1000e/igb/igbvf/ixgb/ixgbe: Fix tests of\nunsigned in *_tx_map()\") fixed the infinite loop, but introduced the\noff-by-one error.\n\nThis issue may still exist in the igbvf driver, but I did not address it\nin this patch."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:43.676Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7eaeb778bfaa3b2a804f89321c234d59c74569db"
},
{
"url": "https://git.kernel.org/stable/c/0606c24a745bafd1be5d66c48361638cd9cad74b"
},
{
"url": "https://git.kernel.org/stable/c/519051c711dfd239ef6e4b28878efee400a035f9"
},
{
"url": "https://git.kernel.org/stable/c/0a1fc25deabab4efce64610e3c449485c4fa8f5f"
},
{
"url": "https://git.kernel.org/stable/c/fa5ba9867a55e640df0dc79bf0199770fb043f03"
},
{
"url": "https://git.kernel.org/stable/c/30e87ade8d678c25a8546cf38c0b498fa5cb27d3"
},
{
"url": "https://git.kernel.org/stable/c/10b5e65959e955a1c8894e0a5413944b5a70204a"
},
{
"url": "https://git.kernel.org/stable/c/e94eaef11142b01f77bf8ba4d0b59720b7858109"
}
],
"title": "e1000/e1000e: Fix leak in DMA error cleanup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43445",
"datePublished": "2026-05-08T14:22:12.660Z",
"dateReserved": "2026-05-01T14:12:56.010Z",
"dateUpdated": "2026-05-11T22:24:43.676Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53262 (GCVE-0-2026-53262)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
pppol2tp_ioctl() read sock->sk->sk_user_data directly without any
locks or reference counting. If a controllable sleep was induced during
copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent
socket close could trigger pppol2tp_session_close() asynchronously. This
frees the l2tp_session structure via the l2tp_session_del_work workqueue.
Upon resuming, the ioctl thread dereferences the stale session pointer,
resulting in a Use-After-Free (UAF).
Fix this by securely fetching the session reference using the RCU-safe,
refcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the
session's refcount across the sleep. We structured the function to exit
via standard err breaks, guaranteeing that l2tp_session_put() is cleanly
called on all return paths to drop the reference.
To preserve existing behavior we validate the session and its magic
signature only for the specific L2TP commands that require it. This
ensures that generic/unknown ioctls called on an unconnected socket
still return -ENOIOCTLCMD and correctly fall back to generic handlers
(e.g. in sock_do_ioctl()).
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/l2tp/l2tp_ppp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "78cdfdca88cbf731a92f3b9ee5427c633dd94e28",
"status": "affected",
"version": "fd558d186df2c13a22455373858bae634a4795af",
"versionType": "git"
},
{
"lessThan": "e251d4cdfc725c9e7d686161e3b775a0e7d95053",
"status": "affected",
"version": "fd558d186df2c13a22455373858bae634a4795af",
"versionType": "git"
},
{
"lessThan": "62f327e287cf7b595ae3f73ba72f5cd2a9e9f39f",
"status": "affected",
"version": "fd558d186df2c13a22455373858bae634a4795af",
"versionType": "git"
},
{
"lessThan": "a213a8950414c684999dcf03edeea6c46ede172e",
"status": "affected",
"version": "fd558d186df2c13a22455373858bae634a4795af",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/l2tp/l2tp_ppp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()\n\npppol2tp_ioctl() read sock-\u003esk-\u003esk_user_data directly without any\nlocks or reference counting. If a controllable sleep was induced during\ncopy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent\nsocket close could trigger pppol2tp_session_close() asynchronously. This\nfrees the l2tp_session structure via the l2tp_session_del_work workqueue.\nUpon resuming, the ioctl thread dereferences the stale session pointer,\nresulting in a Use-After-Free (UAF).\n\nFix this by securely fetching the session reference using the RCU-safe,\nrefcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the\nsession\u0027s refcount across the sleep. We structured the function to exit\nvia standard err breaks, guaranteeing that l2tp_session_put() is cleanly\ncalled on all return paths to drop the reference.\n\nTo preserve existing behavior we validate the session and its magic\nsignature only for the specific L2TP commands that require it. This\nensures that generic/unknown ioctls called on an unconnected socket\nstill return -ENOIOCTLCMD and correctly fall back to generic handlers\n(e.g. in sock_do_ioctl())."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through a local `ioctl()` on a connected PPPoL2TP `AF_PPPOX` socket. Remote L2TP packets do not invoke `pppol2tp_ioctl()`.\nAC:L - The attacker controls both sides of the race by blocking `copy_from_user()` in the ioctl thread and closing the same socket concurrently. No external victim state is required.\nPR:L - A local unprivileged user can reach the PPPoL2TP socket/ioctl path; L2TP management also uses user-namespace admin permissions rather than requiring real init-namespace root. This is not remotely reachable without local code execution.\nUI:N - No victim action is required after the attacker runs local code. The attacker creates/connects the socket, issues the ioctl, and closes the socket.\nS:U - The impact is within the kernel security authority on the same system. It is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - This is a kernel heap use-after-free of `struct l2tp_session`, and the resumed ioctl can read from reclaimed/faked session and tunnel data before copying results to userspace. Per conservative kernel UAF scoring, this supports high confidentiality impact.\nI:H - Kernel UAFs with attacker-controlled timing and heap reuse can be leveraged beyond a simple stale read, including corruption or control-flow primitives. When uncertain, the higher severity option is appropriate.\nA:H - At minimum, dereferencing the stale session or tunnel pointer can trigger a kernel oops or panic. The attacker can repeatedly trigger the race locally."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:40.148Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/78cdfdca88cbf731a92f3b9ee5427c633dd94e28"
},
{
"url": "https://git.kernel.org/stable/c/e251d4cdfc725c9e7d686161e3b775a0e7d95053"
},
{
"url": "https://git.kernel.org/stable/c/62f327e287cf7b595ae3f73ba72f5cd2a9e9f39f"
},
{
"url": "https://git.kernel.org/stable/c/a213a8950414c684999dcf03edeea6c46ede172e"
}
],
"title": "l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53262",
"datePublished": "2026-06-25T08:39:50.550Z",
"dateReserved": "2026-06-09T07:44:35.394Z",
"dateUpdated": "2026-08-05T12:34:40.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43278 (GCVE-0-2026-43278)
Vulnerability from cvelistv5
Published
2026-05-06 11:29
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm: clear cloned request bio pointer when last clone bio completes
Stale rq->bio values have been observed to cause double-initialization of
cloned bios in request-based device-mapper targets, leading to
use-after-free and double-free scenarios.
One such case occurs when using dm-multipath on top of a PCIe NVMe
namespace, where cloned request bios are freed during
blk_complete_request(), but rq->bio is left intact. Subsequent clone
teardown then attempts to free the same bios again via
blk_rq_unprep_clone().
The resulting double-free path looks like:
nvme_pci_complete_batch()
nvme_complete_batch()
blk_mq_end_request_batch()
blk_complete_request() // called on a DM clone request
bio_endio() // first free of all clone bios
...
rq->end_io() // end_clone_request()
dm_complete_request(tio->orig)
dm_softirq_done()
dm_done()
dm_end_request()
blk_rq_unprep_clone() // second free of clone bios
Fix this by clearing the clone request's bio pointer when the last cloned
bio completes, ensuring that later teardown paths do not attempt to free
already-released bios.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ab3e1d3bbab9e973aeb4dd4603251578658a47ff Version: ab3e1d3bbab9e973aeb4dd4603251578658a47ff Version: ab3e1d3bbab9e973aeb4dd4603251578658a47ff Version: ab3e1d3bbab9e973aeb4dd4603251578658a47ff Version: ab3e1d3bbab9e973aeb4dd4603251578658a47ff Version: ab3e1d3bbab9e973aeb4dd4603251578658a47ff |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-rq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8d9ddad561136f7e6a9346767bf97b4d79e38e67",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
},
{
"lessThan": "7daf279c674d515fb22a727a7bbc92aeb35c5442",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
},
{
"lessThan": "e2e738e8dfbbf83bd2bae0467ec4420cc52da42a",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
},
{
"lessThan": "b1c1a2637ebd675aa2d71fee8c70da8791d73850",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
},
{
"lessThan": "83d72091804600ead96dc9e9f518ea56cb4942f6",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
},
{
"lessThan": "fb8a6c18fb9a6561f7a15b58b272442b77a242dd",
"status": "affected",
"version": "ab3e1d3bbab9e973aeb4dd4603251578658a47ff",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-rq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: clear cloned request bio pointer when last clone bio completes\n\nStale rq-\u003ebio values have been observed to cause double-initialization of\ncloned bios in request-based device-mapper targets, leading to\nuse-after-free and double-free scenarios.\n\nOne such case occurs when using dm-multipath on top of a PCIe NVMe\nnamespace, where cloned request bios are freed during\nblk_complete_request(), but rq-\u003ebio is left intact. Subsequent clone\nteardown then attempts to free the same bios again via\nblk_rq_unprep_clone().\n\nThe resulting double-free path looks like:\n\n nvme_pci_complete_batch()\n nvme_complete_batch()\n blk_mq_end_request_batch()\n blk_complete_request() // called on a DM clone request\n bio_endio() // first free of all clone bios\n ...\n rq-\u003eend_io() // end_clone_request()\n dm_complete_request(tio-\u003eorig)\n dm_softirq_done()\n dm_done()\n dm_end_request()\n blk_rq_unprep_clone() // second free of clone bios\n\nFix this by clearing the clone request\u0027s bio pointer when the last cloned\nbio completes, ensuring that later teardown paths do not attempt to free\nalready-released bios."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable request-based device-mapper path is reached by local block I/O, such as reads or writes to a filesystem backed by dm-multipath. It is not itself a network protocol handler, even though network services may indirectly generate disk I/O.\nAC:L - On an affected request-based dm-multipath stack over blk-mq/NVMe, ordinary I/O can drive the deterministic completion path that frees the clone bios and then tears down the clone. No attacker-uncontrolled race is required.\nPR:L - Creating or reconfiguring DM devices requires CAP_SYS_ADMIN, but triggering the bug only requires the ability to issue I/O to an existing affected mapped device, for example through files the local user can read or write. Thus a basic unprivileged local user can reach the vulnerable path.\nUI:N - The attacker can trigger the I/O directly through their own syscalls. No separate victim action is required.\nS:U - The impact remains within the kernel/host security authority. This is a standard local kernel memory-corruption issue, not a VM escape or cross-authority boundary bypass.\nC:H - The stale cloned bio pointer causes use-after-free/double-free of kernel heap objects from the DM bioset. Per kernel CVSS guidance, such memory corruption is treated as capable of enabling high-impact information disclosure.\nI:H - The double-free/use-after-free can corrupt allocator state or allow overlapping/reused kernel objects, which is defensibly exploitable for arbitrary memory modification or code execution. Per guidance, UAF/double-free memory corruption warrants high integrity impact.\nA:H - Even without full exploitation, the double-free/use-after-free can trigger kernel memory corruption, oops, or panic during I/O completion. Repeated attacker-controlled I/O can repeatedly hit the vulnerable path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:00.162Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8d9ddad561136f7e6a9346767bf97b4d79e38e67"
},
{
"url": "https://git.kernel.org/stable/c/7daf279c674d515fb22a727a7bbc92aeb35c5442"
},
{
"url": "https://git.kernel.org/stable/c/e2e738e8dfbbf83bd2bae0467ec4420cc52da42a"
},
{
"url": "https://git.kernel.org/stable/c/b1c1a2637ebd675aa2d71fee8c70da8791d73850"
},
{
"url": "https://git.kernel.org/stable/c/83d72091804600ead96dc9e9f518ea56cb4942f6"
},
{
"url": "https://git.kernel.org/stable/c/fb8a6c18fb9a6561f7a15b58b272442b77a242dd"
}
],
"title": "dm: clear cloned request bio pointer when last clone bio completes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43278",
"datePublished": "2026-05-06T11:29:00.193Z",
"dateReserved": "2026-05-01T14:12:55.998Z",
"dateUpdated": "2026-08-05T12:27:00.162Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43471 (GCVE-0-2026-43471)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-23 16:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()
The kernel log indicates a crash in ufshcd_add_command_trace, due to a NULL
pointer dereference when accessing hwq->id. This can happen if
ufshcd_mcq_req_to_hwq() returns NULL.
This patch adds a NULL check for hwq before accessing its id field to
prevent a kernel crash.
Kernel log excerpt:
[<ffffffd5d192dc4c>] notify_die+0x4c/0x8c
[<ffffffd5d1814e58>] __die+0x60/0xb0
[<ffffffd5d1814d64>] die+0x4c/0xe0
[<ffffffd5d181575c>] die_kernel_fault+0x74/0x88
[<ffffffd5d1864db4>] __do_kernel_fault+0x314/0x318
[<ffffffd5d2a3cdf8>] do_page_fault+0xa4/0x5f8
[<ffffffd5d2a3cd34>] do_translation_fault+0x34/0x54
[<ffffffd5d1864524>] do_mem_abort+0x50/0xa8
[<ffffffd5d2a297dc>] el1_abort+0x3c/0x64
[<ffffffd5d2a29718>] el1h_64_sync_handler+0x44/0xcc
[<ffffffd5d181133c>] el1h_64_sync+0x80/0x88
[<ffffffd5d255c1dc>] ufshcd_add_command_trace+0x23c/0x320
[<ffffffd5d255bad8>] ufshcd_compl_one_cqe+0xa4/0x404
[<ffffffd5d2572968>] ufshcd_mcq_poll_cqe_lock+0xac/0x104
[<ffffffd5d11c7460>] ufs_mtk_mcq_intr+0x54/0x74 [ufs_mediatek_mod]
[<ffffffd5d19ab92c>] __handle_irq_event_percpu+0xc8/0x348
[<ffffffd5d19abca8>] handle_irq_event+0x3c/0xa8
[<ffffffd5d19b1f0c>] handle_fasteoi_irq+0xf8/0x294
[<ffffffd5d19aa778>] generic_handle_domain_irq+0x54/0x80
[<ffffffd5d18102bc>] gic_handle_irq+0x1d4/0x330
[<ffffffd5d1838210>] call_on_irq_stack+0x44/0x68
[<ffffffd5d183af30>] do_interrupt_handler+0x78/0xd8
[<ffffffd5d2a29c00>] el1_interrupt+0x48/0xa8
[<ffffffd5d2a29ba8>] el1h_64_irq_handler+0x14/0x24
[<ffffffd5d18113c4>] el1h_64_irq+0x80/0x88
[<ffffffd5d2527fb4>] arch_local_irq_enable+0x4/0x1c
[<ffffffd5d25282e4>] cpuidle_enter+0x34/0x54
[<ffffffd5d195a678>] do_idle+0x1dc/0x2f8
[<ffffffd5d195a7c4>] cpu_startup_entry+0x30/0x3c
[<ffffffd5d18155c4>] secondary_start_kernel+0x134/0x1ac
[<ffffffd5d18640bc>] __secondary_switched+0xc4/0xcc
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bed0896008334eeee4b4bfd7150491ca098cbf72 Version: 9307a998cb9846a2557fdca286997430bee36a2a Version: 9307a998cb9846a2557fdca286997430bee36a2a Version: 9307a998cb9846a2557fdca286997430bee36a2a Version: 9307a998cb9846a2557fdca286997430bee36a2a Version: 11d81233f4ebe6907b12c79ad7d8787aa4db0633 Version: 6.6.41 ≤ Version: 6.9.10 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ufs/core/ufshcd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0614f5618c24fbc3d555efade22887b102ad7ad6",
"status": "affected",
"version": "bed0896008334eeee4b4bfd7150491ca098cbf72",
"versionType": "git"
},
{
"lessThan": "be730f9ee92ae08f2bc4b336967bcfd8183c06fe",
"status": "affected",
"version": "9307a998cb9846a2557fdca286997430bee36a2a",
"versionType": "git"
},
{
"lessThan": "f4f590c6c9df7453bbda2ef9170b1b09e42a124c",
"status": "affected",
"version": "9307a998cb9846a2557fdca286997430bee36a2a",
"versionType": "git"
},
{
"lessThan": "93b9e7ee9e93629db80bbc9dab8a874215b89ccf",
"status": "affected",
"version": "9307a998cb9846a2557fdca286997430bee36a2a",
"versionType": "git"
},
{
"lessThan": "30df81f2228d65bddf492db3929d9fcaffd38fc5",
"status": "affected",
"version": "9307a998cb9846a2557fdca286997430bee36a2a",
"versionType": "git"
},
{
"status": "affected",
"version": "11d81233f4ebe6907b12c79ad7d8787aa4db0633",
"versionType": "git"
},
{
"lessThan": "6.6.130",
"status": "affected",
"version": "6.6.41",
"versionType": "semver"
},
{
"lessThan": "6.10",
"status": "affected",
"version": "6.9.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ufs/core/ufshcd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.6.41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()\n\nThe kernel log indicates a crash in ufshcd_add_command_trace, due to a NULL\npointer dereference when accessing hwq-\u003eid. This can happen if\nufshcd_mcq_req_to_hwq() returns NULL.\n\nThis patch adds a NULL check for hwq before accessing its id field to\nprevent a kernel crash.\n\nKernel log excerpt:\n[\u003cffffffd5d192dc4c\u003e] notify_die+0x4c/0x8c\n[\u003cffffffd5d1814e58\u003e] __die+0x60/0xb0\n[\u003cffffffd5d1814d64\u003e] die+0x4c/0xe0\n[\u003cffffffd5d181575c\u003e] die_kernel_fault+0x74/0x88\n[\u003cffffffd5d1864db4\u003e] __do_kernel_fault+0x314/0x318\n[\u003cffffffd5d2a3cdf8\u003e] do_page_fault+0xa4/0x5f8\n[\u003cffffffd5d2a3cd34\u003e] do_translation_fault+0x34/0x54\n[\u003cffffffd5d1864524\u003e] do_mem_abort+0x50/0xa8\n[\u003cffffffd5d2a297dc\u003e] el1_abort+0x3c/0x64\n[\u003cffffffd5d2a29718\u003e] el1h_64_sync_handler+0x44/0xcc\n[\u003cffffffd5d181133c\u003e] el1h_64_sync+0x80/0x88\n[\u003cffffffd5d255c1dc\u003e] ufshcd_add_command_trace+0x23c/0x320\n[\u003cffffffd5d255bad8\u003e] ufshcd_compl_one_cqe+0xa4/0x404\n[\u003cffffffd5d2572968\u003e] ufshcd_mcq_poll_cqe_lock+0xac/0x104\n[\u003cffffffd5d11c7460\u003e] ufs_mtk_mcq_intr+0x54/0x74 [ufs_mediatek_mod]\n[\u003cffffffd5d19ab92c\u003e] __handle_irq_event_percpu+0xc8/0x348\n[\u003cffffffd5d19abca8\u003e] handle_irq_event+0x3c/0xa8\n[\u003cffffffd5d19b1f0c\u003e] handle_fasteoi_irq+0xf8/0x294\n[\u003cffffffd5d19aa778\u003e] generic_handle_domain_irq+0x54/0x80\n[\u003cffffffd5d18102bc\u003e] gic_handle_irq+0x1d4/0x330\n[\u003cffffffd5d1838210\u003e] call_on_irq_stack+0x44/0x68\n[\u003cffffffd5d183af30\u003e] do_interrupt_handler+0x78/0xd8\n[\u003cffffffd5d2a29c00\u003e] el1_interrupt+0x48/0xa8\n[\u003cffffffd5d2a29ba8\u003e] el1h_64_irq_handler+0x14/0x24\n[\u003cffffffd5d18113c4\u003e] el1h_64_irq+0x80/0x88\n[\u003cffffffd5d2527fb4\u003e] arch_local_irq_enable+0x4/0x1c\n[\u003cffffffd5d25282e4\u003e] cpuidle_enter+0x34/0x54\n[\u003cffffffd5d195a678\u003e] do_idle+0x1dc/0x2f8\n[\u003cffffffd5d195a7c4\u003e] cpu_startup_entry+0x30/0x3c\n[\u003cffffffd5d18155c4\u003e] secondary_start_kernel+0x134/0x1ac\n[\u003cffffffd5d18640bc\u003e] __secondary_switched+0xc4/0xcc"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:07:11.013Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0614f5618c24fbc3d555efade22887b102ad7ad6"
},
{
"url": "https://git.kernel.org/stable/c/be730f9ee92ae08f2bc4b336967bcfd8183c06fe"
},
{
"url": "https://git.kernel.org/stable/c/f4f590c6c9df7453bbda2ef9170b1b09e42a124c"
},
{
"url": "https://git.kernel.org/stable/c/93b9e7ee9e93629db80bbc9dab8a874215b89ccf"
},
{
"url": "https://git.kernel.org/stable/c/30df81f2228d65bddf492db3929d9fcaffd38fc5"
}
],
"title": "scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43471",
"datePublished": "2026-05-08T14:22:30.909Z",
"dateReserved": "2026-05-01T14:12:56.011Z",
"dateUpdated": "2026-05-23T16:07:11.013Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43260 (GCVE-0-2026-43260)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: Fix RSS context delete logic
We need to free the corresponding RSS context VNIC
in FW everytime an RSS context is deleted in driver.
Commit 667ac333dbb7 added a check to delete the VNIC
in FW only when netif_running() is true to help delete
RSS contexts with interface down.
Having that condition will make the driver leak VNICs
in FW whenever close() happens with active RSS contexts.
On the subsequent open(), as part of RSS context restoration,
we will end up trying to create extra VNICs for which we
did not make any reservation. FW can fail this request,
thereby making us lose active RSS contexts.
Suppose an RSS context is deleted already and we try to
process a delete request again, then the HWRM functions
will check for validity of the request and they simply
return if the resource is already freed. So, even for
delete-when-down cases, netif_running() check is not
necessary.
Remove the netif_running() condition check when deleting
an RSS context.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "348a5f8d06c7bdf954e13c17ad5f80b59a075604",
"status": "affected",
"version": "667ac333dbb7e265b3f5bc4bc94e236f64682c86",
"versionType": "git"
},
{
"lessThan": "079986d6db1f8e3d50c55f400cf998ac9690d2c8",
"status": "affected",
"version": "667ac333dbb7e265b3f5bc4bc94e236f64682c86",
"versionType": "git"
},
{
"lessThan": "9a9b89eea4a9cc7726702946ff688d716962fabd",
"status": "affected",
"version": "667ac333dbb7e265b3f5bc4bc94e236f64682c86",
"versionType": "git"
},
{
"lessThan": "e123d9302d223767bd910bfbcfe607bae909f8ac",
"status": "affected",
"version": "667ac333dbb7e265b3f5bc4bc94e236f64682c86",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/bnxt/bnxt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbnxt_en: Fix RSS context delete logic\n\nWe need to free the corresponding RSS context VNIC\nin FW everytime an RSS context is deleted in driver.\nCommit 667ac333dbb7 added a check to delete the VNIC\nin FW only when netif_running() is true to help delete\nRSS contexts with interface down.\n\nHaving that condition will make the driver leak VNICs\nin FW whenever close() happens with active RSS contexts.\nOn the subsequent open(), as part of RSS context restoration,\nwe will end up trying to create extra VNICs for which we\ndid not make any reservation. FW can fail this request,\nthereby making us lose active RSS contexts.\n\nSuppose an RSS context is deleted already and we try to\nprocess a delete request again, then the HWRM functions\nwill check for validity of the request and they simply\nreturn if the resource is already freed. So, even for\ndelete-when-down cases, netif_running() check is not\nnecessary.\n\nRemove the netif_running() condition check when deleting\nan RSS context."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:21:07.350Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/348a5f8d06c7bdf954e13c17ad5f80b59a075604"
},
{
"url": "https://git.kernel.org/stable/c/079986d6db1f8e3d50c55f400cf998ac9690d2c8"
},
{
"url": "https://git.kernel.org/stable/c/9a9b89eea4a9cc7726702946ff688d716962fabd"
},
{
"url": "https://git.kernel.org/stable/c/e123d9302d223767bd910bfbcfe607bae909f8ac"
}
],
"title": "bnxt_en: Fix RSS context delete logic",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43260",
"datePublished": "2026-05-06T11:28:48.113Z",
"dateReserved": "2026-05-01T14:12:55.997Z",
"dateUpdated": "2026-05-11T22:21:07.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43226 (GCVE-0-2026-43226)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/rds: No shortcut out of RDS_CONN_ERROR
RDS connections carry a state "rds_conn_path::cp_state"
and transitions from one state to another and are conditional
upon an expected state: "rds_conn_path_transition."
There is one exception to this conditionality, which is
"RDS_CONN_ERROR" that can be enforced by "rds_conn_path_drop"
regardless of what state the condition is currently in.
But as soon as a connection enters state "RDS_CONN_ERROR",
the connection handling code expects it to go through the
shutdown-path.
The RDS/TCP multipath changes added a shortcut out of
"RDS_CONN_ERROR" straight back to "RDS_CONN_CONNECTING"
via "rds_tcp_accept_one_path" (e.g. after "rds_tcp_state_change").
A subsequent "rds_tcp_reset_callbacks" can then transition
the state to "RDS_CONN_RESETTING" with a shutdown-worker queued.
That'll trip up "rds_conn_init_shutdown", which was
never adjusted to handle "RDS_CONN_RESETTING" and subsequently
drops the connection with the dreaded "DR_INV_CONN_STATE",
which leaves "RDS_SHUTDOWN_WORK_QUEUED" on forever.
So we do two things here:
a) Don't shortcut "RDS_CONN_ERROR", but take the longer
path through the shutdown code.
b) Add "RDS_CONN_RESETTING" to the expected states in
"rds_conn_init_shutdown" so that we won't error out
and get stuck, if we ever hit weird state transitions
like this again."
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5916e2c1554f3e36f770401c989c3c7fadf619ca Version: 5916e2c1554f3e36f770401c989c3c7fadf619ca Version: 5916e2c1554f3e36f770401c989c3c7fadf619ca Version: 5916e2c1554f3e36f770401c989c3c7fadf619ca Version: 5916e2c1554f3e36f770401c989c3c7fadf619ca Version: 5916e2c1554f3e36f770401c989c3c7fadf619ca Version: 5916e2c1554f3e36f770401c989c3c7fadf619ca Version: 5916e2c1554f3e36f770401c989c3c7fadf619ca |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/connection.c",
"net/rds/tcp_listen.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9bcd7c00691a2db9745817d5ea79262a503b135c",
"status": "affected",
"version": "5916e2c1554f3e36f770401c989c3c7fadf619ca",
"versionType": "git"
},
{
"lessThan": "a179ac7be8f5a650d0068040705f4cddd6ca369c",
"status": "affected",
"version": "5916e2c1554f3e36f770401c989c3c7fadf619ca",
"versionType": "git"
},
{
"lessThan": "19e384a7d00d888303a8285977cdf1970c6cccd6",
"status": "affected",
"version": "5916e2c1554f3e36f770401c989c3c7fadf619ca",
"versionType": "git"
},
{
"lessThan": "f0f729bdffb08af32e0f54521b81b8a9e0321f16",
"status": "affected",
"version": "5916e2c1554f3e36f770401c989c3c7fadf619ca",
"versionType": "git"
},
{
"lessThan": "81248b1eb3c5954cc1fc7b33b7c03e34d20cb8c8",
"status": "affected",
"version": "5916e2c1554f3e36f770401c989c3c7fadf619ca",
"versionType": "git"
},
{
"lessThan": "899ef00963ce76f9fc421a7d02335fe4ead6389b",
"status": "affected",
"version": "5916e2c1554f3e36f770401c989c3c7fadf619ca",
"versionType": "git"
},
{
"lessThan": "9ff599a9be784a808c36765086e3db2144aa3b66",
"status": "affected",
"version": "5916e2c1554f3e36f770401c989c3c7fadf619ca",
"versionType": "git"
},
{
"lessThan": "ad22d24be635c6beab6a1fdd3f8b1f3c478d15da",
"status": "affected",
"version": "5916e2c1554f3e36f770401c989c3c7fadf619ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/connection.c",
"net/rds/tcp_listen.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: No shortcut out of RDS_CONN_ERROR\n\nRDS connections carry a state \"rds_conn_path::cp_state\"\nand transitions from one state to another and are conditional\nupon an expected state: \"rds_conn_path_transition.\"\n\nThere is one exception to this conditionality, which is\n\"RDS_CONN_ERROR\" that can be enforced by \"rds_conn_path_drop\"\nregardless of what state the condition is currently in.\n\nBut as soon as a connection enters state \"RDS_CONN_ERROR\",\nthe connection handling code expects it to go through the\nshutdown-path.\n\nThe RDS/TCP multipath changes added a shortcut out of\n\"RDS_CONN_ERROR\" straight back to \"RDS_CONN_CONNECTING\"\nvia \"rds_tcp_accept_one_path\" (e.g. after \"rds_tcp_state_change\").\n\nA subsequent \"rds_tcp_reset_callbacks\" can then transition\nthe state to \"RDS_CONN_RESETTING\" with a shutdown-worker queued.\n\nThat\u0027ll trip up \"rds_conn_init_shutdown\", which was\nnever adjusted to handle \"RDS_CONN_RESETTING\" and subsequently\ndrops the connection with the dreaded \"DR_INV_CONN_STATE\",\nwhich leaves \"RDS_SHUTDOWN_WORK_QUEUED\" on forever.\n\nSo we do two things here:\n\na) Don\u0027t shortcut \"RDS_CONN_ERROR\", but take the longer\n path through the shutdown code.\n\nb) Add \"RDS_CONN_RESETTING\" to the expected states in\n \"rds_conn_init_shutdown\" so that we won\u0027t error out\n and get stuck, if we ever hit weird state transitions\n like this again.\""
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is in the RDS/TCP passive accept path reached by remote TCP connections to the kernel RDS listener on port 16385. No local syscall or physical access is required in a deployment where RDS/TCP is enabled and reachable.\nAC:L - The attacker can drive the relevant error and reconnect sequence by opening, closing, and reconnecting TCP connections; the queued-shutdown timing is repeatable and under attacker influence. There is no requirement for a rare victim-controlled state beyond an active RDS/TCP deployment.\nPR:N - The accept path runs before any RDS authentication or credential check, and RDS/TCP does not authenticate the remote peer before reaching rds_tcp_accept_one_path. A network attacker only needs the ability to connect to the listener.\nUI:N - Exploitation does not require a user to open a file, mount anything, or perform an action. The attacker triggers it through network connection sequencing.\nS:U - The impact remains within the kernel/RDS networking security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:N - The bug is a connection state-machine error and I found no memory disclosure path, out-of-bounds read, or use-after-free primitive. It does not expose kernel or application data.\nI:N - The fix addresses invalid RDS connection state transitions, not memory corruption or unauthorized data modification. I found no arbitrary write, control-flow hijack, or integrity-impacting primitive.\nA:H - The invalid shortcut can leave an RDS/TCP connection path stuck with shutdown/reconnect work state permanently wedged, denying RDS availability for affected peer paths until external recovery. Because it is remotely and repeatedly triggerable against a network service, the availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:42.896Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9bcd7c00691a2db9745817d5ea79262a503b135c"
},
{
"url": "https://git.kernel.org/stable/c/a179ac7be8f5a650d0068040705f4cddd6ca369c"
},
{
"url": "https://git.kernel.org/stable/c/19e384a7d00d888303a8285977cdf1970c6cccd6"
},
{
"url": "https://git.kernel.org/stable/c/f0f729bdffb08af32e0f54521b81b8a9e0321f16"
},
{
"url": "https://git.kernel.org/stable/c/81248b1eb3c5954cc1fc7b33b7c03e34d20cb8c8"
},
{
"url": "https://git.kernel.org/stable/c/899ef00963ce76f9fc421a7d02335fe4ead6389b"
},
{
"url": "https://git.kernel.org/stable/c/9ff599a9be784a808c36765086e3db2144aa3b66"
},
{
"url": "https://git.kernel.org/stable/c/ad22d24be635c6beab6a1fdd3f8b1f3c478d15da"
}
],
"title": "net/rds: No shortcut out of RDS_CONN_ERROR",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43226",
"datePublished": "2026-05-06T11:28:24.952Z",
"dateReserved": "2026-05-01T14:12:55.994Z",
"dateUpdated": "2026-08-05T12:26:42.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45940 (GCVE-0-2026-45940)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-27 12:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: fix oops when split header is enabled
For GMAC4, when split header is enabled, in some rare cases, the
hardware does not fill buf2 of the first descriptor with payload.
Thus we cannot assume buf2 is always fully filled if it is not
the last descriptor. Otherwise, the length of buf2 of the second
descriptor will be calculated wrong and cause an oops:
Unable to handle kernel paging request at virtual address ffff00019246bfc0
...
x2 : 0000000000000040 x1 : ffff00019246bfc0 x0 : ffff00009246c000
Call trace:
dcache_inval_poc+0x28/0x58 (P)
dma_direct_sync_single_for_cpu+0x38/0x6c
__dma_sync_single_for_cpu+0x34/0x6c
stmmac_napi_poll_rx+0x8f0/0xb60
__napi_poll.constprop.0+0x30/0x144
net_rx_action+0x160/0x274
handle_softirqs+0x1b8/0x1fc
...
To fix this, the PL bit-field in RDES3 register is used for all
descriptors, whether it is the last descriptor or not.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b1f23df09e7dbf4c86b6908dff7efb8cb2b7d609",
"status": "affected",
"version": "ec222003bd948de8f3ffbca522d328af1a8452ad",
"versionType": "git"
},
{
"lessThan": "36f81cb7d82e9614a7058da6abdf2e3a03993df1",
"status": "affected",
"version": "ec222003bd948de8f3ffbca522d328af1a8452ad",
"versionType": "git"
},
{
"lessThan": "babab1b42ed68877ef669a08384becf281ad2582",
"status": "affected",
"version": "ec222003bd948de8f3ffbca522d328af1a8452ad",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix oops when split header is enabled\n\nFor GMAC4, when split header is enabled, in some rare cases, the\nhardware does not fill buf2 of the first descriptor with payload.\nThus we cannot assume buf2 is always fully filled if it is not\nthe last descriptor. Otherwise, the length of buf2 of the second\ndescriptor will be calculated wrong and cause an oops:\n\nUnable to handle kernel paging request at virtual address ffff00019246bfc0\n...\nx2 : 0000000000000040 x1 : ffff00019246bfc0 x0 : ffff00009246c000\nCall trace:\n dcache_inval_poc+0x28/0x58 (P)\n dma_direct_sync_single_for_cpu+0x38/0x6c\n __dma_sync_single_for_cpu+0x34/0x6c\n stmmac_napi_poll_rx+0x8f0/0xb60\n __napi_poll.constprop.0+0x30/0x144\n net_rx_action+0x160/0x274\n handle_softirqs+0x1b8/0x1fc\n...\n\nTo fix this, the PL bit-field in RDES3 register is used for all\ndescriptors, whether it is the last descriptor or not."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:17:56.350Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b1f23df09e7dbf4c86b6908dff7efb8cb2b7d609"
},
{
"url": "https://git.kernel.org/stable/c/36f81cb7d82e9614a7058da6abdf2e3a03993df1"
},
{
"url": "https://git.kernel.org/stable/c/babab1b42ed68877ef669a08384becf281ad2582"
}
],
"title": "net: stmmac: fix oops when split header is enabled",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45940",
"datePublished": "2026-05-27T12:17:56.350Z",
"dateReserved": "2026-05-13T15:03:33.087Z",
"dateUpdated": "2026-05-27T12:17:56.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31520 (GCVE-0-2026-31520)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-05-11 22:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: apple: avoid memory leak in apple_report_fixup()
The apple_report_fixup() function was returning a
newly kmemdup()-allocated buffer, but never freeing it.
The caller of report_fixup() does not take ownership of the returned
pointer, but it *is* permitted to return a sub-portion of the input
rdesc, whose lifetime is managed by the caller.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6e143293e17a73c9313f91c5ca3aaacbaef030cf Version: 6e143293e17a73c9313f91c5ca3aaacbaef030cf Version: 6e143293e17a73c9313f91c5ca3aaacbaef030cf Version: 6e143293e17a73c9313f91c5ca3aaacbaef030cf Version: 6e143293e17a73c9313f91c5ca3aaacbaef030cf Version: 6e143293e17a73c9313f91c5ca3aaacbaef030cf |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-apple.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e2f090aeb7b9930a964e151910f4d45b04c8a7e5",
"status": "affected",
"version": "6e143293e17a73c9313f91c5ca3aaacbaef030cf",
"versionType": "git"
},
{
"lessThan": "2635d0c715f3fb177e0f80ecd5fa48feb6bf3884",
"status": "affected",
"version": "6e143293e17a73c9313f91c5ca3aaacbaef030cf",
"versionType": "git"
},
{
"lessThan": "31860c3f7ac66ab897a8c90dc4e74fa17ca0b624",
"status": "affected",
"version": "6e143293e17a73c9313f91c5ca3aaacbaef030cf",
"versionType": "git"
},
{
"lessThan": "be1a341c161430282acdfe2ac99b413271575cf1",
"status": "affected",
"version": "6e143293e17a73c9313f91c5ca3aaacbaef030cf",
"versionType": "git"
},
{
"lessThan": "e652ebd29928181c3e6820e303da25873e9917d4",
"status": "affected",
"version": "6e143293e17a73c9313f91c5ca3aaacbaef030cf",
"versionType": "git"
},
{
"lessThan": "239c15116d80f67d32f00acc34575f1a6b699613",
"status": "affected",
"version": "6e143293e17a73c9313f91c5ca3aaacbaef030cf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-apple.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: apple: avoid memory leak in apple_report_fixup()\n\nThe apple_report_fixup() function was returning a\nnewly kmemdup()-allocated buffer, but never freeing it.\n\nThe caller of report_fixup() does not take ownership of the returned\npointer, but it *is* permitted to return a sub-portion of the input\nrdesc, whose lifetime is managed by the caller."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:10:23.085Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e2f090aeb7b9930a964e151910f4d45b04c8a7e5"
},
{
"url": "https://git.kernel.org/stable/c/2635d0c715f3fb177e0f80ecd5fa48feb6bf3884"
},
{
"url": "https://git.kernel.org/stable/c/31860c3f7ac66ab897a8c90dc4e74fa17ca0b624"
},
{
"url": "https://git.kernel.org/stable/c/be1a341c161430282acdfe2ac99b413271575cf1"
},
{
"url": "https://git.kernel.org/stable/c/e652ebd29928181c3e6820e303da25873e9917d4"
},
{
"url": "https://git.kernel.org/stable/c/239c15116d80f67d32f00acc34575f1a6b699613"
}
],
"title": "HID: apple: avoid memory leak in apple_report_fixup()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31520",
"datePublished": "2026-04-22T13:54:35.534Z",
"dateReserved": "2026-03-09T15:48:24.108Z",
"dateUpdated": "2026-05-11T22:10:23.085Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53202 (GCVE-0-2026-53202)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-24 12:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/ivpu: Fix signed integer truncation in IPC receive
Fix potential buffer overflow where firmware-supplied data_size is cast
to signed int before being used in min_t(). Large unsigned values
(>= 0x80000000) become negative, causing unsigned wraparound and
oversized memcpy operations that can overflow the stack buffer.
Change min_t(int, ...) to min() as both values are unsigned and can be
handled by min() without explicit cast.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.47.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.39.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s accel/ivpu component. A local attacker could exploit a signed integer truncation vulnerability in the Inter-Process Communication (IPC) receive path. This flaw occurs when a firmware-supplied data size is incorrectly converted, leading to an oversized memory copy operation that can overflow a kernel stack buffer. Successful exploitation could result in a denial of service through a kernel crash and potentially lead to privilege escalation."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T12:06:54.374Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53202"
},
{
"name": "RHBZ#2492823",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492823"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53202.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54343"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54443"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:54343: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:54443: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: Kernel: Privilege escalation and denial of service via integer truncation in accel/ivpu",
"workarounds": [
{
"lang": "en",
"value": "If the Intel Versatile Processing Unit (IVPU) accelerator is not required, the `ivpu` kernel module can be blacklisted to prevent it from loading, thereby mitigating this vulnerability. To blacklist the module, create a file named `/etc/modprobe.d/blacklist-ivpu.conf` with the following content:\n\n```\nblacklist ivpu\n```\n\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact functionality if the IVPU accelerator is actively used."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/ivpu/ivpu_ipc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4788556d4dd9d717037e385de178974e9649231d",
"status": "affected",
"version": "3b434a3445fff3149128db0169da864d67057325",
"versionType": "git"
},
{
"lessThan": "45cb105b8642c65e9be286f7058e92314efe7ea3",
"status": "affected",
"version": "3b434a3445fff3149128db0169da864d67057325",
"versionType": "git"
},
{
"lessThan": "2821bf2b79e47f87e1dbdd9d25c78240965a97d6",
"status": "affected",
"version": "3b434a3445fff3149128db0169da864d67057325",
"versionType": "git"
},
{
"lessThan": "d9faef564438d1e4579c692c046603e7ada7bdf4",
"status": "affected",
"version": "3b434a3445fff3149128db0169da864d67057325",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/ivpu/ivpu_ipc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Fix signed integer truncation in IPC receive\n\nFix potential buffer overflow where firmware-supplied data_size is cast\nto signed int before being used in min_t(). Large unsigned values\n(\u003e= 0x80000000) become negative, causing unsigned wraparound and\noversized memcpy operations that can overflow the stack buffer.\n\nChange min_t(int, ...) to min() as both values are unsigned and can be\nhandled by min() without explicit cast."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable IPC receive path is reached through local DRM/accel device operations and driver-triggered JSM IPC responses, not through network or adjacent protocols.\nAC:L - Triggering the vulnerable copy requires a malformed firmware IPC response with a large data_size, but there is no race or external timing condition once such a response is induced; when uncertain, the lower complexity is chosen.\nPR:L - The ivpu accel ioctls require local access to the accelerator device file but no CAP_SYS_ADMIN, DRM master, or other kernel capability checks were found on the relevant paths.\nUI:N - The attacker can open the device and issue ioctls or submit work directly; no separate victim action is required.\nS:U - The corruption affects the kernel driver/host kernel within the same security authority and does not by itself cross a VM, sandbox, or IOMMU security boundary.\nC:H - The signed truncation can turn firmware-controlled data_size into an oversized memcpy into a stack vpu_jsm_msg buffer, creating kernel memory corruption that can plausibly be leveraged for information disclosure.\nI:H - The bug is an out-of-bounds stack write from an attacker-influenced firmware IPC buffer, which is defensibly exploitable for kernel control-flow or data integrity compromise.\nA:H - Even without reliable code execution, the oversized kernel memcpy can corrupt the stack or fault while reading/writing far beyond the buffers, causing an oops or panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:06.087Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4788556d4dd9d717037e385de178974e9649231d"
},
{
"url": "https://git.kernel.org/stable/c/45cb105b8642c65e9be286f7058e92314efe7ea3"
},
{
"url": "https://git.kernel.org/stable/c/2821bf2b79e47f87e1dbdd9d25c78240965a97d6"
},
{
"url": "https://git.kernel.org/stable/c/d9faef564438d1e4579c692c046603e7ada7bdf4"
}
],
"title": "accel/ivpu: Fix signed integer truncation in IPC receive",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53202",
"datePublished": "2026-06-25T08:39:10.287Z",
"dateReserved": "2026-06-09T07:44:35.391Z",
"dateUpdated": "2026-08-24T12:06:54.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31414 (GCVE-0-2026-31414)
Vulnerability from cvelistv5
Published
2026-04-13 13:21
Modified
2026-08-05 12:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_expect: use expect->helper
Use expect->helper in ctnetlink and /proc to dump the helper name.
Using nfct_help() without holding a reference to the master conntrack
is unsafe.
Use exp->master->helper in ctnetlink path if userspace does not provide
an explicit helper when creating an expectation to retain the existing
behaviour. The ctnetlink expectation path holds the reference on the
master conntrack and nf_conntrack_expect lock and the nfnetlink glue
path refers to the master ct that is attached to the skb.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ea781f197d6a835cbb93a0bf88ee1696296ed8aa Version: ea781f197d6a835cbb93a0bf88ee1696296ed8aa Version: ea781f197d6a835cbb93a0bf88ee1696296ed8aa Version: ea781f197d6a835cbb93a0bf88ee1696296ed8aa Version: ea781f197d6a835cbb93a0bf88ee1696296ed8aa Version: ea781f197d6a835cbb93a0bf88ee1696296ed8aa |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:47:32.470Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_expect.c",
"net/netfilter/nf_conntrack_helper.c",
"net/netfilter/nf_conntrack_netlink.c",
"net/netfilter/nf_conntrack_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "847cb7fe26c5ce5dce0d1a41fac1ea488b7f1781",
"status": "affected",
"version": "ea781f197d6a835cbb93a0bf88ee1696296ed8aa",
"versionType": "git"
},
{
"lessThan": "e7ccaa0a62a8ff2be5d521299ce79390c318d306",
"status": "affected",
"version": "ea781f197d6a835cbb93a0bf88ee1696296ed8aa",
"versionType": "git"
},
{
"lessThan": "4bd1b3d839172724b33d8d02c5a4ff6a1c775417",
"status": "affected",
"version": "ea781f197d6a835cbb93a0bf88ee1696296ed8aa",
"versionType": "git"
},
{
"lessThan": "b53294bff19e56ada2f230ceb8b1ffde61cc3817",
"status": "affected",
"version": "ea781f197d6a835cbb93a0bf88ee1696296ed8aa",
"versionType": "git"
},
{
"lessThan": "3dfd3f7712b5a800f2ba632179e9b738076a51f0",
"status": "affected",
"version": "ea781f197d6a835cbb93a0bf88ee1696296ed8aa",
"versionType": "git"
},
{
"lessThan": "f01794106042ee27e54af6fdf5b319a2fe3df94d",
"status": "affected",
"version": "ea781f197d6a835cbb93a0bf88ee1696296ed8aa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_expect.c",
"net/netfilter/nf_conntrack_helper.c",
"net/netfilter/nf_conntrack_netlink.c",
"net/netfilter/nf_conntrack_sip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_expect: use expect-\u003ehelper\n\nUse expect-\u003ehelper in ctnetlink and /proc to dump the helper name.\nUsing nfct_help() without holding a reference to the master conntrack\nis unsafe.\n\nUse exp-\u003emaster-\u003ehelper in ctnetlink path if userspace does not provide\nan explicit helper when creating an expectation to retain the existing\nbehaviour. The ctnetlink expectation path holds the reference on the\nmaster conntrack and nf_conntrack_expect lock and the nfnetlink glue\npath refers to the master ct that is attached to the skb."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable helper lookup is reachable from packet-processing paths such as the SIP conntrack helper when network traffic creates and collides with expectations. A remote peer can drive SIP/SDP traffic through a reasonably configured firewall/router using this helper.\nAC:L - The race/lifetime window can be exercised by repeatedly creating and tearing down related conntrack expectations, which the attacker can influence through controlled traffic. No rare, attacker-uncontrolled condition is required beyond the affected helper being enabled.\nPR:N - The network packet path does not require local credentials or capabilities. Although ctnetlink and proc dump paths are local and capability-gated, the SIP helper path gives a no-privilege remote trigger.\nUI:N - Exploitation does not require a victim user to perform an action. The attacker only needs to send crafted traffic or local netlink/proc requests in the relevant scenario.\nS:U - The vulnerability is in the kernel networking subsystem and impacts kernel resources under the same security authority. It is not a VM escape, IOMMU bypass, or cross-scope isolation break by itself.\nC:H - The bug is a stale use of the master conntrack/helper state, allowing kernel heap use-after-free reads through helper pointers. Under the required conservative scoring rule, this can expose arbitrary kernel memory.\nI:H - Use-after-free in kernel heap objects can be shaped with heap spraying and may be leveraged beyond the immediate stale read. Under the required conservative scoring rule, kernel memory corruption is treated as high integrity impact.\nA:H - Invalid or attacker-shaped stale helper pointers can cause kernel oops or panic during packet processing, netlink dumps, event delivery, or proc reads. This provides a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:20.834Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/847cb7fe26c5ce5dce0d1a41fac1ea488b7f1781"
},
{
"url": "https://git.kernel.org/stable/c/e7ccaa0a62a8ff2be5d521299ce79390c318d306"
},
{
"url": "https://git.kernel.org/stable/c/4bd1b3d839172724b33d8d02c5a4ff6a1c775417"
},
{
"url": "https://git.kernel.org/stable/c/b53294bff19e56ada2f230ceb8b1ffde61cc3817"
},
{
"url": "https://git.kernel.org/stable/c/3dfd3f7712b5a800f2ba632179e9b738076a51f0"
},
{
"url": "https://git.kernel.org/stable/c/f01794106042ee27e54af6fdf5b319a2fe3df94d"
}
],
"title": "netfilter: nf_conntrack_expect: use expect-\u003ehelper",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31414",
"datePublished": "2026-04-13T13:21:02.592Z",
"dateReserved": "2026-03-09T15:48:24.087Z",
"dateUpdated": "2026-08-05T12:22:20.834Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45837 (GCVE-0-2026-45837)
Vulnerability from cvelistv5
Published
2026-05-27 09:24
Modified
2026-06-14 17:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix use-after-free in arena_vm_close on fork
arena_vm_open() only bumps vml->mmap_count but never registers the
child VMA in arena->vma_list. The vml->vma always points at the
parent VMA, so after parent munmap the pointer dangles. If the child
then calls bpf_arena_free_pages(), zap_pages() reads the stale
vml->vma triggering use-after-free.
Fix this by preventing the arena VMA from being inherited across
fork with VM_DONTCOPY, and preventing VMA splits via the may_split
callback.
Also reject mremap with a .mremap callback returning -EINVAL. A
same-size mremap(MREMAP_FIXED) on the full arena VMA reaches
copy_vma() through the following path:
check_prep_vma() - returns 0 early: new_len == old_len
skips VM_DONTEXPAND check
prep_move_vma() - vm_start == old_addr and
vm_end == old_addr + old_len
so may_split is never called
move_vma()
copy_vma_and_data()
copy_vma()
vm_area_dup() - copies vm_private_data (vml pointer)
vm_ops->open() - bumps vml->mmap_count
vm_ops->mremap() - returns -EINVAL, rollback unmaps new VMA
The refcount ensures the rollback's arena_vm_close does not free
the vml shared with the original VMA.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/arena.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "723b9fa930cc277c15ce6b9ec9feec828cfac9d7",
"status": "affected",
"version": "317460317a02a1af512697e6e964298dedd8a163",
"versionType": "git"
},
{
"lessThan": "d18099f19e53250f8ad2801498b88cec29d9107a",
"status": "affected",
"version": "317460317a02a1af512697e6e964298dedd8a163",
"versionType": "git"
},
{
"lessThan": "201128fcc7b213d27ab77bc4e89488b41796480f",
"status": "affected",
"version": "317460317a02a1af512697e6e964298dedd8a163",
"versionType": "git"
},
{
"lessThan": "4fddde2a732de60bb97e3307d4eb69ac5f1d2b74",
"status": "affected",
"version": "317460317a02a1af512697e6e964298dedd8a163",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/arena.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix use-after-free in arena_vm_close on fork\n\narena_vm_open() only bumps vml-\u003emmap_count but never registers the\nchild VMA in arena-\u003evma_list. The vml-\u003evma always points at the\nparent VMA, so after parent munmap the pointer dangles. If the child\nthen calls bpf_arena_free_pages(), zap_pages() reads the stale\nvml-\u003evma triggering use-after-free.\n\nFix this by preventing the arena VMA from being inherited across\nfork with VM_DONTCOPY, and preventing VMA splits via the may_split\ncallback.\n\nAlso reject mremap with a .mremap callback returning -EINVAL. A\nsame-size mremap(MREMAP_FIXED) on the full arena VMA reaches\ncopy_vma() through the following path:\n\n check_prep_vma() - returns 0 early: new_len == old_len\n skips VM_DONTEXPAND check\n prep_move_vma() - vm_start == old_addr and\n vm_end == old_addr + old_len\n so may_split is never called\n move_vma()\n copy_vma_and_data()\n copy_vma()\n vm_area_dup() - copies vm_private_data (vml pointer)\n vm_ops-\u003eopen() - bumps vml-\u003emmap_count\n vm_ops-\u003emremap() - returns -EINVAL, rollback unmaps new VMA\n\nThe refcount ensures the rollback\u0027s arena_vm_close does not free\nthe vml shared with the original VMA."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:46:01.781Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/723b9fa930cc277c15ce6b9ec9feec828cfac9d7"
},
{
"url": "https://git.kernel.org/stable/c/d18099f19e53250f8ad2801498b88cec29d9107a"
},
{
"url": "https://git.kernel.org/stable/c/201128fcc7b213d27ab77bc4e89488b41796480f"
},
{
"url": "https://git.kernel.org/stable/c/4fddde2a732de60bb97e3307d4eb69ac5f1d2b74"
}
],
"title": "bpf: Fix use-after-free in arena_vm_close on fork",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45837",
"datePublished": "2026-05-27T09:24:32.833Z",
"dateReserved": "2026-05-13T15:03:33.077Z",
"dateUpdated": "2026-06-14T17:46:01.781Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43223 (GCVE-0-2026-43223)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: pvrusb2: fix URB leak in pvr2_send_request_ex
When pvr2_send_request_ex() submits a write URB successfully but fails to
submit the read URB (e.g. returns -ENOMEM), it returns immediately without
waiting for the write URB to complete. Since the driver reuses the same
URB structure, a subsequent call to pvr2_send_request_ex() attempts to
submit the still-active write URB, triggering a 'URB submitted while
active' warning in usb_submit_urb().
Fix this by ensuring the write URB is unlinked and waited upon if the read
URB submission fails.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d855497edbfbf9e19a17f4a1154bca69cb4bd9ba Version: d855497edbfbf9e19a17f4a1154bca69cb4bd9ba Version: d855497edbfbf9e19a17f4a1154bca69cb4bd9ba Version: d855497edbfbf9e19a17f4a1154bca69cb4bd9ba Version: d855497edbfbf9e19a17f4a1154bca69cb4bd9ba Version: d855497edbfbf9e19a17f4a1154bca69cb4bd9ba Version: d855497edbfbf9e19a17f4a1154bca69cb4bd9ba Version: d855497edbfbf9e19a17f4a1154bca69cb4bd9ba |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "da524c939b1e5ba17f10db4bde4bdaf569ffcda6",
"status": "affected",
"version": "d855497edbfbf9e19a17f4a1154bca69cb4bd9ba",
"versionType": "git"
},
{
"lessThan": "cf459d6ffa5e150ef3744b897f936ff24b52bd15",
"status": "affected",
"version": "d855497edbfbf9e19a17f4a1154bca69cb4bd9ba",
"versionType": "git"
},
{
"lessThan": "77a63f8efc434ddb04667ed632aade58301a2f13",
"status": "affected",
"version": "d855497edbfbf9e19a17f4a1154bca69cb4bd9ba",
"versionType": "git"
},
{
"lessThan": "4ba5c7a1aade7090172cbffd4d120bf4cf5ccbde",
"status": "affected",
"version": "d855497edbfbf9e19a17f4a1154bca69cb4bd9ba",
"versionType": "git"
},
{
"lessThan": "58dd722b6c3debcddb4684fb256c90fee7f063e5",
"status": "affected",
"version": "d855497edbfbf9e19a17f4a1154bca69cb4bd9ba",
"versionType": "git"
},
{
"lessThan": "2011929f0e4cf6a0a34dd6205911b12276904453",
"status": "affected",
"version": "d855497edbfbf9e19a17f4a1154bca69cb4bd9ba",
"versionType": "git"
},
{
"lessThan": "5f3ac816861c3b8a5d1a3645b17dc3a99d668d94",
"status": "affected",
"version": "d855497edbfbf9e19a17f4a1154bca69cb4bd9ba",
"versionType": "git"
},
{
"lessThan": "a8333c8262aed2aedf608c18edd39cf5342680a7",
"status": "affected",
"version": "d855497edbfbf9e19a17f4a1154bca69cb4bd9ba",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/usb/pvrusb2/pvrusb2-hdw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"lessThan": "2.6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pvrusb2: fix URB leak in pvr2_send_request_ex\n\nWhen pvr2_send_request_ex() submits a write URB successfully but fails to\nsubmit the read URB (e.g. returns -ENOMEM), it returns immediately without\nwaiting for the write URB to complete. Since the driver reuses the same\nURB structure, a subsequent call to pvr2_send_request_ex() attempts to\nsubmit the still-active write URB, triggering a \u0027URB submitted while\nactive\u0027 warning in usb_submit_urb().\n\nFix this by ensuring the write URB is unlinked and waited upon if the read\nURB submission fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:20:23.149Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/da524c939b1e5ba17f10db4bde4bdaf569ffcda6"
},
{
"url": "https://git.kernel.org/stable/c/cf459d6ffa5e150ef3744b897f936ff24b52bd15"
},
{
"url": "https://git.kernel.org/stable/c/77a63f8efc434ddb04667ed632aade58301a2f13"
},
{
"url": "https://git.kernel.org/stable/c/4ba5c7a1aade7090172cbffd4d120bf4cf5ccbde"
},
{
"url": "https://git.kernel.org/stable/c/58dd722b6c3debcddb4684fb256c90fee7f063e5"
},
{
"url": "https://git.kernel.org/stable/c/2011929f0e4cf6a0a34dd6205911b12276904453"
},
{
"url": "https://git.kernel.org/stable/c/5f3ac816861c3b8a5d1a3645b17dc3a99d668d94"
},
{
"url": "https://git.kernel.org/stable/c/a8333c8262aed2aedf608c18edd39cf5342680a7"
}
],
"title": "media: pvrusb2: fix URB leak in pvr2_send_request_ex",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43223",
"datePublished": "2026-05-06T11:28:22.952Z",
"dateReserved": "2026-05-01T14:12:55.994Z",
"dateUpdated": "2026-05-11T22:20:23.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31726 (GCVE-0-2026-31726)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-05-23 16:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: fix NULL pointer dereference during unbind race
Commit b81ac4395bbe ("usb: gadget: uvc: allow for application to cleanly
shutdown") introduced two stages of synchronization waits totaling 1500ms
in uvc_function_unbind() to prevent several types of kernel panics.
However, this timing-based approach is insufficient during power
management (PM) transitions.
When the PM subsystem starts freezing user space processes, the
wait_event_interruptible_timeout() is aborted early, which allows the
unbind thread to proceed and nullify the gadget pointer
(cdev->gadget = NULL):
[ 814.123447][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind()
[ 814.178583][ T3173] PM: suspend entry (deep)
[ 814.192487][ T3173] Freezing user space processes
[ 814.197668][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind no clean disconnect, wait for release
When the PM subsystem resumes or aborts the suspend and tasks are
restarted, the V4L2 release path is executed and attempts to access the
already nullified gadget pointer, triggering a kernel panic:
[ 814.292597][ C0] PM: pm_system_irq_wakeup: 479 triggered dhdpcie_host_wake
[ 814.386727][ T3173] Restarting tasks ...
[ 814.403522][ T4558] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030
[ 814.404021][ T4558] pc : usb_gadget_deactivate+0x14/0xf4
[ 814.404031][ T4558] lr : usb_function_deactivate+0x54/0x94
[ 814.404078][ T4558] Call trace:
[ 814.404080][ T4558] usb_gadget_deactivate+0x14/0xf4
[ 814.404083][ T4558] usb_function_deactivate+0x54/0x94
[ 814.404087][ T4558] uvc_function_disconnect+0x1c/0x5c
[ 814.404092][ T4558] uvc_v4l2_release+0x44/0xac
[ 814.404095][ T4558] v4l2_release+0xcc/0x130
Address the race condition and NULL pointer dereference by:
1. State Synchronization (flag + mutex)
Introduce a 'func_unbound' flag in struct uvc_device. This allows
uvc_function_disconnect() to safely skip accessing the nullified
cdev->gadget pointer. As suggested by Alan Stern, this flag is protected
by a new mutex (uvc->lock) to ensure proper memory ordering and prevent
instruction reordering or speculative loads. This mutex is also used to
protect 'func_connected' for consistent state management.
2. Explicit Synchronization (completion)
Use a completion to synchronize uvc_function_unbind() with the
uvc_vdev_release() callback. This prevents Use-After-Free (UAF) by
ensuring struct uvc_device is freed after all video device resources
are released.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1444e0568bc2c70868e7b8da5b46fc2252acc3f5 Version: 4962e5a2f301d24953f17d6748d986e21566abe1 Version: b81ac4395bbeaf36e078dea1a48c02dd97b76235 Version: b81ac4395bbeaf36e078dea1a48c02dd97b76235 Version: b81ac4395bbeaf36e078dea1a48c02dd97b76235 Version: b81ac4395bbeaf36e078dea1a48c02dd97b76235 Version: b81ac4395bbeaf36e078dea1a48c02dd97b76235 Version: b81ac4395bbeaf36e078dea1a48c02dd97b76235 Version: e10735ce87502b07e171727e574afdd6c0890a08 Version: 5.10.117 ≤ Version: 5.15.41 ≤ Version: 5.17.9 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_uvc.c",
"drivers/usb/gadget/function/uvc.h",
"drivers/usb/gadget/function/uvc_v4l2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0c00ec409d7b2bce3fcac73188b79a141db7cfda",
"status": "affected",
"version": "1444e0568bc2c70868e7b8da5b46fc2252acc3f5",
"versionType": "git"
},
{
"lessThan": "d92d1532e05b1b31d36d48765e43bf73d793d19f",
"status": "affected",
"version": "4962e5a2f301d24953f17d6748d986e21566abe1",
"versionType": "git"
},
{
"lessThan": "0587de744615628c38e33ddc1601160a5ea8c50a",
"status": "affected",
"version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235",
"versionType": "git"
},
{
"lessThan": "c78e463ee134b4669579d453c81ae00795e4c19a",
"status": "affected",
"version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235",
"versionType": "git"
},
{
"lessThan": "8a1128d604c360eca135f15b882b70256a522145",
"status": "affected",
"version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235",
"versionType": "git"
},
{
"lessThan": "1aa9356881ee4ed414bf72d0c56d915492cb5345",
"status": "affected",
"version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235",
"versionType": "git"
},
{
"lessThan": "c038ba56b92e410d1caec22b2dc68780a0b42091",
"status": "affected",
"version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235",
"versionType": "git"
},
{
"lessThan": "eba2936bbe6b752a31725a9eb5c674ecbf21ee7d",
"status": "affected",
"version": "b81ac4395bbeaf36e078dea1a48c02dd97b76235",
"versionType": "git"
},
{
"status": "affected",
"version": "e10735ce87502b07e171727e574afdd6c0890a08",
"versionType": "git"
},
{
"lessThan": "5.10.253",
"status": "affected",
"version": "5.10.117",
"versionType": "semver"
},
{
"lessThan": "5.15.203",
"status": "affected",
"version": "5.15.41",
"versionType": "semver"
},
{
"lessThan": "5.18",
"status": "affected",
"version": "5.17.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_uvc.c",
"drivers/usb/gadget/function/uvc.h",
"drivers/usb/gadget/function/uvc_v4l2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.10.117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.15.41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.17.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: uvc: fix NULL pointer dereference during unbind race\n\nCommit b81ac4395bbe (\"usb: gadget: uvc: allow for application to cleanly\nshutdown\") introduced two stages of synchronization waits totaling 1500ms\nin uvc_function_unbind() to prevent several types of kernel panics.\nHowever, this timing-based approach is insufficient during power\nmanagement (PM) transitions.\n\nWhen the PM subsystem starts freezing user space processes, the\nwait_event_interruptible_timeout() is aborted early, which allows the\nunbind thread to proceed and nullify the gadget pointer\n(cdev-\u003egadget = NULL):\n\n[ 814.123447][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind()\n[ 814.178583][ T3173] PM: suspend entry (deep)\n[ 814.192487][ T3173] Freezing user space processes\n[ 814.197668][ T947] configfs-gadget.g1 gadget.0: uvc: uvc_function_unbind no clean disconnect, wait for release\n\nWhen the PM subsystem resumes or aborts the suspend and tasks are\nrestarted, the V4L2 release path is executed and attempts to access the\nalready nullified gadget pointer, triggering a kernel panic:\n\n[ 814.292597][ C0] PM: pm_system_irq_wakeup: 479 triggered dhdpcie_host_wake\n[ 814.386727][ T3173] Restarting tasks ...\n[ 814.403522][ T4558] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000030\n[ 814.404021][ T4558] pc : usb_gadget_deactivate+0x14/0xf4\n[ 814.404031][ T4558] lr : usb_function_deactivate+0x54/0x94\n[ 814.404078][ T4558] Call trace:\n[ 814.404080][ T4558] usb_gadget_deactivate+0x14/0xf4\n[ 814.404083][ T4558] usb_function_deactivate+0x54/0x94\n[ 814.404087][ T4558] uvc_function_disconnect+0x1c/0x5c\n[ 814.404092][ T4558] uvc_v4l2_release+0x44/0xac\n[ 814.404095][ T4558] v4l2_release+0xcc/0x130\n\nAddress the race condition and NULL pointer dereference by:\n\n1. State Synchronization (flag + mutex)\nIntroduce a \u0027func_unbound\u0027 flag in struct uvc_device. This allows\nuvc_function_disconnect() to safely skip accessing the nullified\ncdev-\u003egadget pointer. As suggested by Alan Stern, this flag is protected\nby a new mutex (uvc-\u003elock) to ensure proper memory ordering and prevent\ninstruction reordering or speculative loads. This mutex is also used to\nprotect \u0027func_connected\u0027 for consistent state management.\n\n2. Explicit Synchronization (completion)\nUse a completion to synchronize uvc_function_unbind() with the\nuvc_vdev_release() callback. This prevents Use-After-Free (UAF) by\nensuring struct uvc_device is freed after all video device resources\nare released."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:05:51.035Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c00ec409d7b2bce3fcac73188b79a141db7cfda"
},
{
"url": "https://git.kernel.org/stable/c/d92d1532e05b1b31d36d48765e43bf73d793d19f"
},
{
"url": "https://git.kernel.org/stable/c/0587de744615628c38e33ddc1601160a5ea8c50a"
},
{
"url": "https://git.kernel.org/stable/c/c78e463ee134b4669579d453c81ae00795e4c19a"
},
{
"url": "https://git.kernel.org/stable/c/8a1128d604c360eca135f15b882b70256a522145"
},
{
"url": "https://git.kernel.org/stable/c/1aa9356881ee4ed414bf72d0c56d915492cb5345"
},
{
"url": "https://git.kernel.org/stable/c/c038ba56b92e410d1caec22b2dc68780a0b42091"
},
{
"url": "https://git.kernel.org/stable/c/eba2936bbe6b752a31725a9eb5c674ecbf21ee7d"
}
],
"title": "usb: gadget: uvc: fix NULL pointer dereference during unbind race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31726",
"datePublished": "2026-05-01T14:14:26.882Z",
"dateReserved": "2026-03-09T15:48:24.134Z",
"dateUpdated": "2026-05-23T16:05:51.035Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43025 (GCVE-0-2026-43025)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ctnetlink: ignore explicit helper on new expectations
Use the existing master conntrack helper, anything else is not really
supported and it just makes validation more complicated, so just ignore
what helper userspace suggests for this expectation.
This was uncovered when validating CTA_EXPECT_CLASS via different helper
provided by userspace than the existing master conntrack helper:
BUG: KASAN: slab-out-of-bounds in nf_ct_expect_related_report+0x2479/0x27c0
Read of size 4 at addr ffff8880043fe408 by task poc/102
Call Trace:
nf_ct_expect_related_report+0x2479/0x27c0
ctnetlink_create_expect+0x22b/0x3b0
ctnetlink_new_expect+0x4bd/0x5c0
nfnetlink_rcv_msg+0x67a/0x950
netlink_rcv_skb+0x120/0x350
Allowing to read kernel memory bytes off the expectation boundary.
CTA_EXPECT_HELP_NAME is still used to offer the helper name to userspace
via netlink dump.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bd0779370588386e4a67ba5d0b176cfded8e6a53 Version: bd0779370588386e4a67ba5d0b176cfded8e6a53 Version: bd0779370588386e4a67ba5d0b176cfded8e6a53 Version: bd0779370588386e4a67ba5d0b176cfded8e6a53 Version: bd0779370588386e4a67ba5d0b176cfded8e6a53 Version: bd0779370588386e4a67ba5d0b176cfded8e6a53 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:49:00.048Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e135f8e8212cbed12a03ab8dec77fa1247139897",
"status": "affected",
"version": "bd0779370588386e4a67ba5d0b176cfded8e6a53",
"versionType": "git"
},
{
"lessThan": "2ea0f35f235f70c133ad61fe05ba013753b978c6",
"status": "affected",
"version": "bd0779370588386e4a67ba5d0b176cfded8e6a53",
"versionType": "git"
},
{
"lessThan": "0f6c33697ccfac6499d0b7a4dbdec5d3a3a566cd",
"status": "affected",
"version": "bd0779370588386e4a67ba5d0b176cfded8e6a53",
"versionType": "git"
},
{
"lessThan": "187b6ec5229ea93cb04c4f6d3b52efc80f513d0d",
"status": "affected",
"version": "bd0779370588386e4a67ba5d0b176cfded8e6a53",
"versionType": "git"
},
{
"lessThan": "21a04c31db4057deec85fcd6cc63d720b38819c3",
"status": "affected",
"version": "bd0779370588386e4a67ba5d0b176cfded8e6a53",
"versionType": "git"
},
{
"lessThan": "917b61fa2042f11e2af4c428e43f08199586633a",
"status": "affected",
"version": "bd0779370588386e4a67ba5d0b176cfded8e6a53",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.12"
},
{
"lessThan": "3.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: ignore explicit helper on new expectations\n\nUse the existing master conntrack helper, anything else is not really\nsupported and it just makes validation more complicated, so just ignore\nwhat helper userspace suggests for this expectation.\n\nThis was uncovered when validating CTA_EXPECT_CLASS via different helper\nprovided by userspace than the existing master conntrack helper:\n\n BUG: KASAN: slab-out-of-bounds in nf_ct_expect_related_report+0x2479/0x27c0\n Read of size 4 at addr ffff8880043fe408 by task poc/102\n Call Trace:\n nf_ct_expect_related_report+0x2479/0x27c0\n ctnetlink_create_expect+0x22b/0x3b0\n ctnetlink_new_expect+0x4bd/0x5c0\n nfnetlink_rcv_msg+0x67a/0x950\n netlink_rcv_skb+0x120/0x350\n\nAllowing to read kernel memory bytes off the expectation boundary.\n\nCTA_EXPECT_HELP_NAME is still used to offer the helper name to userspace\nvia netlink dump."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached by a local userspace netlink request to NETLINK_NETFILTER, specifically CT expectation creation or NFQUEUE verdict attachment. It is not directly reachable from remote network packets without a local netlink actor.\nAC:L - There is no race or victim-dependent condition; the attacker controls the netlink attributes, master conntrack, helper selection, and expectation class. On an affected configuration with conntrack helpers available, triggering the out-of-bounds read is deterministic.\nPR:L - nfnetlink requires CAP_NET_ADMIN via netlink_net_capable(), but that capability is attainable by an unprivileged user in a new user/network namespace on systems that allow user namespaces. Therefore this is low privilege rather than real init-namespace administrator privilege.\nUI:N - No victim action is required after the attacker has local execution and can send the crafted netlink messages. The trigger is entirely attacker driven.\nS:U - The bug affects kernel netfilter/conntrack state within the same kernel security authority. It does not cross a VM, IOMMU, or other separate security scope boundary.\nC:H - The helper mismatch lets CTA_EXPECT_CLASS be validated against one helper while nf_ct_expect_related_report indexes the master helper\u0027s expect_policy with that class, causing slab out-of-bounds reads of kernel memory adjacent to the policy array. Following the higher-severity rule for out-of-bounds reads, this is treated as high confidentiality impact.\nI:L - No direct arbitrary write or control-flow hijack primitive was evident, but the invalid expectation class can still be inserted and affect conntrack expectation accounting and timer behavior outside the intended helper policy. This supports limited integrity impact.\nA:H - The reported failure is a KASAN slab-out-of-bounds BUG in nf_ct_expect_related_report, and the crafted request can be issued repeatedly. A kernel oops/panic or reliable local denial of service is therefore a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:20.705Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e135f8e8212cbed12a03ab8dec77fa1247139897"
},
{
"url": "https://git.kernel.org/stable/c/2ea0f35f235f70c133ad61fe05ba013753b978c6"
},
{
"url": "https://git.kernel.org/stable/c/0f6c33697ccfac6499d0b7a4dbdec5d3a3a566cd"
},
{
"url": "https://git.kernel.org/stable/c/187b6ec5229ea93cb04c4f6d3b52efc80f513d0d"
},
{
"url": "https://git.kernel.org/stable/c/21a04c31db4057deec85fcd6cc63d720b38819c3"
},
{
"url": "https://git.kernel.org/stable/c/917b61fa2042f11e2af4c428e43f08199586633a"
}
],
"title": "netfilter: ctnetlink: ignore explicit helper on new expectations",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43025",
"datePublished": "2026-05-01T14:15:27.103Z",
"dateReserved": "2026-05-01T14:12:55.976Z",
"dateUpdated": "2026-08-05T12:25:20.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43255 (GCVE-0-2026-43255)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: libertas: fix WARNING in usb_tx_block
The function usb_tx_block() submits cardp->tx_urb without ensuring that
any previous transmission on this URB has completed. If a second call
occurs while the URB is still active (e.g. during rapid firmware loading),
usb_submit_urb() detects the active state and triggers a warning:
'URB submitted while active'.
Fix this by enforcing serialization: call usb_kill_urb() before
submitting the new request. This ensures the URB is idle and safe to reuse.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 876c9d3aeb989cf1961f2c228d309ba5dcfb1172 Version: 876c9d3aeb989cf1961f2c228d309ba5dcfb1172 Version: 876c9d3aeb989cf1961f2c228d309ba5dcfb1172 Version: 876c9d3aeb989cf1961f2c228d309ba5dcfb1172 Version: 876c9d3aeb989cf1961f2c228d309ba5dcfb1172 Version: 876c9d3aeb989cf1961f2c228d309ba5dcfb1172 Version: 876c9d3aeb989cf1961f2c228d309ba5dcfb1172 Version: 876c9d3aeb989cf1961f2c228d309ba5dcfb1172 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/libertas/if_usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "498525d8358d6d20918787e59736d5b6a021e9fd",
"status": "affected",
"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172",
"versionType": "git"
},
{
"lessThan": "2902a9b4415a6bafc9b1e5dd360f065d757a0bb7",
"status": "affected",
"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172",
"versionType": "git"
},
{
"lessThan": "948a39c95d0f8d73722910f8cdb7b6e3e9206232",
"status": "affected",
"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172",
"versionType": "git"
},
{
"lessThan": "5bfb25495e391a1be0db94b15715174fa06b93a1",
"status": "affected",
"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172",
"versionType": "git"
},
{
"lessThan": "b82073564373e68c6ae3a96039fae14cd002a496",
"status": "affected",
"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172",
"versionType": "git"
},
{
"lessThan": "3308c7504e093b22e91a4468470309cee2e26b83",
"status": "affected",
"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172",
"versionType": "git"
},
{
"lessThan": "fc188b44547dea4e7350833171982a6312befde9",
"status": "affected",
"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172",
"versionType": "git"
},
{
"lessThan": "d66676e6ca96bf8680f869a9bd6573b26c634622",
"status": "affected",
"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/marvell/libertas/if_usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.22"
},
{
"lessThan": "2.6.22",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: fix WARNING in usb_tx_block\n\nThe function usb_tx_block() submits cardp-\u003etx_urb without ensuring that\nany previous transmission on this URB has completed. If a second call\noccurs while the URB is still active (e.g. during rapid firmware loading),\nusb_submit_urb() detects the active state and triggers a warning:\n\u0027URB submitted while active\u0027.\n\nFix this by enforcing serialization: call usb_kill_urb() before\nsubmitting the new request. This ensures the URB is idle and safe to reuse."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:21:00.707Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/498525d8358d6d20918787e59736d5b6a021e9fd"
},
{
"url": "https://git.kernel.org/stable/c/2902a9b4415a6bafc9b1e5dd360f065d757a0bb7"
},
{
"url": "https://git.kernel.org/stable/c/948a39c95d0f8d73722910f8cdb7b6e3e9206232"
},
{
"url": "https://git.kernel.org/stable/c/5bfb25495e391a1be0db94b15715174fa06b93a1"
},
{
"url": "https://git.kernel.org/stable/c/b82073564373e68c6ae3a96039fae14cd002a496"
},
{
"url": "https://git.kernel.org/stable/c/3308c7504e093b22e91a4468470309cee2e26b83"
},
{
"url": "https://git.kernel.org/stable/c/fc188b44547dea4e7350833171982a6312befde9"
},
{
"url": "https://git.kernel.org/stable/c/d66676e6ca96bf8680f869a9bd6573b26c634622"
}
],
"title": "wifi: libertas: fix WARNING in usb_tx_block",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43255",
"datePublished": "2026-05-06T11:28:44.522Z",
"dateReserved": "2026-05-01T14:12:55.996Z",
"dateUpdated": "2026-05-11T22:21:00.707Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43502 (GCVE-0-2026-43502)
Vulnerability from cvelistv5
Published
2026-05-21 12:17
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/rds: handle zerocopy send cleanup before the message is queued
A zerocopy send can fail after user pages have been pinned but before
the message is attached to the sending socket.
The purge path currently infers zerocopy state from rm->m_rs, so an
unqueued message can be cleaned up as if it owned normal payload pages.
However, zerocopy ownership is really determined by the presence of
op_mmp_znotifier, regardless of whether the message has reached the
socket queue.
Capture op_mmp_znotifier up front in rds_message_purge() and use it as
the cleanup discriminator. If the message is already associated with a
socket, keep the existing completion path. Otherwise, drop the pinned
page accounting directly and release the notifier before putting the
payload pages.
This keeps early send failure cleanup consistent with the zerocopy
lifetime rules without changing the normal queued completion path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/message.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e9aefdc5c53fe9aed108c14e3d155710a1bb14c9",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "46662f7dc59475995609bf3e9d27eb36f4acf26f",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "1e262db7675e27f42c3f3f47d6011855f4454f24",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "21d70744e6d3bbf9293aa1ee6fba7c53ad75275e",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "3abc8983b2bae3f487f77d9da5527d7d6b210d46",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "14ef6fd18db2494098b21e0471bf27a1d8e9993e",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "44b550d88b267320459d518c0743a241ab2108fa",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/message.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: handle zerocopy send cleanup before the message is queued\n\nA zerocopy send can fail after user pages have been pinned but before\nthe message is attached to the sending socket.\n\nThe purge path currently infers zerocopy state from rm-\u003em_rs, so an\nunqueued message can be cleaned up as if it owned normal payload pages.\nHowever, zerocopy ownership is really determined by the presence of\nop_mmp_znotifier, regardless of whether the message has reached the\nsocket queue.\n\nCapture op_mmp_znotifier up front in rds_message_purge() and use it as\nthe cleanup discriminator. If the message is already associated with a\nsocket, keep the existing completion path. Otherwise, drop the pinned\npage accounting directly and release the notifier before putting the\npayload pages.\n\nThis keeps early send failure cleanup consistent with the zerocopy\nlifetime rules without changing the normal queued completion path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is triggered by a local sendmsg(MSG_ZEROCOPY) syscall on an AF_RDS socket; the buggy cleanup decision depends only on local send-side failure conditions, not on any data received from a remote peer.\nAC:L - The attacker fully and deterministically controls the pre-queue failure (e.g., nonblocking socket with a full send buffer, or an invalid RDMA/atomic cmsg), so no race or uncontrolled condition is involved.\nPR:L - Creating an AF_RDS SOCK_SEQPACKET socket and enabling SO_ZEROCOPY require no capabilities (rds_create has no privilege check), so any unprivileged local user can reach the code.\nUI:N - The attacker triggers the entire flow through its own syscall; no action by another user is required.\nS:U - The memory corruption stays within the kernel\u0027s own security authority and does not cross into another security scope such as a VM or IOMMU boundary.\nC:H - Releasing GUP-pinned user pages through the wrong path (and underflowing compound-page refcounts) can free/reuse pages still owned by user space, enabling disclosure of memory contents after reuse.\nI:H - The struct-page refcount underflow and improper page free constitute memory corruption that can be leveraged into a page use-after-free/write primitive, not merely a clean crash.\nA:H - The corrupted page accounting/refcounting and improper buddy-allocator free can cause VM_BUG_ON, oops, or kernel panic, in addition to leaking pinned-page accounting and the notifier struct."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:25.250Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e9aefdc5c53fe9aed108c14e3d155710a1bb14c9"
},
{
"url": "https://git.kernel.org/stable/c/46662f7dc59475995609bf3e9d27eb36f4acf26f"
},
{
"url": "https://git.kernel.org/stable/c/1e262db7675e27f42c3f3f47d6011855f4454f24"
},
{
"url": "https://git.kernel.org/stable/c/21d70744e6d3bbf9293aa1ee6fba7c53ad75275e"
},
{
"url": "https://git.kernel.org/stable/c/3abc8983b2bae3f487f77d9da5527d7d6b210d46"
},
{
"url": "https://git.kernel.org/stable/c/14ef6fd18db2494098b21e0471bf27a1d8e9993e"
},
{
"url": "https://git.kernel.org/stable/c/0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b"
},
{
"url": "https://git.kernel.org/stable/c/44b550d88b267320459d518c0743a241ab2108fa"
}
],
"title": "net/rds: handle zerocopy send cleanup before the message is queued",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43502",
"datePublished": "2026-05-21T12:17:50.444Z",
"dateReserved": "2026-05-01T14:12:56.014Z",
"dateUpdated": "2026-08-05T12:28:25.250Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52975 (GCVE-0-2026-52975)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bonding: 3ad: implement proper RCU rules for port->aggregator
syzbot found a data-race in bond_3ad_get_active_agg_info /
bond_3ad_state_machine_handler [1] which hints at lack of proper
RCU implementation.
Add __rcu qualifier to port->aggregator, and add proper RCU API.
[1]
BUG: KCSAN: data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler
write to 0xffff88813cf5c4b0 of 8 bytes by task 36 on cpu 0:
ad_port_selection_logic drivers/net/bonding/bond_3ad.c:1659 [inline]
bond_3ad_state_machine_handler+0x9d5/0x2d60 drivers/net/bonding/bond_3ad.c:2569
process_one_work kernel/workqueue.c:3302 [inline]
process_scheduled_works+0x4f0/0x9c0 kernel/workqueue.c:3385
worker_thread+0x58a/0x780 kernel/workqueue.c:3466
kthread+0x22a/0x280 kernel/kthread.c:436
ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
read to 0xffff88813cf5c4b0 of 8 bytes by task 22063 on cpu 1:
__bond_3ad_get_active_agg_info drivers/net/bonding/bond_3ad.c:2858 [inline]
bond_3ad_get_active_agg_info+0x8c/0x230 drivers/net/bonding/bond_3ad.c:2881
bond_fill_info+0xe0f/0x10f0 drivers/net/bonding/bond_netlink.c:853
rtnl_link_info_fill net/core/rtnetlink.c:906 [inline]
rtnl_link_fill+0x1d7/0x4e0 net/core/rtnetlink.c:927
rtnl_fill_ifinfo+0xf8e/0x1380 net/core/rtnetlink.c:2168
rtmsg_ifinfo_build_skb+0x11c/0x1b0 net/core/rtnetlink.c:4453
rtmsg_ifinfo_event net/core/rtnetlink.c:4486 [inline]
rtmsg_ifinfo+0x6d/0x110 net/core/rtnetlink.c:4495
__dev_notify_flags+0x76/0x390 net/core/dev.c:9790
netif_change_flags+0xac/0xd0 net/core/dev.c:9823
do_setlink+0x905/0x2950 net/core/rtnetlink.c:3180
rtnl_group_changelink net/core/rtnetlink.c:3813 [inline]
__rtnl_newlink net/core/rtnetlink.c:3981 [inline]
rtnl_newlink+0xf55/0x1400 net/core/rtnetlink.c:4109
rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:6995
netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2550
rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7022
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x5a8/0x680 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x5c8/0x6f0 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:787 [inline]
__sock_sendmsg net/socket.c:802 [inline]
____sys_sendmsg+0x563/0x5b0 net/socket.c:2698
___sys_sendmsg+0x195/0x1e0 net/socket.c:2752
__sys_sendmsg net/socket.c:2784 [inline]
__do_sys_sendmsg net/socket.c:2789 [inline]
__se_sys_sendmsg net/socket.c:2787 [inline]
__x64_sys_sendmsg+0xd4/0x160 net/socket.c:2787
x64_sys_call+0x194c/0x3020 arch/x86/include/generated/asm/syscalls_64.h:47
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
value changed: 0x0000000000000000 -> 0xffff88813cf5c400
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 22063 Comm: syz.0.31122 Tainted: G W syzkaller #0 PREEMPT(full)
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 Version: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 Version: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 Version: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 Version: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 Version: 47e91f56008b43e1365e8d1d4a6813fe8a33b6f6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_3ad.c",
"drivers/net/bonding/bond_main.c",
"drivers/net/bonding/bond_netlink.c",
"drivers/net/bonding/bond_procfs.c",
"drivers/net/bonding/bond_sysfs_slave.c",
"include/net/bond_3ad.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ba2272be04f0cb1e74e1e355ff32ef95df280731",
"status": "affected",
"version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
"versionType": "git"
},
{
"lessThan": "3b7265b3a82f40d2357c4004b26eb794a095b186",
"status": "affected",
"version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
"versionType": "git"
},
{
"lessThan": "5fb9ea4e8ebf514d92df2b6c9d0db25ba02ac735",
"status": "affected",
"version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
"versionType": "git"
},
{
"lessThan": "c169c5837525ad842df6a542facf52b6f866a519",
"status": "affected",
"version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
"versionType": "git"
},
{
"lessThan": "78f409fd34fe9de2b24ad8e9dca1b4608a48ed3d",
"status": "affected",
"version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
"versionType": "git"
},
{
"lessThan": "c4f050ce06c56cfb5993268af4a5cb66ed1cd04e",
"status": "affected",
"version": "47e91f56008b43e1365e8d1d4a6813fe8a33b6f6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_3ad.c",
"drivers/net/bonding/bond_main.c",
"drivers/net/bonding/bond_netlink.c",
"drivers/net/bonding/bond_procfs.c",
"drivers/net/bonding/bond_sysfs_slave.c",
"include/net/bond_3ad.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: 3ad: implement proper RCU rules for port-\u003eaggregator\n\nsyzbot found a data-race in bond_3ad_get_active_agg_info /\nbond_3ad_state_machine_handler [1] which hints at lack of proper\nRCU implementation.\n\nAdd __rcu qualifier to port-\u003eaggregator, and add proper RCU API.\n\n[1]\n\nBUG: KCSAN: data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler\n\nwrite to 0xffff88813cf5c4b0 of 8 bytes by task 36 on cpu 0:\n ad_port_selection_logic drivers/net/bonding/bond_3ad.c:1659 [inline]\n bond_3ad_state_machine_handler+0x9d5/0x2d60 drivers/net/bonding/bond_3ad.c:2569\n process_one_work kernel/workqueue.c:3302 [inline]\n process_scheduled_works+0x4f0/0x9c0 kernel/workqueue.c:3385\n worker_thread+0x58a/0x780 kernel/workqueue.c:3466\n kthread+0x22a/0x280 kernel/kthread.c:436\n ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n\nread to 0xffff88813cf5c4b0 of 8 bytes by task 22063 on cpu 1:\n __bond_3ad_get_active_agg_info drivers/net/bonding/bond_3ad.c:2858 [inline]\n bond_3ad_get_active_agg_info+0x8c/0x230 drivers/net/bonding/bond_3ad.c:2881\n bond_fill_info+0xe0f/0x10f0 drivers/net/bonding/bond_netlink.c:853\n rtnl_link_info_fill net/core/rtnetlink.c:906 [inline]\n rtnl_link_fill+0x1d7/0x4e0 net/core/rtnetlink.c:927\n rtnl_fill_ifinfo+0xf8e/0x1380 net/core/rtnetlink.c:2168\n rtmsg_ifinfo_build_skb+0x11c/0x1b0 net/core/rtnetlink.c:4453\n rtmsg_ifinfo_event net/core/rtnetlink.c:4486 [inline]\n rtmsg_ifinfo+0x6d/0x110 net/core/rtnetlink.c:4495\n __dev_notify_flags+0x76/0x390 net/core/dev.c:9790\n netif_change_flags+0xac/0xd0 net/core/dev.c:9823\n do_setlink+0x905/0x2950 net/core/rtnetlink.c:3180\n rtnl_group_changelink net/core/rtnetlink.c:3813 [inline]\n __rtnl_newlink net/core/rtnetlink.c:3981 [inline]\n rtnl_newlink+0xf55/0x1400 net/core/rtnetlink.c:4109\n rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:6995\n netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2550\n rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7022\n netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n netlink_unicast+0x5a8/0x680 net/netlink/af_netlink.c:1344\n netlink_sendmsg+0x5c8/0x6f0 net/netlink/af_netlink.c:1894\n sock_sendmsg_nosec net/socket.c:787 [inline]\n __sock_sendmsg net/socket.c:802 [inline]\n ____sys_sendmsg+0x563/0x5b0 net/socket.c:2698\n ___sys_sendmsg+0x195/0x1e0 net/socket.c:2752\n __sys_sendmsg net/socket.c:2784 [inline]\n __do_sys_sendmsg net/socket.c:2789 [inline]\n __se_sys_sendmsg net/socket.c:2787 [inline]\n __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2787\n x64_sys_call+0x194c/0x3020 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x0000000000000000 -\u003e 0xffff88813cf5c400\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 1 UID: 0 PID: 22063 Comm: syz.0.31122 Tainted: G W syzkaller #0 PREEMPT(full)\nTainted: [W]=WARN\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable paths are local bonding control/information paths such as rtnetlink, sysfs, and procfs racing with the 802.3ad workqueue. A remote packet alone is not sufficient for the complete race; a local attacker can exercise the reader and drive bond state changes.\nAC:L - A local attacker can create/configure an 802.3ad bond in a user/network namespace and repeatedly issue concurrent link queries while the bond workqueue updates port-\u003eaggregator. The race is attacker-influenced and does not depend on rare conditions outside the attacker\u0027s control.\nPR:L - Bond creation and many control operations require CAP_NET_ADMIN, but that is reachable by an unprivileged user inside a user namespace. RTM_GETLINK-style readers are even less restricted, but exploitation still assumes a local unprivileged user context.\nUI:N - No victim action is required once the attacker can run local commands or netlink requests. The attacker can trigger the relevant reader and writer activity directly.\nS:U - The impact remains within the kernel and the host networking subsystem security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is an RCU lifetime violation on port-\u003eaggregator, which points into per-slave ad_slave_info memory that can be cleared, freed, or reused. Treating the stale-pointer/UAF condition conservatively, it can expose kernel memory through groomed object reuse.\nI:H - A stale kernel pointer/UAF in attacker-controllable bonding state is a memory-safety issue that can plausibly be heap-groomed beyond a simple crash. Under the required overestimation rule, this supports high integrity impact.\nA:H - At minimum, racing dereferences of port-\u003eaggregator can lead to invalid pointer dereferences, inconsistent list traversal, oops, or panic. The vulnerability is therefore capable of causing a kernel-level denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:17.100Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ba2272be04f0cb1e74e1e355ff32ef95df280731"
},
{
"url": "https://git.kernel.org/stable/c/3b7265b3a82f40d2357c4004b26eb794a095b186"
},
{
"url": "https://git.kernel.org/stable/c/5fb9ea4e8ebf514d92df2b6c9d0db25ba02ac735"
},
{
"url": "https://git.kernel.org/stable/c/c169c5837525ad842df6a542facf52b6f866a519"
},
{
"url": "https://git.kernel.org/stable/c/78f409fd34fe9de2b24ad8e9dca1b4608a48ed3d"
},
{
"url": "https://git.kernel.org/stable/c/c4f050ce06c56cfb5993268af4a5cb66ed1cd04e"
}
],
"title": "bonding: 3ad: implement proper RCU rules for port-\u003eaggregator",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52975",
"datePublished": "2026-06-24T16:28:52.514Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-08-05T12:32:17.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46219 (GCVE-0-2026-46219)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-06-14 18:03
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
spi: mpc52xx: fix use-after-free on unbind
The state machine work is scheduled by the interrupt handler and
therefore needs to be cancelled after disabling interrupts to avoid a
potential use-after-free.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e0c6ce8424095c2da32a063d3fc027494c689817 Version: cd5106c77d6d6828aa82449f01f4eb436d602a21 Version: 373d55a47dc662e5e30d12ad5d334312f757c1f1 Version: f65d85bc1ffd8a2c194bb2cd65e35ed3648ddd59 Version: 90b72189de2cddacb26250579da0510b29a8b82b Version: 984836621aad98802d92c4a3047114cf518074c8 Version: 984836621aad98802d92c4a3047114cf518074c8 Version: 984836621aad98802d92c4a3047114cf518074c8 Version: d0cde3911cf24e1bcdd4caa1d1b9ef57589db5a1 Version: 5.10.231 ≤ Version: 5.15.174 ≤ Version: 6.1.120 ≤ Version: 6.6.66 ≤ Version: 6.12.5 ≤ Version: 5.4.287 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-mpc52xx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ac8316c896c79f32c1d0a38cb41fd2b14cf8112e",
"status": "affected",
"version": "e0c6ce8424095c2da32a063d3fc027494c689817",
"versionType": "git"
},
{
"lessThan": "ed929d40963073f23cfb50219ccbcc6e0c3ea641",
"status": "affected",
"version": "cd5106c77d6d6828aa82449f01f4eb436d602a21",
"versionType": "git"
},
{
"lessThan": "0944b20e9dfa2917bd70eb5b301cbb67fe54a718",
"status": "affected",
"version": "373d55a47dc662e5e30d12ad5d334312f757c1f1",
"versionType": "git"
},
{
"lessThan": "bb6b50f709c5a01906ff72a07fdc070bb3357188",
"status": "affected",
"version": "f65d85bc1ffd8a2c194bb2cd65e35ed3648ddd59",
"versionType": "git"
},
{
"lessThan": "ee52da0dd83ebcd89ecbbe2660c57b15a25489f2",
"status": "affected",
"version": "90b72189de2cddacb26250579da0510b29a8b82b",
"versionType": "git"
},
{
"lessThan": "6c3e413919a12627d04a31a4a5fccb9fc129bb02",
"status": "affected",
"version": "984836621aad98802d92c4a3047114cf518074c8",
"versionType": "git"
},
{
"lessThan": "bbcd6dd8e9f264440eaf6167382bf404911c1c46",
"status": "affected",
"version": "984836621aad98802d92c4a3047114cf518074c8",
"versionType": "git"
},
{
"lessThan": "706b3dc2ac7a998c55e14b3fd2e8f934c367e6e0",
"status": "affected",
"version": "984836621aad98802d92c4a3047114cf518074c8",
"versionType": "git"
},
{
"status": "affected",
"version": "d0cde3911cf24e1bcdd4caa1d1b9ef57589db5a1",
"versionType": "git"
},
{
"lessThan": "5.10.258",
"status": "affected",
"version": "5.10.231",
"versionType": "semver"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThan": "6.6.140",
"status": "affected",
"version": "6.6.66",
"versionType": "semver"
},
{
"lessThan": "6.12.90",
"status": "affected",
"version": "6.12.5",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.287",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-mpc52xx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10.231",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.174",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.6.66",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "6.12.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.287",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: mpc52xx: fix use-after-free on unbind\n\nThe state machine work is scheduled by the interrupt handler and\ntherefore needs to be cancelled after disabling interrupts to avoid a\npotential use-after-free."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:03:33.018Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ac8316c896c79f32c1d0a38cb41fd2b14cf8112e"
},
{
"url": "https://git.kernel.org/stable/c/ed929d40963073f23cfb50219ccbcc6e0c3ea641"
},
{
"url": "https://git.kernel.org/stable/c/0944b20e9dfa2917bd70eb5b301cbb67fe54a718"
},
{
"url": "https://git.kernel.org/stable/c/bb6b50f709c5a01906ff72a07fdc070bb3357188"
},
{
"url": "https://git.kernel.org/stable/c/ee52da0dd83ebcd89ecbbe2660c57b15a25489f2"
},
{
"url": "https://git.kernel.org/stable/c/6c3e413919a12627d04a31a4a5fccb9fc129bb02"
},
{
"url": "https://git.kernel.org/stable/c/bbcd6dd8e9f264440eaf6167382bf404911c1c46"
},
{
"url": "https://git.kernel.org/stable/c/706b3dc2ac7a998c55e14b3fd2e8f934c367e6e0"
}
],
"title": "spi: mpc52xx: fix use-after-free on unbind",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46219",
"datePublished": "2026-05-28T09:40:35.297Z",
"dateReserved": "2026-05-13T15:03:33.105Z",
"dateUpdated": "2026-06-14T18:03:33.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53058 (GCVE-0-2026-53058)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable()
In case if we get errors in cdns_mhdp_link_up() or cdns_mhdp_reg_read()
in atomic_enable, we will go to cdns_mhdp_modeset_retry_fn() and will hit
NULL pointer while trying to access the mutex. We need the connector to
be set before that. Unlike in legacy cases with flag
!DRM_BRIDGE_ATTACH_NO_CONNECTOR, we do not have connector initialised
in bridge_attach(), so add the mhdp->connector_ptr in device structure
to handle both cases with DRM_BRIDGE_ATTACH_NO_CONNECTOR and
!DRM_BRIDGE_ATTACH_NO_CONNECTOR, set it in atomic_enable() earlier to
avoid possible NULL pointer dereference in recovery paths like
modeset_retry_fn() with the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag set.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c",
"drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.h",
"drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5302015daf26ef6b48e067f2b86c9482ac19e015",
"status": "affected",
"version": "c932ced6b58524eeb948ff252f6512cd6bcb9d9f",
"versionType": "git"
},
{
"lessThan": "a3611554e599d1a24b45fd8415bacb72ce861e4b",
"status": "affected",
"version": "c932ced6b58524eeb948ff252f6512cd6bcb9d9f",
"versionType": "git"
},
{
"lessThan": "cf2ac2cac8b319f89b3a3851ca0c5ffb6a549575",
"status": "affected",
"version": "c932ced6b58524eeb948ff252f6512cd6bcb9d9f",
"versionType": "git"
},
{
"lessThan": "1af3b42e08a957e53bab8e1897393fe0a27d9fbf",
"status": "affected",
"version": "c932ced6b58524eeb948ff252f6512cd6bcb9d9f",
"versionType": "git"
},
{
"lessThan": "43d6508ddbf9fb974fbc359a033154f78c9d4c8b",
"status": "affected",
"version": "c932ced6b58524eeb948ff252f6512cd6bcb9d9f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.c",
"drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-core.h",
"drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable()\n\nIn case if we get errors in cdns_mhdp_link_up() or cdns_mhdp_reg_read()\nin atomic_enable, we will go to cdns_mhdp_modeset_retry_fn() and will hit\nNULL pointer while trying to access the mutex. We need the connector to\nbe set before that. Unlike in legacy cases with flag\n!DRM_BRIDGE_ATTACH_NO_CONNECTOR, we do not have connector initialised\nin bridge_attach(), so add the mhdp-\u003econnector_ptr in device structure\nto handle both cases with DRM_BRIDGE_ATTACH_NO_CONNECTOR and\n!DRM_BRIDGE_ATTACH_NO_CONNECTOR, set it in atomic_enable() earlier to\navoid possible NULL pointer dereference in recovery paths like\nmodeset_retry_fn() with the DRM_BRIDGE_ATTACH_NO_CONNECTOR flag set."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:03.463Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5302015daf26ef6b48e067f2b86c9482ac19e015"
},
{
"url": "https://git.kernel.org/stable/c/a3611554e599d1a24b45fd8415bacb72ce861e4b"
},
{
"url": "https://git.kernel.org/stable/c/cf2ac2cac8b319f89b3a3851ca0c5ffb6a549575"
},
{
"url": "https://git.kernel.org/stable/c/1af3b42e08a957e53bab8e1897393fe0a27d9fbf"
},
{
"url": "https://git.kernel.org/stable/c/43d6508ddbf9fb974fbc359a033154f78c9d4c8b"
}
],
"title": "drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53058",
"datePublished": "2026-06-24T16:30:03.463Z",
"dateReserved": "2026-06-09T07:44:35.381Z",
"dateUpdated": "2026-06-24T16:30:03.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31623 (GCVE-0-2026-31623)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()
A malicious USB device claiming to be a CDC Phonet modem can overflow
the skb_shared_info->frags[] array by sending an unbounded sequence of
full-page bulk transfers.
Drop the skb and increment the length error when the frag limit is
reached. This matches the same fix that commit f0813bcd2d9d ("net:
wwan: t7xx: fix potential skb->frags overflow in RX path") did for the
t7xx driver.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 Version: 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 Version: 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 Version: 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 Version: 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 Version: 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 Version: 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 Version: 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 Version: 87cf65601e1709e57f7e28f0f7b3eb0a992c1782 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/cdc-phonet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6807ff49bf796b3823b1e29f97b69316a40a9a94",
"status": "affected",
"version": "87cf65601e1709e57f7e28f0f7b3eb0a992c1782",
"versionType": "git"
},
{
"lessThan": "0c5c65a17db729fc63ab656bdaaf0e675a9dbeac",
"status": "affected",
"version": "87cf65601e1709e57f7e28f0f7b3eb0a992c1782",
"versionType": "git"
},
{
"lessThan": "6053620fdbcd89fa7e755644efdaab78e0daaae7",
"status": "affected",
"version": "87cf65601e1709e57f7e28f0f7b3eb0a992c1782",
"versionType": "git"
},
{
"lessThan": "d4e1946bea8d6441835eb3fd09b19237ba366a6f",
"status": "affected",
"version": "87cf65601e1709e57f7e28f0f7b3eb0a992c1782",
"versionType": "git"
},
{
"lessThan": "a23b1b1aaf41e174181d5853a70e65d4d01e648c",
"status": "affected",
"version": "87cf65601e1709e57f7e28f0f7b3eb0a992c1782",
"versionType": "git"
},
{
"lessThan": "c183d5775129a0a7495bd61a6e57ec230dcf01e5",
"status": "affected",
"version": "87cf65601e1709e57f7e28f0f7b3eb0a992c1782",
"versionType": "git"
},
{
"lessThan": "ebf75c6301c4972a87542ebf2d994c6391eb5d46",
"status": "affected",
"version": "87cf65601e1709e57f7e28f0f7b3eb0a992c1782",
"versionType": "git"
},
{
"lessThan": "9989938d13cc5ba8447eeed5a61acfcf61bc6801",
"status": "affected",
"version": "87cf65601e1709e57f7e28f0f7b3eb0a992c1782",
"versionType": "git"
},
{
"lessThan": "600dc40554dc5ad1e6f3af51f700228033f43ea7",
"status": "affected",
"version": "87cf65601e1709e57f7e28f0f7b3eb0a992c1782",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/cdc-phonet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()\n\nA malicious USB device claiming to be a CDC Phonet modem can overflow\nthe skb_shared_info-\u003efrags[] array by sending an unbounded sequence of\nfull-page bulk transfers.\n\nDrop the skb and increment the length error when the frag limit is\nreached. This matches the same fix that commit f0813bcd2d9d (\"net:\nwwan: t7xx: fix potential skb-\u003efrags overflow in RX path\") did for the\nt7xx driver."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:43:10.837Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6807ff49bf796b3823b1e29f97b69316a40a9a94"
},
{
"url": "https://git.kernel.org/stable/c/0c5c65a17db729fc63ab656bdaaf0e675a9dbeac"
},
{
"url": "https://git.kernel.org/stable/c/6053620fdbcd89fa7e755644efdaab78e0daaae7"
},
{
"url": "https://git.kernel.org/stable/c/d4e1946bea8d6441835eb3fd09b19237ba366a6f"
},
{
"url": "https://git.kernel.org/stable/c/a23b1b1aaf41e174181d5853a70e65d4d01e648c"
},
{
"url": "https://git.kernel.org/stable/c/c183d5775129a0a7495bd61a6e57ec230dcf01e5"
},
{
"url": "https://git.kernel.org/stable/c/ebf75c6301c4972a87542ebf2d994c6391eb5d46"
},
{
"url": "https://git.kernel.org/stable/c/9989938d13cc5ba8447eeed5a61acfcf61bc6801"
},
{
"url": "https://git.kernel.org/stable/c/600dc40554dc5ad1e6f3af51f700228033f43ea7"
}
],
"title": "net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31623",
"datePublished": "2026-04-24T14:42:40.566Z",
"dateReserved": "2026-03-09T15:48:24.124Z",
"dateUpdated": "2026-06-14T17:43:10.837Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23248 (GCVE-0-2026-23248)
Vulnerability from cvelistv5
Published
2026-03-18 10:05
Modified
2026-08-05 12:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix refcount bug and potential UAF in perf_mmap
Syzkaller reported a refcount_t: addition on 0; use-after-free warning
in perf_mmap.
The issue is caused by a race condition between a failing mmap() setup
and a concurrent mmap() on a dependent event (e.g., using output
redirection).
In perf_mmap(), the ring_buffer (rb) is allocated and assigned to
event->rb with the mmap_mutex held. The mutex is then released to
perform map_range().
If map_range() fails, perf_mmap_close() is called to clean up.
However, since the mutex was dropped, another thread attaching to
this event (via inherited events or output redirection) can acquire
the mutex, observe the valid event->rb pointer, and attempt to
increment its reference count. If the cleanup path has already
dropped the reference count to zero, this results in a
use-after-free or refcount saturation warning.
Fix this by extending the scope of mmap_mutex to cover the
map_range() call. This ensures that the ring buffer initialization
and mapping (or cleanup on failure) happens atomically effectively,
preventing other threads from accessing a half-initialized or
dying ring buffer.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/events/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c27dea9f50ed525facb62ef647dddc4722456e07",
"status": "affected",
"version": "b709eb872e19a19607bbb6d2975bc264d59735cf",
"versionType": "git"
},
{
"lessThan": "ac7ecb65af170a7fc193e7bd8be15dac84ec6a56",
"status": "affected",
"version": "b709eb872e19a19607bbb6d2975bc264d59735cf",
"versionType": "git"
},
{
"lessThan": "77de62ad3de3967818c3dbe656b7336ebee461d2",
"status": "affected",
"version": "b709eb872e19a19607bbb6d2975bc264d59735cf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/events/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix refcount bug and potential UAF in perf_mmap\n\nSyzkaller reported a refcount_t: addition on 0; use-after-free warning\nin perf_mmap.\n\nThe issue is caused by a race condition between a failing mmap() setup\nand a concurrent mmap() on a dependent event (e.g., using output\nredirection).\n\nIn perf_mmap(), the ring_buffer (rb) is allocated and assigned to\nevent-\u003erb with the mmap_mutex held. The mutex is then released to\nperform map_range().\n\nIf map_range() fails, perf_mmap_close() is called to clean up.\nHowever, since the mutex was dropped, another thread attaching to\nthis event (via inherited events or output redirection) can acquire\nthe mutex, observe the valid event-\u003erb pointer, and attempt to\nincrement its reference count. If the cleanup path has already\ndropped the reference count to zero, this results in a\nuse-after-free or refcount saturation warning.\n\nFix this by extending the scope of mmap_mutex to cover the\nmap_range() call. This ensures that the ring buffer initialization\nand mapping (or cleanup on failure) happens atomically effectively,\npreventing other threads from accessing a half-initialized or\ndying ring buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is triggered via the perf_event_open() syscall followed by mmap() on the resulting file descriptor, requiring local system access.\nAC:L - The attacker controls both sides of the race by spawning two threads that concurrently mmap() the same perf event fd. Per CVSS guidance, attacker-controlled races are AC:L.\nPR:L - Unprivileged local users can use perf_event_open() with exclude_kernel=1 and per-task events (cpu=-1) even with the default perf_event_paranoid=2, then mmap() the resulting fd to trigger the race.\nUI:N - No user interaction is needed; the attacker creates the perf event and triggers the race entirely on their own.\nS:U - This is a standard kernel use-after-free for privilege escalation within the same security authority; no VM escape or sandbox boundary crossing occurs.\nC:H - The UAF on the perf_buffer heap object allows the attacker to spray controlled data into the freed slab, enabling arbitrary kernel memory reads through the buffer\u0027s data page pointers and user_page.\nI:H - The freed perf_buffer contains function pointers (free_aux) and is accessed through multiple code paths, enabling heap spraying for arbitrary write primitives and control flow hijacking.\nA:H - The use-after-free reliably causes kernel crashes (refcount saturation warnings, oops, or panic) when the freed ring buffer is accessed."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:20:56.308Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c27dea9f50ed525facb62ef647dddc4722456e07"
},
{
"url": "https://git.kernel.org/stable/c/ac7ecb65af170a7fc193e7bd8be15dac84ec6a56"
},
{
"url": "https://git.kernel.org/stable/c/77de62ad3de3967818c3dbe656b7336ebee461d2"
}
],
"title": "perf/core: Fix refcount bug and potential UAF in perf_mmap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23248",
"datePublished": "2026-03-18T10:05:10.070Z",
"dateReserved": "2026-01-13T15:37:45.989Z",
"dateUpdated": "2026-08-05T12:20:56.308Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53133 (GCVE-0-2026-53133)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/umem: Fix truncation for block sizes >= 4G
When the iommu is used the linearization of the mapping can give a single
block that is very large split across multiple SG entries.
When __rdma_block_iter_next() reassembles the split SG entries it is
overflowing the 32 bit stack values and computed the wrong DMA addresses
for blocks after the truncation.
Use the right types to hold DMA addresses.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a808273a495c657e33281b181fd7fcc2bb28f662 Version: a808273a495c657e33281b181fd7fcc2bb28f662 Version: a808273a495c657e33281b181fd7fcc2bb28f662 Version: a808273a495c657e33281b181fd7fcc2bb28f662 Version: a808273a495c657e33281b181fd7fcc2bb28f662 Version: a808273a495c657e33281b181fd7fcc2bb28f662 Version: a808273a495c657e33281b181fd7fcc2bb28f662 Version: a808273a495c657e33281b181fd7fcc2bb28f662 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/iter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2ff4b7817e5b78070c30f5fb5e678e452a2628b3",
"status": "affected",
"version": "a808273a495c657e33281b181fd7fcc2bb28f662",
"versionType": "git"
},
{
"lessThan": "dee2a49adeeb2a5e16a3fc858fa21b841c519802",
"status": "affected",
"version": "a808273a495c657e33281b181fd7fcc2bb28f662",
"versionType": "git"
},
{
"lessThan": "cc644d5608e3b0dadc970bd6e6aa26b91ea07d0f",
"status": "affected",
"version": "a808273a495c657e33281b181fd7fcc2bb28f662",
"versionType": "git"
},
{
"lessThan": "8fe0231adebe086c8a459c790944ac026cd99c6e",
"status": "affected",
"version": "a808273a495c657e33281b181fd7fcc2bb28f662",
"versionType": "git"
},
{
"lessThan": "baf8685bcf56dc1efb44b8f6a57c42516e549068",
"status": "affected",
"version": "a808273a495c657e33281b181fd7fcc2bb28f662",
"versionType": "git"
},
{
"lessThan": "afd35fec9297195b759078745549c2671223f24f",
"status": "affected",
"version": "a808273a495c657e33281b181fd7fcc2bb28f662",
"versionType": "git"
},
{
"lessThan": "ac1aad8e1281534ce936c250f68084fc79c5469e",
"status": "affected",
"version": "a808273a495c657e33281b181fd7fcc2bb28f662",
"versionType": "git"
},
{
"lessThan": "15fe76e23615f502d051ef0768f86babaf08746c",
"status": "affected",
"version": "a808273a495c657e33281b181fd7fcc2bb28f662",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/iter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umem: Fix truncation for block sizes \u003e= 4G\n\nWhen the iommu is used the linearization of the mapping can give a single\nblock that is very large split across multiple SG entries.\n\nWhen __rdma_block_iter_next() reassembles the split SG entries it is\noverflowing the 32 bit stack values and computed the wrong DMA addresses\nfor blocks after the truncation.\n\nUse the right types to hold DMA addresses."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Vulnerable code is reached through local RDMA uverbs operations such as opening `/dev/infiniband/uverbsX` and issuing memory-registration commands. Remote RDMA traffic may later exercise a bad MR, but the vulnerable iterator is invoked by local userspace registration, not by network packet parsing.\nAC:L - There is no race or probabilistic condition; on an affected RDMA/IOMMU deployment the attacker controls the MR address, length, and access flags needed to request large aligned mappings. Hardware/IOMMU support is an environmental prerequisite for the affected subsystem, not an exploitation step beyond attacker control.\nPR:L - The uverbs device node is created world-accessible and MR registration does not require CAP_SYS_ADMIN or CAP_NET_ADMIN, though the process must be an unprivileged local user able to use the RDMA device and pin memory under its memlock limits. No real init-namespace root privilege is required.\nUI:N - After local access to the RDMA device, the attacker can perform the open/context/PD/MR registration sequence directly. No separate victim action is required.\nS:U - The impact remains within the kernel/RDMA device memory-management security authority. This is not a guest-to-host escape, IOMMU boundary bypass by a guest, or another cross-scope boundary change.\nC:H - The truncation can program wrong DMA addresses into RDMA memory translation tables for blocks after the overflow. With RDMA read-capable access, the resulting mistranslation can expose unintended memory reachable through the device mapping, so the higher defensible confidentiality impact is High.\nI:H - The same wrong DMA translation can be used with local or remote write-capable MR permissions to direct RDMA writes to unintended mapped memory. Because this is device DMA memory corruption rather than a bounded metadata error, the higher defensible integrity impact is High.\nA:H - Incorrect DMA translations can cause IOMMU/device faults, corrupted RDMA state, or repeated failures of registered memory operations. Given the kernel/device-level DMA fault surface and the requirement to choose the higher severity when uncertain, availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:27.415Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2ff4b7817e5b78070c30f5fb5e678e452a2628b3"
},
{
"url": "https://git.kernel.org/stable/c/dee2a49adeeb2a5e16a3fc858fa21b841c519802"
},
{
"url": "https://git.kernel.org/stable/c/cc644d5608e3b0dadc970bd6e6aa26b91ea07d0f"
},
{
"url": "https://git.kernel.org/stable/c/8fe0231adebe086c8a459c790944ac026cd99c6e"
},
{
"url": "https://git.kernel.org/stable/c/baf8685bcf56dc1efb44b8f6a57c42516e549068"
},
{
"url": "https://git.kernel.org/stable/c/afd35fec9297195b759078745549c2671223f24f"
},
{
"url": "https://git.kernel.org/stable/c/ac1aad8e1281534ce936c250f68084fc79c5469e"
},
{
"url": "https://git.kernel.org/stable/c/15fe76e23615f502d051ef0768f86babaf08746c"
}
],
"title": "RDMA/umem: Fix truncation for block sizes \u003e= 4G",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53133",
"datePublished": "2026-06-25T08:38:22.469Z",
"dateReserved": "2026-06-09T07:44:35.386Z",
"dateUpdated": "2026-08-05T12:33:27.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31452 (GCVE-0-2026-31452)
Vulnerability from cvelistv5
Published
2026-04-22 13:53
Modified
2026-07-14 12:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: convert inline data to extents when truncate exceeds inline size
Add a check in ext4_setattr() to convert files from inline data storage
to extent-based storage when truncate() grows the file size beyond the
inline capacity. This prevents the filesystem from entering an
inconsistent state where the inline data flag is set but the file size
exceeds what can be stored inline.
Without this fix, the following sequence causes a kernel BUG_ON():
1. Mount filesystem with inode that has inline flag set and small size
2. truncate(file, 50MB) - grows size but inline flag remains set
3. sendfile() attempts to write data
4. ext4_write_inline_data() hits BUG_ON(write_size > inline_capacity)
The crash occurs because ext4_write_inline_data() expects inline storage
to accommodate the write, but the actual inline capacity (~60 bytes for
i_block + ~96 bytes for xattrs) is far smaller than the file size and
write request.
The fix checks if the new size from setattr exceeds the inode's actual
inline capacity (EXT4_I(inode)->i_inline_size) and converts the file to
extent-based storage before proceeding with the size change.
This addresses the root cause by ensuring the inline data flag and file
size remain consistent during truncate operations.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 67cf5b09a46f72e048501b84996f2f77bc42e947 Version: 67cf5b09a46f72e048501b84996f2f77bc42e947 Version: 67cf5b09a46f72e048501b84996f2f77bc42e947 Version: 67cf5b09a46f72e048501b84996f2f77bc42e947 Version: 67cf5b09a46f72e048501b84996f2f77bc42e947 Version: 67cf5b09a46f72e048501b84996f2f77bc42e947 Version: 67cf5b09a46f72e048501b84996f2f77bc42e947 Version: 67cf5b09a46f72e048501b84996f2f77bc42e947 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:47:57.228Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "110d7ef602659ce4d7947c5480f7ca2779696aaf",
"status": "affected",
"version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
"versionType": "git"
},
{
"lessThan": "f53a5d9f32924bc2a810d2df243b7714da58b636",
"status": "affected",
"version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
"versionType": "git"
},
{
"lessThan": "c047332be7195833a5c5126816c2502df8269fe4",
"status": "affected",
"version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
"versionType": "git"
},
{
"lessThan": "699bac4d4c951974d55b045c983d1de777215949",
"status": "affected",
"version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
"versionType": "git"
},
{
"lessThan": "7920dcc571cef3d8aa9ee109c136125d61d41669",
"status": "affected",
"version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
"versionType": "git"
},
{
"lessThan": "93cb2d103e5c707de0f7ad58a39b7f0fddc27aa6",
"status": "affected",
"version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
"versionType": "git"
},
{
"lessThan": "07c1a31af18290054da3d18221b8bf58983c5d3a",
"status": "affected",
"version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
"versionType": "git"
},
{
"lessThan": "ed9356a30e59c7cc3198e7fc46cfedf3767b9b17",
"status": "affected",
"version": "67cf5b09a46f72e048501b84996f2f77bc42e947",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: convert inline data to extents when truncate exceeds inline size\n\nAdd a check in ext4_setattr() to convert files from inline data storage\nto extent-based storage when truncate() grows the file size beyond the\ninline capacity. This prevents the filesystem from entering an\ninconsistent state where the inline data flag is set but the file size\nexceeds what can be stored inline.\n\nWithout this fix, the following sequence causes a kernel BUG_ON():\n\n1. Mount filesystem with inode that has inline flag set and small size\n2. truncate(file, 50MB) - grows size but inline flag remains set\n3. sendfile() attempts to write data\n4. ext4_write_inline_data() hits BUG_ON(write_size \u003e inline_capacity)\n\nThe crash occurs because ext4_write_inline_data() expects inline storage\nto accommodate the write, but the actual inline capacity (~60 bytes for\ni_block + ~96 bytes for xattrs) is far smaller than the file size and\nwrite request.\n\nThe fix checks if the new size from setattr exceeds the inode\u0027s actual\ninline capacity (EXT4_I(inode)-\u003ei_inline_size) and converts the file to\nextent-based storage before proceeding with the size change.\n\nThis addresses the root cause by ensuring the inline data flag and file\nsize remain consistent during truncate operations."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:08:58.941Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/110d7ef602659ce4d7947c5480f7ca2779696aaf"
},
{
"url": "https://git.kernel.org/stable/c/f53a5d9f32924bc2a810d2df243b7714da58b636"
},
{
"url": "https://git.kernel.org/stable/c/c047332be7195833a5c5126816c2502df8269fe4"
},
{
"url": "https://git.kernel.org/stable/c/699bac4d4c951974d55b045c983d1de777215949"
},
{
"url": "https://git.kernel.org/stable/c/7920dcc571cef3d8aa9ee109c136125d61d41669"
},
{
"url": "https://git.kernel.org/stable/c/93cb2d103e5c707de0f7ad58a39b7f0fddc27aa6"
},
{
"url": "https://git.kernel.org/stable/c/07c1a31af18290054da3d18221b8bf58983c5d3a"
},
{
"url": "https://git.kernel.org/stable/c/ed9356a30e59c7cc3198e7fc46cfedf3767b9b17"
}
],
"title": "ext4: convert inline data to extents when truncate exceeds inline size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31452",
"datePublished": "2026-04-22T13:53:46.917Z",
"dateReserved": "2026-03-09T15:48:24.091Z",
"dateUpdated": "2026-07-14T12:47:57.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43130 (GCVE-0-2026-43130)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-23 16:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode
Commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation
request when device is disconnected") relies on
pci_dev_is_disconnected() to skip ATS invalidation for
safely-removed devices, but it does not cover link-down caused
by faults, which can still hard-lock the system.
For example, if a VM fails to connect to the PCIe device,
"virsh destroy" is executed to release resources and isolate
the fault, but a hard-lockup occurs while releasing the group fd.
Call Trace:
qi_submit_sync
qi_flush_dev_iotlb
intel_pasid_tear_down_entry
device_block_translation
blocking_domain_attach_dev
__iommu_attach_device
__iommu_device_set_domain
__iommu_group_set_domain_internal
iommu_detach_group
vfio_iommu_type1_detach_group
vfio_group_detach_container
vfio_group_fops_release
__fput
Although pci_device_is_present() is slower than
pci_dev_is_disconnected(), it still takes only ~70 µs on a
ConnectX-5 (8 GT/s, x2) and becomes even faster as PCIe speed
and width increase.
Besides, devtlb_invalidation_with_pasid() is called only in the
paths below, which are far less frequent than memory map/unmap.
1. mm-struct release
2. {attach,release}_dev
3. set/remove PASID
4. dirty-tracking setup
The gain in system stability far outweighs the negligible cost
of using pci_device_is_present() instead of pci_dev_is_disconnected()
to decide when to skip ATS invalidation, especially under GDR
high-load conditions.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f873b85ec762c5a6abe94a7ddb31df5d3ba07d85 Version: d70f1c85113cd8c2aa8373f491ca5d1b22ec0554 Version: 34a7b30f56d30114bf4d436e4dc793afe326fbcf Version: 2b74b2a92e524d7c8dec8e02e95ecf18b667c062 Version: 4fc82cd907ac075648789cc3a00877778aa1838b Version: 4fc82cd907ac075648789cc3a00877778aa1838b Version: 4fc82cd907ac075648789cc3a00877778aa1838b Version: 4fc82cd907ac075648789cc3a00877778aa1838b Version: c04f2780919f20e2cc4846764221f5e802555868 Version: 025bc6b41e020aeb1e71f84ae3ffce945026de05 Version: 5.10.214 ≤ Version: 5.15.153 ≤ Version: 6.1.83 ≤ Version: 6.6.23 ≤ Version: 6.7.11 ≤ Version: 6.8.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/pasid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "581ce094d9eafb78ec4f9de77bd24b780c151236",
"status": "affected",
"version": "f873b85ec762c5a6abe94a7ddb31df5d3ba07d85",
"versionType": "git"
},
{
"lessThan": "e2c78c69f8faf2885ea4ceee08c71ac738f401a0",
"status": "affected",
"version": "d70f1c85113cd8c2aa8373f491ca5d1b22ec0554",
"versionType": "git"
},
{
"lessThan": "ead67d0378e90f419e385a43af29435242d80c12",
"status": "affected",
"version": "34a7b30f56d30114bf4d436e4dc793afe326fbcf",
"versionType": "git"
},
{
"lessThan": "01aed2f1d7cb8fdf4c60c5bb4727608cb82b401d",
"status": "affected",
"version": "2b74b2a92e524d7c8dec8e02e95ecf18b667c062",
"versionType": "git"
},
{
"lessThan": "9813306610d0d718c863aaa70928bf57d7570ec0",
"status": "affected",
"version": "4fc82cd907ac075648789cc3a00877778aa1838b",
"versionType": "git"
},
{
"lessThan": "9deaacc8dcaddb6ddc5b52e1e63b457450ec0f94",
"status": "affected",
"version": "4fc82cd907ac075648789cc3a00877778aa1838b",
"versionType": "git"
},
{
"lessThan": "0da6697e577023d8867c7beb2d16a22510e4eea9",
"status": "affected",
"version": "4fc82cd907ac075648789cc3a00877778aa1838b",
"versionType": "git"
},
{
"lessThan": "10e60d87813989e20eac1f3eda30b3bae461e7f9",
"status": "affected",
"version": "4fc82cd907ac075648789cc3a00877778aa1838b",
"versionType": "git"
},
{
"status": "affected",
"version": "c04f2780919f20e2cc4846764221f5e802555868",
"versionType": "git"
},
{
"status": "affected",
"version": "025bc6b41e020aeb1e71f84ae3ffce945026de05",
"versionType": "git"
},
{
"lessThan": "5.10.252",
"status": "affected",
"version": "5.10.214",
"versionType": "semver"
},
{
"lessThan": "5.15.202",
"status": "affected",
"version": "5.15.153",
"versionType": "semver"
},
{
"lessThan": "6.1.165",
"status": "affected",
"version": "6.1.83",
"versionType": "semver"
},
{
"lessThan": "6.6.128",
"status": "affected",
"version": "6.6.23",
"versionType": "semver"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.11",
"versionType": "semver"
},
{
"lessThan": "6.9",
"status": "affected",
"version": "6.8.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/pasid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "5.10.214",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.15.153",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.1.83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.8.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode\n\nCommit 4fc82cd907ac (\"iommu/vt-d: Don\u0027t issue ATS Invalidation\nrequest when device is disconnected\") relies on\npci_dev_is_disconnected() to skip ATS invalidation for\nsafely-removed devices, but it does not cover link-down caused\nby faults, which can still hard-lock the system.\n\nFor example, if a VM fails to connect to the PCIe device,\n\"virsh destroy\" is executed to release resources and isolate\nthe fault, but a hard-lockup occurs while releasing the group fd.\n\nCall Trace:\n qi_submit_sync\n qi_flush_dev_iotlb\n intel_pasid_tear_down_entry\n device_block_translation\n blocking_domain_attach_dev\n __iommu_attach_device\n __iommu_device_set_domain\n __iommu_group_set_domain_internal\n iommu_detach_group\n vfio_iommu_type1_detach_group\n vfio_group_detach_container\n vfio_group_fops_release\n __fput\n\nAlthough pci_device_is_present() is slower than\npci_dev_is_disconnected(), it still takes only ~70 \u00b5s on a\nConnectX-5 (8 GT/s, x2) and becomes even faster as PCIe speed\nand width increase.\n\nBesides, devtlb_invalidation_with_pasid() is called only in the\npaths below, which are far less frequent than memory map/unmap.\n\n1. mm-struct release\n2. {attach,release}_dev\n3. set/remove PASID\n4. dirty-tracking setup\n\nThe gain in system stability far outweighs the negligible cost\nof using pci_device_is_present() instead of pci_dev_is_disconnected()\nto decide when to skip ATS invalidation, especially under GDR\nhigh-load conditions."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:06:22.409Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/581ce094d9eafb78ec4f9de77bd24b780c151236"
},
{
"url": "https://git.kernel.org/stable/c/e2c78c69f8faf2885ea4ceee08c71ac738f401a0"
},
{
"url": "https://git.kernel.org/stable/c/ead67d0378e90f419e385a43af29435242d80c12"
},
{
"url": "https://git.kernel.org/stable/c/01aed2f1d7cb8fdf4c60c5bb4727608cb82b401d"
},
{
"url": "https://git.kernel.org/stable/c/9813306610d0d718c863aaa70928bf57d7570ec0"
},
{
"url": "https://git.kernel.org/stable/c/9deaacc8dcaddb6ddc5b52e1e63b457450ec0f94"
},
{
"url": "https://git.kernel.org/stable/c/0da6697e577023d8867c7beb2d16a22510e4eea9"
},
{
"url": "https://git.kernel.org/stable/c/10e60d87813989e20eac1f3eda30b3bae461e7f9"
}
],
"title": "iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43130",
"datePublished": "2026-05-06T11:27:18.825Z",
"dateReserved": "2026-05-01T14:12:55.988Z",
"dateUpdated": "2026-05-23T16:06:22.409Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43051 (GCVE-0-2026-43051)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
The wacom_intuos_bt_irq() function processes Bluetooth HID reports
without sufficient bounds checking. A maliciously crafted short report
can trigger an out-of-bounds read when copying data into the wacom
structure.
Specifically, report 0x03 requires at least 22 bytes to safely read
the processed data and battery status, while report 0x04 (which
falls through to 0x03) requires 32 bytes.
Add explicit length checks for these report IDs and log a warning if
a short report is received.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a Version: 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a Version: 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a Version: 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a Version: 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a Version: 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a Version: 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a Version: 78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/wacom_wac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada",
"status": "affected",
"version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a",
"versionType": "git"
},
{
"lessThan": "5b5b9730111808410e404ceac2fabd32eef92fbd",
"status": "affected",
"version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a",
"versionType": "git"
},
{
"lessThan": "fa8901cb1f0b2113a342db93bd5684b59fe99dcf",
"status": "affected",
"version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a",
"versionType": "git"
},
{
"lessThan": "8bd690ac1242332c73cba10dacdad6c6642bbb94",
"status": "affected",
"version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a",
"versionType": "git"
},
{
"lessThan": "41026bcc0fdf82605205c27935ef719cbc07193b",
"status": "affected",
"version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a",
"versionType": "git"
},
{
"lessThan": "c8dc23c97680eebefde06da5858aaef1b37cf75d",
"status": "affected",
"version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a",
"versionType": "git"
},
{
"lessThan": "3d78386b144453c47e81bf62dc3601b757f02d99",
"status": "affected",
"version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a",
"versionType": "git"
},
{
"lessThan": "2f1763f62909ccb6386ac50350fa0abbf5bb16a9",
"status": "affected",
"version": "78761ff9bc4e944e0b4e5df1e7eedcfdbb1a9a1a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/wacom_wac.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq\n\nThe wacom_intuos_bt_irq() function processes Bluetooth HID reports\nwithout sufficient bounds checking. A maliciously crafted short report\ncan trigger an out-of-bounds read when copying data into the wacom\nstructure.\n\nSpecifically, report 0x03 requires at least 22 bytes to safely read\nthe processed data and battery status, while report 0x04 (which\nfalls through to 0x03) requires 32 bytes.\n\nAdd explicit length checks for these report IDs and log a warning if\na short report is received."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable handler processes Bluetooth HID input reports from Wacom Intuos wireless devices, so an attacker must be within Bluetooth radio range or control a Bluetooth HID peripheral.\nAC:L - The attacker directly controls the report ID and report length; a short 0x03 or 0x04 report deterministically reaches the missing bounds checks once the HIDP session exists.\nPR:N - The attacker is the Bluetooth HID peer sending input reports and needs no local kernel privileges. The local HIDP setup path uses CAP_NET_ADMIN, but that is a host-side management gate, not a privilege required by the remote reporting device.\nUI:N - No victim action is needed to trigger the bug after the malicious or compromised Bluetooth HID device is connected; it can send the crafted input report on its own.\nS:U - The vulnerable Wacom HID driver and the impacted kernel/input state are under the same host kernel security authority.\nC:H - The bug reads beyond a kmemdup() report buffer and copies adjacent kernel heap bytes into Wacom report processing state. Because this is a kernel heap out-of-bounds read of up to the 32-byte report window, high confidentiality impact is the highest defensible assessment.\nI:N - The defect is an out-of-bounds read, not an out-of-bounds write or use-after-free, and it does not provide an attacker-controlled kernel memory modification primitive.\nA:H - Malformed short reports can repeatedly trigger kernel out-of-bounds reads; on hardened/debug configurations this is a KASAN-detected kernel fault, and on production systems it is defensible to treat repeated invalid kernel memory access as a potential crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:34.976Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d0ae84b3c9f3ea1a564eb1b7612113ca9fe8aada"
},
{
"url": "https://git.kernel.org/stable/c/5b5b9730111808410e404ceac2fabd32eef92fbd"
},
{
"url": "https://git.kernel.org/stable/c/fa8901cb1f0b2113a342db93bd5684b59fe99dcf"
},
{
"url": "https://git.kernel.org/stable/c/8bd690ac1242332c73cba10dacdad6c6642bbb94"
},
{
"url": "https://git.kernel.org/stable/c/41026bcc0fdf82605205c27935ef719cbc07193b"
},
{
"url": "https://git.kernel.org/stable/c/c8dc23c97680eebefde06da5858aaef1b37cf75d"
},
{
"url": "https://git.kernel.org/stable/c/3d78386b144453c47e81bf62dc3601b757f02d99"
},
{
"url": "https://git.kernel.org/stable/c/2f1763f62909ccb6386ac50350fa0abbf5bb16a9"
}
],
"title": "HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43051",
"datePublished": "2026-05-01T14:15:45.314Z",
"dateReserved": "2026-05-01T14:12:55.980Z",
"dateUpdated": "2026-08-05T12:25:34.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43395 (GCVE-0-2026-43395)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-05-11 22:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/sync: Cleanup partially initialized sync on parse failure
xe_sync_entry_parse() can allocate references (syncobj, fence, chain fence,
or user fence) before hitting a later failure path. Several of those paths
returned directly, leaving partially initialized state and leaking refs.
Route these error paths through a common free_sync label and call
xe_sync_entry_cleanup(sync) before returning the error.
(cherry picked from commit f939bdd9207a5d1fc55cced5459858480686ce22)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "91c228f96fcfacc2341a58815b1da8c69da94ebb",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
},
{
"lessThan": "af65cd1853599394b94201c08bed7a46717db478",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
},
{
"lessThan": "f0af63ffa06306f12592cd3919fad6957b425e1b",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
},
{
"lessThan": "1bfd7575092420ba5a0b944953c95b74a5646ff8",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/sync: Cleanup partially initialized sync on parse failure\n\nxe_sync_entry_parse() can allocate references (syncobj, fence, chain fence,\nor user fence) before hitting a later failure path. Several of those paths\nreturned directly, leaving partially initialized state and leaking refs.\n\nRoute these error paths through a common free_sync label and call\nxe_sync_entry_cleanup(sync) before returning the error.\n\n(cherry picked from commit f939bdd9207a5d1fc55cced5459858480686ce22)"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:23:45.325Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/91c228f96fcfacc2341a58815b1da8c69da94ebb"
},
{
"url": "https://git.kernel.org/stable/c/af65cd1853599394b94201c08bed7a46717db478"
},
{
"url": "https://git.kernel.org/stable/c/f0af63ffa06306f12592cd3919fad6957b425e1b"
},
{
"url": "https://git.kernel.org/stable/c/1bfd7575092420ba5a0b944953c95b74a5646ff8"
}
],
"title": "drm/xe/sync: Cleanup partially initialized sync on parse failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43395",
"datePublished": "2026-05-08T14:21:38.756Z",
"dateReserved": "2026-05-01T14:12:56.007Z",
"dateUpdated": "2026-05-11T22:23:45.325Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31685 (GCVE-0-2026-31685)
Vulnerability from cvelistv5
Published
2026-04-25 08:47
Modified
2026-08-05 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6t_eui64: reject invalid MAC header for all packets
`eui64_mt6()` derives a modified EUI-64 from the Ethernet source address
and compares it with the low 64 bits of the IPv6 source address.
The existing guard only rejects an invalid MAC header when
`par->fragoff != 0`. For packets with `par->fragoff == 0`, `eui64_mt6()`
can still reach `eth_hdr(skb)` even when the MAC header is not valid.
Fix this by removing the `par->fragoff != 0` condition so that packets
with an invalid MAC header are rejected before accessing `eth_hdr(skb)`.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter/ip6t_eui64.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4d75bc2cd093bf5803edf512c099bfb220fd6459",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7d6a57411caf54df025860c9b1a82cd42d57a562",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d5603591373441fecf9951833d6d873e09320f08",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "288138418bef956f8b295751a4536c60f0e89f4a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9eda5478746ef7dc0e4e537b5a5e4b0ca1027091",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "807d6ee15804df6f01a35c910f09612e858739a6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "309ae3e9a51a69699ca94eac5fac5688fa562d55",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "fdce0b3590f724540795b874b4c8850c90e6b0a8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter/ip6t_eui64.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_eui64: reject invalid MAC header for all packets\n\n`eui64_mt6()` derives a modified EUI-64 from the Ethernet source address\nand compares it with the low 64 bits of the IPv6 source address.\n\nThe existing guard only rejects an invalid MAC header when\n`par-\u003efragoff != 0`. For packets with `par-\u003efragoff == 0`, `eui64_mt6()`\ncan still reach `eth_hdr(skb)` even when the MAC header is not valid.\n\nFix this by removing the `par-\u003efragoff != 0` condition so that packets\nwith an invalid MAC header are rejected before accessing `eth_hdr(skb)`."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable match runs from IPv6 netfilter PREROUTING/LOCAL_IN/FORWARD packet hooks, so a remote peer can reach it by sending IPv6 traffic to or through a host/router with an active eui64 xtables rule on a path with an invalid or absent Ethernet MAC header.\nAC:L - There is no race or timing requirement; the attacker can send first-fragment or non-fragment IPv6 packets with controlled header fields, and the active rule/interface combination is a deployment precondition.\nPR:N - Although installing the rule requires CAP_NET_ADMIN, in the highest-severity reasonable deployment the eui64 rule is already active and unauthenticated packets trigger the vulnerable packet path without attacker privileges.\nUI:N - No victim action is needed after the affected netfilter rule is present; packet delivery alone invokes the match.\nS:U - The impact remains within the kernel/networking security authority of the affected system and does not cross a VM, IOMMU, or similar boundary.\nC:H - With an unset or invalid MAC header, eth_hdr() can read outside the valid Ethernet header area and those bytes can influence observable netfilter behavior; following the required conservative rule for out-of-bounds reads, confidentiality is High.\nI:L - The bug can cause invalid-L2 packets to satisfy an eui64 match and bypass filtering decisions based on Ethernet-source-to-IPv6-source binding, but it does not provide a direct kernel write primitive.\nA:H - Invalid eth_hdr() access on packets with no valid MAC header can produce kernel warnings/oopses or KASAN-detected out-of-bounds accesses, and an attacker can repeat packet delivery to sustain denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:29.973Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4d75bc2cd093bf5803edf512c099bfb220fd6459"
},
{
"url": "https://git.kernel.org/stable/c/7d6a57411caf54df025860c9b1a82cd42d57a562"
},
{
"url": "https://git.kernel.org/stable/c/d5603591373441fecf9951833d6d873e09320f08"
},
{
"url": "https://git.kernel.org/stable/c/288138418bef956f8b295751a4536c60f0e89f4a"
},
{
"url": "https://git.kernel.org/stable/c/9eda5478746ef7dc0e4e537b5a5e4b0ca1027091"
},
{
"url": "https://git.kernel.org/stable/c/807d6ee15804df6f01a35c910f09612e858739a6"
},
{
"url": "https://git.kernel.org/stable/c/309ae3e9a51a69699ca94eac5fac5688fa562d55"
},
{
"url": "https://git.kernel.org/stable/c/fdce0b3590f724540795b874b4c8850c90e6b0a8"
}
],
"title": "netfilter: ip6t_eui64: reject invalid MAC header for all packets",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31685",
"datePublished": "2026-04-25T08:47:02.857Z",
"dateReserved": "2026-03-09T15:48:24.131Z",
"dateUpdated": "2026-08-05T12:24:29.973Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43022 (GCVE-0-2026-43022)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-05-23 16:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
hci_cmd_sync_queue_once() needs to indicate whether a queue item was
added, so caller can know if callbacks are called, so it can avoid
leaking resources.
Change the function to return -EEXIST if queue item already exists.
Modify all callsites to handle that.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 Version: 505ea2b295929e7be2b4e1bc86ee31cb7862fb01 Version: f00f36db76eb8fd10d13e80e2590f23b5beaa54d Version: 1499f79995c7ee58e3bfeeff75f6d1b37dcda881 Version: 357603f4d396d85fbf0045512efaf1d7f7394ed7 Version: 6.1.120 ≤ Version: 6.6.51 ≤ Version: 6.8.9 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0ad2ce230b38cd4b3f6732cc609e270461e626e5",
"status": "affected",
"version": "505ea2b295929e7be2b4e1bc86ee31cb7862fb01",
"versionType": "git"
},
{
"lessThan": "2969554bcfccb5c609f6b6cd4a014933f3a66dd0",
"status": "affected",
"version": "505ea2b295929e7be2b4e1bc86ee31cb7862fb01",
"versionType": "git"
},
{
"status": "affected",
"version": "f00f36db76eb8fd10d13e80e2590f23b5beaa54d",
"versionType": "git"
},
{
"status": "affected",
"version": "1499f79995c7ee58e3bfeeff75f6d1b37dcda881",
"versionType": "git"
},
{
"status": "affected",
"version": "357603f4d396d85fbf0045512efaf1d7f7394ed7",
"versionType": "git"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.51",
"versionType": "semver"
},
{
"lessThan": "6.9",
"status": "affected",
"version": "6.8.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.51",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.8.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists\n\nhci_cmd_sync_queue_once() needs to indicate whether a queue item was\nadded, so caller can know if callbacks are called, so it can avoid\nleaking resources.\n\nChange the function to return -EEXIST if queue item already exists.\n\nModify all callsites to handle that."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:06:00.475Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ad2ce230b38cd4b3f6732cc609e270461e626e5"
},
{
"url": "https://git.kernel.org/stable/c/2969554bcfccb5c609f6b6cd4a014933f3a66dd0"
}
],
"title": "Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43022",
"datePublished": "2026-05-01T14:15:25.059Z",
"dateReserved": "2026-05-01T14:12:55.975Z",
"dateUpdated": "2026-05-23T16:06:00.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43205 (GCVE-0-2026-43205)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dpaa2-switch: validate num_ifs to prevent out-of-bounds write
The driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes()
but never validates it against DPSW_MAX_IF (64). This value controls
iteration in dpaa2_switch_fdb_get_flood_cfg(), which writes port indices
into the fixed-size cfg->if_id[DPSW_MAX_IF] array. When firmware reports
num_ifs >= 64, the loop can write past the array bounds.
Add a bound check for num_ifs in dpaa2_switch_init().
dpaa2_switch_fdb_get_flood_cfg() appends the control interface (port
num_ifs) after all matched ports. When num_ifs == DPSW_MAX_IF and all
ports match the flood filter, the loop fills all 64 slots and the control
interface write overflows by one entry.
The check uses >= because num_ifs == DPSW_MAX_IF is also functionally
broken.
build_if_id_bitmap() silently drops any ID >= 64:
if (id[i] < DPSW_MAX_IF)
bmap[id[i] / 64] |= ...
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 539dda3c5d190c5088b5e57944b1b482fcb464de Version: 539dda3c5d190c5088b5e57944b1b482fcb464de Version: 539dda3c5d190c5088b5e57944b1b482fcb464de Version: 539dda3c5d190c5088b5e57944b1b482fcb464de Version: 539dda3c5d190c5088b5e57944b1b482fcb464de Version: 539dda3c5d190c5088b5e57944b1b482fcb464de Version: 539dda3c5d190c5088b5e57944b1b482fcb464de |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a26dda3bae469c8e4e1b1993ad33dafa32d0fc28",
"status": "affected",
"version": "539dda3c5d190c5088b5e57944b1b482fcb464de",
"versionType": "git"
},
{
"lessThan": "a3034a8d56174dd6464c46823438f25797910a8d",
"status": "affected",
"version": "539dda3c5d190c5088b5e57944b1b482fcb464de",
"versionType": "git"
},
{
"lessThan": "b690635d4719214892855b79ce018d4b1672ac96",
"status": "affected",
"version": "539dda3c5d190c5088b5e57944b1b482fcb464de",
"versionType": "git"
},
{
"lessThan": "8b841fd529db9faf8bc678d429d4bf4e98b10900",
"status": "affected",
"version": "539dda3c5d190c5088b5e57944b1b482fcb464de",
"versionType": "git"
},
{
"lessThan": "89764cf44544e943230f5e03b8c40a90da26537c",
"status": "affected",
"version": "539dda3c5d190c5088b5e57944b1b482fcb464de",
"versionType": "git"
},
{
"lessThan": "c18493f750208eb4ff1198fc5a02786b8b2d70a6",
"status": "affected",
"version": "539dda3c5d190c5088b5e57944b1b482fcb464de",
"versionType": "git"
},
{
"lessThan": "8a5752c6dcc085a3bfc78589925182e4e98468c5",
"status": "affected",
"version": "539dda3c5d190c5088b5e57944b1b482fcb464de",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: validate num_ifs to prevent out-of-bounds write\n\nThe driver obtains sw_attr.num_ifs from firmware via dpsw_get_attributes()\nbut never validates it against DPSW_MAX_IF (64). This value controls\niteration in dpaa2_switch_fdb_get_flood_cfg(), which writes port indices\ninto the fixed-size cfg-\u003eif_id[DPSW_MAX_IF] array. When firmware reports\nnum_ifs \u003e= 64, the loop can write past the array bounds.\n\nAdd a bound check for num_ifs in dpaa2_switch_init().\n\ndpaa2_switch_fdb_get_flood_cfg() appends the control interface (port\nnum_ifs) after all matched ports. When num_ifs == DPSW_MAX_IF and all\nports match the flood filter, the loop fills all 64 slots and the control\ninterface write overflows by one entry.\n\nThe check uses \u003e= because num_ifs == DPSW_MAX_IF is also functionally\nbroken.\n\nbuild_if_id_bitmap() silently drops any ID \u003e= 64:\n if (id[i] \u003c DPSW_MAX_IF)\n bmap[id[i] / 64] |= ..."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:20:00.994Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a26dda3bae469c8e4e1b1993ad33dafa32d0fc28"
},
{
"url": "https://git.kernel.org/stable/c/a3034a8d56174dd6464c46823438f25797910a8d"
},
{
"url": "https://git.kernel.org/stable/c/b690635d4719214892855b79ce018d4b1672ac96"
},
{
"url": "https://git.kernel.org/stable/c/8b841fd529db9faf8bc678d429d4bf4e98b10900"
},
{
"url": "https://git.kernel.org/stable/c/89764cf44544e943230f5e03b8c40a90da26537c"
},
{
"url": "https://git.kernel.org/stable/c/c18493f750208eb4ff1198fc5a02786b8b2d70a6"
},
{
"url": "https://git.kernel.org/stable/c/8a5752c6dcc085a3bfc78589925182e4e98468c5"
}
],
"title": "dpaa2-switch: validate num_ifs to prevent out-of-bounds write",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43205",
"datePublished": "2026-05-06T11:28:10.270Z",
"dateReserved": "2026-05-01T14:12:55.992Z",
"dateUpdated": "2026-05-11T22:20:00.994Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52933 (GCVE-0-2026-52933)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
io_uring/poll: fix signed comparison in io_poll_get_ownership()
io_poll_get_ownership() uses a signed comparison to check whether
poll_refs has reached the threshold for the slowpath:
if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS))
atomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG
(BIT(31)) is set in poll_refs, the value becomes negative in
signed arithmetic, so the >= 128 comparison always evaluates to
false and the slowpath is never taken.
Fix this by casting the atomic_read() result to unsigned int
before the comparison, so that the cancel flag is treated as a
large positive value and correctly triggers the slowpath.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a26a35e9019fd70bf3cf647dcfdae87abc7bacea Version: a26a35e9019fd70bf3cf647dcfdae87abc7bacea Version: a26a35e9019fd70bf3cf647dcfdae87abc7bacea Version: a26a35e9019fd70bf3cf647dcfdae87abc7bacea Version: a26a35e9019fd70bf3cf647dcfdae87abc7bacea Version: a26a35e9019fd70bf3cf647dcfdae87abc7bacea Version: 4b702b7d11ce1b9d26fc6d7c5a7ef4ac1d455048 Version: bc4e6ee16778149811333a969a7a893d4cc110c5 Version: 5.15.82 ≤ Version: 6.0.11 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/poll.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "81bf96b0abbfa4cd47ea32e12596aed3855fb2f3",
"status": "affected",
"version": "a26a35e9019fd70bf3cf647dcfdae87abc7bacea",
"versionType": "git"
},
{
"lessThan": "cf522703d4f194991615763697ae25a3f9539763",
"status": "affected",
"version": "a26a35e9019fd70bf3cf647dcfdae87abc7bacea",
"versionType": "git"
},
{
"lessThan": "fc47043f3d9af3efa407665b47f8378ec691ba18",
"status": "affected",
"version": "a26a35e9019fd70bf3cf647dcfdae87abc7bacea",
"versionType": "git"
},
{
"lessThan": "ea0697129807d718037f618221037aa0660ee3c5",
"status": "affected",
"version": "a26a35e9019fd70bf3cf647dcfdae87abc7bacea",
"versionType": "git"
},
{
"lessThan": "c6d191164dc81838d8dbf452a6000f68c558d1ae",
"status": "affected",
"version": "a26a35e9019fd70bf3cf647dcfdae87abc7bacea",
"versionType": "git"
},
{
"lessThan": "326941b22806cbf2df1fbfe902b7908b368cce42",
"status": "affected",
"version": "a26a35e9019fd70bf3cf647dcfdae87abc7bacea",
"versionType": "git"
},
{
"status": "affected",
"version": "4b702b7d11ce1b9d26fc6d7c5a7ef4ac1d455048",
"versionType": "git"
},
{
"status": "affected",
"version": "bc4e6ee16778149811333a969a7a893d4cc110c5",
"versionType": "git"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.82",
"versionType": "semver"
},
{
"lessThan": "6.1",
"status": "affected",
"version": "6.0.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/poll.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: fix signed comparison in io_poll_get_ownership()\n\nio_poll_get_ownership() uses a signed comparison to check whether\npoll_refs has reached the threshold for the slowpath:\n\n if (unlikely(atomic_read(\u0026req-\u003epoll_refs) \u003e= IO_POLL_REF_BIAS))\n\natomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG\n(BIT(31)) is set in poll_refs, the value becomes negative in\nsigned arithmetic, so the \u003e= 128 comparison always evaluates to\nfalse and the slowpath is never taken.\n\nFix this by casting the atomic_read() result to unsigned int\nbefore the comparison, so that the cancel flag is treated as a\nlarge positive value and correctly triggers the slowpath."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached by local `io_uring_setup()`/`io_uring_enter()` submissions of poll and cancel operations, not by remote packets or physical access.\nAC:L - An attacker can create the ring, choose pollable file descriptors, submit cancels/removes, and generate concurrent wakeups; the race participants are attacker-controlled.\nPR:L - With the default `io_uring_disabled=0`, an unprivileged local user can create and use io_uring; no real root or init-namespace capability is required.\nUI:N - Exploitation does not require another user to mount, open, or process anything; the attacker drives the syscall and file-descriptor activity directly.\nS:U - This is a kernel request-lifetime/ownership bug within the same host kernel security authority, not a VM, IOMMU, or separate security-scope escape.\nC:H - The signedness bug defeats the poll_refs overflow/ownership slow path after cancellation, allowing ref-bit wrap and duplicate ownership/completion of an `io_kiocb`; that is UAF-style kernel memory corruption with plausible memory disclosure.\nI:H - The same duplicate ownership/completion and request lifetime corruption can plausibly be shaped into arbitrary kernel memory modification or control-flow compromise, so integrity impact is high.\nA:H - At minimum, corrupted poll ownership and duplicate completion can trigger kernel warnings, NULL dereferences, UAF crashes, or hangs in a local attacker-controlled loop."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:51.192Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/81bf96b0abbfa4cd47ea32e12596aed3855fb2f3"
},
{
"url": "https://git.kernel.org/stable/c/cf522703d4f194991615763697ae25a3f9539763"
},
{
"url": "https://git.kernel.org/stable/c/fc47043f3d9af3efa407665b47f8378ec691ba18"
},
{
"url": "https://git.kernel.org/stable/c/ea0697129807d718037f618221037aa0660ee3c5"
},
{
"url": "https://git.kernel.org/stable/c/c6d191164dc81838d8dbf452a6000f68c558d1ae"
},
{
"url": "https://git.kernel.org/stable/c/326941b22806cbf2df1fbfe902b7908b368cce42"
}
],
"title": "io_uring/poll: fix signed comparison in io_poll_get_ownership()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52933",
"datePublished": "2026-06-24T07:14:24.678Z",
"dateReserved": "2026-06-09T07:44:35.369Z",
"dateUpdated": "2026-08-05T12:31:51.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43145 (GCVE-0-2026-43145)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-23 16:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
remoteproc: imx_rproc: Fix invalid loaded resource table detection
imx_rproc_elf_find_loaded_rsc_table() may incorrectly report a loaded
resource table even when the current firmware does not provide one.
When the device tree contains a "rsc-table" entry, priv->rsc_table is
non-NULL and denotes where a resource table would be located if one is
present in memory. However, when the current firmware has no resource
table, rproc->table_ptr is NULL. The function still returns
priv->rsc_table, and the remoteproc core interprets this as a valid loaded
resource table.
Fix this by returning NULL from imx_rproc_elf_find_loaded_rsc_table() when
there is no resource table for the current firmware (i.e. when
rproc->table_ptr is NULL). This aligns the function's semantics with the
remoteproc core: a loaded resource table is only reported when a valid
table_ptr exists.
With this change, starting firmware without a resource table no longer
triggers a crash.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 64f2ca5ce97111a364a18c31772eb46c79e8b772 Version: 1d750606fedcdff7886f35a558c51b05ce2680a6 Version: 7fb5f957213bc7268bac449f8bfe95967c9f3f3b Version: e954a1bd16102abc800629f9900715d8ec4c3130 Version: e954a1bd16102abc800629f9900715d8ec4c3130 Version: e954a1bd16102abc800629f9900715d8ec4c3130 Version: e954a1bd16102abc800629f9900715d8ec4c3130 Version: 3d131f138e092c414c69860f2c897c59d660da99 Version: 5.15.168 ≤ Version: 6.1.113 ≤ Version: 6.6.57 ≤ Version: 6.11.4 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/remoteproc/imx_rproc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "91baf24d972ea3c04a75dd18821c03d223c0dbc0",
"status": "affected",
"version": "64f2ca5ce97111a364a18c31772eb46c79e8b772",
"versionType": "git"
},
{
"lessThan": "fcec79b6a3649ae7b1f659267602ca402c240d6e",
"status": "affected",
"version": "1d750606fedcdff7886f35a558c51b05ce2680a6",
"versionType": "git"
},
{
"lessThan": "9bd98d088f47153a81a6ec8162b4415c64aa7f39",
"status": "affected",
"version": "7fb5f957213bc7268bac449f8bfe95967c9f3f3b",
"versionType": "git"
},
{
"lessThan": "65379adf7d231c930572db45933ff4538f4c5128",
"status": "affected",
"version": "e954a1bd16102abc800629f9900715d8ec4c3130",
"versionType": "git"
},
{
"lessThan": "500778df9e4c313190368908ff40c23948508e97",
"status": "affected",
"version": "e954a1bd16102abc800629f9900715d8ec4c3130",
"versionType": "git"
},
{
"lessThan": "198c629bd03863591f3fbf5ce8ff974a33f13dc9",
"status": "affected",
"version": "e954a1bd16102abc800629f9900715d8ec4c3130",
"versionType": "git"
},
{
"lessThan": "26aa5295010ffaebcf8f1991c53fa7cf2ee1b20d",
"status": "affected",
"version": "e954a1bd16102abc800629f9900715d8ec4c3130",
"versionType": "git"
},
{
"status": "affected",
"version": "3d131f138e092c414c69860f2c897c59d660da99",
"versionType": "git"
},
{
"lessThan": "5.15.202",
"status": "affected",
"version": "5.15.168",
"versionType": "semver"
},
{
"lessThan": "6.1.165",
"status": "affected",
"version": "6.1.113",
"versionType": "semver"
},
{
"lessThan": "6.6.128",
"status": "affected",
"version": "6.6.57",
"versionType": "semver"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/remoteproc/imx_rproc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.15.168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.1.113",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.6.57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: imx_rproc: Fix invalid loaded resource table detection\n\nimx_rproc_elf_find_loaded_rsc_table() may incorrectly report a loaded\nresource table even when the current firmware does not provide one.\n\nWhen the device tree contains a \"rsc-table\" entry, priv-\u003ersc_table is\nnon-NULL and denotes where a resource table would be located if one is\npresent in memory. However, when the current firmware has no resource\ntable, rproc-\u003etable_ptr is NULL. The function still returns\npriv-\u003ersc_table, and the remoteproc core interprets this as a valid loaded\nresource table.\n\nFix this by returning NULL from imx_rproc_elf_find_loaded_rsc_table() when\nthere is no resource table for the current firmware (i.e. when\nrproc-\u003etable_ptr is NULL). This aligns the function\u0027s semantics with the\nremoteproc core: a loaded resource table is only reported when a valid\ntable_ptr exists.\n\nWith this change, starting firmware without a resource table no longer\ntriggers a crash."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:06:23.479Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/91baf24d972ea3c04a75dd18821c03d223c0dbc0"
},
{
"url": "https://git.kernel.org/stable/c/fcec79b6a3649ae7b1f659267602ca402c240d6e"
},
{
"url": "https://git.kernel.org/stable/c/9bd98d088f47153a81a6ec8162b4415c64aa7f39"
},
{
"url": "https://git.kernel.org/stable/c/65379adf7d231c930572db45933ff4538f4c5128"
},
{
"url": "https://git.kernel.org/stable/c/500778df9e4c313190368908ff40c23948508e97"
},
{
"url": "https://git.kernel.org/stable/c/198c629bd03863591f3fbf5ce8ff974a33f13dc9"
},
{
"url": "https://git.kernel.org/stable/c/26aa5295010ffaebcf8f1991c53fa7cf2ee1b20d"
}
],
"title": "remoteproc: imx_rproc: Fix invalid loaded resource table detection",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43145",
"datePublished": "2026-05-06T11:27:28.911Z",
"dateReserved": "2026-05-01T14:12:55.989Z",
"dateUpdated": "2026-05-23T16:06:23.479Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46033 (GCVE-0-2026-46033)
Vulnerability from cvelistv5
Published
2026-05-27 12:56
Modified
2026-08-21 12:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: authencesn - reject short ahash digests during instance creation
authencesn requires either a zero authsize or an authsize of at least
4 bytes because the ESN encrypt/decrypt paths always move 4 bytes of
high-order sequence number data at the end of the authenticated data.
While crypto_authenc_esn_setauthsize() already rejects explicit
non-zero authsizes in the range 1..3, crypto_authenc_esn_create()
still copied auth->digestsize into inst->alg.maxauthsize without
validating it. The AEAD core then initialized the tfm's default
authsize from that value.
As a result, selecting an ahash with digest size 1..3, such as
cbcmac(cipher_null), exposed authencesn instances whose default
authsize was invalid even though setauthsize() would have rejected the
same value. AF_ALG could then trigger the ESN tail handling with a
too-short tag and hit an out-of-bounds access.
Reject authencesn instances whose ahash digest size is in the invalid
non-zero range 1..3 so that no tfm can inherit an unsupported default
authsize.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f15f05b0a5de667c821a9727c33bce9d1d9b26dd Version: f15f05b0a5de667c821a9727c33bce9d1d9b26dd Version: f15f05b0a5de667c821a9727c33bce9d1d9b26dd Version: f15f05b0a5de667c821a9727c33bce9d1d9b26dd Version: f15f05b0a5de667c821a9727c33bce9d1d9b26dd Version: f15f05b0a5de667c821a9727c33bce9d1d9b26dd Version: f15f05b0a5de667c821a9727c33bce9d1d9b26dd Version: f15f05b0a5de667c821a9727c33bce9d1d9b26dd |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s `authencesn` cryptographic module. This vulnerability arises from insufficient validation of cryptographic digest sizes during the creation of new instances. A local attacker could exploit this by providing a malformed input, leading to an out-of-bounds memory access. This could cause system instability, a denial of service (DoS), or potentially enable unauthorized access to sensitive information or system control."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T12:12:52.673Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-46033"
},
{
"name": "RHBZ#2482000",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482000"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46033.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-27T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-27T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: crypto: authencesn - reject short ahash digests during instance creation",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/authencesn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "77f59fb2d3aa33e90ec6cbbf45dcfb20ab82b1a9",
"status": "affected",
"version": "f15f05b0a5de667c821a9727c33bce9d1d9b26dd",
"versionType": "git"
},
{
"lessThan": "2f31cd1e64a079c845bca31d2da7b3c90a311726",
"status": "affected",
"version": "f15f05b0a5de667c821a9727c33bce9d1d9b26dd",
"versionType": "git"
},
{
"lessThan": "d4c6a6d08e70bb1083c7c405fc7faacbf19aebc0",
"status": "affected",
"version": "f15f05b0a5de667c821a9727c33bce9d1d9b26dd",
"versionType": "git"
},
{
"lessThan": "b69933e97efea238ebbfcf70c2b1be1cd03f13e3",
"status": "affected",
"version": "f15f05b0a5de667c821a9727c33bce9d1d9b26dd",
"versionType": "git"
},
{
"lessThan": "67f1f0933cc3d78dde222842bcad2778ec7a0b88",
"status": "affected",
"version": "f15f05b0a5de667c821a9727c33bce9d1d9b26dd",
"versionType": "git"
},
{
"lessThan": "b42821c15445f93daea3e76ada682b2b7181c476",
"status": "affected",
"version": "f15f05b0a5de667c821a9727c33bce9d1d9b26dd",
"versionType": "git"
},
{
"lessThan": "9aff81e8217e9de2929084b03b3c7f81988c112b",
"status": "affected",
"version": "f15f05b0a5de667c821a9727c33bce9d1d9b26dd",
"versionType": "git"
},
{
"lessThan": "5db6ef9847717329f12c5ea8aba7e9f588a980c0",
"status": "affected",
"version": "f15f05b0a5de667c821a9727c33bce9d1d9b26dd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/authencesn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: authencesn - reject short ahash digests during instance creation\n\nauthencesn requires either a zero authsize or an authsize of at least\n4 bytes because the ESN encrypt/decrypt paths always move 4 bytes of\nhigh-order sequence number data at the end of the authenticated data.\n\nWhile crypto_authenc_esn_setauthsize() already rejects explicit\nnon-zero authsizes in the range 1..3, crypto_authenc_esn_create()\nstill copied auth-\u003edigestsize into inst-\u003ealg.maxauthsize without\nvalidating it. The AEAD core then initialized the tfm\u0027s default\nauthsize from that value.\n\nAs a result, selecting an ahash with digest size 1..3, such as\ncbcmac(cipher_null), exposed authencesn instances whose default\nauthsize was invalid even though setauthsize() would have rejected the\nsame value. AF_ALG could then trigger the ESN tail handling with a\ntoo-short tag and hit an out-of-bounds access.\n\nReject authencesn instances whose ahash digest size is in the invalid\nnon-zero range 1..3 so that no tfm can inherit an unsupported default\nauthsize."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:49:24.256Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/77f59fb2d3aa33e90ec6cbbf45dcfb20ab82b1a9"
},
{
"url": "https://git.kernel.org/stable/c/2f31cd1e64a079c845bca31d2da7b3c90a311726"
},
{
"url": "https://git.kernel.org/stable/c/d4c6a6d08e70bb1083c7c405fc7faacbf19aebc0"
},
{
"url": "https://git.kernel.org/stable/c/b69933e97efea238ebbfcf70c2b1be1cd03f13e3"
},
{
"url": "https://git.kernel.org/stable/c/67f1f0933cc3d78dde222842bcad2778ec7a0b88"
},
{
"url": "https://git.kernel.org/stable/c/b42821c15445f93daea3e76ada682b2b7181c476"
},
{
"url": "https://git.kernel.org/stable/c/9aff81e8217e9de2929084b03b3c7f81988c112b"
},
{
"url": "https://git.kernel.org/stable/c/5db6ef9847717329f12c5ea8aba7e9f588a980c0"
}
],
"title": "crypto: authencesn - reject short ahash digests during instance creation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46033",
"datePublished": "2026-05-27T12:56:42.038Z",
"dateReserved": "2026-05-13T15:03:33.093Z",
"dateUpdated": "2026-08-21T12:12:52.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53190 (GCVE-0-2026-53190)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()
dma_fence_unwrap_for_each() internally calls dma_fence_unwrap_first()
which does cursor->chain = dma_fence_get(head), taking an extra
reference. On normal loop completion, dma_fence_unwrap_next()
releases this via dma_fence_chain_walk() -> dma_fence_put().
When virtio_gpu_do_fence_wait() fails and the function returns early
from inside the loop, the cursor->chain reference is never released.
This is the only caller in the entire kernel that does an early return
inside dma_fence_unwrap_for_each.
Add dma_fence_put(itr.chain) before the early return.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/virtio/virtgpu_submit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "898bd0ccfed71651b881660c5d20ad73b5203174",
"status": "affected",
"version": "eba57fb5498f2858768321e64570caea188455b8",
"versionType": "git"
},
{
"lessThan": "73524e9f96a278b521f257a78a845c49eb522bc1",
"status": "affected",
"version": "eba57fb5498f2858768321e64570caea188455b8",
"versionType": "git"
},
{
"lessThan": "8348567a6afb24e2c9cafe8a321162d0eebe1411",
"status": "affected",
"version": "eba57fb5498f2858768321e64570caea188455b8",
"versionType": "git"
},
{
"lessThan": "c0fffc874c264292e769f26194a2a5e66ce31810",
"status": "affected",
"version": "eba57fb5498f2858768321e64570caea188455b8",
"versionType": "git"
},
{
"lessThan": "3f26bb732cc136ab20176697c92f32c9c84cb125",
"status": "affected",
"version": "eba57fb5498f2858768321e64570caea188455b8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/virtio/virtgpu_submit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()\n\ndma_fence_unwrap_for_each() internally calls dma_fence_unwrap_first()\nwhich does cursor-\u003echain = dma_fence_get(head), taking an extra\nreference. On normal loop completion, dma_fence_unwrap_next()\nreleases this via dma_fence_chain_walk() -\u003e dma_fence_put().\n\nWhen virtio_gpu_do_fence_wait() fails and the function returns early\nfrom inside the loop, the cursor-\u003echain reference is never released.\nThis is the only caller in the entire kernel that does an early return\ninside dma_fence_unwrap_for_each.\n\nAdd dma_fence_put(itr.chain) before the early return."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:02.366Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/898bd0ccfed71651b881660c5d20ad73b5203174"
},
{
"url": "https://git.kernel.org/stable/c/73524e9f96a278b521f257a78a845c49eb522bc1"
},
{
"url": "https://git.kernel.org/stable/c/8348567a6afb24e2c9cafe8a321162d0eebe1411"
},
{
"url": "https://git.kernel.org/stable/c/c0fffc874c264292e769f26194a2a5e66ce31810"
},
{
"url": "https://git.kernel.org/stable/c/3f26bb732cc136ab20176697c92f32c9c84cb125"
}
],
"title": "drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53190",
"datePublished": "2026-06-25T08:39:02.366Z",
"dateReserved": "2026-06-09T07:44:35.390Z",
"dateUpdated": "2026-06-25T08:39:02.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31693 (GCVE-0-2026-31693)
Vulnerability from cvelistv5
Published
2026-04-30 11:47
Modified
2026-08-05 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
cifs: some missing initializations on replay
In several places in the code, we have a label to signify
the start of the code where a request can be replayed if
necessary. However, some of these places were missing the
necessary reinitializations of certain local variables
before replay.
This change makes sure that these variables get initialized
after the label.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 433042a91f9373241307725b52de573933ffedbf Version: 4f1fffa2376922f3d1d506e49c0fd445b023a28e Version: 4f1fffa2376922f3d1d506e49c0fd445b023a28e Version: 4f1fffa2376922f3d1d506e49c0fd445b023a28e Version: 4f1fffa2376922f3d1d506e49c0fd445b023a28e Version: 6.6.32 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c",
"fs/smb/client/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c854ab481ece4b3e5f4c2e8b22824f015ff874a5",
"status": "affected",
"version": "433042a91f9373241307725b52de573933ffedbf",
"versionType": "git"
},
{
"lessThan": "1d731e512134495e0ef490ade0e4d91dc0d515ec",
"status": "affected",
"version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
"versionType": "git"
},
{
"lessThan": "7c9ce68192eef14c777cb6ce17155d2eb2431aea",
"status": "affected",
"version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
"versionType": "git"
},
{
"lessThan": "c99e160938b627f6f28edee930e8abc157e84386",
"status": "affected",
"version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
"versionType": "git"
},
{
"lessThan": "14f66f44646333d2bfd7ece36585874fd72f8286",
"status": "affected",
"version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
"versionType": "git"
},
{
"lessThan": "6.6.128",
"status": "affected",
"version": "6.6.32",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2ops.c",
"fs/smb/client/smb2pdu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: some missing initializations on replay\n\nIn several places in the code, we have a label to signify\nthe start of the code where a request can be replayed if\nnecessary. However, some of these places were missing the\nnecessary reinitializations of certain local variables\nbefore replay.\n\nThis change makes sure that these variables get initialized\nafter the label."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable replay paths are reached through local CIFS filesystem operations such as ioctl(CIFS_QUERY_INFO), setxattr, and mkdir on an existing SMB/CIFS mount.\nAC:L - Replay is triggered by -EAGAIN/-ECONNABORTED reconnect conditions, which a controlled or malicious SMB server can force, and the local caller controls the ioctl/xattr/mkdir inputs across retries.\nPR:L - The strongest reachable path, PASSTHRU_QUERY_INFO in smb2_ioctl_query_info(), has no CAP_SYS_ADMIN check and can be invoked by an unprivileged user with access to a mounted CIFS file.\nUI:N - A local attacker can invoke the filesystem operation directly; no separate victim action is required once the CIFS mount is available.\nS:U - The vulnerability corrupts kernel memory in the same kernel security authority and does not cross a VM, IOMMU, or other separate security boundary.\nC:H - Missing reinitialization can leave freed heap pointers live across replay, creating use-after-free/double-free style memory corruption that can be leveraged for kernel memory disclosure.\nI:H - Kernel heap double-free/use-after-free conditions are memory corruption primitives that can plausibly be shaped into arbitrary write or control-flow compromise.\nA:H - Even without full exploitation, stale pointer reuse or double-free in these replay paths can crash or oops the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:31.188Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c854ab481ece4b3e5f4c2e8b22824f015ff874a5"
},
{
"url": "https://git.kernel.org/stable/c/1d731e512134495e0ef490ade0e4d91dc0d515ec"
},
{
"url": "https://git.kernel.org/stable/c/7c9ce68192eef14c777cb6ce17155d2eb2431aea"
},
{
"url": "https://git.kernel.org/stable/c/c99e160938b627f6f28edee930e8abc157e84386"
},
{
"url": "https://git.kernel.org/stable/c/14f66f44646333d2bfd7ece36585874fd72f8286"
}
],
"title": "cifs: some missing initializations on replay",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31693",
"datePublished": "2026-04-30T11:47:01.230Z",
"dateReserved": "2026-03-09T15:48:24.131Z",
"dateUpdated": "2026-08-05T12:24:31.188Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45869 (GCVE-0-2026-45869)
Vulnerability from cvelistv5
Published
2026-05-27 12:15
Modified
2026-05-27 12:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()
In `probe()`, `request_irq()` is called before allocating/registering a
`power_supply` handle. If an interrupt is fired between the call to
`request_irq()` and `power_supply_register()`, the `power_supply` handle
will be used uninitialized in `power_supply_changed()` in
`wm97xx_bat_update()` (triggered from the interrupt handler). This will
lead to a `NULL` pointer dereference since
Fix this racy `NULL` pointer dereference by making sure the IRQ is
requested _after_ the registration of the `power_supply` handle. Since
the IRQ is the last thing requests in the `probe()` now, remove the
error path for freeing it. Instead add one for unregistering the
`power_supply` handle when IRQ request fails.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7c87942aef52d2120e95ff1dec739998b9f95a78 Version: 7c87942aef52d2120e95ff1dec739998b9f95a78 Version: 7c87942aef52d2120e95ff1dec739998b9f95a78 Version: 7c87942aef52d2120e95ff1dec739998b9f95a78 Version: 7c87942aef52d2120e95ff1dec739998b9f95a78 Version: 7c87942aef52d2120e95ff1dec739998b9f95a78 Version: 7c87942aef52d2120e95ff1dec739998b9f95a78 Version: 7c87942aef52d2120e95ff1dec739998b9f95a78 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/wm97xx_battery.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d7b5391bb95505b3581c1fb77150c467ab92864",
"status": "affected",
"version": "7c87942aef52d2120e95ff1dec739998b9f95a78",
"versionType": "git"
},
{
"lessThan": "438f9a303ea8b55162b2d5376490c2ab3ec165a0",
"status": "affected",
"version": "7c87942aef52d2120e95ff1dec739998b9f95a78",
"versionType": "git"
},
{
"lessThan": "9b7d77cb046b4487e8e511e04e62b6f416ce845c",
"status": "affected",
"version": "7c87942aef52d2120e95ff1dec739998b9f95a78",
"versionType": "git"
},
{
"lessThan": "86183153c299e8bb1839e717286d6c6f39508a59",
"status": "affected",
"version": "7c87942aef52d2120e95ff1dec739998b9f95a78",
"versionType": "git"
},
{
"lessThan": "93bdf715d33cf5ee01c58e8546c2469c71ce082a",
"status": "affected",
"version": "7c87942aef52d2120e95ff1dec739998b9f95a78",
"versionType": "git"
},
{
"lessThan": "c0def811ad8d642dca9b6d31a198cc39f5f90837",
"status": "affected",
"version": "7c87942aef52d2120e95ff1dec739998b9f95a78",
"versionType": "git"
},
{
"lessThan": "dfaf235d5a6b60cbf115a14a656946303ad007b7",
"status": "affected",
"version": "7c87942aef52d2120e95ff1dec739998b9f95a78",
"versionType": "git"
},
{
"lessThan": "39fe0eac6d755ef215026518985fcf8de9360e9e",
"status": "affected",
"version": "7c87942aef52d2120e95ff1dec739998b9f95a78",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/wm97xx_battery.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.32"
},
{
"lessThan": "2.6.32",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()\n\nIn `probe()`, `request_irq()` is called before allocating/registering a\n`power_supply` handle. If an interrupt is fired between the call to\n`request_irq()` and `power_supply_register()`, the `power_supply` handle\nwill be used uninitialized in `power_supply_changed()` in\n`wm97xx_bat_update()` (triggered from the interrupt handler). This will\nlead to a `NULL` pointer dereference since\n\nFix this racy `NULL` pointer dereference by making sure the IRQ is\nrequested _after_ the registration of the `power_supply` handle. Since\nthe IRQ is the last thing requests in the `probe()` now, remove the\nerror path for freeing it. Instead add one for unregistering the\n`power_supply` handle when IRQ request fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:15:49.107Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d7b5391bb95505b3581c1fb77150c467ab92864"
},
{
"url": "https://git.kernel.org/stable/c/438f9a303ea8b55162b2d5376490c2ab3ec165a0"
},
{
"url": "https://git.kernel.org/stable/c/9b7d77cb046b4487e8e511e04e62b6f416ce845c"
},
{
"url": "https://git.kernel.org/stable/c/86183153c299e8bb1839e717286d6c6f39508a59"
},
{
"url": "https://git.kernel.org/stable/c/93bdf715d33cf5ee01c58e8546c2469c71ce082a"
},
{
"url": "https://git.kernel.org/stable/c/c0def811ad8d642dca9b6d31a198cc39f5f90837"
},
{
"url": "https://git.kernel.org/stable/c/dfaf235d5a6b60cbf115a14a656946303ad007b7"
},
{
"url": "https://git.kernel.org/stable/c/39fe0eac6d755ef215026518985fcf8de9360e9e"
}
],
"title": "power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45869",
"datePublished": "2026-05-27T12:15:49.107Z",
"dateReserved": "2026-05-13T15:03:33.080Z",
"dateUpdated": "2026-05-27T12:15:49.107Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46132 (GCVE-0-2026-46132)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-06-14 17:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo
rtnl_fill_vfinfo() declares struct ifla_vf_broadcast on the stack
without initialisation:
struct ifla_vf_broadcast vf_broadcast;
The struct contains a single fixed 32-byte field:
/* include/uapi/linux/if_link.h */
struct ifla_vf_broadcast {
__u8 broadcast[32];
};
The function then copies dev->broadcast into it using dev->addr_len
as the length:
memcpy(vf_broadcast.broadcast, dev->broadcast, dev->addr_len);
On Ethernet devices (the overwhelming majority of SR-IOV NICs)
dev->addr_len is 6, so only the first 6 bytes of broadcast[] are
written. The remaining 26 bytes retain whatever was previously on
the kernel stack. The full struct is then handed to userspace via:
nla_put(skb, IFLA_VF_BROADCAST,
sizeof(vf_broadcast), &vf_broadcast)
leaking up to 26 bytes of uninitialised kernel stack per VF per
RTM_GETLINK request, repeatable.
The other vf_* structs in the same function are explicitly zeroed
for exactly this reason - see the memset() calls for ivi,
vf_vlan_info, node_guid and port_guid a few lines above.
vf_broadcast was simply missed when it was added.
Reachability: any unprivileged local process can open AF_NETLINK /
NETLINK_ROUTE without capabilities and send RTM_GETLINK with an
IFLA_EXT_MASK attribute carrying RTEXT_FILTER_VF. The kernel walks
each VF and emits IFLA_VF_BROADCAST, leaking 26 bytes of stack per
VF per request. Stack residue at this call site can include return
addresses and transient sensitive data; KASAN with stack
instrumentation, or KMSAN, will flag the nla_put() when reproduced.
Zero the on-stack struct before the partial memcpy, matching the
existing pattern used for the other vf_* structs in the same
function.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 75345f888f700c4ab2448287e35d48c760b202e6 Version: 75345f888f700c4ab2448287e35d48c760b202e6 Version: 75345f888f700c4ab2448287e35d48c760b202e6 Version: 75345f888f700c4ab2448287e35d48c760b202e6 Version: 75345f888f700c4ab2448287e35d48c760b202e6 Version: 75345f888f700c4ab2448287e35d48c760b202e6 Version: 75345f888f700c4ab2448287e35d48c760b202e6 Version: 75345f888f700c4ab2448287e35d48c760b202e6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/rtnetlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "14271b401ec6a4bf0d88054106fc2956084717e1",
"status": "affected",
"version": "75345f888f700c4ab2448287e35d48c760b202e6",
"versionType": "git"
},
{
"lessThan": "cccce3190ba4356432b9f22369b56123d3d89f0d",
"status": "affected",
"version": "75345f888f700c4ab2448287e35d48c760b202e6",
"versionType": "git"
},
{
"lessThan": "a44fbb631cba646532f3948636626f81717365a7",
"status": "affected",
"version": "75345f888f700c4ab2448287e35d48c760b202e6",
"versionType": "git"
},
{
"lessThan": "0653c0516234c8258975d268a749115fc0f0ff00",
"status": "affected",
"version": "75345f888f700c4ab2448287e35d48c760b202e6",
"versionType": "git"
},
{
"lessThan": "c5b1b92ab7eff1a6e8c507ddde6fd02fabd0cfa8",
"status": "affected",
"version": "75345f888f700c4ab2448287e35d48c760b202e6",
"versionType": "git"
},
{
"lessThan": "fbe0e6197225e6a83cf113a67a4b425f8de0bcd5",
"status": "affected",
"version": "75345f888f700c4ab2448287e35d48c760b202e6",
"versionType": "git"
},
{
"lessThan": "38bcc21f52246badb3154b6158dcb381d98de011",
"status": "affected",
"version": "75345f888f700c4ab2448287e35d48c760b202e6",
"versionType": "git"
},
{
"lessThan": "4b9e327991815e128ad3af75c3a04630a63ce3e0",
"status": "affected",
"version": "75345f888f700c4ab2448287e35d48c760b202e6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/rtnetlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo\n\nrtnl_fill_vfinfo() declares struct ifla_vf_broadcast on the stack\nwithout initialisation:\n\n\tstruct ifla_vf_broadcast vf_broadcast;\n\nThe struct contains a single fixed 32-byte field:\n\n\t/* include/uapi/linux/if_link.h */\n\tstruct ifla_vf_broadcast {\n\t\t__u8 broadcast[32];\n\t};\n\nThe function then copies dev-\u003ebroadcast into it using dev-\u003eaddr_len\nas the length:\n\n\tmemcpy(vf_broadcast.broadcast, dev-\u003ebroadcast, dev-\u003eaddr_len);\n\nOn Ethernet devices (the overwhelming majority of SR-IOV NICs)\ndev-\u003eaddr_len is 6, so only the first 6 bytes of broadcast[] are\nwritten. The remaining 26 bytes retain whatever was previously on\nthe kernel stack. The full struct is then handed to userspace via:\n\n\tnla_put(skb, IFLA_VF_BROADCAST,\n\t\tsizeof(vf_broadcast), \u0026vf_broadcast)\n\nleaking up to 26 bytes of uninitialised kernel stack per VF per\nRTM_GETLINK request, repeatable.\n\nThe other vf_* structs in the same function are explicitly zeroed\nfor exactly this reason - see the memset() calls for ivi,\nvf_vlan_info, node_guid and port_guid a few lines above.\nvf_broadcast was simply missed when it was added.\n\nReachability: any unprivileged local process can open AF_NETLINK /\nNETLINK_ROUTE without capabilities and send RTM_GETLINK with an\nIFLA_EXT_MASK attribute carrying RTEXT_FILTER_VF. The kernel walks\neach VF and emits IFLA_VF_BROADCAST, leaking 26 bytes of stack per\nVF per request. Stack residue at this call site can include return\naddresses and transient sensitive data; KASAN with stack\ninstrumentation, or KMSAN, will flag the nla_put() when reproduced.\n\nZero the on-stack struct before the partial memcpy, matching the\nexisting pattern used for the other vf_* structs in the same\nfunction."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:56:50.522Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/14271b401ec6a4bf0d88054106fc2956084717e1"
},
{
"url": "https://git.kernel.org/stable/c/cccce3190ba4356432b9f22369b56123d3d89f0d"
},
{
"url": "https://git.kernel.org/stable/c/a44fbb631cba646532f3948636626f81717365a7"
},
{
"url": "https://git.kernel.org/stable/c/0653c0516234c8258975d268a749115fc0f0ff00"
},
{
"url": "https://git.kernel.org/stable/c/c5b1b92ab7eff1a6e8c507ddde6fd02fabd0cfa8"
},
{
"url": "https://git.kernel.org/stable/c/fbe0e6197225e6a83cf113a67a4b425f8de0bcd5"
},
{
"url": "https://git.kernel.org/stable/c/38bcc21f52246badb3154b6158dcb381d98de011"
},
{
"url": "https://git.kernel.org/stable/c/4b9e327991815e128ad3af75c3a04630a63ce3e0"
}
],
"title": "net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46132",
"datePublished": "2026-05-28T09:35:47.047Z",
"dateReserved": "2026-05-13T15:03:33.099Z",
"dateUpdated": "2026-06-14T17:56:50.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53237 (GCVE-0-2026-53237)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpio: mvebu: fix NULL pointer dereference in suspend/resume
mvebu_pwm_suspend() and mvebu_pwm_resume() are called for all GPIO
banks during suspend/resume, but not all banks have PWM functionality.
GPIO banks without PWM have mvchip->mvpwm set to NULL.
Calling mvebu_pwm_suspend() with mvpwm == NULL causes a NULL pointer
dereference when it tries to access mvpwm->blink_select.
Unable to handle kernel NULL pointer dereference at virtual address 00000020 when write
[00000020] *pgd=00000000
Internal error: Oops: 815 [#1] PREEMPT ARM
Modules linked in:
CPU: 0 UID: 0 PID: 406 Comm: sh Not tainted 6.12.74-rt12-yocto-standard-g4e96f98fb7db-dirty #353
Hardware name: Marvell Armada 370/XP (Device Tree)
PC is at regmap_mmio_read+0x38/0x54
LR is at regmap_mmio_read+0x38/0x54
pc : [<c05fd2ac>] lr : [<c05fd2ac>] psr: 200f0013
sp : f0c11d10 ip : 00000000 fp : c100d2f0
r10: c14fb854 r9 : 00000000 r8 : 00000000
r7 : c1799c00 r6 : 00000020 r5 : 00000020 r4 : c179c7c0
r3 : f0a231a0 r2 : 00000020 r1 : 00000020 r0 : 00000000
Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
Control: 10c5387d Table: 135ec059 DAC: 00000051
Call trace:
regmap_mmio_read from _regmap_bus_reg_read+0x78/0xac
_regmap_bus_reg_read from _regmap_read+0x60/0x154
_regmap_read from regmap_read+0x3c/0x60
regmap_read from mvebu_gpio_suspend+0xa4/0x14c
mvebu_gpio_suspend from dpm_run_callback+0x54/0x180
dpm_run_callback from device_suspend+0x124/0x630
device_suspend from dpm_suspend+0x124/0x270
dpm_suspend from dpm_suspend_start+0x64/0x6c
dpm_suspend_start from suspend_devices_and_enter+0x140/0x8e8
suspend_devices_and_enter from pm_suspend+0x2fc/0x308
pm_suspend from state_store+0x6c/0xc8
state_store from kernfs_fop_write_iter+0x10c/0x1f8
kernfs_fop_write_iter from vfs_write+0x270/0x468
vfs_write from ksys_write+0x70/0xf0
ksys_write from ret_fast_syscall+0x0/0x54
Add a NULL check for mvchip->mvpwm before calling the PWM
suspend/resume functions.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-mvebu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7db09011ce62162d72897fc4856b4425245dfe35",
"status": "affected",
"version": "757642f9a584e893f3f4e50c99b674ee8a3ed363",
"versionType": "git"
},
{
"lessThan": "4ef24338eda3c7e96d6f94a988266ff16ed3985d",
"status": "affected",
"version": "757642f9a584e893f3f4e50c99b674ee8a3ed363",
"versionType": "git"
},
{
"lessThan": "6136c1474db88272231573e222896e1998d34662",
"status": "affected",
"version": "757642f9a584e893f3f4e50c99b674ee8a3ed363",
"versionType": "git"
},
{
"lessThan": "c9677a9274ffb44987ec209dc8ec9f2d34946956",
"status": "affected",
"version": "757642f9a584e893f3f4e50c99b674ee8a3ed363",
"versionType": "git"
},
{
"lessThan": "b9ad50d7505ebd48282ec3630258dc820fc85c81",
"status": "affected",
"version": "757642f9a584e893f3f4e50c99b674ee8a3ed363",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-mvebu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mvebu: fix NULL pointer dereference in suspend/resume\n\nmvebu_pwm_suspend() and mvebu_pwm_resume() are called for all GPIO\nbanks during suspend/resume, but not all banks have PWM functionality.\nGPIO banks without PWM have mvchip-\u003emvpwm set to NULL.\n\nCalling mvebu_pwm_suspend() with mvpwm == NULL causes a NULL pointer\ndereference when it tries to access mvpwm-\u003eblink_select.\n\n Unable to handle kernel NULL pointer dereference at virtual address 00000020 when write\n [00000020] *pgd=00000000\n Internal error: Oops: 815 [#1] PREEMPT ARM\n Modules linked in:\n CPU: 0 UID: 0 PID: 406 Comm: sh Not tainted 6.12.74-rt12-yocto-standard-g4e96f98fb7db-dirty #353\n Hardware name: Marvell Armada 370/XP (Device Tree)\n PC is at regmap_mmio_read+0x38/0x54\n LR is at regmap_mmio_read+0x38/0x54\n pc : [\u003cc05fd2ac\u003e] lr : [\u003cc05fd2ac\u003e] psr: 200f0013\n sp : f0c11d10 ip : 00000000 fp : c100d2f0\n r10: c14fb854 r9 : 00000000 r8 : 00000000\n r7 : c1799c00 r6 : 00000020 r5 : 00000020 r4 : c179c7c0\n r3 : f0a231a0 r2 : 00000020 r1 : 00000020 r0 : 00000000\n Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none\n Control: 10c5387d Table: 135ec059 DAC: 00000051\n Call trace:\n regmap_mmio_read from _regmap_bus_reg_read+0x78/0xac\n _regmap_bus_reg_read from _regmap_read+0x60/0x154\n _regmap_read from regmap_read+0x3c/0x60\n regmap_read from mvebu_gpio_suspend+0xa4/0x14c\n mvebu_gpio_suspend from dpm_run_callback+0x54/0x180\n dpm_run_callback from device_suspend+0x124/0x630\n device_suspend from dpm_suspend+0x124/0x270\n dpm_suspend from dpm_suspend_start+0x64/0x6c\n dpm_suspend_start from suspend_devices_and_enter+0x140/0x8e8\n suspend_devices_and_enter from pm_suspend+0x2fc/0x308\n pm_suspend from state_store+0x6c/0xc8\n state_store from kernfs_fop_write_iter+0x10c/0x1f8\n kernfs_fop_write_iter from vfs_write+0x270/0x468\n vfs_write from ksys_write+0x70/0xf0\n ksys_write from ret_fast_syscall+0x0/0x54\n\nAdd a NULL check for mvchip-\u003emvpwm before calling the PWM\nsuspend/resume functions."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:33.833Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7db09011ce62162d72897fc4856b4425245dfe35"
},
{
"url": "https://git.kernel.org/stable/c/4ef24338eda3c7e96d6f94a988266ff16ed3985d"
},
{
"url": "https://git.kernel.org/stable/c/6136c1474db88272231573e222896e1998d34662"
},
{
"url": "https://git.kernel.org/stable/c/c9677a9274ffb44987ec209dc8ec9f2d34946956"
},
{
"url": "https://git.kernel.org/stable/c/b9ad50d7505ebd48282ec3630258dc820fc85c81"
}
],
"title": "gpio: mvebu: fix NULL pointer dereference in suspend/resume",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53237",
"datePublished": "2026-06-25T08:39:33.833Z",
"dateReserved": "2026-06-09T07:44:35.393Z",
"dateUpdated": "2026-06-25T08:39:33.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53186 (GCVE-0-2026-53186)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/srp: bound SRP_RSP sense copy by the received length
srp_process_rsp() copies sense data from rsp->data + resp_data_len,
where resp_data_len is the full 32-bit value supplied by the SRP target
and is never checked against the number of bytes actually received
(wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so
at most 96 bytes are copied, but the source offset is not bounded.
A malicious or compromised SRP target on the InfiniBand/RoCE fabric that
the initiator has logged into can return an SRP_RSP with
SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer
is allocated at the target-chosen max_ti_iu_len, so the source of the
sense copy lands past the bytes actually received; with resp_data_len
near 0xFFFFFFFF it is gigabytes past the buffer and the read faults.
Copy the sense data only if it has not been truncated, that is, only if
the response header, the response data, and the sense region fit within
the bytes actually received; otherwise drop the sense and log. The
in-tree iSER and NVMe-RDMA receive paths already bound their parse by
wc->byte_len; this brings ib_srp into line with them.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: aef9ec39c47f0cece886ddd6b53c440321e0b2a6 Version: aef9ec39c47f0cece886ddd6b53c440321e0b2a6 Version: aef9ec39c47f0cece886ddd6b53c440321e0b2a6 Version: aef9ec39c47f0cece886ddd6b53c440321e0b2a6 Version: aef9ec39c47f0cece886ddd6b53c440321e0b2a6 Version: aef9ec39c47f0cece886ddd6b53c440321e0b2a6 Version: aef9ec39c47f0cece886ddd6b53c440321e0b2a6 Version: aef9ec39c47f0cece886ddd6b53c440321e0b2a6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/srp/ib_srp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3889517c2ec7f364914aea8209abfff735f7ecde",
"status": "affected",
"version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6",
"versionType": "git"
},
{
"lessThan": "ed77cc819ad631264787cade5ae5ec4c535ec6bb",
"status": "affected",
"version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6",
"versionType": "git"
},
{
"lessThan": "0b9ee09d5e849591f17d98c078033dadea967293",
"status": "affected",
"version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6",
"versionType": "git"
},
{
"lessThan": "0d64bc200ebe4f275b27438c6e593903e0b16fe1",
"status": "affected",
"version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6",
"versionType": "git"
},
{
"lessThan": "2015038195939eac54a1ee83c9d98ef1a8ccbbce",
"status": "affected",
"version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6",
"versionType": "git"
},
{
"lessThan": "f92a285db7ff6e598591ccbfb551be155c5f4d57",
"status": "affected",
"version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6",
"versionType": "git"
},
{
"lessThan": "3523e53ff95f1837ec3f57ff7558532bcb2661b7",
"status": "affected",
"version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6",
"versionType": "git"
},
{
"lessThan": "13e91fd076306f5d0cdfa14f53d69e37274723c4",
"status": "affected",
"version": "aef9ec39c47f0cece886ddd6b53c440321e0b2a6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/srp/ib_srp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.15"
},
{
"lessThan": "2.6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/srp: bound SRP_RSP sense copy by the received length\n\nsrp_process_rsp() copies sense data from rsp-\u003edata + resp_data_len,\nwhere resp_data_len is the full 32-bit value supplied by the SRP target\nand is never checked against the number of bytes actually received\n(wc-\u003ebyte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so\nat most 96 bytes are copied, but the source offset is not bounded.\n\nA malicious or compromised SRP target on the InfiniBand/RoCE fabric that\nthe initiator has logged into can return an SRP_RSP with\nSRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer\nis allocated at the target-chosen max_ti_iu_len, so the source of the\nsense copy lands past the bytes actually received; with resp_data_len\nnear 0xFFFFFFFF it is gigabytes past the buffer and the read faults.\n\nCopy the sense data only if it has not been truncated, that is, only if\nthe response header, the response data, and the sense region fit within\nthe bytes actually received; otherwise drop the sense and log. The\nin-tree iSER and NVMe-RDMA receive paths already bound their parse by\nwc-\u003ebyte_len; this brings ib_srp into line with them."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious or compromised SRP target can trigger this by sending an SRP_RSP over the established RDMA network session to the initiator. The vulnerable parsing is reached from remote peer-controlled RDMA receive completions, not from local or physical access.\nAC:L - The target controls SRP_RSP flags and length fields and sees the command tag in each SRP_CMD, so it can craft a matching response with SRP_RSP_FLAG_SNSVALID and an oversized resp_data_len. No race or hard-to-control environmental condition is required.\nPR:N - The attacker needs control of the remote SRP target or a compromised target on the fabric, but no privileges on the vulnerable initiator host. The vulnerable receive path processes target responses after the initiator is connected.\nUI:N - Once the initiator is logged into the target, the target can trigger the bug by responding to normal SCSI commands or scan traffic. No additional victim user action is needed for the malicious SRP_RSP to be processed.\nS:U - The impact is within the vulnerable kernel instance processing the SRP response. This is not a guest-to-host escape, IOMMU bypass, or other cross-authority boundary change.\nC:H - The target-controlled offset can make the kernel read out of bounds from memory beyond the SRP receive buffer, with up to SCSI_SENSE_BUFFERSIZE bytes copied into sense data. Under the required higher-severity rule, this out-of-bounds kernel read is treated as high confidentiality impact.\nI:N - The bug is an out-of-bounds read source for a copy into the intended SCSI sense buffer, not an out-of-bounds write or control-flow overwrite. The target can already provide arbitrary valid sense data, so this flaw does not add a distinct kernel integrity primitive.\nA:H - With a large resp_data_len, the copy source can land far beyond the receive buffer and fault in kernel context, causing an oops or panic. The malicious target can repeat this by sending crafted responses."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:53.227Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3889517c2ec7f364914aea8209abfff735f7ecde"
},
{
"url": "https://git.kernel.org/stable/c/ed77cc819ad631264787cade5ae5ec4c535ec6bb"
},
{
"url": "https://git.kernel.org/stable/c/0b9ee09d5e849591f17d98c078033dadea967293"
},
{
"url": "https://git.kernel.org/stable/c/0d64bc200ebe4f275b27438c6e593903e0b16fe1"
},
{
"url": "https://git.kernel.org/stable/c/2015038195939eac54a1ee83c9d98ef1a8ccbbce"
},
{
"url": "https://git.kernel.org/stable/c/f92a285db7ff6e598591ccbfb551be155c5f4d57"
},
{
"url": "https://git.kernel.org/stable/c/3523e53ff95f1837ec3f57ff7558532bcb2661b7"
},
{
"url": "https://git.kernel.org/stable/c/13e91fd076306f5d0cdfa14f53d69e37274723c4"
}
],
"title": "RDMA/srp: bound SRP_RSP sense copy by the received length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53186",
"datePublished": "2026-06-25T08:38:59.508Z",
"dateReserved": "2026-06-09T07:44:35.390Z",
"dateUpdated": "2026-08-05T12:33:53.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43279 (GCVE-0-2026-43279)
Vulnerability from cvelistv5
Published
2026-05-06 11:29
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Add sanity check for OOB writes at silencing
At silencing the playback URB packets in the implicit fb mode before
the actual playback, we blindly assume that the received packets fit
with the buffer size. But when the setup in the capture stream
differs from the playback stream (e.g. due to the USB core limitation
of max packet size), such an inconsistency may lead to OOB writes to
the buffer, resulting in a crash.
For addressing it, add a sanity check of the transfer buffer size at
prepare_silent_urb(), and stop the data copy if the received data
overflows. Also, report back the transfer error properly from there,
too.
Note that this doesn't fix the root cause of the playback error
itself, but this merely covers the kernel Oops.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c75a8a7ae565d7cd9baa87a504ba9162e355b4b0 Version: c75a8a7ae565d7cd9baa87a504ba9162e355b4b0 Version: c75a8a7ae565d7cd9baa87a504ba9162e355b4b0 Version: c75a8a7ae565d7cd9baa87a504ba9162e355b4b0 Version: c75a8a7ae565d7cd9baa87a504ba9162e355b4b0 Version: c75a8a7ae565d7cd9baa87a504ba9162e355b4b0 Version: c75a8a7ae565d7cd9baa87a504ba9162e355b4b0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/endpoint.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f",
"status": "affected",
"version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
"versionType": "git"
},
{
"lessThan": "780dc57794a217b49994fa1d0b42465fb10a00aa",
"status": "affected",
"version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
"versionType": "git"
},
{
"lessThan": "8995fc0e00b3fee9bf7ecb3d836b635b730c1049",
"status": "affected",
"version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
"versionType": "git"
},
{
"lessThan": "fc9e5af60dc199051dc202ae78e1fe76a9977a5e",
"status": "affected",
"version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
"versionType": "git"
},
{
"lessThan": "6af16f1b8649df4c00d6ced924bdd8b72c885b6a",
"status": "affected",
"version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
"versionType": "git"
},
{
"lessThan": "ccaf9296763be4f76b59e2cac377006016c34435",
"status": "affected",
"version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
"versionType": "git"
},
{
"lessThan": "fba2105a157fffcf19825e4eea498346738c9948",
"status": "affected",
"version": "c75a8a7ae565d7cd9baa87a504ba9162e355b4b0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/endpoint.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Add sanity check for OOB writes at silencing\n\nAt silencing the playback URB packets in the implicit fb mode before\nthe actual playback, we blindly assume that the received packets fit\nwith the buffer size. But when the setup in the capture stream\ndiffers from the playback stream (e.g. due to the USB core limitation\nof max packet size), such an inconsistency may lead to OOB writes to\nthe buffer, resulting in a crash.\n\nFor addressing it, add a sanity check of the transfer buffer size at\nprepare_silent_urb(), and stop the data copy if the received data\noverflows. Also, report back the transfer error properly from there,\ntoo.\n\nNote that this doesn\u0027t fix the root cause of the playback error\nitself, but this merely covers the kernel Oops."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is exercised through local ALSA PCM device-file operations such as open, hw_params, prepare, and trigger/write on a USB audio PCM device. It is not network reachable, but a local user can drive the stream path once a susceptible USB audio device is present.\nAC:L - There is no race or hard-to-hit timing condition; the overflow follows deterministically when implicit-feedback packet sizes exceed the playback URB buffer. A malicious or affected device plus chosen stream parameters can repeatedly drive the bad packet-size path.\nPR:L - The ALSA PCM path does not require CAP_SYS_ADMIN or another kernel capability, only permission to access the relevant /dev/snd PCM node as a normal local audio user/session. User namespaces are not needed.\nUI:N - A local attacker with PCM device access can open, configure, and start the stream directly. No separate victim action is required for that local attack path.\nS:U - The corruption occurs within the host kernel USB audio/ALSA subsystem and impacts the same kernel security authority. It is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is an out-of-bounds write into kernel USB transfer-buffer memory, which is kernel memory corruption. Even though the reported symptom is an oops, such corruption can plausibly be leveraged for information disclosure.\nI:H - The vulnerable code writes past the allocated URB transfer buffer while preparing silent playback packets. Out-of-bounds kernel writes are high-integrity impact because they can corrupt adjacent kernel state and potentially enable control-flow or data modification.\nA:H - The commit explicitly describes resulting kernel oops/crash behavior, and the fix only bounds the write to prevent that crash. The trigger can be repeated by starting the affected stream again."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:01.240Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fa01973bb79d70c4736b6a4b2de99fbb2cbc8d1f"
},
{
"url": "https://git.kernel.org/stable/c/780dc57794a217b49994fa1d0b42465fb10a00aa"
},
{
"url": "https://git.kernel.org/stable/c/8995fc0e00b3fee9bf7ecb3d836b635b730c1049"
},
{
"url": "https://git.kernel.org/stable/c/fc9e5af60dc199051dc202ae78e1fe76a9977a5e"
},
{
"url": "https://git.kernel.org/stable/c/6af16f1b8649df4c00d6ced924bdd8b72c885b6a"
},
{
"url": "https://git.kernel.org/stable/c/ccaf9296763be4f76b59e2cac377006016c34435"
},
{
"url": "https://git.kernel.org/stable/c/fba2105a157fffcf19825e4eea498346738c9948"
}
],
"title": "ALSA: usb-audio: Add sanity check for OOB writes at silencing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43279",
"datePublished": "2026-05-06T11:29:00.844Z",
"dateReserved": "2026-05-01T14:12:55.998Z",
"dateUpdated": "2026-08-05T12:27:01.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46244 (GCVE-0-2026-46244)
Vulnerability from cvelistv5
Published
2026-06-03 15:48
Modified
2026-08-19 12:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_inner: Fix IPv6 inner_thoff desync
In nft_inner_parse_l2l3(), when processing inner IPv6 packets,
ipv6_find_hdr() correctly computes the transport header offset
traversing all extension headers, but the result is immediately
overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only
accounts for the IPv6 base header. This creates a desync between
inner_thoff (wrong — points to extension header start) and l4proto
(correct — e.g., IPPROTO_TCP), enabling transport header forgery
and potential firewall bypass. This issue affects stable versions
from Linux 6.2.
For comparison, the normal (non-inner) IPv6 path correctly
preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite
ensures that ipv6_find_hdr()'s calculated transport header offset is
preserved, thereby fixing the desynchronization.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.30.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.84.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.22.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.135.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.125.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus:9.6"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s netfilter subsystem, specifically within the nft_inner module. This vulnerability arises from an incorrect handling of IPv6 inner packet processing, where the transport header offset (inner_thoff) becomes desynchronized from the Layer 4 protocol (l4proto). A remote attacker could exploit this desynchronization to perform transport header forgery, potentially leading to a firewall bypass and allowing unauthorized network access."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-823",
"description": "Use of Out-of-range Pointer Offset",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T12:05:18.939Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-46244"
},
{
"name": "RHBZ#2484451",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484451"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46244.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33215"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34911"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34443"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34094"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36018"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55618"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:56225"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55763"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:33215: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:34911: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:34443: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:34094: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:36018: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:55618: Red Hat Enterprise Linux BaseOS (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:56225: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:55763: Red Hat Enterprise Linux BaseOS (v. 9)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-03T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-03T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_inner.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c161ad9157f5a0429b5ff94d9770faf3bf48d273",
"status": "affected",
"version": "3a07327d10a09379315c844c63f27941f5081e0a",
"versionType": "git"
},
{
"lessThan": "870d59e2cf218e7418491e26bad768cb16654582",
"status": "affected",
"version": "3a07327d10a09379315c844c63f27941f5081e0a",
"versionType": "git"
},
{
"lessThan": "689bbf48c1f45130086ae1c46ab83ea4c753c601",
"status": "affected",
"version": "3a07327d10a09379315c844c63f27941f5081e0a",
"versionType": "git"
},
{
"lessThan": "d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce",
"status": "affected",
"version": "3a07327d10a09379315c844c63f27941f5081e0a",
"versionType": "git"
},
{
"lessThan": "b6a91f68ebfed9c38e0e9150f58a9b85da07181c",
"status": "affected",
"version": "3a07327d10a09379315c844c63f27941f5081e0a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_inner.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_inner: Fix IPv6 inner_thoff desync\n\nIn nft_inner_parse_l2l3(), when processing inner IPv6 packets,\nipv6_find_hdr() correctly computes the transport header offset\ntraversing all extension headers, but the result is immediately\noverwritten with nhoff + sizeof(_ip6h) (40 bytes), which only\naccounts for the IPv6 base header. This creates a desync between\ninner_thoff (wrong \u2014 points to extension header start) and l4proto\n(correct \u2014 e.g., IPPROTO_TCP), enabling transport header forgery\nand potential firewall bypass. This issue affects stable versions\nfrom Linux 6.2.\n\nFor comparison, the normal (non-inner) IPv6 path correctly\npreserves ipv6_find_hdr()\u0027s result. Removing the incorrect overwrite\nensures that ipv6_find_hdr()\u0027s calculated transport header offset is\npreserved, thereby fixing the desynchronization."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Exploitation is triggered when a remote attacker sends crafted tunneled packets (GRE/Geneve/VXLAN/UDP/TCP) that are evaluated on netfilter ingress/forward hooks, not via netlink rule installation.\nAC:L - The attacker fully controls packet layout including inner IPv6 extension headers and can reliably desynchronize inner_thoff from the real transport header without races or rare layout conditions.\nPR:N - The attacker needs no privileges on the victim; only pre-existing nftables rules using the inner expression must be present, which is victim infrastructure rather than attacker privilege.\nUI:N - No victim user action is required beyond normal network traffic processing once vulnerable firewall rules exist.\nS:U - Impact is bypass of host netfilter policy within the kernel network security boundary, not VM escape, container breakout, or crossing a separate hardware/IOMMU authority.\nC:H - Bypassing inner-header filtering can expose confidential services and data on protected internal networks that the firewall was meant to block from the attacker\u2019s network position.\nI:H - The desync allows forged inner transport matches so traffic can be misclassified, defeating integrity of nftables filtering decisions and permitting unauthorized flows.\nA:N - The bug misdirects skb_copy_bits reads within attacker-supplied packet data and yields NFT_BREAK on failure; it does not corrupt kernel memory or cause panics/oops."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:43.795Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c161ad9157f5a0429b5ff94d9770faf3bf48d273"
},
{
"url": "https://git.kernel.org/stable/c/870d59e2cf218e7418491e26bad768cb16654582"
},
{
"url": "https://git.kernel.org/stable/c/689bbf48c1f45130086ae1c46ab83ea4c753c601"
},
{
"url": "https://git.kernel.org/stable/c/d0f98a3617f6ae5b1e95cde1e68e7ead4a1279ce"
},
{
"url": "https://git.kernel.org/stable/c/b6a91f68ebfed9c38e0e9150f58a9b85da07181c"
}
],
"title": "netfilter: nft_inner: Fix IPv6 inner_thoff desync",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46244",
"datePublished": "2026-06-03T15:48:59.049Z",
"dateReserved": "2026-05-13T15:03:33.107Z",
"dateUpdated": "2026-08-19T12:05:18.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43198 (GCVE-0-2026-43198)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix potential race in tcp_v6_syn_recv_sock()
Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock()
is done too late.
After tcp_v4_syn_recv_sock(), the child socket is already visible
from TCP ehash table and other cpus might use it.
Since newinet->pinet6 is still pointing to the listener ipv6_pinfo
bad things can happen as syzbot found.
Move the problematic code in tcp_v6_mapped_child_init()
and call this new helper from tcp_v4_syn_recv_sock() before
the ehash insertion.
This allows the removal of one tcp_sync_mss(), since
tcp_v4_syn_recv_sock() will call it with the correct
context.
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.28.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.84.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_extras_rt_els:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.10.0-1160.155.1.rt56.1307.el7",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.10.0-1160.155.1.el7",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.140.1.rt7.481.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.140.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.197.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.197.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.199.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.199.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.150.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.150.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.20.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.179.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.179.1.rt14.464.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.135.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.125.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel. A race condition exists in the TCP (Transmission Control Protocol) IPv6 (Internet Protocol version 6) socket handling, specifically within the tcp_v6_syn_recv_sock() function. This occurs because a child socket becomes visible in the TCP hash table before its IPv6-specific information is fully initialized. A remote attacker could potentially exploit this timing window, leading to an unstable system state or unexpected behavior, which may result in a denial of service (DoS)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-821",
"description": "Incorrect Synchronization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T12:04:45.125Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-43198"
},
{
"name": "RHBZ#2467228",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467228"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43198.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36216"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41236"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33215"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30129"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36073"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34443"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34094"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33285"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36349"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35896"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35894"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35863"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36348"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35904"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:36216: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:41236: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:33215: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:30129: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:36073: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:34443: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:34094: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:33285: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:36349: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:35896: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:35894: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:35863: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:36348: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:35904: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-06T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-06T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: tcp: fix potential race in tcp_v6_syn_recv_sock()",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/inet_connection_sock.h",
"include/net/tcp.h",
"net/ipv4/syncookies.c",
"net/ipv4/tcp_fastopen.c",
"net/ipv4/tcp_ipv4.c",
"net/ipv4/tcp_minisocks.c",
"net/ipv6/tcp_ipv6.c",
"net/mptcp/subflow.c",
"net/smc/af_smc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fe89b2f05b854847784f91127319172945c1fadd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7178e2a8027423b2af17ab95df73a749a5b72e5b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "858d2a4f67ff69e645a43487ef7ea7f28f06deae",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/inet_connection_sock.h",
"include/net/tcp.h",
"net/ipv4/syncookies.c",
"net/ipv4/tcp_fastopen.c",
"net/ipv4/tcp_ipv4.c",
"net/ipv4/tcp_minisocks.c",
"net/ipv6/tcp_ipv6.c",
"net/mptcp/subflow.c",
"net/smc/af_smc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix potential race in tcp_v6_syn_recv_sock()\n\nCode in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock()\nis done too late.\n\nAfter tcp_v4_syn_recv_sock(), the child socket is already visible\nfrom TCP ehash table and other cpus might use it.\n\nSince newinet-\u003epinet6 is still pointing to the listener ipv6_pinfo\nbad things can happen as syzbot found.\n\nMove the problematic code in tcp_v6_mapped_child_init()\nand call this new helper from tcp_v4_syn_recv_sock() before\nthe ehash insertion.\n\nThis allows the removal of one tcp_sync_mss(), since\ntcp_v4_syn_recv_sock() will call it with the correct\ncontext."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - An unauthenticated remote peer can reach this through ordinary IPv4 TCP packets delivered to a dual-stack IPv6 listener with IPV6_V6ONLY disabled, which is the default on Linux. The vulnerable path is in the packet receive and TCP handshake path before any application authentication.\nAC:L - The race can be exercised by driving many concurrent TCP handshakes and follow-up packets against the same listener, so the attacker controls the relevant network-side timing. Under the required conservative rule, this is Low complexity.\nPR:N - No local account, capability, or prior authentication is required to send TCP connection attempts to an exposed listening service. The vulnerable kernel code runs before the connection is handed to userspace.\nUI:N - No victim user action is needed beyond the target system already running a reachable dual-stack TCP listener. Packets alone trigger the vulnerable path.\nS:U - The impact remains within the target kernel and its networking state. This is not a VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The bug leaves a newly created child socket temporarily using the listener\u0027s IPv6 private pointer, allowing concurrent reads of the wrong kernel socket private area and associated pointer-bearing state. Conservatively, this kernel memory corruption/race is treated as capable of high confidentiality impact.\nI:H - Operations on the child can write through the stale pinet6 pointer into the listener\u0027s IPv6 state, and related cleanup paths can affect pointer-backed socket options. Conservatively, this is high integrity impact because kernel socket state can be corrupted.\nA:H - Corrupting or freeing the wrong socket IPv6 state can lead to kernel warnings, oopses, or crashes. The trigger can be repeated remotely with connection floods, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:29.717Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fe89b2f05b854847784f91127319172945c1fadd"
},
{
"url": "https://git.kernel.org/stable/c/7178e2a8027423b2af17ab95df73a749a5b72e5b"
},
{
"url": "https://git.kernel.org/stable/c/858d2a4f67ff69e645a43487ef7ea7f28f06deae"
}
],
"title": "tcp: fix potential race in tcp_v6_syn_recv_sock()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43198",
"datePublished": "2026-05-06T11:28:05.569Z",
"dateReserved": "2026-05-01T14:12:55.992Z",
"dateUpdated": "2026-08-05T12:26:29.717Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53209 (GCVE-0-2026-53209)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend
Existing advertising instances can already hold the maximum extended
advertising payload. When hci_adv_bcast_annoucement() prepends the
Broadcast Announcement service data to that payload, the combined data
may no longer fit in the temporary buffer used to rebuild the
advertising data.
Reject that case before copying the existing payload and report the
failure through the device log. This keeps the existing advertising
data intact and avoids overrunning the temporary buffer.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 63f365eb4d1668a04070151b555d55a07ede8d4b Version: c621211b308816889f0a3246de448bfcef8ab3ab Version: 907ef6e12fb558a0763e894311eb245a94c192dd Version: 5725bc608252050ed8a4d47d59225b7dd73474c8 Version: 5725bc608252050ed8a4d47d59225b7dd73474c8 Version: 5725bc608252050ed8a4d47d59225b7dd73474c8 Version: 15da883c010cbc2a84aec1738b6ad6ee477846de Version: 6.1.142 ≤ Version: 6.6.94 ≤ Version: 6.12.34 ≤ Version: 6.15.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "10b0e832cc05d7aef4b92bed912cbd4a395d0862",
"status": "affected",
"version": "63f365eb4d1668a04070151b555d55a07ede8d4b",
"versionType": "git"
},
{
"lessThan": "1338ee049a8910ba6c9cee963920e978e6893c7d",
"status": "affected",
"version": "c621211b308816889f0a3246de448bfcef8ab3ab",
"versionType": "git"
},
{
"lessThan": "02f50e8bb69f9b22516163a09922f5537d3b12d1",
"status": "affected",
"version": "907ef6e12fb558a0763e894311eb245a94c192dd",
"versionType": "git"
},
{
"lessThan": "dafc9f57140e66a10945127aa7433c3d715dc253",
"status": "affected",
"version": "5725bc608252050ed8a4d47d59225b7dd73474c8",
"versionType": "git"
},
{
"lessThan": "cdd8bbdbee763fdf5bf343e6f7d4e79347739f62",
"status": "affected",
"version": "5725bc608252050ed8a4d47d59225b7dd73474c8",
"versionType": "git"
},
{
"lessThan": "5c65b96b549ea2dcfde497436bf9e048deb87758",
"status": "affected",
"version": "5725bc608252050ed8a4d47d59225b7dd73474c8",
"versionType": "git"
},
{
"status": "affected",
"version": "15da883c010cbc2a84aec1738b6ad6ee477846de",
"versionType": "git"
},
{
"lessThan": "6.1.176",
"status": "affected",
"version": "6.1.142",
"versionType": "semver"
},
{
"lessThan": "6.6.143",
"status": "affected",
"version": "6.6.94",
"versionType": "semver"
},
{
"lessThan": "6.12.94",
"status": "affected",
"version": "6.12.34",
"versionType": "semver"
},
{
"lessThan": "6.16",
"status": "affected",
"version": "6.15.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "6.1.142",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.6.94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.12.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: reject oversized Broadcast Announcement prepend\n\nExisting advertising instances can already hold the maximum extended\nadvertising payload. When hci_adv_bcast_annoucement() prepends the\nBroadcast Announcement service data to that payload, the combined data\nmay no longer fit in the temporary buffer used to rebuild the\nadvertising data.\n\nReject that case before copying the existing payload and report the\nfailure through the device log. This keeps the existing advertising\ndata intact and avoids overrunning the temporary buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local AF_BLUETOOTH HCI management/ISO socket operations that configure advertising data and start BIS/periodic advertising. It is not reachable directly from Bluetooth radio packets sent by an adjacent attacker.\nAC:L - The attacker can choose the advertising payload length/content, omit an existing Broadcast Announcement, provide BASE data that creates Basic Audio Announcement periodic data, and trigger the prepend deterministically. The needed Bluetooth LE Audio/extended advertising support is a reasonable affected deployment condition.\nPR:L - The advertising setup path requires a trusted HCI management socket via CAP_NET_ADMIN, but the code uses capable() and is therefore reachable by a basic local user with CAP_NET_ADMIN obtained in a user namespace on systems allowing unprivileged user namespaces. ISO socket triggering itself has no stronger privilege gate.\nUI:N - No victim action is required once the local attacker can issue the Bluetooth socket operations. The attacker performs both setup and trigger steps directly.\nS:U - The corruption occurs in kernel Bluetooth code and affects the same kernel security authority. This is a standard local kernel memory-corruption scenario, not a VM/IOMMU or other cross-scope boundary escape.\nC:H - The bug is an attacker-controlled kernel stack out-of-bounds write, and such memory corruption can plausibly be leveraged beyond a simple crash in less hardened configurations. Under the required uncertainty rule, confidentiality impact is scored high.\nI:H - The vulnerable memcpy writes past a fixed 251-byte stack buffer with attacker-controlled advertising bytes. Out-of-bounds kernel writes are scored as high integrity impact because they may enable control-flow or data corruption.\nA:H - At minimum, the overflow can corrupt stack state or trigger hardening checks such as stack protector/FORTIFY, causing an oops or panic. The attacker can repeat the local trigger to deny service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:09.314Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/10b0e832cc05d7aef4b92bed912cbd4a395d0862"
},
{
"url": "https://git.kernel.org/stable/c/1338ee049a8910ba6c9cee963920e978e6893c7d"
},
{
"url": "https://git.kernel.org/stable/c/02f50e8bb69f9b22516163a09922f5537d3b12d1"
},
{
"url": "https://git.kernel.org/stable/c/dafc9f57140e66a10945127aa7433c3d715dc253"
},
{
"url": "https://git.kernel.org/stable/c/cdd8bbdbee763fdf5bf343e6f7d4e79347739f62"
},
{
"url": "https://git.kernel.org/stable/c/5c65b96b549ea2dcfde497436bf9e048deb87758"
}
],
"title": "Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53209",
"datePublished": "2026-06-25T08:39:14.915Z",
"dateReserved": "2026-06-09T07:44:35.391Z",
"dateUpdated": "2026-08-05T12:34:09.314Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43459 (GCVE-0-2026-43459)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: soc-core: flush delayed work before removing DAIs and widgets
When a sound card is unbound while a PCM stream is open, a
use-after-free can occur in snd_soc_dapm_stream_event(), called from
the close_delayed_work workqueue handler.
During unbind, snd_soc_unbind_card() flushes delayed work and then
calls soc_cleanup_card_resources(). Inside cleanup,
snd_card_disconnect_sync() releases all PCM file descriptors, and
the resulting PCM close path can call snd_soc_dapm_stream_stop()
which schedules new delayed work with a pmdown_time timer delay.
Since this happens after the flush in snd_soc_unbind_card(), the
new work is not caught. soc_remove_link_components() then frees
DAPM widgets before this work fires, leading to the use-after-free.
The existing flush in soc_free_pcm_runtime() also cannot help as it
runs after soc_remove_link_components() has already freed the widgets.
Add a flush in soc_cleanup_card_resources() after
snd_card_disconnect_sync() (after which no new PCM closes can
schedule further delayed work) and before soc_remove_link_dais()
and soc_remove_link_components() (which tear down the structures the
delayed work accesses).
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e894efef9ac7c10b7727798dcc711cccf07569f9 Version: e894efef9ac7c10b7727798dcc711cccf07569f9 Version: e894efef9ac7c10b7727798dcc711cccf07569f9 Version: e894efef9ac7c10b7727798dcc711cccf07569f9 Version: e894efef9ac7c10b7727798dcc711cccf07569f9 Version: e894efef9ac7c10b7727798dcc711cccf07569f9 Version: e894efef9ac7c10b7727798dcc711cccf07569f9 Version: e894efef9ac7c10b7727798dcc711cccf07569f9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/soc-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bf80a89da97285d9b877e0c6995e870d46b8025c",
"status": "affected",
"version": "e894efef9ac7c10b7727798dcc711cccf07569f9",
"versionType": "git"
},
{
"lessThan": "3887e514978d28216246360b46a9cb534969eb5a",
"status": "affected",
"version": "e894efef9ac7c10b7727798dcc711cccf07569f9",
"versionType": "git"
},
{
"lessThan": "231568afbc0cd25b8fb2a94ebf9738eabe1cf007",
"status": "affected",
"version": "e894efef9ac7c10b7727798dcc711cccf07569f9",
"versionType": "git"
},
{
"lessThan": "317a9298c54bb00319da73e5a7179f00e67fcbdf",
"status": "affected",
"version": "e894efef9ac7c10b7727798dcc711cccf07569f9",
"versionType": "git"
},
{
"lessThan": "eab71e11ce2447c1e01809cbc11eab4234cf8dc8",
"status": "affected",
"version": "e894efef9ac7c10b7727798dcc711cccf07569f9",
"versionType": "git"
},
{
"lessThan": "7d33e6140945482a07f8089ee86e13e02553ffdb",
"status": "affected",
"version": "e894efef9ac7c10b7727798dcc711cccf07569f9",
"versionType": "git"
},
{
"lessThan": "c054f0607c8bb1b1aa529bc109e4149298a1cccd",
"status": "affected",
"version": "e894efef9ac7c10b7727798dcc711cccf07569f9",
"versionType": "git"
},
{
"lessThan": "95bc5c225513fc3c4ce169563fb5e3929fbb938b",
"status": "affected",
"version": "e894efef9ac7c10b7727798dcc711cccf07569f9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/soc-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: soc-core: flush delayed work before removing DAIs and widgets\n\nWhen a sound card is unbound while a PCM stream is open, a\nuse-after-free can occur in snd_soc_dapm_stream_event(), called from\nthe close_delayed_work workqueue handler.\n\nDuring unbind, snd_soc_unbind_card() flushes delayed work and then\ncalls soc_cleanup_card_resources(). Inside cleanup,\nsnd_card_disconnect_sync() releases all PCM file descriptors, and\nthe resulting PCM close path can call snd_soc_dapm_stream_stop()\nwhich schedules new delayed work with a pmdown_time timer delay.\nSince this happens after the flush in snd_soc_unbind_card(), the\nnew work is not caught. soc_remove_link_components() then frees\nDAPM widgets before this work fires, leading to the use-after-free.\n\nThe existing flush in soc_free_pcm_runtime() also cannot help as it\nruns after soc_remove_link_components() has already freed the widgets.\n\nAdd a flush in soc_cleanup_card_resources() after\nsnd_card_disconnect_sync() (after which no new PCM closes can\nschedule further delayed work) and before soc_remove_link_dais()\nand soc_remove_link_components() (which tear down the structures the\ndelayed work accesses)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable ASoC/ALSA teardown path is reached locally through open PCM device files and sound-card driver unbind/removal, not by network or adjacent inputs.\nAC:L - Once a PCM playback stream is open and card unbind occurs, the delayed work is queued deterministically after disconnect; no attacker-uncontrolled race win is required.\nPR:L - A low-privileged local user with access to ALSA PCM devices can control the open stream and close side of the sequence. The unbind side is normally root-mediated, but the lower-privileged scenario is defensible when paired with required user/admin interaction.\nUI:R - A non-admin attacker cannot normally write the root-owned sysfs driver unbind attribute or unload the driver, so exploitation in the low-privileged scenario requires a privileged user or system action to unbind/remove the sound card.\nS:U - The impact remains within the local kernel security authority; this is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug is a kernel use-after-free in delayed work over freed DAPM/DAI-related objects. Following kernel scoring guidance, UAF memory corruption can enable high-impact information disclosure.\nI:H - The delayed work writes through freed widget/list objects and can corrupt kernel heap state. Following kernel scoring guidance, UAF memory corruption is treated as potentially enabling arbitrary write or control-flow compromise.\nA:H - Even without full exploitation, the use-after-free can dereference or mutate freed kernel objects from a workqueue and plausibly cause an oops, panic, or hang."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:04.321Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bf80a89da97285d9b877e0c6995e870d46b8025c"
},
{
"url": "https://git.kernel.org/stable/c/3887e514978d28216246360b46a9cb534969eb5a"
},
{
"url": "https://git.kernel.org/stable/c/231568afbc0cd25b8fb2a94ebf9738eabe1cf007"
},
{
"url": "https://git.kernel.org/stable/c/317a9298c54bb00319da73e5a7179f00e67fcbdf"
},
{
"url": "https://git.kernel.org/stable/c/eab71e11ce2447c1e01809cbc11eab4234cf8dc8"
},
{
"url": "https://git.kernel.org/stable/c/7d33e6140945482a07f8089ee86e13e02553ffdb"
},
{
"url": "https://git.kernel.org/stable/c/c054f0607c8bb1b1aa529bc109e4149298a1cccd"
},
{
"url": "https://git.kernel.org/stable/c/95bc5c225513fc3c4ce169563fb5e3929fbb938b"
}
],
"title": "ASoC: soc-core: flush delayed work before removing DAIs and widgets",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43459",
"datePublished": "2026-05-08T14:22:22.651Z",
"dateReserved": "2026-05-01T14:12:56.010Z",
"dateUpdated": "2026-08-05T12:28:04.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31727 (GCVE-0-2026-31727)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-06-19 11:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo
Commit ec35c1969650 ("usb: gadget: f_ncm: Fix net_device lifecycle with
device_move") reparents the gadget device to /sys/devices/virtual during
unbind, clearing the gadget pointer. If the userspace tool queries on
the surviving interface during this detached window, this leads to a
NULL pointer dereference.
Unable to handle kernel NULL pointer dereference
Call trace:
eth_get_drvinfo+0x50/0x90
ethtool_get_drvinfo+0x5c/0x1f0
__dev_ethtool+0xaec/0x1fe0
dev_ethtool+0x134/0x2e0
dev_ioctl+0x338/0x560
Add a NULL check for dev->gadget in eth_get_drvinfo(). When detached,
skip copying the fw_version and bus_info strings, which is natively
handled by ethtool_get_drvinfo for empty strings.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7c97366f5dac5255e60a317ffe3a5b18f3745547 Version: 36c41e9724c9a7a7cda37f5a4e9d94f25c8031c4 Version: 93f116c3393a22acab96ad1bef12b2572eb80ca4 Version: e584cb58a2ea7ff4d3a4bc43d5ca512ed3ecb77d Version: 85acaba2f42b557499bab3608307f17bf13beb69 Version: ec35c1969650e7cb6c8a91020e568ed46e3551b0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/u_ether.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f9f987472f4b8ab177be2b6492a59278ed969479",
"status": "affected",
"version": "7c97366f5dac5255e60a317ffe3a5b18f3745547",
"versionType": "git"
},
{
"lessThan": "7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2",
"status": "affected",
"version": "36c41e9724c9a7a7cda37f5a4e9d94f25c8031c4",
"versionType": "git"
},
{
"lessThan": "0326429e8ba99892e1d1e115dc8e88e1a3b64e24",
"status": "affected",
"version": "93f116c3393a22acab96ad1bef12b2572eb80ca4",
"versionType": "git"
},
{
"lessThan": "a36e5e800b9c93e3e1ffa42f34d38b36775dbcee",
"status": "affected",
"version": "e584cb58a2ea7ff4d3a4bc43d5ca512ed3ecb77d",
"versionType": "git"
},
{
"lessThan": "7de4d46be40738c7e48e64b5cc0a34aa1e047b0a",
"status": "affected",
"version": "85acaba2f42b557499bab3608307f17bf13beb69",
"versionType": "git"
},
{
"lessThan": "e002e92e88e12457373ed096b18716d97e7bbb20",
"status": "affected",
"version": "ec35c1969650e7cb6c8a91020e568ed46e3551b0",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/u_ether.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.12.81",
"status": "affected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThan": "6.18.22",
"status": "affected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThan": "6.19.12",
"status": "affected",
"version": "6.19.9",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "6.12.78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.18.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.19.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo\n\nCommit ec35c1969650 (\"usb: gadget: f_ncm: Fix net_device lifecycle with\ndevice_move\") reparents the gadget device to /sys/devices/virtual during\nunbind, clearing the gadget pointer. If the userspace tool queries on\nthe surviving interface during this detached window, this leads to a\nNULL pointer dereference.\n\nUnable to handle kernel NULL pointer dereference\nCall trace:\n eth_get_drvinfo+0x50/0x90\n ethtool_get_drvinfo+0x5c/0x1f0\n __dev_ethtool+0xaec/0x1fe0\n dev_ethtool+0x134/0x2e0\n dev_ioctl+0x338/0x560\n\nAdd a NULL check for dev-\u003egadget in eth_get_drvinfo(). When detached,\nskip copying the fw_version and bus_info strings, which is natively\nhandled by ethtool_get_drvinfo for empty strings."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-19T11:58:05.053Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f9f987472f4b8ab177be2b6492a59278ed969479"
},
{
"url": "https://git.kernel.org/stable/c/7fce959e9be3bf63bb0fdf4b05f9cc42cb289fe2"
},
{
"url": "https://git.kernel.org/stable/c/0326429e8ba99892e1d1e115dc8e88e1a3b64e24"
},
{
"url": "https://git.kernel.org/stable/c/a36e5e800b9c93e3e1ffa42f34d38b36775dbcee"
},
{
"url": "https://git.kernel.org/stable/c/7de4d46be40738c7e48e64b5cc0a34aa1e047b0a"
},
{
"url": "https://git.kernel.org/stable/c/e002e92e88e12457373ed096b18716d97e7bbb20"
}
],
"title": "usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31727",
"datePublished": "2026-05-01T14:14:27.552Z",
"dateReserved": "2026-03-09T15:48:24.134Z",
"dateUpdated": "2026-06-19T11:58:05.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71286 (GCVE-0-2025-71286)
Vulnerability from cvelistv5
Published
2026-05-06 11:32
Modified
2026-08-05 12:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls
The size of the data behind of scontrol->ipc_control_data for bytes
controls is:
[1] sizeof(struct sof_ipc4_control_data) + // kernel only struct
[2] sizeof(struct sof_abi_hdr)) + payload
The max_size specifies the size of [2] and it is coming from topology.
Change the function to take this into account and allocate adequate amount
of memory behind scontrol->ipc_control_data.
With the change we will allocate [1] amount more memory to be able to hold
the full size of data.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/ipc4-topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "59fe643f21b9d59bcbedb0dfbf988ee455c23736",
"status": "affected",
"version": "a382082ff74b036944cbc5b6ad29b65f633acd3a",
"versionType": "git"
},
{
"lessThan": "491956b45b5f4933632ea6d8a8bdfdf045ab81e1",
"status": "affected",
"version": "a382082ff74b036944cbc5b6ad29b65f633acd3a",
"versionType": "git"
},
{
"lessThan": "a704a1a4394b5877b9adc31b2c3165ad0b541896",
"status": "affected",
"version": "a382082ff74b036944cbc5b6ad29b65f633acd3a",
"versionType": "git"
},
{
"lessThan": "1237cd9ff198cb882402572f29569e5247190974",
"status": "affected",
"version": "a382082ff74b036944cbc5b6ad29b65f633acd3a",
"versionType": "git"
},
{
"lessThan": "a653820700b81c9e6f05ac23b7969ecec1a18e85",
"status": "affected",
"version": "a382082ff74b036944cbc5b6ad29b65f633acd3a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/ipc4-topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls\n\nThe size of the data behind of scontrol-\u003eipc_control_data for bytes\ncontrols is:\n[1] sizeof(struct sof_ipc4_control_data) + // kernel only struct\n[2] sizeof(struct sof_abi_hdr)) + payload\n\nThe max_size specifies the size of [2] and it is coming from topology.\n\nChange the function to take this into account and allocate adequate amount\nof memory behind scontrol-\u003eipc_control_data.\n\nWith the change we will allocate [1] amount more memory to be able to hold\nthe full size of data."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An attacker reaches the undersized IPC4 bytes-control buffer through ALSA ioctls on a local /dev/snd/controlC* device; no network or physical attack path exists.\nAC:L - Writable production controls commonly use allocator-boundary maxima such as 1024 bytes, and a malformed nested TLV deterministically produces an attacker-controlled heap overflow without a race or firmware interaction.\nPR:L - The path requires ordinary unprivileged access to the ALSA control device, commonly granted to the active desktop user or audio group, and performs no capability or namespace privilege check.\nUI:N - After obtaining local ALSA control-device access, the attacker can issue the malicious TLV ioctl directly without any victim action.\nS:U - The vulnerable ALSA/SOF driver and the affected kernel resources share the same security authority; ordinary kernel privilege escalation does not change CVSS scope.\nC:H - The size mismatch permits an adjacent heap out-of-bounds read through the TLV get path, while heap corruption can also be leveraged to disclose sensitive kernel memory.\nI:H - The TLV write path copies attacker-controlled bytes past the undersized allocation, providing a controlled adjacent heap overwrite that can plausibly corrupt pointers or enable control-flow hijacking.\nA:H - The heap overflow can corrupt adjacent kernel objects and cause an oops or panic, and it can be triggered repeatedly through the control ioctl."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:12:40.213Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/59fe643f21b9d59bcbedb0dfbf988ee455c23736"
},
{
"url": "https://git.kernel.org/stable/c/491956b45b5f4933632ea6d8a8bdfdf045ab81e1"
},
{
"url": "https://git.kernel.org/stable/c/a704a1a4394b5877b9adc31b2c3165ad0b541896"
},
{
"url": "https://git.kernel.org/stable/c/1237cd9ff198cb882402572f29569e5247190974"
},
{
"url": "https://git.kernel.org/stable/c/a653820700b81c9e6f05ac23b7969ecec1a18e85"
}
],
"title": "ASoC: SOF: ipc4-topology: Correct the allocation size for bytes controls",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-71286",
"datePublished": "2026-05-06T11:32:19.468Z",
"dateReserved": "2026-05-06T11:31:45.509Z",
"dateUpdated": "2026-08-05T12:12:40.213Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46167 (GCVE-0-2026-46167)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-06-14 17:59
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl
Just like in a previous problem in this driver, usblp_ctrl_msg() will
collapse the usb_control_msg() return value to 0/-errno, discarding the
actual number of bytes transferred.
Ideally that short command should be detected and error out, but many
printers are known to send "incorrect" responses back so we can't just
do that.
statusbuf is kmalloc(8) at probe time and never filled before the first
LPGETSTATUS ioctl.
usblp_read_status() requests 1 byte. If a malicious printer responds
with zero bytes, *statusbuf is one byte of stale kmalloc heap,
sign-extended into the local int status, which the LPGETSTATUS path then
copy_to_user()s directly to the ioctl caller.
Fix this all by just zapping out the memory buffer when allocated at
probe time. If a later call does a short read, the data will be
identical to what the device sent it the last time, so there is no
"leak" of information happening.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/class/usblp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f7c41314ebf17049917a452684db371babf711a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "cf24991619be317e2769310b4a367bf4a04b82bc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "087d97342c100138ea7d75a50977c9c2319f957b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d06d937b0a4cdb8867f04275c8100a8b943da31a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a502b997668401a6821501fc98b7f9220f9b6ff2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "762a6ccf391db0d629e590a803a3a2231e17dd3f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6b0e7438e31c74b01514d31ff35c1e688c4baaba",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b38e53cbfb9d84732e5984fbd73e128d592415c5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/class/usblp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl\n\nJust like in a previous problem in this driver, usblp_ctrl_msg() will\ncollapse the usb_control_msg() return value to 0/-errno, discarding the\nactual number of bytes transferred.\n\nIdeally that short command should be detected and error out, but many\nprinters are known to send \"incorrect\" responses back so we can\u0027t just\ndo that.\n\nstatusbuf is kmalloc(8) at probe time and never filled before the first\nLPGETSTATUS ioctl.\n\nusblp_read_status() requests 1 byte. If a malicious printer responds\nwith zero bytes, *statusbuf is one byte of stale kmalloc heap,\nsign-extended into the local int status, which the LPGETSTATUS path then\ncopy_to_user()s directly to the ioctl caller.\n\nFix this all by just zapping out the memory buffer when allocated at\nprobe time. If a later call does a short read, the data will be\nidentical to what the device sent it the last time, so there is no\n\"leak\" of information happening."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:59:37.617Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f7c41314ebf17049917a452684db371babf711a"
},
{
"url": "https://git.kernel.org/stable/c/cf24991619be317e2769310b4a367bf4a04b82bc"
},
{
"url": "https://git.kernel.org/stable/c/087d97342c100138ea7d75a50977c9c2319f957b"
},
{
"url": "https://git.kernel.org/stable/c/d06d937b0a4cdb8867f04275c8100a8b943da31a"
},
{
"url": "https://git.kernel.org/stable/c/a502b997668401a6821501fc98b7f9220f9b6ff2"
},
{
"url": "https://git.kernel.org/stable/c/762a6ccf391db0d629e590a803a3a2231e17dd3f"
},
{
"url": "https://git.kernel.org/stable/c/6b0e7438e31c74b01514d31ff35c1e688c4baaba"
},
{
"url": "https://git.kernel.org/stable/c/b38e53cbfb9d84732e5984fbd73e128d592415c5"
}
],
"title": "usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46167",
"datePublished": "2026-05-28T09:36:22.434Z",
"dateReserved": "2026-05-13T15:03:33.102Z",
"dateUpdated": "2026-06-14T17:59:37.617Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43024 (GCVE-0-2026-43024)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-07-14 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: reject immediate NF_QUEUE verdict
nft_queue is always used from userspace nftables to deliver the NF_QUEUE
verdict. Immediately emitting an NF_QUEUE verdict is never used by the
userspace nft tools, so reject immediate NF_QUEUE verdicts.
The arp family does not provide queue support, but such an immediate
verdict is still reachable. Globally reject NF_QUEUE immediate verdicts
to address this issue.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 55a60251fa50d4e68175e36666b536a602ce4f6c Version: 960cf4f812530f01f6acc6878ceaa5404c06af7b Version: 8e34430e33b8a80bc014f3efe29cac76bc30a4b4 Version: 6653118b176a00915125521c6572ae8e507621db Version: f342de4e2f33e0e39165d8639387aa6c19dff660 Version: f342de4e2f33e0e39165d8639387aa6c19dff660 Version: f342de4e2f33e0e39165d8639387aa6c19dff660 Version: f342de4e2f33e0e39165d8639387aa6c19dff660 Version: 8365e9d92b85fda975a5ece7a3a139cb964018c8 Version: 4e66422f1b56149761dc76030e6345d1cca6f869 Version: f05a497e7bc8851eeeb3a58da180ba469efebb05 Version: 5.10.210 ≤ Version: 5.15.149 ≤ Version: 6.1.76 ≤ Version: 6.6.15 ≤ Version: 4.19.307 ≤ Version: 5.4.269 ≤ Version: 6.7.3 ≤ |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:58.424Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_tables_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2f7f825a548be55420f0f5f716f6c27b9d312d3f",
"status": "affected",
"version": "55a60251fa50d4e68175e36666b536a602ce4f6c",
"versionType": "git"
},
{
"lessThan": "f140593901724cfbd16597c3a4fcb24a58ae44b0",
"status": "affected",
"version": "960cf4f812530f01f6acc6878ceaa5404c06af7b",
"versionType": "git"
},
{
"lessThan": "68390437a998c3f2c57212b413abef5e6d657d88",
"status": "affected",
"version": "8e34430e33b8a80bc014f3efe29cac76bc30a4b4",
"versionType": "git"
},
{
"lessThan": "4b12a3cc3f075e750cc3c5e693fd25fb400af4a2",
"status": "affected",
"version": "6653118b176a00915125521c6572ae8e507621db",
"versionType": "git"
},
{
"lessThan": "f710691be163ae6b39e4bcab9e5be32d329f035b",
"status": "affected",
"version": "f342de4e2f33e0e39165d8639387aa6c19dff660",
"versionType": "git"
},
{
"lessThan": "42a47f4b1b7695026ab9bc1bb35d4622b0835c95",
"status": "affected",
"version": "f342de4e2f33e0e39165d8639387aa6c19dff660",
"versionType": "git"
},
{
"lessThan": "17dc5d5a935c771338430cbc156a16a51cfd31e8",
"status": "affected",
"version": "f342de4e2f33e0e39165d8639387aa6c19dff660",
"versionType": "git"
},
{
"lessThan": "da107398cbd4bbdb6bffecb2ce86d5c9384f4cec",
"status": "affected",
"version": "f342de4e2f33e0e39165d8639387aa6c19dff660",
"versionType": "git"
},
{
"status": "affected",
"version": "8365e9d92b85fda975a5ece7a3a139cb964018c8",
"versionType": "git"
},
{
"status": "affected",
"version": "4e66422f1b56149761dc76030e6345d1cca6f869",
"versionType": "git"
},
{
"status": "affected",
"version": "f05a497e7bc8851eeeb3a58da180ba469efebb05",
"versionType": "git"
},
{
"lessThan": "5.10.253",
"status": "affected",
"version": "5.10.210",
"versionType": "semver"
},
{
"lessThan": "5.15.203",
"status": "affected",
"version": "5.15.149",
"versionType": "semver"
},
{
"lessThan": "6.1.168",
"status": "affected",
"version": "6.1.76",
"versionType": "semver"
},
{
"lessThan": "6.6.134",
"status": "affected",
"version": "6.6.15",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.307",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.269",
"versionType": "semver"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_tables_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.10.210",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.15.149",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "6.1.76",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "6.6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.307",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.269",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: reject immediate NF_QUEUE verdict\n\nnft_queue is always used from userspace nftables to deliver the NF_QUEUE\nverdict. Immediately emitting an NF_QUEUE verdict is never used by the\nuserspace nft tools, so reject immediate NF_QUEUE verdicts.\n\nThe arp family does not provide queue support, but such an immediate\nverdict is still reachable. Globally reject NF_QUEUE immediate verdicts\nto address this issue."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:06:03.632Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2f7f825a548be55420f0f5f716f6c27b9d312d3f"
},
{
"url": "https://git.kernel.org/stable/c/f140593901724cfbd16597c3a4fcb24a58ae44b0"
},
{
"url": "https://git.kernel.org/stable/c/68390437a998c3f2c57212b413abef5e6d657d88"
},
{
"url": "https://git.kernel.org/stable/c/4b12a3cc3f075e750cc3c5e693fd25fb400af4a2"
},
{
"url": "https://git.kernel.org/stable/c/f710691be163ae6b39e4bcab9e5be32d329f035b"
},
{
"url": "https://git.kernel.org/stable/c/42a47f4b1b7695026ab9bc1bb35d4622b0835c95"
},
{
"url": "https://git.kernel.org/stable/c/17dc5d5a935c771338430cbc156a16a51cfd31e8"
},
{
"url": "https://git.kernel.org/stable/c/da107398cbd4bbdb6bffecb2ce86d5c9384f4cec"
}
],
"title": "netfilter: nf_tables: reject immediate NF_QUEUE verdict",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43024",
"datePublished": "2026-05-01T14:15:26.424Z",
"dateReserved": "2026-05-01T14:12:55.975Z",
"dateUpdated": "2026-07-14T12:48:58.424Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45901 (GCVE-0-2026-45901)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-08-03 09:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: revert commit_mutex usage in reset path
It causes circular lock dependency between commit_mutex, nfnl_subsys_ipset
and nlk_cb_mutex when nft reset, ipset list, and iptables-nft with '-m set'
rule run at the same time.
Previous patches made it safe to run individual reset handlers concurrently
so commit_mutex is no longer required to prevent this.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3cb03edb4de33fd04c4ea55f47397b96a8657c53 Version: 3cb03edb4de33fd04c4ea55f47397b96a8657c53 Version: 3cb03edb4de33fd04c4ea55f47397b96a8657c53 Version: 3cb03edb4de33fd04c4ea55f47397b96a8657c53 Version: fb1adb05ea87b6149e65a31e511756c4f470d0cd Version: f123293db16dcd0cd81b246ae60e6362f0025d0a Version: 6.1.107 ≤ Version: 6.6.48 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_tables_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d66bedfe97a2bc321fa8118e669aae988038f729",
"status": "affected",
"version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
"versionType": "git"
},
{
"lessThan": "f6410d18c1e2da325df02be989d5bca5ed38b086",
"status": "affected",
"version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
"versionType": "git"
},
{
"lessThan": "ee3978b6a0dcd4215cb7cedcba705a12174786a7",
"status": "affected",
"version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
"versionType": "git"
},
{
"lessThan": "7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc",
"status": "affected",
"version": "3cb03edb4de33fd04c4ea55f47397b96a8657c53",
"versionType": "git"
},
{
"status": "affected",
"version": "fb1adb05ea87b6149e65a31e511756c4f470d0cd",
"versionType": "git"
},
{
"status": "affected",
"version": "f123293db16dcd0cd81b246ae60e6362f0025d0a",
"versionType": "git"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.107",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.48",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_tables_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.107",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.48",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: revert commit_mutex usage in reset path\n\nIt causes circular lock dependency between commit_mutex, nfnl_subsys_ipset\nand nlk_cb_mutex when nft reset, ipset list, and iptables-nft with \u0027-m set\u0027\nrule run at the same time.\n\nPrevious patches made it safe to run individual reset handlers concurrently\nso commit_mutex is no longer required to prevent this."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T09:32:31.525Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d66bedfe97a2bc321fa8118e669aae988038f729"
},
{
"url": "https://git.kernel.org/stable/c/f6410d18c1e2da325df02be989d5bca5ed38b086"
},
{
"url": "https://git.kernel.org/stable/c/ee3978b6a0dcd4215cb7cedcba705a12174786a7"
},
{
"url": "https://git.kernel.org/stable/c/7f261bb906bf527c4a6e2a646e2d5f3679f2a8bc"
}
],
"title": "netfilter: nf_tables: revert commit_mutex usage in reset path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45901",
"datePublished": "2026-05-27T12:17:09.861Z",
"dateReserved": "2026-05-13T15:03:33.084Z",
"dateUpdated": "2026-08-03T09:32:31.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45885 (GCVE-0-2026-45885)
Vulnerability from cvelistv5
Published
2026-05-27 12:16
Modified
2026-05-27 12:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()
Using the `devm_` variant for requesting IRQ _before_ the `devm_`
variant for allocating/registering the `power_supply` handle, means that
the `power_supply` handle will be deallocated/unregistered _before_ the
interrupt handler (since `devm_` naturally deallocates in reverse
allocation order). This means that during removal, there is a race
condition where an interrupt can fire just _after_ the `power_supply`
handle has been freed, *but* just _before_ the corresponding
unregistration of the IRQ handler has run.
This will lead to the IRQ handler calling `power_supply_changed()` with
a freed `power_supply` handle. Which usually crashes the system or
otherwise silently corrupts the memory...
Note that there is a similar situation which can also happen during
`probe()`; the possibility of an interrupt firing _before_ registering
the `power_supply` handle. This would then lead to the nasty situation
of using the `power_supply` handle *uninitialized* in
`power_supply_changed()`.
Fix this racy use-after-free by making sure the IRQ is requested _after_
the registration of the `power_supply` handle.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 874b2adbed1253a11549cb9b7b912ab65fea9cf2 Version: 874b2adbed1253a11549cb9b7b912ab65fea9cf2 Version: 874b2adbed1253a11549cb9b7b912ab65fea9cf2 Version: 874b2adbed1253a11549cb9b7b912ab65fea9cf2 Version: 874b2adbed1253a11549cb9b7b912ab65fea9cf2 Version: 874b2adbed1253a11549cb9b7b912ab65fea9cf2 Version: 874b2adbed1253a11549cb9b7b912ab65fea9cf2 Version: 874b2adbed1253a11549cb9b7b912ab65fea9cf2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/cpcap-battery.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c549dd3de4b3f6e726d1b8386d40ccf7d3abdbe4",
"status": "affected",
"version": "874b2adbed1253a11549cb9b7b912ab65fea9cf2",
"versionType": "git"
},
{
"lessThan": "3ff75cba1c98349a23a8f9333981deba1972cc11",
"status": "affected",
"version": "874b2adbed1253a11549cb9b7b912ab65fea9cf2",
"versionType": "git"
},
{
"lessThan": "2ce2334be155bd8bad6377e99984246ce4dbd08c",
"status": "affected",
"version": "874b2adbed1253a11549cb9b7b912ab65fea9cf2",
"versionType": "git"
},
{
"lessThan": "cbb9b07f88a9ef6518934c41eb3e8cf840d657d5",
"status": "affected",
"version": "874b2adbed1253a11549cb9b7b912ab65fea9cf2",
"versionType": "git"
},
{
"lessThan": "f3fbe309c9bfe1aac1e2b26543e9dc4829f3275a",
"status": "affected",
"version": "874b2adbed1253a11549cb9b7b912ab65fea9cf2",
"versionType": "git"
},
{
"lessThan": "2841bbb5a35c4449c0a0458e8e476b2a62f95147",
"status": "affected",
"version": "874b2adbed1253a11549cb9b7b912ab65fea9cf2",
"versionType": "git"
},
{
"lessThan": "e261be6f18929f2397cd54cd583a2df624c129c1",
"status": "affected",
"version": "874b2adbed1253a11549cb9b7b912ab65fea9cf2",
"versionType": "git"
},
{
"lessThan": "642f33e34b969eedec334738fd5df95d2dc42742",
"status": "affected",
"version": "874b2adbed1253a11549cb9b7b912ab65fea9cf2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/cpcap-battery.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: cpcap-battery: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:16:57.246Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c549dd3de4b3f6e726d1b8386d40ccf7d3abdbe4"
},
{
"url": "https://git.kernel.org/stable/c/3ff75cba1c98349a23a8f9333981deba1972cc11"
},
{
"url": "https://git.kernel.org/stable/c/2ce2334be155bd8bad6377e99984246ce4dbd08c"
},
{
"url": "https://git.kernel.org/stable/c/cbb9b07f88a9ef6518934c41eb3e8cf840d657d5"
},
{
"url": "https://git.kernel.org/stable/c/f3fbe309c9bfe1aac1e2b26543e9dc4829f3275a"
},
{
"url": "https://git.kernel.org/stable/c/2841bbb5a35c4449c0a0458e8e476b2a62f95147"
},
{
"url": "https://git.kernel.org/stable/c/e261be6f18929f2397cd54cd583a2df624c129c1"
},
{
"url": "https://git.kernel.org/stable/c/642f33e34b969eedec334738fd5df95d2dc42742"
}
],
"title": "power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45885",
"datePublished": "2026-05-27T12:16:57.246Z",
"dateReserved": "2026-05-13T15:03:33.082Z",
"dateUpdated": "2026-05-27T12:16:57.246Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43494 (GCVE-0-2026-43494)
Vulnerability from cvelistv5
Published
2026-05-21 10:49
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/rds: reset op_nents when zerocopy page pin fails
When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(),
the pinned pages are released with put_page(), and
rm->data.op_mmp_znotifier is cleared. But we fail to properly
clear rm->data.op_nents.
Later when rds_message_purge() is called from rds_sendmsg() the
cleanup loop iterates over the incorrectly non zero number of
op_nents and frees them again.
Fix this by properly resetting op_nents when it should be in
rds_message_zcopy_from_user().
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 Version: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 |
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-05-21T15:04:20.704Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/05/21/2"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel, specifically within the `net/rds` module. When a zerocopy page pin operation fails, a counter used for memory management (`op_nents`) is not correctly reset. This can result in a double-free vulnerability, where the same memory is released twice. A local attacker could potentially exploit this to cause the system to crash (denial of service) or, in some cases, execute unauthorized code."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1341",
"description": "Multiple Releases of Same Resource or Handle",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:55:52.893Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-43494"
},
{
"name": "RHBZ#2480434",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480434"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43494.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-21T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-21T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: net/rds: reset op_nents when zerocopy page pin fails",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/message.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c6e51512a784c4a7b86e1a044988696e3b3721fa",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "03014551938a0887fa55f18ce49b70158a9c0113",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "d84ce1786ce40fdd3dd98db47aec5527817e1ef6",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "9115669faedccdda100428e2d26fd0aac8c50799",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "0bbbff00a15b1df2cac9014d6cf4b6890f473353",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "640e37f58f991546a87540d067279c2c1fa9fe51",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "290e833d1acb1093bc121fcdc97f5e6161157479",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
},
{
"lessThan": "e174929793195e0cd6a4adb0cad731b39f9019b4",
"status": "affected",
"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/message.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: reset op_nents when zerocopy page pin fails\n\nWhen iov_iter_get_pages2() fails in rds_message_zcopy_from_user(),\nthe pinned pages are released with put_page(), and\nrm-\u003edata.op_mmp_znotifier is cleared. But we fail to properly\nclear rm-\u003edata.op_nents.\n\nLater when rds_message_purge() is called from rds_sendmsg() the\ncleanup loop iterates over the incorrectly non zero number of\nop_nents and frees them again.\n\nFix this by properly resetting op_nents when it should be in\nrds_message_zcopy_from_user()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Triggered entirely by a local `sendmsg(MSG_ZEROCOPY)` syscall operating on the sending process\u0027s own user memory; a remote peer has no control over the page-pinning that fails, so it is not network-reachable.\nAC:L - The attacker fully controls the iovec layout and can deterministically pin one valid segment then point a later segment at unmapped memory to force `iov_iter_get_pages2()` to fail with `op_nents\u003e=1`; no race or uncontrolled condition.\nPR:L - `rds_create()` performs no capability check, so any unprivileged local user can open the AF_RDS socket and reach the zerocopy send path; no real root or CAP needed.\nUI:N - The attacker performs the entire socket/setsockopt/sendmsg sequence themselves; no victim action is required.\nS:U - The corruption is within the kernel\u0027s own page-management security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The refcount underflow frees a page still mapped in the attacker\u0027s address space; once reused for other kernel/process data it remains readable through the stale mapping, enabling arbitrary memory disclosure.\nI:H - The same stale-mapping primitive permits writing into reallocated pages (page tables, slab, other tasks\u0027 memory), yielding an arbitrary-write/control-flow-hijack primitive suitable for privilege escalation.\nA:H - The double-free / page reference-count underflow corrupts kernel page state and reliably causes oops/panic, a full availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:17.738Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c6e51512a784c4a7b86e1a044988696e3b3721fa"
},
{
"url": "https://git.kernel.org/stable/c/03014551938a0887fa55f18ce49b70158a9c0113"
},
{
"url": "https://git.kernel.org/stable/c/d84ce1786ce40fdd3dd98db47aec5527817e1ef6"
},
{
"url": "https://git.kernel.org/stable/c/9115669faedccdda100428e2d26fd0aac8c50799"
},
{
"url": "https://git.kernel.org/stable/c/0bbbff00a15b1df2cac9014d6cf4b6890f473353"
},
{
"url": "https://git.kernel.org/stable/c/640e37f58f991546a87540d067279c2c1fa9fe51"
},
{
"url": "https://git.kernel.org/stable/c/290e833d1acb1093bc121fcdc97f5e6161157479"
},
{
"url": "https://git.kernel.org/stable/c/e174929793195e0cd6a4adb0cad731b39f9019b4"
},
{
"url": "https://github.com/v12-security/pocs/tree/main/pintheft"
}
],
"title": "net/rds: reset op_nents when zerocopy page pin fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43494",
"datePublished": "2026-05-21T10:49:21.310Z",
"dateReserved": "2026-05-01T14:12:56.013Z",
"dateUpdated": "2026-08-05T12:28:17.738Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46243 (GCVE-0-2026-46243)
Vulnerability from cvelistv5
Published
2026-06-01 16:22
Modified
2026-08-24 12:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: reject userspace cifs.spnego descriptions
cifs.spnego key descriptions contain authority-bearing fields such as
pid, uid, creduid, and upcall_target that cifs.upcall treats as
kernel-originating inputs. However, userspace can also create keys of
this type through request_key(2) or add_key(2), allowing those fields to
be supplied without CIFS origin.
Only accept cifs.spnego descriptions while CIFS is using its private
spnego_cred to request the key.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f1d662a7d5e5322e583aad6b3cfec03d8f27b435 Version: f1d662a7d5e5322e583aad6b3cfec03d8f27b435 Version: f1d662a7d5e5322e583aad6b3cfec03d8f27b435 Version: f1d662a7d5e5322e583aad6b3cfec03d8f27b435 Version: f1d662a7d5e5322e583aad6b3cfec03d8f27b435 Version: f1d662a7d5e5322e583aad6b3cfec03d8f27b435 Version: f1d662a7d5e5322e583aad6b3cfec03d8f27b435 Version: f1d662a7d5e5322e583aad6b3cfec03d8f27b435 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-46243",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-01T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-02T03:56:00.563Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/manizada/CIFSwitch"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-06-01T18:55:00.540Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/06/01/6"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_nvidia:10::el10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "NVIDIA for RHEL 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-212.9.el10nv",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-231.12.el10nv",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.20.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.79.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.6.32-754.61.1.el6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_extras_rt_els:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.10.0-1160.155.1.rt56.1307.el7",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.10.0-1160.153.1.el7",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.129.1.rt7.470.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.129.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.194.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.194.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.196.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.196.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.147.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.147.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.13.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.176.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.176.1.rt14.461.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:9.2"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.132.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:9.4"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.123.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus:9.6"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.12::el8"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "412.86.202606251120-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.13::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.13",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "413.92.202607141229-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.14::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "414.92.202606231112-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.15::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "415.92.202606200237-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.16::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "416.94.202607021016-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.17::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.17",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "417.94.202607240132-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.18::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "418.94.202606250458-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.19::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.19.9.6.202606302000-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.20::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.20",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.20.9.6.202607010620-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.21::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.21",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.21.9.6.202607011303-0",
"versionType": "rpm"
}
]
}
],
"datePublic": "2026-05-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability was found in the Linux kernel\u0027s CIFS client implementation. This could allow a local attacker to impersonate other users, bypass authentication in SMB mount operations, and potentially gain unauthorized access to network file shares or escalate privileges."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-825",
"description": "Expired Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T12:06:53.788Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-46243"
},
{
"name": "RHBZ#2481486",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481486"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46243.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23395"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33486"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27719"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27729"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41236"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34048"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:40021"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28887"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28962"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36620"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47727"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34815"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34757"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34788"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34764"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25908"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23329"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26515"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27735"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27708"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24381"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33225"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23258"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33220"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26535"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26570"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26563"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33219"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33221"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33222"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33223"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33224"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23259"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26462"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:23395: NVIDIA for RHEL 10"
},
{
"lang": "en",
"value": "RHSA-2026:33486: NVIDIA for RHEL 10"
},
{
"lang": "en",
"value": "RHSA-2026:27719: Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION), Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION)"
},
{
"lang": "en",
"value": "RHSA-2026:27729: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:41236: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:34048: Red Hat OpenShift Container Platform 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:40021: Red Hat OpenShift Container Platform 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:28887: Red Hat OpenShift Container Platform 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:28962: Red Hat OpenShift Container Platform 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:36620: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:47727: Red Hat OpenShift Container Platform 4.17"
},
{
"lang": "en",
"value": "RHSA-2026:34815: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:34757: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:34788: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:34764: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:25908: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:23329: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:26515: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:27735: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:27708: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:24381: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:33225: Red Hat Enterprise Linux BaseOS (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:23258: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:33220: Red Hat Enterprise Linux BaseOS (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:26535: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:26570: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:26563: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:33219: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:33221: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:33222: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:33223: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:33224: Red Hat Enterprise Linux BaseOS (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:23259: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:26462: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-26T15:07:49.955Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-26T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions",
"workarounds": [
{
"lang": "en",
"value": "See the security bulletin for a detailed mitigation procedure."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifs_spnego.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7713bd320ed4fc3d08a227cd8e41242219a16981",
"status": "affected",
"version": "f1d662a7d5e5322e583aad6b3cfec03d8f27b435",
"versionType": "git"
},
{
"lessThan": "9544559e59438a4b609b2fdfa0763d8360572824",
"status": "affected",
"version": "f1d662a7d5e5322e583aad6b3cfec03d8f27b435",
"versionType": "git"
},
{
"lessThan": "cf20038657d6d4974349556a34e08fe0490bebbc",
"status": "affected",
"version": "f1d662a7d5e5322e583aad6b3cfec03d8f27b435",
"versionType": "git"
},
{
"lessThan": "2035acfb17221729b1b8ac335e941868a04ca079",
"status": "affected",
"version": "f1d662a7d5e5322e583aad6b3cfec03d8f27b435",
"versionType": "git"
},
{
"lessThan": "a3bbda6502a9398b816fa2e71c9a3f955f58013d",
"status": "affected",
"version": "f1d662a7d5e5322e583aad6b3cfec03d8f27b435",
"versionType": "git"
},
{
"lessThan": "91f89c1d83e80417629791fcef6af8140d7d01c8",
"status": "affected",
"version": "f1d662a7d5e5322e583aad6b3cfec03d8f27b435",
"versionType": "git"
},
{
"lessThan": "0aece6685fc80a8de492688ca2315fb86ec379c7",
"status": "affected",
"version": "f1d662a7d5e5322e583aad6b3cfec03d8f27b435",
"versionType": "git"
},
{
"lessThan": "3da1fdf4efbc490041eb4f836bf596201203f8f2",
"status": "affected",
"version": "f1d662a7d5e5322e583aad6b3cfec03d8f27b435",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifs_spnego.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: reject userspace cifs.spnego descriptions\n\ncifs.spnego key descriptions contain authority-bearing fields such as\npid, uid, creduid, and upcall_target that cifs.upcall treats as\nkernel-originating inputs. However, userspace can also create keys of\nthis type through request_key(2) or add_key(2), allowing those fields to\nbe supplied without CIFS origin.\n\nOnly accept cifs.spnego descriptions while CIFS is using its private\nspnego_cred to request the key."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local `request_key(2)` or `add_key(2)` from an unprivileged process; the flaw is missing origin validation in the keyring path, not remote SMB/CIFS protocol input.\nAC:L - On typical affected systems (CIFS module with upcall, cifs-utils request-key rule, unprivileged user/mount namespaces), the attacker fully controls the forged description, target pid, and namespace layout for a reliable root upcall chain.\nPR:L - Any local unprivileged user account can invoke the key syscalls; user/mount namespaces are part of the standard exploit setup and map to basic local user capability, not root-only access.\nUI:N - No victim action such as mounting a Kerberos CIFS share is required; the attacker forges the key request directly without depending on another user\u2019s mount or session.\nS:U - Successful exploitation elevates privileges within the same host/kernel security domain (local root) and does not cross a VM/hypervisor or hardware isolation boundary by itself.\nC:H - The attack chain yields root-equivalent access in the root upcall helper, enabling arbitrary read of host data (full confidentiality compromise of the system).\nI:H - Malicious NSS modules run as root inside `cifs.upcall`, giving arbitrary code execution and full integrity compromise of the host, not merely limited data modification.\nA:N - The kernel bug is a trust-boundary failure without memory corruption or guaranteed kernel panic; primary impact is privilege escalation rather than kernel crash or sustained denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:42.627Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7713bd320ed4fc3d08a227cd8e41242219a16981"
},
{
"url": "https://git.kernel.org/stable/c/9544559e59438a4b609b2fdfa0763d8360572824"
},
{
"url": "https://git.kernel.org/stable/c/cf20038657d6d4974349556a34e08fe0490bebbc"
},
{
"url": "https://git.kernel.org/stable/c/2035acfb17221729b1b8ac335e941868a04ca079"
},
{
"url": "https://git.kernel.org/stable/c/a3bbda6502a9398b816fa2e71c9a3f955f58013d"
},
{
"url": "https://git.kernel.org/stable/c/91f89c1d83e80417629791fcef6af8140d7d01c8"
},
{
"url": "https://git.kernel.org/stable/c/0aece6685fc80a8de492688ca2315fb86ec379c7"
},
{
"url": "https://git.kernel.org/stable/c/3da1fdf4efbc490041eb4f836bf596201203f8f2"
}
],
"title": "smb: client: reject userspace cifs.spnego descriptions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46243",
"datePublished": "2026-06-01T16:22:29.211Z",
"dateReserved": "2026-05-13T15:03:33.107Z",
"dateUpdated": "2026-08-24T12:06:53.788Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53258 (GCVE-0-2026-53258)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: fix leak if split 6 GHz scanning fails
rdev->int_scan_req is leaked if cfg80211_scan() fails. Note that it's
supposed to be released at ___cfg80211_scan_done() but this doesn't happen
as rdev->scan_req is NULL at that point, too, leading to the early return
from the freeing function.
unreferenced object 0xffff8881161d0800 (size 512):
comm "wpa_supplicant", pid 379, jiffies 4294749765
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 f0 81 13 16 81 88 ff ff ................
backtrace (crc c867fdb6):
kmemleak_alloc+0x89/0x90
__kmalloc_noprof+0x2fd/0x410
cfg80211_scan+0x133/0x730
nl80211_trigger_scan+0xc69/0x1cc0
genl_family_rcv_msg_doit+0x204/0x2f0
genl_rcv_msg+0x431/0x6b0
netlink_rcv_skb+0x143/0x3f0
genl_rcv+0x27/0x40
netlink_unicast+0x4f6/0x820
netlink_sendmsg+0x797/0xce0
__sock_sendmsg+0xc4/0x160
____sys_sendmsg+0x5e4/0x890
___sys_sendmsg+0xf8/0x180
__sys_sendmsg+0x136/0x1e0
__x64_sys_sendmsg+0x76/0xc0
x64_sys_call+0x13f0/0x17d0
Found by Linux Verification Center (linuxtesting.org).
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fb8db813eba2e56ee001c9fb5c2ce2cb78c42642",
"status": "affected",
"version": "c8cb5b854b40f2ce52ccd032fa19750f4181d5fc",
"versionType": "git"
},
{
"lessThan": "a24134ddc18b4d440714365637d440b7121447b9",
"status": "affected",
"version": "c8cb5b854b40f2ce52ccd032fa19750f4181d5fc",
"versionType": "git"
},
{
"lessThan": "e8694f7cc29287e843648d1075177b9a2000d957",
"status": "affected",
"version": "c8cb5b854b40f2ce52ccd032fa19750f4181d5fc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/scan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: fix leak if split 6 GHz scanning fails\n\nrdev-\u003eint_scan_req is leaked if cfg80211_scan() fails. Note that it\u0027s\nsupposed to be released at ___cfg80211_scan_done() but this doesn\u0027t happen\nas rdev-\u003escan_req is NULL at that point, too, leading to the early return\nfrom the freeing function.\n\nunreferenced object 0xffff8881161d0800 (size 512):\n comm \"wpa_supplicant\", pid 379, jiffies 4294749765\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n 00 00 00 00 00 00 00 00 f0 81 13 16 81 88 ff ff ................\n backtrace (crc c867fdb6):\n kmemleak_alloc+0x89/0x90\n __kmalloc_noprof+0x2fd/0x410\n cfg80211_scan+0x133/0x730\n nl80211_trigger_scan+0xc69/0x1cc0\n genl_family_rcv_msg_doit+0x204/0x2f0\n genl_rcv_msg+0x431/0x6b0\n netlink_rcv_skb+0x143/0x3f0\n genl_rcv+0x27/0x40\n netlink_unicast+0x4f6/0x820\n netlink_sendmsg+0x797/0xce0\n __sock_sendmsg+0xc4/0x160\n ____sys_sendmsg+0x5e4/0x890\n ___sys_sendmsg+0xf8/0x180\n __sys_sendmsg+0x136/0x1e0\n __x64_sys_sendmsg+0x76/0xc0\n x64_sys_call+0x13f0/0x17d0\n\nFound by Linux Verification Center (linuxtesting.org)."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:47.917Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fb8db813eba2e56ee001c9fb5c2ce2cb78c42642"
},
{
"url": "https://git.kernel.org/stable/c/a24134ddc18b4d440714365637d440b7121447b9"
},
{
"url": "https://git.kernel.org/stable/c/e8694f7cc29287e843648d1075177b9a2000d957"
}
],
"title": "wifi: fix leak if split 6 GHz scanning fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53258",
"datePublished": "2026-06-25T08:39:47.917Z",
"dateReserved": "2026-06-09T07:44:35.394Z",
"dateUpdated": "2026-06-25T08:39:47.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45914 (GCVE-0-2026-45914)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-27 12:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Revert "hwmon: (ibmpex) fix use-after-free in high/low store"
This reverts commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d.
Jean Delvare points out that the patch does not completely
fix the reported problem, that it in fact introduces a
(new) race condition, and that it may actually not be needed in
the first place.
Various AI reviews agree. Specific and relevant AI feedback:
"
This reordering sets the driver data to NULL before removing the sensor
attributes in the loop below.
ibmpex_show_sensor() retrieves this driver data via dev_get_drvdata() but
does not check if it is NULL before dereferencing it to access
data->sensors[].
If a userspace process reads a sensor file (like temp1_input) while this
delete function is running, could it race with the dev_set_drvdata(...,
NULL) call here and crash in ibmpex_show_sensor()?
Would it be safer to keep the original order where device_remove_file() is
called before clearing the driver data? device_remove_file() should wait
for any active sysfs callbacks to complete, which might already prevent the
use-after-free this patch intends to fix.
"
Revert the offending patch. If it can be shown that the originally reported
alleged race condition does indeed exist, it can always be re-introduced
with a complete fix.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3ce9b7ae9d4d148672b35147aaf7987a4f82bb94 Version: 533ead425f8109b02fecc7e72d612b8898ec347a Version: fa37adcf1d564ef58b9dfb01b6c36d35c5294bad Version: 68d62e5bebbd118b763e8bb210d5cf2198ef450c Version: 5aa2139201667c1f644601e4529c4acd6bf8db5a Version: 6946c726c3f4c36f0f049e6f97e88c510b15f65d Version: 6946c726c3f4c36f0f049e6f97e88c510b15f65d Version: 5.10.248 ≤ Version: 6.1.160 ≤ Version: 6.6.120 ≤ Version: 6.12.64 ≤ Version: 6.18.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/ibmpex.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "05112ba67c824ab416cd54307c0b50aba9f0047a",
"status": "affected",
"version": "3ce9b7ae9d4d148672b35147aaf7987a4f82bb94",
"versionType": "git"
},
{
"lessThan": "efd68429f23fb4015b0ebc2392334059e06fad18",
"status": "affected",
"version": "533ead425f8109b02fecc7e72d612b8898ec347a",
"versionType": "git"
},
{
"lessThan": "f448acd86835a650f9ea83460b9ca347d3aafba5",
"status": "affected",
"version": "fa37adcf1d564ef58b9dfb01b6c36d35c5294bad",
"versionType": "git"
},
{
"lessThan": "914b47c9b824d3d74f31c764163edf93302100b1",
"status": "affected",
"version": "68d62e5bebbd118b763e8bb210d5cf2198ef450c",
"versionType": "git"
},
{
"lessThan": "14a38784e09aebc21207dc32fffa05247fc3dd64",
"status": "affected",
"version": "5aa2139201667c1f644601e4529c4acd6bf8db5a",
"versionType": "git"
},
{
"lessThan": "894d9c7aab68fd0c70c78b1d03c8fa589fb0f67d",
"status": "affected",
"version": "6946c726c3f4c36f0f049e6f97e88c510b15f65d",
"versionType": "git"
},
{
"lessThan": "8bde3e395a85017f12af2b0ba5c3684f5af9c006",
"status": "affected",
"version": "6946c726c3f4c36f0f049e6f97e88c510b15f65d",
"versionType": "git"
},
{
"lessThan": "5.10.252",
"status": "affected",
"version": "5.10.248",
"versionType": "semver"
},
{
"lessThan": "6.1.165",
"status": "affected",
"version": "6.1.160",
"versionType": "semver"
},
{
"lessThan": "6.6.128",
"status": "affected",
"version": "6.6.120",
"versionType": "semver"
},
{
"lessThan": "6.12.75",
"status": "affected",
"version": "6.12.64",
"versionType": "semver"
},
{
"lessThan": "6.18.14",
"status": "affected",
"version": "6.18.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/ibmpex.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "5.10.248",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.1.160",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.6.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.12.64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.18.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"hwmon: (ibmpex) fix use-after-free in high/low store\"\n\nThis reverts commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d.\n\nJean Delvare points out that the patch does not completely\nfix the reported problem, that it in fact introduces a\n(new) race condition, and that it may actually not be needed in\nthe first place.\n\nVarious AI reviews agree. Specific and relevant AI feedback:\n\n\"\nThis reordering sets the driver data to NULL before removing the sensor\nattributes in the loop below.\n\nibmpex_show_sensor() retrieves this driver data via dev_get_drvdata() but\ndoes not check if it is NULL before dereferencing it to access\ndata-\u003esensors[].\n\nIf a userspace process reads a sensor file (like temp1_input) while this\ndelete function is running, could it race with the dev_set_drvdata(...,\nNULL) call here and crash in ibmpex_show_sensor()?\n\nWould it be safer to keep the original order where device_remove_file() is\ncalled before clearing the driver data? device_remove_file() should wait\nfor any active sysfs callbacks to complete, which might already prevent the\nuse-after-free this patch intends to fix.\n\"\n\nRevert the offending patch. If it can be shown that the originally reported\nalleged race condition does indeed exist, it can always be re-introduced\nwith a complete fix."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:17:29.426Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/05112ba67c824ab416cd54307c0b50aba9f0047a"
},
{
"url": "https://git.kernel.org/stable/c/efd68429f23fb4015b0ebc2392334059e06fad18"
},
{
"url": "https://git.kernel.org/stable/c/f448acd86835a650f9ea83460b9ca347d3aafba5"
},
{
"url": "https://git.kernel.org/stable/c/914b47c9b824d3d74f31c764163edf93302100b1"
},
{
"url": "https://git.kernel.org/stable/c/14a38784e09aebc21207dc32fffa05247fc3dd64"
},
{
"url": "https://git.kernel.org/stable/c/894d9c7aab68fd0c70c78b1d03c8fa589fb0f67d"
},
{
"url": "https://git.kernel.org/stable/c/8bde3e395a85017f12af2b0ba5c3684f5af9c006"
}
],
"title": "Revert \"hwmon: (ibmpex) fix use-after-free in high/low store\"",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45914",
"datePublished": "2026-05-27T12:17:29.426Z",
"dateReserved": "2026-05-13T15:03:33.085Z",
"dateUpdated": "2026-05-27T12:17:29.426Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43248 (GCVE-0-2026-43248)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vhost: move vdpa group bound check to vhost_vdpa
Remove duplication by consolidating these here. This reduces the
posibility of a parent driver missing them.
While we're at it, fix a bug in vdpa_sim where a valid ASID can be
assigned to a group equal to ngroups, causing an out of bound write.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/mlx5/net/mlx5_vnet.c",
"drivers/vdpa/vdpa_sim/vdpa_sim.c",
"drivers/vhost/vdpa.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ddb57354634b6ba851b79da45f1de42c646f27d0",
"status": "affected",
"version": "bda324fd037a6b0d44da5699574ce741ca161bc4",
"versionType": "git"
},
{
"lessThan": "7441d35d14d9a3d66d925d90cb73c75394e6d454",
"status": "affected",
"version": "bda324fd037a6b0d44da5699574ce741ca161bc4",
"versionType": "git"
},
{
"lessThan": "406db68f9cb976a8ddfafd631197264f2307e9c9",
"status": "affected",
"version": "bda324fd037a6b0d44da5699574ce741ca161bc4",
"versionType": "git"
},
{
"lessThan": "cd025c1e876b4e262e71398236a1550486a73ede",
"status": "affected",
"version": "bda324fd037a6b0d44da5699574ce741ca161bc4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/mlx5/net/mlx5_vnet.c",
"drivers/vdpa/vdpa_sim/vdpa_sim.c",
"drivers/vhost/vdpa.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost: move vdpa group bound check to vhost_vdpa\n\nRemove duplication by consolidating these here. This reduces the\nposibility of a parent driver missing them.\n\nWhile we\u0027re at it, fix a bug in vdpa_sim where a valid ASID can be\nassigned to a group equal to ngroups, causing an out of bound write."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local `ioctl()` calls on a `/dev/vhost-vdpa-*` character device, not by network or adjacent traffic.\nAC:L - The attacker controls the ioctl arguments, including the group index and ASID, and no race or external timing condition is required once the device is accessible.\nPR:L - Creating or binding vDPA devices is administrative, but a delegated/local VM or vDPA process with access to the vhost-vdpa device can trigger the ioctl without further kernel capability checks. Choosing the higher severity option, this is Low rather than High.\nUI:N - No victim user action is needed; the local attacker directly opens the device, becomes vhost owner, and issues the ioctl.\nS:U - The impact is corruption of host kernel memory from a local host device interface, which is a standard kernel privilege/security-domain impact rather than a VM escape or separate authority crossing.\nC:H - The missing group bound permits out-of-bounds kernel heap access in the parent set_group_asid path, and such memory corruption can reasonably be developed into kernel memory disclosure.\nI:H - The bug permits an out-of-bounds kernel write of ASID/group state or adjacent locking/state fields, making kernel memory corruption and potential control-flow or privilege manipulation plausible.\nA:H - Even without full exploitation, the out-of-bounds write can corrupt kernel heap state and can reasonably crash or panic the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:51.590Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ddb57354634b6ba851b79da45f1de42c646f27d0"
},
{
"url": "https://git.kernel.org/stable/c/7441d35d14d9a3d66d925d90cb73c75394e6d454"
},
{
"url": "https://git.kernel.org/stable/c/406db68f9cb976a8ddfafd631197264f2307e9c9"
},
{
"url": "https://git.kernel.org/stable/c/cd025c1e876b4e262e71398236a1550486a73ede"
}
],
"title": "vhost: move vdpa group bound check to vhost_vdpa",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43248",
"datePublished": "2026-05-06T11:28:39.578Z",
"dateReserved": "2026-05-01T14:12:55.996Z",
"dateUpdated": "2026-08-05T12:26:51.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46201 (GCVE-0-2026-46201)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
When xe_dma_buf_init_obj() fails, the attachment from
dma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before
returning the error. Note: we cannot use goto out_err here because
xe_dma_buf_init_obj() already frees bo on failure, and out_err would
double-free it.
(cherry picked from commit a828eb185aac41800df8eae4b60501ccc0dbbe51)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_dma_buf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d394669e194936d7ce15284a24a5ae334c4c5b74",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
},
{
"lessThan": "0afa8b1ef582ecf6fb04097fd356f8741e5005ed",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
},
{
"lessThan": "eea1e10f8d99c0f04deef707c99705b94bba3b78",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
},
{
"lessThan": "111ab678471bf1f90d078d5513bb086b70596c3c",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_dma_buf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()\n\nWhen xe_dma_buf_init_obj() fails, the attachment from\ndma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before\nreturning the error. Note: we cannot use goto out_err here because\nxe_dma_buf_init_obj() already frees bo on failure, and out_err would\ndouble-free it.\n\n(cherry picked from commit a828eb185aac41800df8eae4b60501ccc0dbbe51)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached via the DRM_IOCTL_PRIME_FD_TO_HANDLE ioctl on the xe device node (drivers/gpu/drm/xe/xe_dma_buf.c), which requires local access to /dev/dri/renderD*. There is no network path.\nAC:L - The leak/UAF triggers when xe_dma_buf_init_obj() fails (ENOMEM in bo creation), a condition the attacker can induce via memory pressure and unlimited retries; per the higher-severity rule this is Low.\nPR:L - The PRIME_FD_TO_HANDLE ioctl is DRM_RENDER_ALLOW and the xe driver exposes DRIVER_RENDER render nodes, so any unprivileged local user with render-node access can trigger it. No real root is required.\nUI:N - The attacker performs the prime-import ioctl directly; no victim action is needed.\nS:U - The dangling attachment and freed bo are kernel-internal to the GPU/dma-buf subsystem; the impact stays within the kernel\u0027s security authority.\nC:H - The leaked attachment leaves a dangling importer_priv to the freed bo; via the exporter\u0027s move_notify path the freed (reallocatable) object is dereferenced, enabling disclosure of attacker-influenced freed-object contents (UAF).\nI:H - The use-after-free allows the freed bo to be reclaimed and controlled via heap spray, after which xe_dma_buf_move_notify()/xe_bo_evict() operate on attacker-controlled memory, yielding a write/control-flow primitive.\nA:H - Dereferencing the freed bo through the leaked attachment\u0027s move_notify callback corrupts kernel state and readily causes an oops/panic; the attachment also constitutes a kernel memory leak."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:25.116Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d394669e194936d7ce15284a24a5ae334c4c5b74"
},
{
"url": "https://git.kernel.org/stable/c/0afa8b1ef582ecf6fb04097fd356f8741e5005ed"
},
{
"url": "https://git.kernel.org/stable/c/eea1e10f8d99c0f04deef707c99705b94bba3b78"
},
{
"url": "https://git.kernel.org/stable/c/111ab678471bf1f90d078d5513bb086b70596c3c"
}
],
"title": "drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46201",
"datePublished": "2026-05-28T09:40:17.964Z",
"dateReserved": "2026-05-13T15:03:33.104Z",
"dateUpdated": "2026-08-05T12:30:25.116Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43128 (GCVE-0-2026-43128)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/umem: Fix double dma_buf_unpin in failure path
In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to
ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf
is immediately unpinned but the umem_dmabuf->pinned flag is still
set. Then, when ib_umem_release() is called, it calls
ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again.
Fix this by removing the immediate unpin upon failure and just let
the ib_umem_release/revoke path handle it. This also ensures the
proper unmap-unpin unwind ordering if the dmabuf_map_pages call
happened to fail due to dma_resv_wait_timeout (and therefore has
a non-NULL umem_dmabuf->sgt).
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1e4df4a21c5ac722df1099eee30cad9246c889b5 Version: 1e4df4a21c5ac722df1099eee30cad9246c889b5 Version: 1e4df4a21c5ac722df1099eee30cad9246c889b5 Version: 1e4df4a21c5ac722df1099eee30cad9246c889b5 Version: 1e4df4a21c5ac722df1099eee30cad9246c889b5 Version: 1e4df4a21c5ac722df1099eee30cad9246c889b5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/umem_dmabuf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "70542b69abff34d24b11ae0bb200cc7a766d18df",
"status": "affected",
"version": "1e4df4a21c5ac722df1099eee30cad9246c889b5",
"versionType": "git"
},
{
"lessThan": "b324327ff6f48d8065dca67eb3b91357e72726bd",
"status": "affected",
"version": "1e4df4a21c5ac722df1099eee30cad9246c889b5",
"versionType": "git"
},
{
"lessThan": "ba3bf0f1bf1d5d0404678485e872980532fcc2c4",
"status": "affected",
"version": "1e4df4a21c5ac722df1099eee30cad9246c889b5",
"versionType": "git"
},
{
"lessThan": "d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf",
"status": "affected",
"version": "1e4df4a21c5ac722df1099eee30cad9246c889b5",
"versionType": "git"
},
{
"lessThan": "40126bcbefa79ea86672e05dae608596bab38319",
"status": "affected",
"version": "1e4df4a21c5ac722df1099eee30cad9246c889b5",
"versionType": "git"
},
{
"lessThan": "104016eb671e19709721c1b0048dd912dc2e96be",
"status": "affected",
"version": "1e4df4a21c5ac722df1099eee30cad9246c889b5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/umem_dmabuf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umem: Fix double dma_buf_unpin in failure path\n\nIn ib_umem_dmabuf_get_pinned_with_dma_device(), the call to\nib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf\nis immediately unpinned but the umem_dmabuf-\u003epinned flag is still\nset. Then, when ib_umem_release() is called, it calls\nib_umem_dmabuf_revoke() which will call dma_buf_unpin() again.\n\nFix this by removing the immediate unpin upon failure and just let\nthe ib_umem_release/revoke path handle it. This also ensures the\nproper unmap-unpin unwind ordering if the dmabuf_map_pages call\nhappened to fail due to dma_resv_wait_timeout (and therefore has\na non-NULL umem_dmabuf-\u003esgt)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local RDMA uverbs ioctls such as dma-buf MR/CQ/DevX registration on /dev/infiniband/uverbs*, with a user-supplied dma-buf fd.\nAC:L - The attacker controls the ioctl inputs and dma-buf fd and can repeatedly drive the failure path after dma_buf_pin() succeeds; no uncontrollable race is required.\nPR:L - The uverbs device nodes are created mode 0666 and the relevant paths do not require CAP_* privileges, but the attacker still needs local unprivileged code execution and access to the device files.\nUI:N - No victim action is needed once the local attacker can issue the uverbs ioctl sequence.\nS:U - The impact remains within the kernel/device memory management security authority; this is not a VM escape or distinct authorization-domain boundary crossing.\nC:H - The double unpin can prematurely drop the exporter pin count while another active mapping of the same dma-buf still exists, allowing stale RDMA DMA mappings to read memory after the buffer is moved or reused.\nI:H - The same stale DMA mapping scenario can allow writes into moved or reused physical pages, giving a plausible high-impact memory corruption primitive.\nA:H - At minimum the double unpin reaches exporter/TTM WARN paths and corrupted pin/accounting state; with panic_on_warn or resulting stale-DMA corruption this can crash or destabilize the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:08.164Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/70542b69abff34d24b11ae0bb200cc7a766d18df"
},
{
"url": "https://git.kernel.org/stable/c/b324327ff6f48d8065dca67eb3b91357e72726bd"
},
{
"url": "https://git.kernel.org/stable/c/ba3bf0f1bf1d5d0404678485e872980532fcc2c4"
},
{
"url": "https://git.kernel.org/stable/c/d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf"
},
{
"url": "https://git.kernel.org/stable/c/40126bcbefa79ea86672e05dae608596bab38319"
},
{
"url": "https://git.kernel.org/stable/c/104016eb671e19709721c1b0048dd912dc2e96be"
}
],
"title": "RDMA/umem: Fix double dma_buf_unpin in failure path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43128",
"datePublished": "2026-05-06T11:27:17.474Z",
"dateReserved": "2026-05-01T14:12:55.988Z",
"dateUpdated": "2026-08-05T12:26:08.164Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45985 (GCVE-0-2026-45985)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-05-27 12:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O
When allocating blocks during within-EOF DIO and writeback with
dioread_nolock enabled, EXT4_GET_BLOCKS_PRE_IO was set to split an
existing large unwritten extent. However, EXT4_GET_BLOCKS_CONVERT was
set when calling ext4_split_convert_extents(), which may potentially
result in stale data issues.
Assume we have an unwritten extent, and then DIO writes the second half.
[UUUUUUUUUUUUUUUU] on-disk extent U: unwritten extent
[UUUUUUUUUUUUUUUU] extent status tree
|<- ->| ----> dio write this range
First, ext4_iomap_alloc() call ext4_map_blocks() with
EXT4_GET_BLOCKS_PRE_IO, EXT4_GET_BLOCKS_UNWRIT_EXT and
EXT4_GET_BLOCKS_CREATE flags set. ext4_map_blocks() find this extent and
call ext4_split_convert_extents() with EXT4_GET_BLOCKS_CONVERT and the
above flags set.
Then, ext4_split_convert_extents() calls ext4_split_extent() with
EXT4_EXT_MAY_ZEROOUT, EXT4_EXT_MARK_UNWRIT2 and EXT4_EXT_DATA_VALID2
flags set, and it calls ext4_split_extent_at() to split the second half
with EXT4_EXT_DATA_VALID2, EXT4_EXT_MARK_UNWRIT1, EXT4_EXT_MAY_ZEROOUT
and EXT4_EXT_MARK_UNWRIT2 flags set. However, ext4_split_extent_at()
failed to insert extent since a temporary lack -ENOSPC. It zeroes out
the first half but convert the entire on-disk extent to written since
the EXT4_EXT_DATA_VALID2 flag set, but left the second half as unwritten
in the extent status tree.
[0000000000SSSSSS] data S: stale data, 0: zeroed
[WWWWWWWWWWWWWWWW] on-disk extent W: written extent
[WWWWWWWWWWUUUUUU] extent status tree
Finally, if the DIO failed to write data to the disk, the stale data in
the second half will be exposed once the cached extent entry is gone.
Fix this issue by not passing EXT4_GET_BLOCKS_CONVERT when splitting
an unwritten extent before submitting I/O, and make
ext4_split_convert_extents() to zero out the entire extent range
to zero for this case, and also mark the extent in the extent status
tree for consistency.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b8a8684502a0fc852afa0056c6bb2a9273f6fcc0 Version: b8a8684502a0fc852afa0056c6bb2a9273f6fcc0 Version: b8a8684502a0fc852afa0056c6bb2a9273f6fcc0 Version: b8a8684502a0fc852afa0056c6bb2a9273f6fcc0 Version: b8a8684502a0fc852afa0056c6bb2a9273f6fcc0 Version: b8a8684502a0fc852afa0056c6bb2a9273f6fcc0 Version: b8a8684502a0fc852afa0056c6bb2a9273f6fcc0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/extents.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "77e407967cd872cd75d7e4a691908e49c8e6b4d4",
"status": "affected",
"version": "b8a8684502a0fc852afa0056c6bb2a9273f6fcc0",
"versionType": "git"
},
{
"lessThan": "37555690f39f78ef69af347d9aff897e07445949",
"status": "affected",
"version": "b8a8684502a0fc852afa0056c6bb2a9273f6fcc0",
"versionType": "git"
},
{
"lessThan": "67cdb7bd7442bd3cdc6d6088bbb2df9be2fe936c",
"status": "affected",
"version": "b8a8684502a0fc852afa0056c6bb2a9273f6fcc0",
"versionType": "git"
},
{
"lessThan": "2920ec61c98b9476781359f05b94da84e80f54d4",
"status": "affected",
"version": "b8a8684502a0fc852afa0056c6bb2a9273f6fcc0",
"versionType": "git"
},
{
"lessThan": "2698731d25823267c29190cb578da9296a0c0d7b",
"status": "affected",
"version": "b8a8684502a0fc852afa0056c6bb2a9273f6fcc0",
"versionType": "git"
},
{
"lessThan": "716e7439a5a9b18c3ff882c2f8c834b9ced1aaec",
"status": "affected",
"version": "b8a8684502a0fc852afa0056c6bb2a9273f6fcc0",
"versionType": "git"
},
{
"lessThan": "feaf2a80e78f89ee8a3464126077ba8683b62791",
"status": "affected",
"version": "b8a8684502a0fc852afa0056c6bb2a9273f6fcc0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/extents.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: don\u0027t set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O\n\nWhen allocating blocks during within-EOF DIO and writeback with\ndioread_nolock enabled, EXT4_GET_BLOCKS_PRE_IO was set to split an\nexisting large unwritten extent. However, EXT4_GET_BLOCKS_CONVERT was\nset when calling ext4_split_convert_extents(), which may potentially\nresult in stale data issues.\n\nAssume we have an unwritten extent, and then DIO writes the second half.\n\n [UUUUUUUUUUUUUUUU] on-disk extent U: unwritten extent\n [UUUUUUUUUUUUUUUU] extent status tree\n |\u003c- -\u003e| ----\u003e dio write this range\n\nFirst, ext4_iomap_alloc() call ext4_map_blocks() with\nEXT4_GET_BLOCKS_PRE_IO, EXT4_GET_BLOCKS_UNWRIT_EXT and\nEXT4_GET_BLOCKS_CREATE flags set. ext4_map_blocks() find this extent and\ncall ext4_split_convert_extents() with EXT4_GET_BLOCKS_CONVERT and the\nabove flags set.\n\nThen, ext4_split_convert_extents() calls ext4_split_extent() with\nEXT4_EXT_MAY_ZEROOUT, EXT4_EXT_MARK_UNWRIT2 and EXT4_EXT_DATA_VALID2\nflags set, and it calls ext4_split_extent_at() to split the second half\nwith EXT4_EXT_DATA_VALID2, EXT4_EXT_MARK_UNWRIT1, EXT4_EXT_MAY_ZEROOUT\nand EXT4_EXT_MARK_UNWRIT2 flags set. However, ext4_split_extent_at()\nfailed to insert extent since a temporary lack -ENOSPC. It zeroes out\nthe first half but convert the entire on-disk extent to written since\nthe EXT4_EXT_DATA_VALID2 flag set, but left the second half as unwritten\nin the extent status tree.\n\n [0000000000SSSSSS] data S: stale data, 0: zeroed\n [WWWWWWWWWWWWWWWW] on-disk extent W: written extent\n [WWWWWWWWWWUUUUUU] extent status tree\n\nFinally, if the DIO failed to write data to the disk, the stale data in\nthe second half will be exposed once the cached extent entry is gone.\n\nFix this issue by not passing EXT4_GET_BLOCKS_CONVERT when splitting\nan unwritten extent before submitting I/O, and make\next4_split_convert_extents() to zero out the entire extent range\nto zero for this case, and also mark the extent in the extent status\ntree for consistency."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:18:43.844Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/77e407967cd872cd75d7e4a691908e49c8e6b4d4"
},
{
"url": "https://git.kernel.org/stable/c/37555690f39f78ef69af347d9aff897e07445949"
},
{
"url": "https://git.kernel.org/stable/c/67cdb7bd7442bd3cdc6d6088bbb2df9be2fe936c"
},
{
"url": "https://git.kernel.org/stable/c/2920ec61c98b9476781359f05b94da84e80f54d4"
},
{
"url": "https://git.kernel.org/stable/c/2698731d25823267c29190cb578da9296a0c0d7b"
},
{
"url": "https://git.kernel.org/stable/c/716e7439a5a9b18c3ff882c2f8c834b9ced1aaec"
},
{
"url": "https://git.kernel.org/stable/c/feaf2a80e78f89ee8a3464126077ba8683b62791"
}
],
"title": "ext4: don\u0027t set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45985",
"datePublished": "2026-05-27T12:18:43.844Z",
"dateReserved": "2026-05-13T15:03:33.090Z",
"dateUpdated": "2026-05-27T12:18:43.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45947 (GCVE-0-2026-45947)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-05-27 12:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()
In amdgpu_acpi_enumerate_xcc(), if amdgpu_acpi_dev_init() returns -ENOMEM,
the function returns directly without releasing the allocated xcc_info,
resulting in a memory leak.
Fix this by ensuring that xcc_info is properly freed in the error paths.
Compile tested only. Issue found using a prototype static analysis tool
and code review.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e87c73a80a12d337cf5f493c0956f6c2c9eafd80",
"status": "affected",
"version": "4d5275ab0b18d17697392aafd93e206e6b9de647",
"versionType": "git"
},
{
"lessThan": "18a7bbd11f17a7cd4c42fd5955d3675d68c692df",
"status": "affected",
"version": "4d5275ab0b18d17697392aafd93e206e6b9de647",
"versionType": "git"
},
{
"lessThan": "d1370ef2ecf7d4df25e3e1e430cd191b1e7f8596",
"status": "affected",
"version": "4d5275ab0b18d17697392aafd93e206e6b9de647",
"versionType": "git"
},
{
"lessThan": "7e4b612fe7a960d610c20260c9ee220bddd1b215",
"status": "affected",
"version": "4d5275ab0b18d17697392aafd93e206e6b9de647",
"versionType": "git"
},
{
"lessThan": "c9be63d565789b56ca7b0197e2cb78a3671f95a8",
"status": "affected",
"version": "4d5275ab0b18d17697392aafd93e206e6b9de647",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()\n\nIn amdgpu_acpi_enumerate_xcc(), if amdgpu_acpi_dev_init() returns -ENOMEM,\nthe function returns directly without releasing the allocated xcc_info,\nresulting in a memory leak.\n\nFix this by ensuring that xcc_info is properly freed in the error paths.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:18:04.117Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e87c73a80a12d337cf5f493c0956f6c2c9eafd80"
},
{
"url": "https://git.kernel.org/stable/c/18a7bbd11f17a7cd4c42fd5955d3675d68c692df"
},
{
"url": "https://git.kernel.org/stable/c/d1370ef2ecf7d4df25e3e1e430cd191b1e7f8596"
},
{
"url": "https://git.kernel.org/stable/c/7e4b612fe7a960d610c20260c9ee220bddd1b215"
},
{
"url": "https://git.kernel.org/stable/c/c9be63d565789b56ca7b0197e2cb78a3671f95a8"
}
],
"title": "drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45947",
"datePublished": "2026-05-27T12:18:04.117Z",
"dateReserved": "2026-05-13T15:03:33.088Z",
"dateUpdated": "2026-05-27T12:18:04.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53242 (GCVE-0-2026-53242)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
snd_pcm_drain() uses init_waitqueue_entry which does not clear
entry.prev/next, and add_wait_queue with a conditional
remove_wait_queue that is skipped when to_check is no longer
in the group after concurrent UNLINK. The orphaned wait entry
remains on the unlinked substream sleep queue. On the next
drain iteration, add_wait_queue adds the entry to a new queue
while still linked on the old one, corrupting both lists. A
subsequent wake_up dereferences NULL at the func pointer
(mapped from the spinlock at offset 0 of the misinterpreted
wait_queue_head_t), causing a kernel panic.
Replace init_waitqueue_entry/add_wait_queue/conditional
remove_wait_queue with init_wait_entry/prepare_to_wait/
finish_wait. init_wait_entry clears prev/next via
INIT_LIST_HEAD on each iteration and sets
autoremove_wake_function which auto-removes the entry on
wake-up. finish_wait safely handles both the already-removed
and still-queued cases.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9baee36e8c5443411c4629afabafaff8a46a23fd Version: fc71f888994569f87d5bee20b1ac6c9c1e3a7a79 Version: 629cf09464cf98670996ea5c191dc9743e6f3f00 Version: ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432 Version: 4a758e9a1f5ed722f83c4dd35f867fe811553bcb Version: 9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 Version: 9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6 Version: c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694 Version: 5.10.253 ≤ Version: 6.1.167 ≤ Version: 6.6.130 ≤ Version: 6.12.78 ≤ Version: 6.18.19 ≤ Version: 6.19.9 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/pcm_native.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cac5bf3500ee6422cf64e0df0b5daeecfed42917",
"status": "affected",
"version": "9baee36e8c5443411c4629afabafaff8a46a23fd",
"versionType": "git"
},
{
"lessThan": "d842f26a167e77a36f3ed333b9fa99d36ef99fe6",
"status": "affected",
"version": "fc71f888994569f87d5bee20b1ac6c9c1e3a7a79",
"versionType": "git"
},
{
"lessThan": "d68b621bb5a48051932f1017a6e1bc9b18f854d0",
"status": "affected",
"version": "629cf09464cf98670996ea5c191dc9743e6f3f00",
"versionType": "git"
},
{
"lessThan": "b053fcd8912f06c30f932f5b8ec41c72de474695",
"status": "affected",
"version": "ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432",
"versionType": "git"
},
{
"lessThan": "cd98837db15f323463b8df07282ac723bd5c3fed",
"status": "affected",
"version": "4a758e9a1f5ed722f83c4dd35f867fe811553bcb",
"versionType": "git"
},
{
"lessThan": "7c71a9522555ff137a9ca36b15d759ca04d84788",
"status": "affected",
"version": "9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6",
"versionType": "git"
},
{
"lessThan": "88fe2e3658726cb21ff2dcf9770bf672f9b9d31b",
"status": "affected",
"version": "9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6",
"versionType": "git"
},
{
"status": "affected",
"version": "c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694",
"versionType": "git"
},
{
"lessThan": "5.10.259",
"status": "affected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThan": "6.1.176",
"status": "affected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThan": "6.6.143",
"status": "affected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThan": "6.12.94",
"status": "affected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThan": "6.18.36",
"status": "affected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThan": "6.20",
"status": "affected",
"version": "6.19.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/pcm_native.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.10.253",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "6.1.167",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.6.130",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.12.78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.18.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams\n\nsnd_pcm_drain() uses init_waitqueue_entry which does not clear\nentry.prev/next, and add_wait_queue with a conditional\nremove_wait_queue that is skipped when to_check is no longer\nin the group after concurrent UNLINK. The orphaned wait entry\nremains on the unlinked substream sleep queue. On the next\ndrain iteration, add_wait_queue adds the entry to a new queue\nwhile still linked on the old one, corrupting both lists. A\nsubsequent wake_up dereferences NULL at the func pointer\n(mapped from the spinlock at offset 0 of the misinterpreted\nwait_queue_head_t), causing a kernel panic.\n\nReplace init_waitqueue_entry/add_wait_queue/conditional\nremove_wait_queue with init_wait_entry/prepare_to_wait/\nfinish_wait. init_wait_entry clears prev/next via\nINIT_LIST_HEAD on each iteration and sets\nautoremove_wake_function which auto-removes the entry on\nwake-up. finish_wait safely handles both the already-removed\nand still-queued cases."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached from local userspace through ALSA PCM character-device ioctls such as SNDRV_PCM_IOCTL_LINK, SNDRV_PCM_IOCTL_UNLINK, and SNDRV_PCM_IOCTL_DRAIN. It is not reachable by remote network packets or adjacent/physical protocols.\nAC:L - The bug is a race, but the attacker can control both sides by using multiple PCM file descriptors/threads to link streams, block in drain, and concurrently unlink. No condition outside attacker control is required once suitable PCM devices are accessible.\nPR:L - No kernel capability check gates the vulnerable ioctl path, but the attacker needs local access to open ALSA PCM device nodes. That corresponds to a basic unprivileged local user with device access, not real root/admin privileges.\nUI:N - Exploitation is driven entirely by the attacker\u0027s own ioctl calls on opened PCM file descriptors. No victim user action is required.\nS:U - The vulnerability is in the kernel ALSA subsystem and affects kernel resources under the same security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The documented failure is a panic, but the primitive is kernel wait-queue list corruption with an orphaned stack wait entry and cross-queue linkage under attacker-controlled timing. Under the higher-severity rule, this memory corruption is treated as potentially usable for kernel memory disclosure.\nI:H - The bug corrupts kernel wait-queue list pointers and can leave stale wait entries reachable by later wakeups. Although the observed path dereferences a NULL function pointer, this is kernel memory corruption plausibly usable for control-flow or privilege-impacting writes, so integrity is High.\nA:H - A subsequent wake_up can dereference a NULL/misinterpreted wait-queue function pointer and panic the kernel. This is a reliable high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:28.276Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cac5bf3500ee6422cf64e0df0b5daeecfed42917"
},
{
"url": "https://git.kernel.org/stable/c/d842f26a167e77a36f3ed333b9fa99d36ef99fe6"
},
{
"url": "https://git.kernel.org/stable/c/d68b621bb5a48051932f1017a6e1bc9b18f854d0"
},
{
"url": "https://git.kernel.org/stable/c/b053fcd8912f06c30f932f5b8ec41c72de474695"
},
{
"url": "https://git.kernel.org/stable/c/cd98837db15f323463b8df07282ac723bd5c3fed"
},
{
"url": "https://git.kernel.org/stable/c/7c71a9522555ff137a9ca36b15d759ca04d84788"
},
{
"url": "https://git.kernel.org/stable/c/88fe2e3658726cb21ff2dcf9770bf672f9b9d31b"
}
],
"title": "ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53242",
"datePublished": "2026-06-25T08:39:37.129Z",
"dateReserved": "2026-06-09T07:44:35.393Z",
"dateUpdated": "2026-08-05T12:34:28.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43011 (GCVE-0-2026-43011)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/x25: Fix potential double free of skb
When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at
line 48 and returns 1 (error).
This error propagates back through the call chain:
x25_queue_rx_frame returns 1
|
v
x25_state3_machine receives the return value 1 and takes the else
branch at line 278, setting queued=0 and returning 0
|
v
x25_process_rx_frame returns queued=0
|
v
x25_backlog_rcv at line 452 sees queued=0 and calls kfree_skb(skb)
again
This would free the same skb twice. Looking at x25_backlog_rcv:
net/x25/x25_in.c:x25_backlog_rcv() {
...
queued = x25_process_rx_frame(sk, skb);
...
if (!queued)
kfree_skb(skb);
}
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:57.110Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/x25/x25_in.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5d0aa038a90b30c9bedde0c41c1fdcd98ecb16e9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "3f5e3005984645bf5bd129c6b13149879580b1fb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f782dd382203b2a8c4552a628431b7de65a19a7b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "143d4fa68ae9efb83b0c55b12cc7f0d03732a2b1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "524371398d8463ea7e101fce2cbf3915645d1730",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "fa1dbc93530b34fab0da9862426fe9c918c74dc0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c87dd137c0dad07cc55f98181ff380b0c23d2878",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d10a26aa4d072320530e6968ef945c8c575edf61",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/x25/x25_in.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/x25: Fix potential double free of skb\n\nWhen alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at\nline 48 and returns 1 (error).\nThis error propagates back through the call chain:\n\nx25_queue_rx_frame returns 1\n |\n v\nx25_state3_machine receives the return value 1 and takes the else\nbranch at line 278, setting queued=0 and returning 0\n |\n v\nx25_process_rx_frame returns queued=0\n |\n v\nx25_backlog_rcv at line 452 sees queued=0 and calls kfree_skb(skb)\nagain\n\nThis would free the same skb twice. Looking at x25_backlog_rcv:\n\nnet/x25/x25_in.c:x25_backlog_rcv() {\n ...\n queued = x25_process_rx_frame(sk, skb);\n ...\n if (!queued)\n kfree_skb(skb);\n}"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable X.25 packet-layer receive path processes attacker-controlled frames delivered from a remote X.25 peer over WAN/LAPB-backed network devices. A peer can establish or use a virtual circuit and send fragmented X.25 data packets to reach the reassembly logic.\nAC:L - The attacker controls the fragmented data frames, M bit, sequence progression, and repeated delivery needed to drive reassembly and pressure atomic skb allocation. No race or victim interaction is required, and uncertainty is resolved toward the higher-severity low-complexity value.\nPR:N - The packet path is reached by unauthenticated received X.25 frames after normal virtual-circuit setup; the attacker does not need local kernel privileges. Local administration may configure X.25 devices/routes, but that is deployment setup rather than attacker privilege.\nUI:N - No user action is required once an X.25 listener or established circuit exists. The peer can trigger the vulnerable receive path by sending crafted fragmented data frames.\nS:U - The corruption occurs inside the Linux kernel networking stack and impacts the same kernel security authority. It does not cross a hypervisor, IOMMU, or other separate security scope.\nC:H - A double free of an skb is kernel heap memory corruption and can plausibly be shaped into use-after-free behavior. Under the required conservative scoring rule, this supports high confidentiality impact.\nI:H - The same double free can corrupt kernel heap allocator state or enable reuse of freed skb memory, which is potentially exploitable for arbitrary kernel memory modification or code execution. Under uncertainty, the higher severity impact is selected.\nA:H - Even without full exploitation, double freeing an skb can trigger allocator corruption detection, oops, panic, or other kernel crash behavior. The crafted traffic can be sent repeatedly to cause denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:15.337Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5d0aa038a90b30c9bedde0c41c1fdcd98ecb16e9"
},
{
"url": "https://git.kernel.org/stable/c/3f5e3005984645bf5bd129c6b13149879580b1fb"
},
{
"url": "https://git.kernel.org/stable/c/f782dd382203b2a8c4552a628431b7de65a19a7b"
},
{
"url": "https://git.kernel.org/stable/c/143d4fa68ae9efb83b0c55b12cc7f0d03732a2b1"
},
{
"url": "https://git.kernel.org/stable/c/524371398d8463ea7e101fce2cbf3915645d1730"
},
{
"url": "https://git.kernel.org/stable/c/fa1dbc93530b34fab0da9862426fe9c918c74dc0"
},
{
"url": "https://git.kernel.org/stable/c/c87dd137c0dad07cc55f98181ff380b0c23d2878"
},
{
"url": "https://git.kernel.org/stable/c/d10a26aa4d072320530e6968ef945c8c575edf61"
}
],
"title": "net/x25: Fix potential double free of skb",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43011",
"datePublished": "2026-05-01T14:15:17.597Z",
"dateReserved": "2026-05-01T14:12:55.974Z",
"dateUpdated": "2026-08-05T12:25:15.337Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45983 (GCVE-0-2026-45983)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-05-27 12:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfsd: never defer requests during idmap lookup
During v4 request compound arg decoding, some ops (e.g. SETATTR)
can trigger idmap lookup upcalls. When those upcall responses get
delayed beyond the allowed time limit, cache_check() will mark the
request for deferral and cause it to be dropped.
This prevents nfs4svc_encode_compoundres from being executed, and
thus the session slot flag NFSD4_SLOT_INUSE never gets cleared.
Subsequent client requests will fail with NFSERR_JUKEBOX, given
that the slot will be marked as in-use, making the SEQUENCE op
fail.
Fix this by making sure that the RQ_USEDEFERRAL flag is always
clear during nfs4svc_decode_compoundargs(), since no v4 request
should ever be deferred.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2f425878b6a71571341dcd3f9e9d1a6f6355da9c Version: 2f425878b6a71571341dcd3f9e9d1a6f6355da9c Version: 2f425878b6a71571341dcd3f9e9d1a6f6355da9c Version: 2f425878b6a71571341dcd3f9e9d1a6f6355da9c Version: 2f425878b6a71571341dcd3f9e9d1a6f6355da9c Version: 2f425878b6a71571341dcd3f9e9d1a6f6355da9c Version: 2f425878b6a71571341dcd3f9e9d1a6f6355da9c Version: 2f425878b6a71571341dcd3f9e9d1a6f6355da9c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4idmap.c",
"fs/nfsd/nfs4proc.c",
"fs/nfsd/nfs4xdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b9abb760db20504240a7147f27934d900cd80b23",
"status": "affected",
"version": "2f425878b6a71571341dcd3f9e9d1a6f6355da9c",
"versionType": "git"
},
{
"lessThan": "3a72c7dedc99b321e0f267e4e999e5baf07c4593",
"status": "affected",
"version": "2f425878b6a71571341dcd3f9e9d1a6f6355da9c",
"versionType": "git"
},
{
"lessThan": "99e17b20fddac19a228d213e00f6b9e1c10daff9",
"status": "affected",
"version": "2f425878b6a71571341dcd3f9e9d1a6f6355da9c",
"versionType": "git"
},
{
"lessThan": "243f71ed873ff3feeb6f9b5cb145d63f7188b4c4",
"status": "affected",
"version": "2f425878b6a71571341dcd3f9e9d1a6f6355da9c",
"versionType": "git"
},
{
"lessThan": "063a6f22478ef929625000a2caf54667725c1dfd",
"status": "affected",
"version": "2f425878b6a71571341dcd3f9e9d1a6f6355da9c",
"versionType": "git"
},
{
"lessThan": "d75ec4504a4340b033b15cad0303988b3089dd93",
"status": "affected",
"version": "2f425878b6a71571341dcd3f9e9d1a6f6355da9c",
"versionType": "git"
},
{
"lessThan": "8dff54fe88c0dcd4c55bff9fc2fa6ca968290826",
"status": "affected",
"version": "2f425878b6a71571341dcd3f9e9d1a6f6355da9c",
"versionType": "git"
},
{
"lessThan": "f9c206cdc4266caad6a9a7f46341420a10f03ccb",
"status": "affected",
"version": "2f425878b6a71571341dcd3f9e9d1a6f6355da9c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4idmap.c",
"fs/nfsd/nfs4proc.c",
"fs/nfsd/nfs4xdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: never defer requests during idmap lookup\n\nDuring v4 request compound arg decoding, some ops (e.g. SETATTR)\ncan trigger idmap lookup upcalls. When those upcall responses get\ndelayed beyond the allowed time limit, cache_check() will mark the\nrequest for deferral and cause it to be dropped.\n\nThis prevents nfs4svc_encode_compoundres from being executed, and\nthus the session slot flag NFSD4_SLOT_INUSE never gets cleared.\nSubsequent client requests will fail with NFSERR_JUKEBOX, given\nthat the slot will be marked as in-use, making the SEQUENCE op\nfail.\n\nFix this by making sure that the RQ_USEDEFERRAL flag is always\nclear during nfs4svc_decode_compoundargs(), since no v4 request\nshould ever be deferred."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:18:41.619Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b9abb760db20504240a7147f27934d900cd80b23"
},
{
"url": "https://git.kernel.org/stable/c/3a72c7dedc99b321e0f267e4e999e5baf07c4593"
},
{
"url": "https://git.kernel.org/stable/c/99e17b20fddac19a228d213e00f6b9e1c10daff9"
},
{
"url": "https://git.kernel.org/stable/c/243f71ed873ff3feeb6f9b5cb145d63f7188b4c4"
},
{
"url": "https://git.kernel.org/stable/c/063a6f22478ef929625000a2caf54667725c1dfd"
},
{
"url": "https://git.kernel.org/stable/c/d75ec4504a4340b033b15cad0303988b3089dd93"
},
{
"url": "https://git.kernel.org/stable/c/8dff54fe88c0dcd4c55bff9fc2fa6ca968290826"
},
{
"url": "https://git.kernel.org/stable/c/f9c206cdc4266caad6a9a7f46341420a10f03ccb"
}
],
"title": "nfsd: never defer requests during idmap lookup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45983",
"datePublished": "2026-05-27T12:18:41.619Z",
"dateReserved": "2026-05-13T15:03:33.090Z",
"dateUpdated": "2026-05-27T12:18:41.619Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46101 (GCVE-0-2026-46101)
Vulnerability from cvelistv5
Published
2026-05-27 12:59
Modified
2026-06-14 17:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: reject zero shift in nft_bitwise
Reject zero shift operands for nft_bitwise left and right shift
expressions during initialization.
The carry propagation logic computes the carry from the adjacent 32-bit
word using BITS_PER_TYPE(u32) - shift. A zero shift operand turns this
into a 32-bit shift, which is undefined behaviour.
Reject zero shift operands in the control plane, alongside the existing
check for values greater than or equal to 32, so malformed rules never
reach the packet path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93 Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93 Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93 Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93 Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93 Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93 Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93 Version: 567d746b55bc66d3800c9ae91d50f0c5deb2fd93 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_bitwise.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9baa08d6b6b096fad70049533f0d705d85fdc979",
"status": "affected",
"version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
"versionType": "git"
},
{
"lessThan": "4fccea585631621c975883911a08d15b6671f7dc",
"status": "affected",
"version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
"versionType": "git"
},
{
"lessThan": "9ad26c272405f53834871cc2e46b9b5393a666c3",
"status": "affected",
"version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
"versionType": "git"
},
{
"lessThan": "bffef0acec9c3b837a785248a893137fb7f26c95",
"status": "affected",
"version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
"versionType": "git"
},
{
"lessThan": "ca24f1243ad1a4d12d6a23876bbbe3ed02099853",
"status": "affected",
"version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
"versionType": "git"
},
{
"lessThan": "6f820139d16a4c9865a145d4a9cf9c92cc632c14",
"status": "affected",
"version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
"versionType": "git"
},
{
"lessThan": "f370205974f171a5868c13ff30d7642fed46e47b",
"status": "affected",
"version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
"versionType": "git"
},
{
"lessThan": "fe11e5c40817b84abaa5d83bfb6586d8412bfd07",
"status": "affected",
"version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_bitwise.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: reject zero shift in nft_bitwise\n\nReject zero shift operands for nft_bitwise left and right shift\nexpressions during initialization.\n\nThe carry propagation logic computes the carry from the adjacent 32-bit\nword using BITS_PER_TYPE(u32) - shift. A zero shift operand turns this\ninto a 32-bit shift, which is undefined behaviour.\n\nReject zero shift operands in the control plane, alongside the existing\ncheck for values greater than or equal to 32, so malformed rules never\nreach the packet path."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:54:30.068Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9baa08d6b6b096fad70049533f0d705d85fdc979"
},
{
"url": "https://git.kernel.org/stable/c/4fccea585631621c975883911a08d15b6671f7dc"
},
{
"url": "https://git.kernel.org/stable/c/9ad26c272405f53834871cc2e46b9b5393a666c3"
},
{
"url": "https://git.kernel.org/stable/c/bffef0acec9c3b837a785248a893137fb7f26c95"
},
{
"url": "https://git.kernel.org/stable/c/ca24f1243ad1a4d12d6a23876bbbe3ed02099853"
},
{
"url": "https://git.kernel.org/stable/c/6f820139d16a4c9865a145d4a9cf9c92cc632c14"
},
{
"url": "https://git.kernel.org/stable/c/f370205974f171a5868c13ff30d7642fed46e47b"
},
{
"url": "https://git.kernel.org/stable/c/fe11e5c40817b84abaa5d83bfb6586d8412bfd07"
}
],
"title": "netfilter: reject zero shift in nft_bitwise",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46101",
"datePublished": "2026-05-27T12:59:08.220Z",
"dateReserved": "2026-05-13T15:03:33.097Z",
"dateUpdated": "2026-06-14T17:54:30.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46173 (GCVE-0-2026-46173)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
exit: prevent preemption of oopsing TASK_DEAD task
When an already-exiting task oopses, make_task_dead() currently calls
do_task_dead() with preemption enabled. That is forbidden:
do_task_dead() calls __schedule(), which has a comment saying "WARNING:
must be called with preemption disabled!".
If an oopsing task is preempted in do_task_dead(), between becoming
TASK_DEAD and entering the scheduler explicitly, bad things happen:
finish_task_switch() assumes that once the scheduler has switched away
from a TASK_DEAD task, the task can never run again and its stack is no
longer needed; but that assumption apparently doesn't hold if the dead
task was preempted (the SM_PREEMPT case).
This means that the scheduler ends up repeatedly dropping references on
the dead task's stack, which can lead to use-after-free or double-free
of the entire task stack; in other words, two tasks can end up running
on the same stack, resulting in various kinds of memory corruption.
(This does not just affect "recursively oopsing" tasks; it is enough to
oops once during task exit, for example in a file_operations::release
handler)
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7f80a2fd7db9a55894fd841915236aca611291b5 Version: 7f80a2fd7db9a55894fd841915236aca611291b5 Version: 7f80a2fd7db9a55894fd841915236aca611291b5 Version: 7f80a2fd7db9a55894fd841915236aca611291b5 Version: 7f80a2fd7db9a55894fd841915236aca611291b5 Version: 7f80a2fd7db9a55894fd841915236aca611291b5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/exit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d6fb8a7690c23e3213c4b008f64d89a44b98737",
"status": "affected",
"version": "7f80a2fd7db9a55894fd841915236aca611291b5",
"versionType": "git"
},
{
"lessThan": "640b4c00fb0e2920327435f6176cbefc3c546165",
"status": "affected",
"version": "7f80a2fd7db9a55894fd841915236aca611291b5",
"versionType": "git"
},
{
"lessThan": "7b2800ba5f5f77a8ee7f4cbadb19cf1264597a34",
"status": "affected",
"version": "7f80a2fd7db9a55894fd841915236aca611291b5",
"versionType": "git"
},
{
"lessThan": "6f49f94f3b11fe8bff1bf2a054143789e76aaf17",
"status": "affected",
"version": "7f80a2fd7db9a55894fd841915236aca611291b5",
"versionType": "git"
},
{
"lessThan": "9756b3db5db6c2f5eccb32dddbd88eb4c54f575e",
"status": "affected",
"version": "7f80a2fd7db9a55894fd841915236aca611291b5",
"versionType": "git"
},
{
"lessThan": "c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891",
"status": "affected",
"version": "7f80a2fd7db9a55894fd841915236aca611291b5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/exit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexit: prevent preemption of oopsing TASK_DEAD task\n\nWhen an already-exiting task oopses, make_task_dead() currently calls\ndo_task_dead() with preemption enabled. That is forbidden:\ndo_task_dead() calls __schedule(), which has a comment saying \"WARNING:\nmust be called with preemption disabled!\".\n\nIf an oopsing task is preempted in do_task_dead(), between becoming\nTASK_DEAD and entering the scheduler explicitly, bad things happen:\nfinish_task_switch() assumes that once the scheduler has switched away\nfrom a TASK_DEAD task, the task can never run again and its stack is no\nlonger needed; but that assumption apparently doesn\u0027t hold if the dead\ntask was preempted (the SM_PREEMPT case).\n\nThis means that the scheduler ends up repeatedly dropping references on\nthe dead task\u0027s stack, which can lead to use-after-free or double-free\nof the entire task stack; in other words, two tasks can end up running\non the same stack, resulting in various kinds of memory corruption.\n\n(This does not just affect \"recursively oopsing\" tasks; it is enough to\noops once during task exit, for example in a file_operations::release\nhandler)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is in the kernel task-exit/scheduler path (`make_task_dead` \u2192 `do_task_dead`) of a local process; it is triggered by a task oopsing during its own exit, with no remote network reachability.\nAC:L - Exploitation depends on a preemption-timing window between `set_special_state(TASK_DEAD)` and `__schedule()`, but the attacker can repeatedly spawn exiting+faulting tasks and generate CPU load to induce preemption, making the race winnable; per the uncertainty rule the higher-severity value is chosen.\nPR:L - Any unprivileged local user can spawn processes that exit and fault on the exit path; no real-root or init-namespace privilege is required.\nUI:N - The attacker triggers their own process exit and fault; no action by another user is needed.\nS:U - The use-after-free/double-free corrupts kernel task-stack memory within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The double-free/UAF of the task stack lets two tasks run on the same stack, giving the attacker control over freed memory contents and thus an arbitrary kernel-memory read primitive.\nI:H - The same task-stack UAF/double-free yields an arbitrary write / control-flow-hijack primitive (heap spray, overlapping stacks), enabling privilege escalation.\nA:H - The repeated reference drops cause double-free/use-after-free memory corruption that reliably leads to kernel panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:11.089Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d6fb8a7690c23e3213c4b008f64d89a44b98737"
},
{
"url": "https://git.kernel.org/stable/c/640b4c00fb0e2920327435f6176cbefc3c546165"
},
{
"url": "https://git.kernel.org/stable/c/7b2800ba5f5f77a8ee7f4cbadb19cf1264597a34"
},
{
"url": "https://git.kernel.org/stable/c/6f49f94f3b11fe8bff1bf2a054143789e76aaf17"
},
{
"url": "https://git.kernel.org/stable/c/9756b3db5db6c2f5eccb32dddbd88eb4c54f575e"
},
{
"url": "https://git.kernel.org/stable/c/c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891"
},
{
"url": "https://project-zero.issues.chromium.org/issues/510793286"
}
],
"title": "exit: prevent preemption of oopsing TASK_DEAD task",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46173",
"datePublished": "2026-05-28T09:36:27.892Z",
"dateReserved": "2026-05-13T15:03:33.103Z",
"dateUpdated": "2026-08-05T12:30:11.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46206 (GCVE-0-2026-46206)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: reject new tp_meter sessions during teardown
Prevent tp_meter from starting new sender or receiver sessions after
mesh_state has left BATADV_MESH_ACTIVE.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/tp_meter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0a7a840074c9ca5ebffc9c52358c8ea55828ec71",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "dcff44644bb518598b1a6be722706d6174b2f6a1",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "52e6ec3e972cf27792cc1559874dbee19f286869",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "e4a3c4a4c8f6efd243c3e448c05b7bebcbf7b3b6",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "ff93f86ecbb50a4709c403fc279a396e308edde5",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "e1e2194cc725ec1d41f9412496212f0fa0519c36",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "ca39545cf07c142b39d474a1439a046bf28def3d",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "3243543592425beec83d453793e9d27caa0d8e66",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/tp_meter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: reject new tp_meter sessions during teardown\n\nPrevent tp_meter from starting new sender or receiver sessions after\nmesh_state has left BATADV_MESH_ACTIVE."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached via the netlink BATADV_CMD_TP_METER command (local genl socket) or via mesh packets injected into a locally-set-up batadv interface; batman-adv is an L2 mesh protocol, not internet-routable, so this requires local access rather than Network.\nAC:L - This is a teardown race, but a local attacker controls both sides \u2014 repeatedly creating/destroying the soft interface (driving mesh_free/batadv_tp_stop_all) in one thread while starting tp_meter sessions in another \u2014 and can retry the loop indefinitely until the window is won.\nPR:L - TP_METER is gated by GENL_UNS_ADMIN_PERM (namespaced CAP_NET_ADMIN), which an unprivileged user obtains via `unshare -Urn`, then creates their own batadv mesh interface; no real root is required.\nUI:N - The attacker drives both the session start and the interface teardown themselves; no action by any other user is needed.\nS:U - The use-after-free corrupts kernel heap objects within the kernel\u0027s own security authority; there is no crossing of a VM/IOMMU/sandbox boundary.\nC:H - The surviving session holds a dangling pointer to freed tp_vars/bat_priv memory; reclaiming and reading that freed object enables disclosure of kernel memory contents.\nI:H - The use-after-free permits heap spraying of the freed object and a controlled write through the stale timer/kthread/work references, enabling memory corruption and potential control-flow hijack.\nA:H - A timer/kthread/delayed work operating on freed mesh structures reliably triggers an oops/panic, crashing the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:28.363Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0a7a840074c9ca5ebffc9c52358c8ea55828ec71"
},
{
"url": "https://git.kernel.org/stable/c/dcff44644bb518598b1a6be722706d6174b2f6a1"
},
{
"url": "https://git.kernel.org/stable/c/52e6ec3e972cf27792cc1559874dbee19f286869"
},
{
"url": "https://git.kernel.org/stable/c/e4a3c4a4c8f6efd243c3e448c05b7bebcbf7b3b6"
},
{
"url": "https://git.kernel.org/stable/c/ff93f86ecbb50a4709c403fc279a396e308edde5"
},
{
"url": "https://git.kernel.org/stable/c/e1e2194cc725ec1d41f9412496212f0fa0519c36"
},
{
"url": "https://git.kernel.org/stable/c/ca39545cf07c142b39d474a1439a046bf28def3d"
},
{
"url": "https://git.kernel.org/stable/c/3243543592425beec83d453793e9d27caa0d8e66"
}
],
"title": "batman-adv: reject new tp_meter sessions during teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46206",
"datePublished": "2026-05-28T09:40:23.993Z",
"dateReserved": "2026-05-13T15:03:33.105Z",
"dateUpdated": "2026-08-05T12:30:28.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45881 (GCVE-0-2026-45881)
Vulnerability from cvelistv5
Published
2026-05-27 12:16
Modified
2026-05-27 12:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()
In svs_enable_debug_write(), the buf allocated by memdup_user_nul()
is leaked if kstrtoint() fails.
Fix this by using __free(kfree) to automatically free buf, eliminating
the need for explicit kfree() calls and preventing leaks.
[Angelo: Added missing cleanup.h inclusion]
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 13f1bbcfb5822fcaacfc652017b57b79ffcacefa Version: 13f1bbcfb5822fcaacfc652017b57b79ffcacefa Version: 13f1bbcfb5822fcaacfc652017b57b79ffcacefa Version: 13f1bbcfb5822fcaacfc652017b57b79ffcacefa Version: 13f1bbcfb5822fcaacfc652017b57b79ffcacefa Version: 13f1bbcfb5822fcaacfc652017b57b79ffcacefa |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/soc/mediatek/mtk-svs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "47a3e372f7d68776adb749a27c0ec9058ff1b4fd",
"status": "affected",
"version": "13f1bbcfb5822fcaacfc652017b57b79ffcacefa",
"versionType": "git"
},
{
"lessThan": "06195456c4e4de3826c4ca60eca941c472f991d0",
"status": "affected",
"version": "13f1bbcfb5822fcaacfc652017b57b79ffcacefa",
"versionType": "git"
},
{
"lessThan": "a58c97828911c0b6e25d6b556789da974003efda",
"status": "affected",
"version": "13f1bbcfb5822fcaacfc652017b57b79ffcacefa",
"versionType": "git"
},
{
"lessThan": "0f6498077faa9cd89bb787bcc57063494a6f0601",
"status": "affected",
"version": "13f1bbcfb5822fcaacfc652017b57b79ffcacefa",
"versionType": "git"
},
{
"lessThan": "6bb10466e0884b4a68d4a1f3f4bb87eeb471c18a",
"status": "affected",
"version": "13f1bbcfb5822fcaacfc652017b57b79ffcacefa",
"versionType": "git"
},
{
"lessThan": "6259094ee806fb813ca95894c65fb80e2ec98bf1",
"status": "affected",
"version": "13f1bbcfb5822fcaacfc652017b57b79ffcacefa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/soc/mediatek/mtk-svs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: mediatek: svs: Fix memory leak in svs_enable_debug_write()\n\nIn svs_enable_debug_write(), the buf allocated by memdup_user_nul()\nis leaked if kstrtoint() fails.\n\nFix this by using __free(kfree) to automatically free buf, eliminating\nthe need for explicit kfree() calls and preventing leaks.\n\n[Angelo: Added missing cleanup.h inclusion]"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:16:53.677Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/47a3e372f7d68776adb749a27c0ec9058ff1b4fd"
},
{
"url": "https://git.kernel.org/stable/c/06195456c4e4de3826c4ca60eca941c472f991d0"
},
{
"url": "https://git.kernel.org/stable/c/a58c97828911c0b6e25d6b556789da974003efda"
},
{
"url": "https://git.kernel.org/stable/c/0f6498077faa9cd89bb787bcc57063494a6f0601"
},
{
"url": "https://git.kernel.org/stable/c/6bb10466e0884b4a68d4a1f3f4bb87eeb471c18a"
},
{
"url": "https://git.kernel.org/stable/c/6259094ee806fb813ca95894c65fb80e2ec98bf1"
}
],
"title": "soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45881",
"datePublished": "2026-05-27T12:16:53.677Z",
"dateReserved": "2026-05-13T15:03:33.082Z",
"dateUpdated": "2026-05-27T12:16:53.677Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31485 (GCVE-0-2026-31485)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-07-14 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
spi: spi-fsl-lpspi: fix teardown order issue (UAF)
There is a teardown order issue in the driver. The SPI controller is
registered using devm_spi_register_controller(), which delays
unregistration of the SPI controller until after the fsl_lpspi_remove()
function returns.
As the fsl_lpspi_remove() function synchronously tears down the DMA
channels, a running SPI transfer triggers the following NULL pointer
dereference due to use after free:
| fsl_lpspi 42550000.spi: I/O Error in DMA RX
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[...]
| Call trace:
| fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi]
| fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi]
| spi_transfer_one_message+0x49c/0x7c8
| __spi_pump_transfer_message+0x120/0x420
| __spi_sync+0x2c4/0x520
| spi_sync+0x34/0x60
| spidev_message+0x20c/0x378 [spidev]
| spidev_ioctl+0x398/0x750 [spidev]
[...]
Switch from devm_spi_register_controller() to spi_register_controller() in
fsl_lpspi_probe() and add the corresponding spi_unregister_controller() in
fsl_lpspi_remove().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5314987de5e5f5e38436ef4a69328bc472bbd63e Version: 5314987de5e5f5e38436ef4a69328bc472bbd63e Version: 5314987de5e5f5e38436ef4a69328bc472bbd63e Version: 5314987de5e5f5e38436ef4a69328bc472bbd63e Version: 5314987de5e5f5e38436ef4a69328bc472bbd63e Version: 5314987de5e5f5e38436ef4a69328bc472bbd63e Version: 5314987de5e5f5e38436ef4a69328bc472bbd63e Version: 5314987de5e5f5e38436ef4a69328bc472bbd63e |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:01.902Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-fsl-lpspi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fbe6f40caeebb0b1ea9dfedc259124c1d3cda7a6",
"status": "affected",
"version": "5314987de5e5f5e38436ef4a69328bc472bbd63e",
"versionType": "git"
},
{
"lessThan": "ca4483f36ac1b62e69f8b182c5b8f059e0abecfb",
"status": "affected",
"version": "5314987de5e5f5e38436ef4a69328bc472bbd63e",
"versionType": "git"
},
{
"lessThan": "e3fd54f8b0317fbccc103961ddd660f2a32dcf0b",
"status": "affected",
"version": "5314987de5e5f5e38436ef4a69328bc472bbd63e",
"versionType": "git"
},
{
"lessThan": "adb25339b66112393fd6892ceff926765feb5b86",
"status": "affected",
"version": "5314987de5e5f5e38436ef4a69328bc472bbd63e",
"versionType": "git"
},
{
"lessThan": "d5d01f24bc6fbde40b4e567ef9160194b61267bc",
"status": "affected",
"version": "5314987de5e5f5e38436ef4a69328bc472bbd63e",
"versionType": "git"
},
{
"lessThan": "e89e2b97253c124d37bf88e96e5e8ce5c3aeeec3",
"status": "affected",
"version": "5314987de5e5f5e38436ef4a69328bc472bbd63e",
"versionType": "git"
},
{
"lessThan": "15650dfbaeeb14bcaaf053b93cf631db8d465300",
"status": "affected",
"version": "5314987de5e5f5e38436ef4a69328bc472bbd63e",
"versionType": "git"
},
{
"lessThan": "b341c1176f2e001b3adf0b47154fc31589f7410e",
"status": "affected",
"version": "5314987de5e5f5e38436ef4a69328bc472bbd63e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-fsl-lpspi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-fsl-lpspi: fix teardown order issue (UAF)\n\nThere is a teardown order issue in the driver. The SPI controller is\nregistered using devm_spi_register_controller(), which delays\nunregistration of the SPI controller until after the fsl_lpspi_remove()\nfunction returns.\n\nAs the fsl_lpspi_remove() function synchronously tears down the DMA\nchannels, a running SPI transfer triggers the following NULL pointer\ndereference due to use after free:\n\n| fsl_lpspi 42550000.spi: I/O Error in DMA RX\n| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[...]\n| Call trace:\n| fsl_lpspi_dma_transfer+0x260/0x340 [spi_fsl_lpspi]\n| fsl_lpspi_transfer_one+0x198/0x448 [spi_fsl_lpspi]\n| spi_transfer_one_message+0x49c/0x7c8\n| __spi_pump_transfer_message+0x120/0x420\n| __spi_sync+0x2c4/0x520\n| spi_sync+0x34/0x60\n| spidev_message+0x20c/0x378 [spidev]\n| spidev_ioctl+0x398/0x750 [spidev]\n[...]\n\nSwitch from devm_spi_register_controller() to spi_register_controller() in\nfsl_lpspi_probe() and add the corresponding spi_unregister_controller() in\nfsl_lpspi_remove()."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:09:38.585Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fbe6f40caeebb0b1ea9dfedc259124c1d3cda7a6"
},
{
"url": "https://git.kernel.org/stable/c/ca4483f36ac1b62e69f8b182c5b8f059e0abecfb"
},
{
"url": "https://git.kernel.org/stable/c/e3fd54f8b0317fbccc103961ddd660f2a32dcf0b"
},
{
"url": "https://git.kernel.org/stable/c/adb25339b66112393fd6892ceff926765feb5b86"
},
{
"url": "https://git.kernel.org/stable/c/d5d01f24bc6fbde40b4e567ef9160194b61267bc"
},
{
"url": "https://git.kernel.org/stable/c/e89e2b97253c124d37bf88e96e5e8ce5c3aeeec3"
},
{
"url": "https://git.kernel.org/stable/c/15650dfbaeeb14bcaaf053b93cf631db8d465300"
},
{
"url": "https://git.kernel.org/stable/c/b341c1176f2e001b3adf0b47154fc31589f7410e"
}
],
"title": "spi: spi-fsl-lpspi: fix teardown order issue (UAF)",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31485",
"datePublished": "2026-04-22T13:54:10.892Z",
"dateReserved": "2026-03-09T15:48:24.101Z",
"dateUpdated": "2026-07-14T12:48:01.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31778 (GCVE-0-2026-31778)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-05-11 22:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: caiaq: fix stack out-of-bounds read in init_card
The loop creates a whitespace-stripped copy of the card shortname
where `len < sizeof(card->id)` is used for the bounds check. Since
sizeof(card->id) is 16 and the local id buffer is also 16 bytes,
writing 16 non-space characters fills the entire buffer,
overwriting the terminating nullbyte.
When this non-null-terminated string is later passed to
snd_card_set_id() -> copy_valid_id_string(), the function scans
forward with `while (*nid && ...)` and reads past the end of the
stack buffer, reading the contents of the stack.
A USB device with a product name containing many non-ASCII, non-space
characters (e.g. multibyte UTF-8) will reliably trigger this as follows:
BUG: KASAN: stack-out-of-bounds in copy_valid_id_string
sound/core/init.c:696 [inline]
BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c
sound/core/init.c:718
The off-by-one has been present since commit bafeee5b1f8d ("ALSA:
snd_usb_caiaq: give better shortname") from June 2009 (v2.6.31-rc1),
which first introduced this whitespace-stripping loop. The original
code never accounted for the null terminator when bounding the copy.
Fix this by changing the loop bound to `sizeof(card->id) - 1`,
ensuring at least one byte remains as the null terminator.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a Version: bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a Version: bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a Version: bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a Version: bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a Version: bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a Version: bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a Version: bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/caiaq/device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "02d9c5b0b5553a391448b6d655262bd829f90234",
"status": "affected",
"version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a",
"versionType": "git"
},
{
"lessThan": "3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6",
"status": "affected",
"version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a",
"versionType": "git"
},
{
"lessThan": "66194c2575a4f567577ae70b1d7561163ce791a6",
"status": "affected",
"version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a",
"versionType": "git"
},
{
"lessThan": "a82c1bce2d1299dd3c686a8fe48cf75b79a403c7",
"status": "affected",
"version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a",
"versionType": "git"
},
{
"lessThan": "3178b62e2e31bab39f63d4c8e54bf4ee0a425627",
"status": "affected",
"version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a",
"versionType": "git"
},
{
"lessThan": "3afa2e67f3523a980a2f90fd63c22322ac2b9ce0",
"status": "affected",
"version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a",
"versionType": "git"
},
{
"lessThan": "7594a6464873d90fd229e5b94cdd3b92c9feabed",
"status": "affected",
"version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a",
"versionType": "git"
},
{
"lessThan": "45424e871abf2a152e247a9cff78359f18dd95c0",
"status": "affected",
"version": "bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/caiaq/device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: fix stack out-of-bounds read in init_card\n\nThe loop creates a whitespace-stripped copy of the card shortname\nwhere `len \u003c sizeof(card-\u003eid)` is used for the bounds check. Since\nsizeof(card-\u003eid) is 16 and the local id buffer is also 16 bytes,\nwriting 16 non-space characters fills the entire buffer,\noverwriting the terminating nullbyte.\n\nWhen this non-null-terminated string is later passed to\nsnd_card_set_id() -\u003e copy_valid_id_string(), the function scans\nforward with `while (*nid \u0026\u0026 ...)` and reads past the end of the\nstack buffer, reading the contents of the stack.\n\nA USB device with a product name containing many non-ASCII, non-space\ncharacters (e.g. multibyte UTF-8) will reliably trigger this as follows:\n\n BUG: KASAN: stack-out-of-bounds in copy_valid_id_string\n sound/core/init.c:696 [inline]\n BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c\n sound/core/init.c:718\n\nThe off-by-one has been present since commit bafeee5b1f8d (\"ALSA:\nsnd_usb_caiaq: give better shortname\") from June 2009 (v2.6.31-rc1),\nwhich first introduced this whitespace-stripping loop. The original\ncode never accounted for the null terminator when bounding the copy.\n\nFix this by changing the loop bound to `sizeof(card-\u003eid) - 1`,\nensuring at least one byte remains as the null terminator."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:15:37.687Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/02d9c5b0b5553a391448b6d655262bd829f90234"
},
{
"url": "https://git.kernel.org/stable/c/3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6"
},
{
"url": "https://git.kernel.org/stable/c/66194c2575a4f567577ae70b1d7561163ce791a6"
},
{
"url": "https://git.kernel.org/stable/c/a82c1bce2d1299dd3c686a8fe48cf75b79a403c7"
},
{
"url": "https://git.kernel.org/stable/c/3178b62e2e31bab39f63d4c8e54bf4ee0a425627"
},
{
"url": "https://git.kernel.org/stable/c/3afa2e67f3523a980a2f90fd63c22322ac2b9ce0"
},
{
"url": "https://git.kernel.org/stable/c/7594a6464873d90fd229e5b94cdd3b92c9feabed"
},
{
"url": "https://git.kernel.org/stable/c/45424e871abf2a152e247a9cff78359f18dd95c0"
}
],
"title": "ALSA: caiaq: fix stack out-of-bounds read in init_card",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31778",
"datePublished": "2026-05-01T14:15:05.804Z",
"dateReserved": "2026-03-09T15:48:24.140Z",
"dateUpdated": "2026-05-11T22:15:37.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53360 (GCVE-0-2026-53360)
Vulnerability from cvelistv5
Published
2026-07-04 11:53
Modified
2026-08-05 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use
As per the GHCB spec, when using GHCB v2+ require the software scratch area
to reside in the GHCB's shared buffer. Note, things like Page State Change
(PSC) requests _rely_ on this behavior, as the guest can't provide a length
when making the request, i.e. the size of the guest payload is bounded by
the size of the shared buffer.
Failure to force usage of the GHCB, and a slew of other flaws, lets a
malicious SNP guest corrupt host kernel heap memory, and leak host heap
layout information.
setup_vmgexit_scratch() allocates a buffer via kvzalloc(exit_info_2),
where exit_info_2 is guest-controlled. With exit_info_2=24, this yields
a 24-byte allocation in kmalloc-cg-32 (32-byte slab objects). The buffer
holds an 8-byte psc_hdr followed by 8-byte psc_entry structs, so only
entries[0] and entries[1] are in-bounds.
snp_begin_psc() validates end_entry against VMGEXIT_PSC_MAX_COUNT (253)
but NOT against the actual buffer size:
idx_end = hdr->end_entry;
if (idx_end >= VMGEXIT_PSC_MAX_COUNT) { // checks 253, not buffer
snp_complete_psc(svm, ...);
return 1;
}
for (idx = idx_start; idx <= idx_end; idx++) {
entry_start = entries[idx]; // OOB when idx >= 2
The guest sets end_entry=10+, causing the host to iterate entries[2+]
which are OOB into adjacent slab objects. For each OOB entry:
- The host reads 8 bytes (OOB READ / info leak oracle)
- If the data passes PSC validation, __snp_complete_one_psc() writes
cur_page = 1 or 512 into the entry (OOB WRITE, sev.c:3806)
- If validation fails, the error response reveals whether adjacent
memory is zero vs non-zero (information disclosure to guest)
The guest controls allocation size (exit_info_2), entry range
(cur_entry/end_entry), and can fire unlimited VMGEXITs to repeatedly
hit different slab positions.
By exploiting the variety of bugs, a malicious SEV-SNP guest can:
- OOB read adjacent kmalloc-cg-32 objects (heap layout disclosure)
- OOB write cur_page bits into adjacent objects (heap corruption)
- Trigger use-after-free conditions across VMGEXITs
E.g. with KASAN enabled, a single insmod of the PoC guest module
produces 73 KASAN reports:
BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x126/0x890
Read of size 8 at addr ffff888219ffb5e0 by task qemu-system-x86/2199
BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x468/0x890
Write of size 8 at addr ffff888351566648 by task qemu-system-x86/2199
The buggy address belongs to the object at ffff888XXXXXXXXX
which belongs to the cache kmalloc-cg-32 of size 32
The buggy address is located N bytes to the right of
allocated 32-byte region [ffff888XXXXXXXXX, ffff888XXXXXXXXX)
Breakdown:
62 slab-out-of-bounds (reads + writes past allocation)
7 slab-use-after-free
4 use-after-free
All credit to Stan for the wonderful description and reproducer!
[sean: write changelog]
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/sev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bf9ba093fbb83c0c9a3dedd50efec29424eca2fc",
"status": "affected",
"version": "4af663c2f64a8d252e690c60cf8b8abf22dc2951",
"versionType": "git"
},
{
"lessThan": "c9b4198fbc6ed99a9da4bee9f74bb730f926c9ae",
"status": "affected",
"version": "4af663c2f64a8d252e690c60cf8b8abf22dc2951",
"versionType": "git"
},
{
"lessThan": "b328ede59ac34e7998e1eee5e5f0cc26c2a91846",
"status": "affected",
"version": "4af663c2f64a8d252e690c60cf8b8abf22dc2951",
"versionType": "git"
},
{
"lessThan": "db3f2195d29344a3cf1e9dd9ab7f21ced7308cf7",
"status": "affected",
"version": "4af663c2f64a8d252e690c60cf8b8abf22dc2951",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/sev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use\n\nAs per the GHCB spec, when using GHCB v2+ require the software scratch area\nto reside in the GHCB\u0027s shared buffer. Note, things like Page State Change\n(PSC) requests _rely_ on this behavior, as the guest can\u0027t provide a length\nwhen making the request, i.e. the size of the guest payload is bounded by\nthe size of the shared buffer.\n\nFailure to force usage of the GHCB, and a slew of other flaws, lets a\nmalicious SNP guest corrupt host kernel heap memory, and leak host heap\nlayout information.\n\nsetup_vmgexit_scratch() allocates a buffer via kvzalloc(exit_info_2),\nwhere exit_info_2 is guest-controlled. With exit_info_2=24, this yields\na 24-byte allocation in kmalloc-cg-32 (32-byte slab objects). The buffer\nholds an 8-byte psc_hdr followed by 8-byte psc_entry structs, so only\nentries[0] and entries[1] are in-bounds.\n\nsnp_begin_psc() validates end_entry against VMGEXIT_PSC_MAX_COUNT (253)\nbut NOT against the actual buffer size:\n\n idx_end = hdr-\u003eend_entry;\n\n if (idx_end \u003e= VMGEXIT_PSC_MAX_COUNT) { // checks 253, not buffer\n snp_complete_psc(svm, ...);\n return 1;\n }\n\n for (idx = idx_start; idx \u003c= idx_end; idx++) {\n entry_start = entries[idx]; // OOB when idx \u003e= 2\n\nThe guest sets end_entry=10+, causing the host to iterate entries[2+]\nwhich are OOB into adjacent slab objects. For each OOB entry:\n\n - The host reads 8 bytes (OOB READ / info leak oracle)\n - If the data passes PSC validation, __snp_complete_one_psc() writes\n cur_page = 1 or 512 into the entry (OOB WRITE, sev.c:3806)\n - If validation fails, the error response reveals whether adjacent\n memory is zero vs non-zero (information disclosure to guest)\n\nThe guest controls allocation size (exit_info_2), entry range\n(cur_entry/end_entry), and can fire unlimited VMGEXITs to repeatedly\nhit different slab positions.\n\nBy exploiting the variety of bugs, a malicious SEV-SNP guest can:\n - OOB read adjacent kmalloc-cg-32 objects (heap layout disclosure)\n - OOB write cur_page bits into adjacent objects (heap corruption)\n - Trigger use-after-free conditions across VMGEXITs\n\nE.g. with KASAN enabled, a single insmod of the PoC guest module\nproduces 73 KASAN reports:\n\n BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x126/0x890\n Read of size 8 at addr ffff888219ffb5e0 by task qemu-system-x86/2199\n\n BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x468/0x890\n Write of size 8 at addr ffff888351566648 by task qemu-system-x86/2199\n\n The buggy address belongs to the object at ffff888XXXXXXXXX\n which belongs to the cache kmalloc-cg-32 of size 32\n The buggy address is located N bytes to the right of\n allocated 32-byte region [ffff888XXXXXXXXX, ffff888XXXXXXXXX)\n\n Breakdown:\n 62 slab-out-of-bounds (reads + writes past allocation)\n 7 slab-use-after-free\n 4 use-after-free\n\nAll credit to Stan for the wonderful description and reproducer!\n\n[sean: write changelog]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached by running a SEV-SNP vCPU through KVM and issuing a guest-controlled VMGEXIT PSC request, not by remote packets or adjacent/physical access.\nAC:L - The guest directly controls the scratch pointer/length and PSC entry bounds, and can repeatedly issue malformed VMGEXITs without needing external races or rare timing conditions.\nPR:L - Exploitation requires the ability to run or control a SEV-SNP guest/KVM vCPU, which is a low-privilege local or tenant capability rather than real host root in the init namespace.\nUI:N - Once the attacker controls the malicious guest or VM process, no additional victim action is required to trigger the VMGEXIT handling path.\nS:C - The bug lets a malicious guest corrupt and disclose host kernel heap memory, crossing the guest-to-host virtualization security boundary.\nC:H - The OOB reads and error oracle leak adjacent host heap contents/layout, and the associated memory corruption/UAF behavior is sufficient to treat confidentiality impact as high.\nI:H - The vulnerable path performs OOB writes into adjacent host slab objects and can trigger UAF conditions, making host kernel memory corruption and potential control-flow compromise defensible.\nA:H - The bug produces host kernel slab OOB writes/reads and UAF reports and can crash or destabilize the host kernel, giving high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:35:09.892Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bf9ba093fbb83c0c9a3dedd50efec29424eca2fc"
},
{
"url": "https://git.kernel.org/stable/c/c9b4198fbc6ed99a9da4bee9f74bb730f926c9ae"
},
{
"url": "https://git.kernel.org/stable/c/b328ede59ac34e7998e1eee5e5f0cc26c2a91846"
},
{
"url": "https://git.kernel.org/stable/c/db3f2195d29344a3cf1e9dd9ab7f21ced7308cf7"
}
],
"title": "KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53360",
"datePublished": "2026-07-04T11:53:58.657Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-08-05T12:35:09.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43405 (GCVE-0-2026-43405)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: Use u32 for non-negative values in ceph_monmap_decode()
This patch fixes unnecessary implicit conversions that change signedness
of blob_len and num_mon in ceph_monmap_decode().
Currently blob_len and num_mon are (signed) int variables. They are used
to hold values that are always non-negative and get assigned in
ceph_decode_32_safe(), which is meant to assign u32 values. Both
variables are subsequently used as unsigned values, and the value of
num_mon is further assigned to monmap->num_mon, which is of type u32.
Therefore, both variables should be of type u32. This is especially
relevant for num_mon. If the value read from the incoming message is
very large, it is interpreted as a negative value, and the check for
num_mon > CEPH_MAX_MON does not catch it. This leads to the attempt to
allocate a very large chunk of memory for monmap, which will most likely
fail. In this case, an unnecessary attempt to allocate memory is
performed, and -ENOMEM is returned instead of -EINVAL.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c Version: a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c Version: a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c Version: a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c Version: a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c Version: a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c Version: a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/mon_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ee5588e2bc41acb73f6676c0520420c107cd0140",
"status": "affected",
"version": "a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c",
"versionType": "git"
},
{
"lessThan": "86f7060cd638d6eb042e8ed780fb83a59ca0dcb3",
"status": "affected",
"version": "a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c",
"versionType": "git"
},
{
"lessThan": "5f2806684b05bd24d05c091083b8e2517ba8ffac",
"status": "affected",
"version": "a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c",
"versionType": "git"
},
{
"lessThan": "b268984ae88cb0dcd7a8e8263962c748448e26e8",
"status": "affected",
"version": "a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c",
"versionType": "git"
},
{
"lessThan": "ba0a4df8c563536857dcbf7b4dbd0f2a15f57ace",
"status": "affected",
"version": "a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c",
"versionType": "git"
},
{
"lessThan": "08bc6173fd611ad5a40f472bf5f15b92aea0fe40",
"status": "affected",
"version": "a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c",
"versionType": "git"
},
{
"lessThan": "770444611f047dbfd4517ec0bc1b179d40c2f346",
"status": "affected",
"version": "a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/mon_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Use u32 for non-negative values in ceph_monmap_decode()\n\nThis patch fixes unnecessary implicit conversions that change signedness\nof blob_len and num_mon in ceph_monmap_decode().\nCurrently blob_len and num_mon are (signed) int variables. They are used\nto hold values that are always non-negative and get assigned in\nceph_decode_32_safe(), which is meant to assign u32 values. Both\nvariables are subsequently used as unsigned values, and the value of\nnum_mon is further assigned to monmap-\u003enum_mon, which is of type u32.\nTherefore, both variables should be of type u32. This is especially\nrelevant for num_mon. If the value read from the incoming message is\nvery large, it is interpreted as a negative value, and the check for\nnum_mon \u003e CEPH_MAX_MON does not catch it. This leads to the attempt to\nallocate a very large chunk of memory for monmap, which will most likely\nfail. In this case, an unnecessary attempt to allocate memory is\nperformed, and -ENOMEM is returned instead of -EINVAL."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable decoder processes CEPH_MSG_MON_MAP data received over the Ceph monitor TCP connection from a remote peer.\nAC:L - Triggering requires sending a single malformed monmap with a large u32 num_mon value; there is no race or condition outside the attacker\u0027s control once they control the monitor-side message stream.\nPR:N - The attacker needs no privileges on the vulnerable host; a malicious or compromised Ceph monitor endpoint can supply the crafted network message.\nUI:N - Although Ceph clients are initially created by mount or RBD setup, monitor map updates are received asynchronously over an established session and do not require further victim action.\nS:U - The impact remains within the kernel/Ceph client security authority and does not cross a VM, sandbox, or hardware isolation boundary.\nC:N - The signedness bug causes an oversized allocation attempt that fails; the investigated path does not expose kernel memory or create a read primitive.\nI:N - The allocation is overflow-safe and fails before the monmap is installed or populated, so there is no demonstrated memory corruption or data modification primitive.\nA:H - A crafted monmap can repeatedly force huge kernel allocation attempts and prevent the client from obtaining or refreshing a valid monitor map, denying Ceph storage availability in affected deployments."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:48.288Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ee5588e2bc41acb73f6676c0520420c107cd0140"
},
{
"url": "https://git.kernel.org/stable/c/86f7060cd638d6eb042e8ed780fb83a59ca0dcb3"
},
{
"url": "https://git.kernel.org/stable/c/5f2806684b05bd24d05c091083b8e2517ba8ffac"
},
{
"url": "https://git.kernel.org/stable/c/b268984ae88cb0dcd7a8e8263962c748448e26e8"
},
{
"url": "https://git.kernel.org/stable/c/ba0a4df8c563536857dcbf7b4dbd0f2a15f57ace"
},
{
"url": "https://git.kernel.org/stable/c/08bc6173fd611ad5a40f472bf5f15b92aea0fe40"
},
{
"url": "https://git.kernel.org/stable/c/770444611f047dbfd4517ec0bc1b179d40c2f346"
}
],
"title": "libceph: Use u32 for non-negative values in ceph_monmap_decode()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43405",
"datePublished": "2026-05-08T14:21:45.581Z",
"dateReserved": "2026-05-01T14:12:56.007Z",
"dateUpdated": "2026-08-05T12:27:48.288Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31599 (GCVE-0-2026-31599)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections
syzbot reported a general protection fault in vidtv_psi_desc_assign [1].
vidtv_psi_pmt_stream_init() can return NULL on memory allocation
failure, but vidtv_channel_pmt_match_sections() does not check for
this. When tail is NULL, the subsequent call to
vidtv_psi_desc_assign(&tail->descriptor, desc) dereferences a NULL
pointer offset, causing a general protection fault.
Add a NULL check after vidtv_psi_pmt_stream_init(). On failure, clean
up the already-allocated stream chain and return.
[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:vidtv_psi_desc_assign+0x24/0x90 drivers/media/test-drivers/vidtv/vidtv_psi.c:629
Call Trace:
<TASK>
vidtv_channel_pmt_match_sections drivers/media/test-drivers/vidtv/vidtv_channel.c:349 [inline]
vidtv_channel_si_init+0x1445/0x1a50 drivers/media/test-drivers/vidtv/vidtv_channel.c:479
vidtv_mux_init+0x526/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:519
vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline]
vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/test-drivers/vidtv/vidtv_channel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "54e18a23e62e81b8335cec3e8e9c5cb33fd88665",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "5c986b77200b5ea754ba6636deacc7e0942fec9b",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "93d9e747a9e8a5ca9e3c5e37dcff76b40399139f",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "b7efb4c94797c504a1c678edb48c2aa311d3309f",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "e589de36da106ef739ba98f66f5a5c2023370706",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "2dff11fb5098ae453651f8f77e94ad499c078022",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "b832cfd516b8504e95884622cee60bf9a39b7945",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "07c1e474cf9acf777f09d14a8f8dfcef5b84e46f",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "f8e1fc918a9fe67103bcda01d20d745f264d00a7",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/test-drivers/vidtv/vidtv_channel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections\n\nsyzbot reported a general protection fault in vidtv_psi_desc_assign [1].\n\nvidtv_psi_pmt_stream_init() can return NULL on memory allocation\nfailure, but vidtv_channel_pmt_match_sections() does not check for\nthis. When tail is NULL, the subsequent call to\nvidtv_psi_desc_assign(\u0026tail-\u003edescriptor, desc) dereferences a NULL\npointer offset, causing a general protection fault.\n\nAdd a NULL check after vidtv_psi_pmt_stream_init(). On failure, clean\nup the already-allocated stream chain and return.\n\n[1]\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nRIP: 0010:vidtv_psi_desc_assign+0x24/0x90 drivers/media/test-drivers/vidtv/vidtv_psi.c:629\nCall Trace:\n \u003cTASK\u003e\n vidtv_channel_pmt_match_sections drivers/media/test-drivers/vidtv/vidtv_channel.c:349 [inline]\n vidtv_channel_si_init+0x1445/0x1a50 drivers/media/test-drivers/vidtv/vidtv_channel.c:479\n vidtv_mux_init+0x526/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:519\n vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline]\n vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:42:40.045Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/54e18a23e62e81b8335cec3e8e9c5cb33fd88665"
},
{
"url": "https://git.kernel.org/stable/c/5c986b77200b5ea754ba6636deacc7e0942fec9b"
},
{
"url": "https://git.kernel.org/stable/c/93d9e747a9e8a5ca9e3c5e37dcff76b40399139f"
},
{
"url": "https://git.kernel.org/stable/c/b7efb4c94797c504a1c678edb48c2aa311d3309f"
},
{
"url": "https://git.kernel.org/stable/c/e589de36da106ef739ba98f66f5a5c2023370706"
},
{
"url": "https://git.kernel.org/stable/c/2dff11fb5098ae453651f8f77e94ad499c078022"
},
{
"url": "https://git.kernel.org/stable/c/b832cfd516b8504e95884622cee60bf9a39b7945"
},
{
"url": "https://git.kernel.org/stable/c/07c1e474cf9acf777f09d14a8f8dfcef5b84e46f"
},
{
"url": "https://git.kernel.org/stable/c/f8e1fc918a9fe67103bcda01d20d745f264d00a7"
}
],
"title": "media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31599",
"datePublished": "2026-04-24T14:42:23.961Z",
"dateReserved": "2026-03-09T15:48:24.121Z",
"dateUpdated": "2026-06-14T17:42:40.045Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43057 (GCVE-0-2026-43057)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback
NETIF_F_IPV6_CSUM only advertises support for checksum offload of
packets without IPv6 extension headers. Packets with extension
headers must fall back onto software checksumming. Since TSO
depends on checksum offload, those must revert to GSO.
The below commit introduces that fallback. It always checks
network header length. For tunneled packets, the inner header length
must be checked instead. Extend the check accordingly.
A special case is tunneled packets without inner IP protocol. Such as
RFC 6951 SCTP in UDP. Those are not standard IPv6 followed by
transport header either, so also must revert to the software GSO path.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a0478d7e888028f85fa7785ea838ce0ca09398e2 Version: 2156d9e9f2e483c8c3906c0ea57ea312c1424235 Version: 041e2f945f82fdbd6fff577b79c33469430297aa Version: 864e3396976ef41de6cc7bc366276bf4e084fff2 Version: 864e3396976ef41de6cc7bc366276bf4e084fff2 Version: 864e3396976ef41de6cc7bc366276bf4e084fff2 Version: 794ddbb7b63b6828c75967b9bcd43b086716e7a1 Version: 6.1.149 ≤ Version: 6.6.103 ≤ Version: 6.12.44 ≤ Version: 6.16.4 ≤ |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:49:12.974Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2094a7cf91b71367b649f991aacc7b579f793d0b",
"status": "affected",
"version": "a0478d7e888028f85fa7785ea838ce0ca09398e2",
"versionType": "git"
},
{
"lessThan": "ed71cf465c75f5688b07a35d373cd1d6b589c8ea",
"status": "affected",
"version": "2156d9e9f2e483c8c3906c0ea57ea312c1424235",
"versionType": "git"
},
{
"lessThan": "33670f780e0120c3dacda188c512bbffe0b6044c",
"status": "affected",
"version": "041e2f945f82fdbd6fff577b79c33469430297aa",
"versionType": "git"
},
{
"lessThan": "a98b78116a27e2a57b696b569b2cb431c95cf9b6",
"status": "affected",
"version": "864e3396976ef41de6cc7bc366276bf4e084fff2",
"versionType": "git"
},
{
"lessThan": "732fdeb2987c94b439d51f5cb9addddc2fc48c42",
"status": "affected",
"version": "864e3396976ef41de6cc7bc366276bf4e084fff2",
"versionType": "git"
},
{
"lessThan": "c4336a07eb6b2526dc2b62928b5104b41a7f81f5",
"status": "affected",
"version": "864e3396976ef41de6cc7bc366276bf4e084fff2",
"versionType": "git"
},
{
"status": "affected",
"version": "794ddbb7b63b6828c75967b9bcd43b086716e7a1",
"versionType": "git"
},
{
"lessThan": "6.1.168",
"status": "affected",
"version": "6.1.149",
"versionType": "semver"
},
{
"lessThan": "6.6.134",
"status": "affected",
"version": "6.6.103",
"versionType": "semver"
},
{
"lessThan": "6.12.81",
"status": "affected",
"version": "6.12.44",
"versionType": "semver"
},
{
"lessThan": "6.17",
"status": "affected",
"version": "6.16.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "6.1.149",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "6.6.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "6.12.44",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.16.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: correctly handle tunneled traffic on IPV6_CSUM GSO fallback\n\nNETIF_F_IPV6_CSUM only advertises support for checksum offload of\npackets without IPv6 extension headers. Packets with extension\nheaders must fall back onto software checksumming. Since TSO\ndepends on checksum offload, those must revert to GSO.\n\nThe below commit introduces that fallback. It always checks\nnetwork header length. For tunneled packets, the inner header length\nmust be checked instead. Extend the check accordingly.\n\nA special case is tunneled packets without inner IP protocol. Such as\nRFC 6951 SCTP in UDP. Those are not standard IPv6 followed by\ntransport header either, so also must revert to the software GSO path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable path is reachable through the network transmit stack when remotely supplied traffic is forwarded or tunneled by an affected Linux system. A remote peer can trigger the bad GSO/offload decision by sending suitable IPv6 tunneled traffic with extension headers through a preconfigured tunnel/router deployment.\nAC:L - There is no race or probabilistic condition; once the affected tunnel and NETIF_F_IPV6_CSUM-capable egress device are present, crafted large/GSO-eligible IPv6 traffic deterministically reaches the flawed feature check. The attacker controls the packet shape needed to hit the fallback error.\nPR:N - For the network forwarding/tunnel scenario, the attacker does not need local credentials or administrative privileges on the vulnerable host. Tunnel setup requires CAP_NET_ADMIN, but exploitation of an already deployed tunnel path is pre-authenticated network traffic.\nUI:N - No victim user action is required. The vulnerable code runs automatically during packet forwarding/transmission.\nS:U - The bug affects the kernel networking stack and availability of traffic handled by the same system. It does not cross a distinct security authority such as a guest-to-host or IOMMU boundary.\nC:N - The bug is a checksum/GSO feature-selection error and does not expose kernel memory or packet contents beyond normal transmission. No information disclosure primitive was identified.\nI:N - The issue can cause incorrect checksum/offload handling for affected packets, but it does not provide an attacker with a meaningful unauthorized data modification primitive. The practical effect is packet loss or malformed traffic rather than controlled integrity compromise.\nA:H - The related failure mode is repeated bad offload handling, warnings, packet drops, and collapse of affected tunnel throughput. A remote attacker can repeatedly trigger loss of availability for the vulnerable network path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:38.181Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2094a7cf91b71367b649f991aacc7b579f793d0b"
},
{
"url": "https://git.kernel.org/stable/c/ed71cf465c75f5688b07a35d373cd1d6b589c8ea"
},
{
"url": "https://git.kernel.org/stable/c/33670f780e0120c3dacda188c512bbffe0b6044c"
},
{
"url": "https://git.kernel.org/stable/c/a98b78116a27e2a57b696b569b2cb431c95cf9b6"
},
{
"url": "https://git.kernel.org/stable/c/732fdeb2987c94b439d51f5cb9addddc2fc48c42"
},
{
"url": "https://git.kernel.org/stable/c/c4336a07eb6b2526dc2b62928b5104b41a7f81f5"
}
],
"title": "net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43057",
"datePublished": "2026-05-01T14:15:49.551Z",
"dateReserved": "2026-05-01T14:12:55.981Z",
"dateUpdated": "2026-08-05T12:25:38.181Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31748 (GCVE-0-2026-31748)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-05-11 22:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
comedi: me_daq: Fix potential overrun of firmware buffer
`me2600_xilinx_download()` loads the firmware that was requested by
`request_firmware()`. It is possible for it to overrun the source
buffer because it blindly trusts the file format. It reads a data
stream length from the first 4 bytes into variable `file_length` and
reads the data stream contents of length `file_length` from offset 16
onwards. Although it checks that the supplied firmware is at least 16
bytes long, it does not check that it is long enough to contain the data
stream.
Add a test to ensure that the supplied firmware is long enough to
contain the header and the data stream. On failure, log an error and
return `-EINVAL`.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 85acac61096f946a78cf0c4b65f7cebe580693b6 Version: 85acac61096f946a78cf0c4b65f7cebe580693b6 Version: 85acac61096f946a78cf0c4b65f7cebe580693b6 Version: 85acac61096f946a78cf0c4b65f7cebe580693b6 Version: 85acac61096f946a78cf0c4b65f7cebe580693b6 Version: 85acac61096f946a78cf0c4b65f7cebe580693b6 Version: 85acac61096f946a78cf0c4b65f7cebe580693b6 Version: 85acac61096f946a78cf0c4b65f7cebe580693b6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/comedi/drivers/me_daq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2fc25a4c2e055cd42ea39a1b42c89bfef70e0319",
"status": "affected",
"version": "85acac61096f946a78cf0c4b65f7cebe580693b6",
"versionType": "git"
},
{
"lessThan": "9f39fa07259eb342908e4aa0271dee038a8ce4f8",
"status": "affected",
"version": "85acac61096f946a78cf0c4b65f7cebe580693b6",
"versionType": "git"
},
{
"lessThan": "f3f8ec00cfb8d8e826e30b1138a56355b88e9ba8",
"status": "affected",
"version": "85acac61096f946a78cf0c4b65f7cebe580693b6",
"versionType": "git"
},
{
"lessThan": "c16ac4e173a05011437a2d868f70cc415339065a",
"status": "affected",
"version": "85acac61096f946a78cf0c4b65f7cebe580693b6",
"versionType": "git"
},
{
"lessThan": "1bf8761eb59e94bf7b8c17b2a1ee48f14378b172",
"status": "affected",
"version": "85acac61096f946a78cf0c4b65f7cebe580693b6",
"versionType": "git"
},
{
"lessThan": "a47ae40339c1048f519df33ff8840731720f57cb",
"status": "affected",
"version": "85acac61096f946a78cf0c4b65f7cebe580693b6",
"versionType": "git"
},
{
"lessThan": "c8c607a77aab783f2e38cc2e0f24aa6c8f6d200b",
"status": "affected",
"version": "85acac61096f946a78cf0c4b65f7cebe580693b6",
"versionType": "git"
},
{
"lessThan": "cc797d4821c754c701d9714b58bea947e31dbbe0",
"status": "affected",
"version": "85acac61096f946a78cf0c4b65f7cebe580693b6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/comedi/drivers/me_daq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: me_daq: Fix potential overrun of firmware buffer\n\n`me2600_xilinx_download()` loads the firmware that was requested by\n`request_firmware()`. It is possible for it to overrun the source\nbuffer because it blindly trusts the file format. It reads a data\nstream length from the first 4 bytes into variable `file_length` and\nreads the data stream contents of length `file_length` from offset 16\nonwards. Although it checks that the supplied firmware is at least 16\nbytes long, it does not check that it is long enough to contain the data\nstream.\n\nAdd a test to ensure that the supplied firmware is long enough to\ncontain the header and the data stream. On failure, log an error and\nreturn `-EINVAL`."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:15:00.272Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2fc25a4c2e055cd42ea39a1b42c89bfef70e0319"
},
{
"url": "https://git.kernel.org/stable/c/9f39fa07259eb342908e4aa0271dee038a8ce4f8"
},
{
"url": "https://git.kernel.org/stable/c/f3f8ec00cfb8d8e826e30b1138a56355b88e9ba8"
},
{
"url": "https://git.kernel.org/stable/c/c16ac4e173a05011437a2d868f70cc415339065a"
},
{
"url": "https://git.kernel.org/stable/c/1bf8761eb59e94bf7b8c17b2a1ee48f14378b172"
},
{
"url": "https://git.kernel.org/stable/c/a47ae40339c1048f519df33ff8840731720f57cb"
},
{
"url": "https://git.kernel.org/stable/c/c8c607a77aab783f2e38cc2e0f24aa6c8f6d200b"
},
{
"url": "https://git.kernel.org/stable/c/cc797d4821c754c701d9714b58bea947e31dbbe0"
}
],
"title": "comedi: me_daq: Fix potential overrun of firmware buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31748",
"datePublished": "2026-05-01T14:14:41.545Z",
"dateReserved": "2026-03-09T15:48:24.138Z",
"dateUpdated": "2026-05-11T22:15:00.272Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45879 (GCVE-0-2026-45879)
Vulnerability from cvelistv5
Published
2026-05-27 12:16
Modified
2026-05-27 12:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: supply: bq25980: Fix use-after-free in power_supply_changed()
Using the `devm_` variant for requesting IRQ _before_ the `devm_`
variant for allocating/registering the `power_supply` handle, means that
the `power_supply` handle will be deallocated/unregistered _before_ the
interrupt handler (since `devm_` naturally deallocates in reverse
allocation order). This means that during removal, there is a race
condition where an interrupt can fire just _after_ the `power_supply`
handle has been freed, *but* just _before_ the corresponding
unregistration of the IRQ handler has run.
This will lead to the IRQ handler calling `power_supply_changed()` with
a freed `power_supply` handle. Which usually crashes the system or
otherwise silently corrupts the memory...
Note that there is a similar situation which can also happen during
`probe()`; the possibility of an interrupt firing _before_ registering
the `power_supply` handle. This would then lead to the nasty situation
of using the `power_supply` handle *uninitialized* in
`power_supply_changed()`.
Fix this racy use-after-free by making sure the IRQ is requested _after_
the registration of the `power_supply` handle.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5069185fc18e810715a91d80fcd075e03add600c Version: 5069185fc18e810715a91d80fcd075e03add600c Version: 5069185fc18e810715a91d80fcd075e03add600c Version: 5069185fc18e810715a91d80fcd075e03add600c Version: 5069185fc18e810715a91d80fcd075e03add600c Version: 5069185fc18e810715a91d80fcd075e03add600c Version: 5069185fc18e810715a91d80fcd075e03add600c Version: 5069185fc18e810715a91d80fcd075e03add600c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/bq25980_charger.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "86f93dfb23f5bf4f285c4256a7e909d222f7de56",
"status": "affected",
"version": "5069185fc18e810715a91d80fcd075e03add600c",
"versionType": "git"
},
{
"lessThan": "16875e3b7bc9e59bfa0acaf1e43f275a6f42a30f",
"status": "affected",
"version": "5069185fc18e810715a91d80fcd075e03add600c",
"versionType": "git"
},
{
"lessThan": "0560a4b09c92e2ecaa883965cf6f9ca51c158ff9",
"status": "affected",
"version": "5069185fc18e810715a91d80fcd075e03add600c",
"versionType": "git"
},
{
"lessThan": "0de95d29d847c6217b7d5845e24a71a4aee7b359",
"status": "affected",
"version": "5069185fc18e810715a91d80fcd075e03add600c",
"versionType": "git"
},
{
"lessThan": "4aeaf03c17260415c2fdd55992f9ad4188d5455a",
"status": "affected",
"version": "5069185fc18e810715a91d80fcd075e03add600c",
"versionType": "git"
},
{
"lessThan": "03d1e4ee4e6aa6d2966e883e4ca0e5be73bf1b7c",
"status": "affected",
"version": "5069185fc18e810715a91d80fcd075e03add600c",
"versionType": "git"
},
{
"lessThan": "abea607ff2f62f4c0a5fb29f7fbdaaab163276a4",
"status": "affected",
"version": "5069185fc18e810715a91d80fcd075e03add600c",
"versionType": "git"
},
{
"lessThan": "5f0b1cb41906e86b64bf69f5ededb83b0d757c27",
"status": "affected",
"version": "5069185fc18e810715a91d80fcd075e03add600c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/bq25980_charger.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: bq25980: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:16:50.137Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/86f93dfb23f5bf4f285c4256a7e909d222f7de56"
},
{
"url": "https://git.kernel.org/stable/c/16875e3b7bc9e59bfa0acaf1e43f275a6f42a30f"
},
{
"url": "https://git.kernel.org/stable/c/0560a4b09c92e2ecaa883965cf6f9ca51c158ff9"
},
{
"url": "https://git.kernel.org/stable/c/0de95d29d847c6217b7d5845e24a71a4aee7b359"
},
{
"url": "https://git.kernel.org/stable/c/4aeaf03c17260415c2fdd55992f9ad4188d5455a"
},
{
"url": "https://git.kernel.org/stable/c/03d1e4ee4e6aa6d2966e883e4ca0e5be73bf1b7c"
},
{
"url": "https://git.kernel.org/stable/c/abea607ff2f62f4c0a5fb29f7fbdaaab163276a4"
},
{
"url": "https://git.kernel.org/stable/c/5f0b1cb41906e86b64bf69f5ededb83b0d757c27"
}
],
"title": "power: supply: bq25980: Fix use-after-free in power_supply_changed()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45879",
"datePublished": "2026-05-27T12:16:50.137Z",
"dateReserved": "2026-05-13T15:03:33.081Z",
"dateUpdated": "2026-05-27T12:16:50.137Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52963 (GCVE-0-2026-52963)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-06-24 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Bound MIDI endpoint descriptor scans
snd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint
descriptor size before using baAssocJackID[], but the descriptor walker can
still return a class-specific endpoint descriptor whose bLength exceeds the
remaining bytes in the endpoint-extra scan.
That leaves later flexible-array reads bounded by bLength, but not by the
remaining bytes in the endpoint-extra scan.
Stop walking when bLength is zero or
extends past the remaining endpoint-extra scan.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5c6cd7021a05a02fcf37f360592d7c18d4d807fb Version: 5c6cd7021a05a02fcf37f360592d7c18d4d807fb Version: 5c6cd7021a05a02fcf37f360592d7c18d4d807fb Version: 5c6cd7021a05a02fcf37f360592d7c18d4d807fb Version: 5c6cd7021a05a02fcf37f360592d7c18d4d807fb Version: 5c6cd7021a05a02fcf37f360592d7c18d4d807fb Version: 5c6cd7021a05a02fcf37f360592d7c18d4d807fb Version: 5c6cd7021a05a02fcf37f360592d7c18d4d807fb Version: 9e0c71f2f633b0442661966228827d1a33df485f Version: 0868bc5654c07628c421547f0821650a8c2cb8f3 Version: 78483c1c7741ffa72991d93d19a75bfdcc2cbf57 Version: 65d95462001c6ccd9bc9499c1fc9a90eca9de496 Version: ca767cf0152d18fc299cde85b18d1f46ac21e1ba Version: 4.4.238 ≤ Version: 4.9.238 ≤ Version: 4.14.200 ≤ Version: 4.19.149 ≤ Version: 5.4.69 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/midi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e2f1260a056eb3215c13c48c5378f3e4112dc3af",
"status": "affected",
"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb",
"versionType": "git"
},
{
"lessThan": "c65b137d351e21cbc5630e73ef0eb1e1d75f5b20",
"status": "affected",
"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb",
"versionType": "git"
},
{
"lessThan": "728ab0c72e49ca27185067984cd565425eb69b2e",
"status": "affected",
"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb",
"versionType": "git"
},
{
"lessThan": "3d3b2b01a3e73828e201ece96f863e7a3e0cdc6e",
"status": "affected",
"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb",
"versionType": "git"
},
{
"lessThan": "a0226560540c16717efcceaf15c862cf115b01d3",
"status": "affected",
"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb",
"versionType": "git"
},
{
"lessThan": "09141583bd97f4bbd7358e29fd138fe798467cdb",
"status": "affected",
"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb",
"versionType": "git"
},
{
"lessThan": "c59159ce10e75b568cd0d4b29efcb0fb0ddecc94",
"status": "affected",
"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb",
"versionType": "git"
},
{
"lessThan": "d6854daa67be623860f4e1873fd3d3c275aba4ed",
"status": "affected",
"version": "5c6cd7021a05a02fcf37f360592d7c18d4d807fb",
"versionType": "git"
},
{
"status": "affected",
"version": "9e0c71f2f633b0442661966228827d1a33df485f",
"versionType": "git"
},
{
"status": "affected",
"version": "0868bc5654c07628c421547f0821650a8c2cb8f3",
"versionType": "git"
},
{
"status": "affected",
"version": "78483c1c7741ffa72991d93d19a75bfdcc2cbf57",
"versionType": "git"
},
{
"status": "affected",
"version": "65d95462001c6ccd9bc9499c1fc9a90eca9de496",
"versionType": "git"
},
{
"status": "affected",
"version": "ca767cf0152d18fc299cde85b18d1f46ac21e1ba",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.238",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.238",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.200",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.149",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.69",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/midi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.200",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.149",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.69",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Bound MIDI endpoint descriptor scans\n\nsnd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint\ndescriptor size before using baAssocJackID[], but the descriptor walker can\nstill return a class-specific endpoint descriptor whose bLength exceeds the\nremaining bytes in the endpoint-extra scan.\n\nThat leaves later flexible-array reads bounded by bLength, but not by the\nremaining bytes in the endpoint-extra scan.\n\nStop walking when bLength is zero or\nextends past the remaining endpoint-extra scan."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:28:43.593Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e2f1260a056eb3215c13c48c5378f3e4112dc3af"
},
{
"url": "https://git.kernel.org/stable/c/c65b137d351e21cbc5630e73ef0eb1e1d75f5b20"
},
{
"url": "https://git.kernel.org/stable/c/728ab0c72e49ca27185067984cd565425eb69b2e"
},
{
"url": "https://git.kernel.org/stable/c/3d3b2b01a3e73828e201ece96f863e7a3e0cdc6e"
},
{
"url": "https://git.kernel.org/stable/c/a0226560540c16717efcceaf15c862cf115b01d3"
},
{
"url": "https://git.kernel.org/stable/c/09141583bd97f4bbd7358e29fd138fe798467cdb"
},
{
"url": "https://git.kernel.org/stable/c/c59159ce10e75b568cd0d4b29efcb0fb0ddecc94"
},
{
"url": "https://git.kernel.org/stable/c/d6854daa67be623860f4e1873fd3d3c275aba4ed"
}
],
"title": "ALSA: usb-audio: Bound MIDI endpoint descriptor scans",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52963",
"datePublished": "2026-06-24T16:28:43.593Z",
"dateReserved": "2026-06-09T07:44:35.374Z",
"dateUpdated": "2026-06-24T16:28:43.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43353 (GCVE-0-2026-43353)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i3c: mipi-i3c-hci: Fix race in DMA ring dequeue
The HCI DMA dequeue path (hci_dma_dequeue_xfer()) may be invoked for
multiple transfers that timeout around the same time. However, the
function is not serialized and can race with itself.
When a timeout occurs, hci_dma_dequeue_xfer() stops the ring, processes
incomplete transfers, and then restarts the ring. If another timeout
triggers a parallel call into the same function, the two instances may
interfere with each other - stopping or restarting the ring at unexpected
times.
Add a mutex so that hci_dma_dequeue_xfer() is serialized with respect to
itself.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i3c/master/mipi-i3c-hci/core.c",
"drivers/i3c/master/mipi-i3c-hci/dma.c",
"drivers/i3c/master/mipi-i3c-hci/hci.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b684b420a5bb0ea1b0e13abfdb8ce41c5266e62e",
"status": "affected",
"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07",
"versionType": "git"
},
{
"lessThan": "4faa1e9c67a2229f6749190aedaf88ce0391efd2",
"status": "affected",
"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07",
"versionType": "git"
},
{
"lessThan": "1dca8aee80eea76d2aae21265de5dd64f6ba0f09",
"status": "affected",
"version": "9ad9a52cce2828d932ae9495181e3d6414f72c07",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i3c/master/mipi-i3c-hci/core.c",
"drivers/i3c/master/mipi-i3c-hci/dma.c",
"drivers/i3c/master/mipi-i3c-hci/hci.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: mipi-i3c-hci: Fix race in DMA ring dequeue\n\nThe HCI DMA dequeue path (hci_dma_dequeue_xfer()) may be invoked for\nmultiple transfers that timeout around the same time. However, the\nfunction is not serialized and can race with itself.\n\nWhen a timeout occurs, hci_dma_dequeue_xfer() stops the ring, processes\nincomplete transfers, and then restarts the ring. If another timeout\ntriggers a parallel call into the same function, the two instances may\ninterfere with each other - stopping or restarting the ring at unexpected\ntimes.\n\nAdd a mutex so that hci_dma_dequeue_xfer() is serialized with respect to\nitself."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable DMA dequeue path is reached through local kernel I3C/I2C transfer APIs, including userspace-triggerable device/client paths on systems exposing I3C-backed devices. There is no evidence of direct internet/network packet reachability for this HCI master driver.\nAC:L - The I3C core explicitly permits parallel normal transfers, and the bug is a missing serialization primitive when multiple transfers time out together. An attacker who can trigger concurrent transfers can create the race rather than relying on an uncontrollable rare condition.\nPR:L - Reaching the path requires local ability to cause I3C/I2C client transfers, such as access to exposed device interfaces or subsystem clients, but no kernel capability check is present in the vulnerable HCI dequeue logic itself. This is best treated as low local privilege rather than real administrator/root-only privilege.\nUI:N - Once the attacker can trigger the relevant transfers, no separate victim action is required. The timeout/dequeue handling runs in the kernel as part of transfer completion/error handling.\nS:U - The vulnerability corrupts or destabilizes kernel-controlled I3C HCI/DMA state within the same kernel security authority. It does not constitute a VM escape or an IOMMU/DMA isolation boundary bypass by itself.\nC:H - The race can restart or manipulate a DMA ring while another dequeue path is still aborting, replacing descriptors, and unmapping DMA buffers, leaving hardware able to access stale or unintended kernel memory. Under the required overestimate rule, this DMA memory corruption is treated as capable of high confidentiality impact.\nI:H - The same stale descriptor/unmap race can allow device DMA or ring state corruption to write into unintended or freed kernel memory. That is a memory corruption primitive, so high integrity impact is defensible.\nA:H - The vulnerable path can leave the DMA ring and host controller in an inconsistent state, trigger WARN/oops-like failure paths, or cause DMA/ring corruption. A kernel crash, hang, or persistent controller failure gives high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:27.095Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b684b420a5bb0ea1b0e13abfdb8ce41c5266e62e"
},
{
"url": "https://git.kernel.org/stable/c/4faa1e9c67a2229f6749190aedaf88ce0391efd2"
},
{
"url": "https://git.kernel.org/stable/c/1dca8aee80eea76d2aae21265de5dd64f6ba0f09"
}
],
"title": "i3c: mipi-i3c-hci: Fix race in DMA ring dequeue",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43353",
"datePublished": "2026-05-08T14:21:10.282Z",
"dateReserved": "2026-05-01T14:12:56.005Z",
"dateUpdated": "2026-08-05T12:27:27.095Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43351 (GCVE-0-2026-43351)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-05-11 22:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Eagerly init vgic dist/redist on vgic creation
If vgic_allocate_private_irqs_locked() fails for any odd reason,
we exit kvm_vgic_create() early, leaving dist->rd_regions uninitialised.
kvm_vgic_dist_destroy() then comes along and walks into the weeds
trying to free the RDs. Got to love this stuff.
Solve it by moving all the static initialisation early, and make
sure that if we fail halfway, we're in a reasonable shape to
perform the rest of the teardown. While at it, reset the vgic model
on failure, just in case...
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic-init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b7493f48c3dba75674a4ee505b4afa8fe5102457",
"status": "affected",
"version": "b3aa9283c0c505b5cfd25f7d6cfd720de2adc807",
"versionType": "git"
},
{
"lessThan": "a24f1d80fbcdbf8b2a7044a00fa12b3972b4c31c",
"status": "affected",
"version": "b3aa9283c0c505b5cfd25f7d6cfd720de2adc807",
"versionType": "git"
},
{
"lessThan": "ac6769c8f948dff33265c50e524aebf9aa6f1be0",
"status": "affected",
"version": "b3aa9283c0c505b5cfd25f7d6cfd720de2adc807",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/vgic/vgic-init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Eagerly init vgic dist/redist on vgic creation\n\nIf vgic_allocate_private_irqs_locked() fails for any odd reason,\nwe exit kvm_vgic_create() early, leaving dist-\u003erd_regions uninitialised.\n\nkvm_vgic_dist_destroy() then comes along and walks into the weeds\ntrying to free the RDs. Got to love this stuff.\n\nSolve it by moving all the static initialisation early, and make\nsure that if we fail halfway, we\u0027re in a reasonable shape to\nperform the rest of the teardown. While at it, reset the vgic model\non failure, just in case..."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:22:53.725Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b7493f48c3dba75674a4ee505b4afa8fe5102457"
},
{
"url": "https://git.kernel.org/stable/c/a24f1d80fbcdbf8b2a7044a00fa12b3972b4c31c"
},
{
"url": "https://git.kernel.org/stable/c/ac6769c8f948dff33265c50e524aebf9aa6f1be0"
}
],
"title": "KVM: arm64: Eagerly init vgic dist/redist on vgic creation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43351",
"datePublished": "2026-05-08T14:21:08.868Z",
"dateReserved": "2026-05-01T14:12:56.003Z",
"dateUpdated": "2026-05-11T22:22:53.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31596 (GCVE-0-2026-31596)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: handle invalid dinode in ocfs2_group_extend
[BUG]
kernel BUG at fs/ocfs2/resize.c:308!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:ocfs2_group_extend+0x10aa/0x1ae0 fs/ocfs2/resize.c:308
Code: 8b8520ff ffff83f8 860f8580 030000e8 5cc3c1fe
Call Trace:
...
ocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583
x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x76/0x7e
...
[CAUSE]
ocfs2_group_extend() assumes that the global bitmap inode block
returned from ocfs2_inode_lock() has already been validated and
BUG_ONs when the signature is not a dinode. That assumption is too
strong for crafted filesystems because the JBD2-managed buffer path
can bypass structural validation and return an invalid dinode to the
resize ioctl.
[FIX]
Validate the dinode explicitly in ocfs2_group_extend(). If the global
bitmap buffer does not contain a valid dinode, report filesystem
corruption with ocfs2_error() and fail the resize operation instead of
crashing the kernel.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 10995aa2451afa20b721cc7de856cae1a13dba57 Version: 10995aa2451afa20b721cc7de856cae1a13dba57 Version: 10995aa2451afa20b721cc7de856cae1a13dba57 Version: 10995aa2451afa20b721cc7de856cae1a13dba57 Version: 10995aa2451afa20b721cc7de856cae1a13dba57 Version: 10995aa2451afa20b721cc7de856cae1a13dba57 Version: 10995aa2451afa20b721cc7de856cae1a13dba57 Version: 10995aa2451afa20b721cc7de856cae1a13dba57 Version: 10995aa2451afa20b721cc7de856cae1a13dba57 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/resize.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7eafcf507fbd68f3276c00f6c02ef155ad69f79b",
"status": "affected",
"version": "10995aa2451afa20b721cc7de856cae1a13dba57",
"versionType": "git"
},
{
"lessThan": "fabfa6b81bd386154d7e59f8cd8f760f9e68b48c",
"status": "affected",
"version": "10995aa2451afa20b721cc7de856cae1a13dba57",
"versionType": "git"
},
{
"lessThan": "b328d8e7c437d0f026ba2c13788af6eae77700f1",
"status": "affected",
"version": "10995aa2451afa20b721cc7de856cae1a13dba57",
"versionType": "git"
},
{
"lessThan": "6575f9fbf084502b7118a628425bf7866666498d",
"status": "affected",
"version": "10995aa2451afa20b721cc7de856cae1a13dba57",
"versionType": "git"
},
{
"lessThan": "911b557dd7817460881fd51a03069b539c674d0e",
"status": "affected",
"version": "10995aa2451afa20b721cc7de856cae1a13dba57",
"versionType": "git"
},
{
"lessThan": "e384a850a3370d89a7a446cdeccd964bfba2a302",
"status": "affected",
"version": "10995aa2451afa20b721cc7de856cae1a13dba57",
"versionType": "git"
},
{
"lessThan": "10fb72c47aac446f12a4ccd962c7daa60cc890a1",
"status": "affected",
"version": "10995aa2451afa20b721cc7de856cae1a13dba57",
"versionType": "git"
},
{
"lessThan": "41c6e9bc3a09539deab43957a3211d902a4818f0",
"status": "affected",
"version": "10995aa2451afa20b721cc7de856cae1a13dba57",
"versionType": "git"
},
{
"lessThan": "4a1c0ddc6e7bcf2e9db0eeaab9340dcfe97f448f",
"status": "affected",
"version": "10995aa2451afa20b721cc7de856cae1a13dba57",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/resize.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: handle invalid dinode in ocfs2_group_extend\n\n[BUG]\nkernel BUG at fs/ocfs2/resize.c:308!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:ocfs2_group_extend+0x10aa/0x1ae0 fs/ocfs2/resize.c:308\nCode: 8b8520ff ffff83f8 860f8580 030000e8 5cc3c1fe\nCall Trace:\n ...\n ocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583\n x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n ...\n\n[CAUSE]\nocfs2_group_extend() assumes that the global bitmap inode block\nreturned from ocfs2_inode_lock() has already been validated and\nBUG_ONs when the signature is not a dinode. That assumption is too\nstrong for crafted filesystems because the JBD2-managed buffer path\ncan bypass structural validation and return an invalid dinode to the\nresize ioctl.\n\n[FIX]\nValidate the dinode explicitly in ocfs2_group_extend(). If the global\nbitmap buffer does not contain a valid dinode, report filesystem\ncorruption with ocfs2_error() and fail the resize operation instead of\ncrashing the kernel."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:42:37.033Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7eafcf507fbd68f3276c00f6c02ef155ad69f79b"
},
{
"url": "https://git.kernel.org/stable/c/fabfa6b81bd386154d7e59f8cd8f760f9e68b48c"
},
{
"url": "https://git.kernel.org/stable/c/b328d8e7c437d0f026ba2c13788af6eae77700f1"
},
{
"url": "https://git.kernel.org/stable/c/6575f9fbf084502b7118a628425bf7866666498d"
},
{
"url": "https://git.kernel.org/stable/c/911b557dd7817460881fd51a03069b539c674d0e"
},
{
"url": "https://git.kernel.org/stable/c/e384a850a3370d89a7a446cdeccd964bfba2a302"
},
{
"url": "https://git.kernel.org/stable/c/10fb72c47aac446f12a4ccd962c7daa60cc890a1"
},
{
"url": "https://git.kernel.org/stable/c/41c6e9bc3a09539deab43957a3211d902a4818f0"
},
{
"url": "https://git.kernel.org/stable/c/4a1c0ddc6e7bcf2e9db0eeaab9340dcfe97f448f"
}
],
"title": "ocfs2: handle invalid dinode in ocfs2_group_extend",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31596",
"datePublished": "2026-04-24T14:42:22.003Z",
"dateReserved": "2026-03-09T15:48:24.121Z",
"dateUpdated": "2026-06-14T17:42:37.033Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43027 (GCVE-0-2026-43027)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-07-14 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_helper: pass helper to expect cleanup
nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy()
to remove expectations belonging to the helper being unregistered.
However, it passes NULL instead of the helper pointer as the data
argument, so expect_iter_me() never matches any expectation and all
of them survive the cleanup.
After unregister returns, nfnl_cthelper_del() frees the helper
object immediately. Subsequent expectation dumps or packet-driven
init_conntrack() calls then dereference the freed exp->helper,
causing a use-after-free.
Pass the actual helper pointer so expectations referencing it are
properly destroyed before the helper object is freed.
BUG: KASAN: slab-use-after-free in string+0x38f/0x430
Read of size 1 at addr ffff888003b14d20 by task poc/103
Call Trace:
string+0x38f/0x430
vsnprintf+0x3cc/0x1170
seq_printf+0x17a/0x240
exp_seq_show+0x2e5/0x560
seq_read_iter+0x419/0x1280
proc_reg_read+0x1ac/0x270
vfs_read+0x179/0x930
ksys_read+0xef/0x1c0
Freed by task 103:
The buggy address is located 32 bytes inside of
freed 192-byte region [ffff888003b14d00, ffff888003b14dc0)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ac7b848390036dadd4351899d2a23748075916bd Version: ac7b848390036dadd4351899d2a23748075916bd Version: ac7b848390036dadd4351899d2a23748075916bd Version: ac7b848390036dadd4351899d2a23748075916bd Version: ac7b848390036dadd4351899d2a23748075916bd Version: ac7b848390036dadd4351899d2a23748075916bd Version: ac7b848390036dadd4351899d2a23748075916bd Version: ac7b848390036dadd4351899d2a23748075916bd |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:49:02.973Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_helper.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5cf28d5c8dcbbe8af6d3b145babe491906d7bad1",
"status": "affected",
"version": "ac7b848390036dadd4351899d2a23748075916bd",
"versionType": "git"
},
{
"lessThan": "504ba4168466c91210c45acdc332479cfd5f2da6",
"status": "affected",
"version": "ac7b848390036dadd4351899d2a23748075916bd",
"versionType": "git"
},
{
"lessThan": "dc1739eff48e34cc71d4e2f03715493fbcebd8af",
"status": "affected",
"version": "ac7b848390036dadd4351899d2a23748075916bd",
"versionType": "git"
},
{
"lessThan": "2cf2737c85a2ba2b52024dafe68ffad2676f97be",
"status": "affected",
"version": "ac7b848390036dadd4351899d2a23748075916bd",
"versionType": "git"
},
{
"lessThan": "2c16e4d64dd91227742dfe196a3e7b0568bef65a",
"status": "affected",
"version": "ac7b848390036dadd4351899d2a23748075916bd",
"versionType": "git"
},
{
"lessThan": "620f3d14c1ef51d425060a3056ad8dbae8f998a3",
"status": "affected",
"version": "ac7b848390036dadd4351899d2a23748075916bd",
"versionType": "git"
},
{
"lessThan": "90bd7e8501349db3006d21fbc09df9ffcb172965",
"status": "affected",
"version": "ac7b848390036dadd4351899d2a23748075916bd",
"versionType": "git"
},
{
"lessThan": "a242a9ae58aa46ff7dae51ce64150a93957abe65",
"status": "affected",
"version": "ac7b848390036dadd4351899d2a23748075916bd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_helper.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_helper: pass helper to expect cleanup\n\nnf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy()\nto remove expectations belonging to the helper being unregistered.\nHowever, it passes NULL instead of the helper pointer as the data\nargument, so expect_iter_me() never matches any expectation and all\nof them survive the cleanup.\n\nAfter unregister returns, nfnl_cthelper_del() frees the helper\nobject immediately. Subsequent expectation dumps or packet-driven\ninit_conntrack() calls then dereference the freed exp-\u003ehelper,\ncausing a use-after-free.\n\nPass the actual helper pointer so expectations referencing it are\nproperly destroyed before the helper object is freed.\n\n BUG: KASAN: slab-use-after-free in string+0x38f/0x430\n Read of size 1 at addr ffff888003b14d20 by task poc/103\n Call Trace:\n string+0x38f/0x430\n vsnprintf+0x3cc/0x1170\n seq_printf+0x17a/0x240\n exp_seq_show+0x2e5/0x560\n seq_read_iter+0x419/0x1280\n proc_reg_read+0x1ac/0x270\n vfs_read+0x179/0x930\n ksys_read+0xef/0x1c0\n Freed by task 103:\n The buggy address is located 32 bytes inside of\n freed 192-byte region [ffff888003b14d00, ffff888003b14dc0)"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:16:18.081Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5cf28d5c8dcbbe8af6d3b145babe491906d7bad1"
},
{
"url": "https://git.kernel.org/stable/c/504ba4168466c91210c45acdc332479cfd5f2da6"
},
{
"url": "https://git.kernel.org/stable/c/dc1739eff48e34cc71d4e2f03715493fbcebd8af"
},
{
"url": "https://git.kernel.org/stable/c/2cf2737c85a2ba2b52024dafe68ffad2676f97be"
},
{
"url": "https://git.kernel.org/stable/c/2c16e4d64dd91227742dfe196a3e7b0568bef65a"
},
{
"url": "https://git.kernel.org/stable/c/620f3d14c1ef51d425060a3056ad8dbae8f998a3"
},
{
"url": "https://git.kernel.org/stable/c/90bd7e8501349db3006d21fbc09df9ffcb172965"
},
{
"url": "https://git.kernel.org/stable/c/a242a9ae58aa46ff7dae51ce64150a93957abe65"
}
],
"title": "netfilter: nf_conntrack_helper: pass helper to expect cleanup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43027",
"datePublished": "2026-05-01T14:15:28.521Z",
"dateReserved": "2026-05-01T14:12:55.976Z",
"dateUpdated": "2026-07-14T12:49:02.973Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46051 (GCVE-0-2026-46051)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-06-14 17:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
md/raid5: fix soft lockup in retry_aligned_read()
When retry_aligned_read() encounters an overlapped stripe, it releases
the stripe via raid5_release_stripe() which puts it on the lockless
released_stripes llist. In the next raid5d loop iteration,
release_stripe_list() drains the stripe onto handle_list (since
STRIPE_HANDLE is set by the original IO), but retry_aligned_read()
runs before handle_active_stripes() and removes the stripe from
handle_list via find_get_stripe() -> list_del_init(). This prevents
handle_stripe() from ever processing the stripe to resolve the
overlap, causing an infinite loop and soft lockup.
Fix this by using __release_stripe() with temp_inactive_list instead
of raid5_release_stripe() in the failure path, so the stripe does not
go through the released_stripes llist. This allows raid5d to break out
of its loop, and the overlap will be resolved when the stripe is
eventually processed by handle_stripe().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6 Version: 773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6 Version: 773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6 Version: 773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6 Version: 773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6 Version: 773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6 Version: 773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6 Version: 773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/raid5.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "66df9f30673db66ac35145820a8e24906069ae57",
"status": "affected",
"version": "773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6",
"versionType": "git"
},
{
"lessThan": "4166d5234fe8b6c3c7f796a6c198605356c5b355",
"status": "affected",
"version": "773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6",
"versionType": "git"
},
{
"lessThan": "a9055300e07d9d6800264d3c2560e1d0144689ca",
"status": "affected",
"version": "773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6",
"versionType": "git"
},
{
"lessThan": "09880592f5a9dc73377d6eb5ac123537b5f8df49",
"status": "affected",
"version": "773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6",
"versionType": "git"
},
{
"lessThan": "80fc6ca2cbde018d52e13f305edcd643911bd94b",
"status": "affected",
"version": "773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6",
"versionType": "git"
},
{
"lessThan": "1985cb3247e87ff6b8ca4bc5f9626f4f51024507",
"status": "affected",
"version": "773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6",
"versionType": "git"
},
{
"lessThan": "883cc33b7af1c448663287f069ef9dfea001e90f",
"status": "affected",
"version": "773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6",
"versionType": "git"
},
{
"lessThan": "7f9f7c697474268d9ef9479df3ddfe7cdcfbbffc",
"status": "affected",
"version": "773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/raid5.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.12"
},
{
"lessThan": "3.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: fix soft lockup in retry_aligned_read()\n\nWhen retry_aligned_read() encounters an overlapped stripe, it releases\nthe stripe via raid5_release_stripe() which puts it on the lockless\nreleased_stripes llist. In the next raid5d loop iteration,\nrelease_stripe_list() drains the stripe onto handle_list (since\nSTRIPE_HANDLE is set by the original IO), but retry_aligned_read()\nruns before handle_active_stripes() and removes the stripe from\nhandle_list via find_get_stripe() -\u003e list_del_init(). This prevents\nhandle_stripe() from ever processing the stripe to resolve the\noverlap, causing an infinite loop and soft lockup.\n\nFix this by using __release_stripe() with temp_inactive_list instead\nof raid5_release_stripe() in the failure path, so the stripe does not\ngo through the released_stripes llist. This allows raid5d to break out\nof its loop, and the overlap will be resolved when the stripe is\neventually processed by handle_stripe()."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:50:46.976Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/66df9f30673db66ac35145820a8e24906069ae57"
},
{
"url": "https://git.kernel.org/stable/c/4166d5234fe8b6c3c7f796a6c198605356c5b355"
},
{
"url": "https://git.kernel.org/stable/c/a9055300e07d9d6800264d3c2560e1d0144689ca"
},
{
"url": "https://git.kernel.org/stable/c/09880592f5a9dc73377d6eb5ac123537b5f8df49"
},
{
"url": "https://git.kernel.org/stable/c/80fc6ca2cbde018d52e13f305edcd643911bd94b"
},
{
"url": "https://git.kernel.org/stable/c/1985cb3247e87ff6b8ca4bc5f9626f4f51024507"
},
{
"url": "https://git.kernel.org/stable/c/883cc33b7af1c448663287f069ef9dfea001e90f"
},
{
"url": "https://git.kernel.org/stable/c/7f9f7c697474268d9ef9479df3ddfe7cdcfbbffc"
}
],
"title": "md/raid5: fix soft lockup in retry_aligned_read()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46051",
"datePublished": "2026-05-27T12:57:09.274Z",
"dateReserved": "2026-05-13T15:03:33.094Z",
"dateUpdated": "2026-06-14T17:50:46.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43242 (GCVE-0-2026-43242)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-23 16:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
soc: ti: k3-socinfo: Fix regmap leak on probe failure
The mmio regmap allocated during probe is never freed.
Switch to using the device managed allocator so that the regmap is
released on probe failures (e.g. probe deferral) and on driver unbind.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c7e8e3e3591cbda98ebe6221e3cc8a971b8eed6e Version: db5833217f133b74fb76c75c45be07c881d4d985 Version: 5f496a9f1c8c7a58f35a8b6bcb826e23c2d58ec0 Version: 3314310b3f3e69961f421a123ccb1ea9669d75c4 Version: 06100e642f4b83ec758744e5f992d7a2039ec98f Version: a5caf03188e44388e8c618dcbe5fffad1a249385 Version: a5caf03188e44388e8c618dcbe5fffad1a249385 Version: a5caf03188e44388e8c618dcbe5fffad1a249385 Version: 5108fd2c67647a0b0f65c7c125ef8978b23a68f8 Version: 5.10.238 ≤ Version: 5.15.185 ≤ Version: 6.1.141 ≤ Version: 6.6.93 ≤ Version: 6.12.31 ≤ Version: 6.14.9 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/soc/ti/k3-socinfo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c97c21d342838b2a7787b0f1d6ad417e85c906f6",
"status": "affected",
"version": "c7e8e3e3591cbda98ebe6221e3cc8a971b8eed6e",
"versionType": "git"
},
{
"lessThan": "b1006b5892ec8a95d039a89b47e6fd69cf607405",
"status": "affected",
"version": "db5833217f133b74fb76c75c45be07c881d4d985",
"versionType": "git"
},
{
"lessThan": "458136527fe127fd051c1c9537f4540849780d70",
"status": "affected",
"version": "5f496a9f1c8c7a58f35a8b6bcb826e23c2d58ec0",
"versionType": "git"
},
{
"lessThan": "d451bf970a0c54b586f8b3161261bdf35d463c99",
"status": "affected",
"version": "3314310b3f3e69961f421a123ccb1ea9669d75c4",
"versionType": "git"
},
{
"lessThan": "eaa16059f9af26d8b8a6f3e887649f58e8ca96c9",
"status": "affected",
"version": "06100e642f4b83ec758744e5f992d7a2039ec98f",
"versionType": "git"
},
{
"lessThan": "ab1ac24c407e4df326d7154a4deadd444e9209d9",
"status": "affected",
"version": "a5caf03188e44388e8c618dcbe5fffad1a249385",
"versionType": "git"
},
{
"lessThan": "bbaa9e615608c204d384a7d4b1a434580a142d4c",
"status": "affected",
"version": "a5caf03188e44388e8c618dcbe5fffad1a249385",
"versionType": "git"
},
{
"lessThan": "c933138d45176780fabbbe7da263e04d5b3e525d",
"status": "affected",
"version": "a5caf03188e44388e8c618dcbe5fffad1a249385",
"versionType": "git"
},
{
"status": "affected",
"version": "5108fd2c67647a0b0f65c7c125ef8978b23a68f8",
"versionType": "git"
},
{
"lessThan": "5.10.252",
"status": "affected",
"version": "5.10.238",
"versionType": "semver"
},
{
"lessThan": "5.15.202",
"status": "affected",
"version": "5.15.185",
"versionType": "semver"
},
{
"lessThan": "6.1.165",
"status": "affected",
"version": "6.1.141",
"versionType": "semver"
},
{
"lessThan": "6.6.128",
"status": "affected",
"version": "6.6.93",
"versionType": "semver"
},
{
"lessThan": "6.12.75",
"status": "affected",
"version": "6.12.31",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/soc/ti/k3-socinfo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "5.10.238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.15.185",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.1.141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.6.93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.12.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsoc: ti: k3-socinfo: Fix regmap leak on probe failure\n\nThe mmio regmap allocated during probe is never freed.\n\nSwitch to using the device managed allocator so that the regmap is\nreleased on probe failures (e.g. probe deferral) and on driver unbind."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:06:32.886Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c97c21d342838b2a7787b0f1d6ad417e85c906f6"
},
{
"url": "https://git.kernel.org/stable/c/b1006b5892ec8a95d039a89b47e6fd69cf607405"
},
{
"url": "https://git.kernel.org/stable/c/458136527fe127fd051c1c9537f4540849780d70"
},
{
"url": "https://git.kernel.org/stable/c/d451bf970a0c54b586f8b3161261bdf35d463c99"
},
{
"url": "https://git.kernel.org/stable/c/eaa16059f9af26d8b8a6f3e887649f58e8ca96c9"
},
{
"url": "https://git.kernel.org/stable/c/ab1ac24c407e4df326d7154a4deadd444e9209d9"
},
{
"url": "https://git.kernel.org/stable/c/bbaa9e615608c204d384a7d4b1a434580a142d4c"
},
{
"url": "https://git.kernel.org/stable/c/c933138d45176780fabbbe7da263e04d5b3e525d"
}
],
"title": "soc: ti: k3-socinfo: Fix regmap leak on probe failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43242",
"datePublished": "2026-05-06T11:28:35.614Z",
"dateReserved": "2026-05-01T14:12:55.995Z",
"dateUpdated": "2026-05-23T16:06:32.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43429 (GCVE-0-2026-43429)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-11 22:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts
The usbtmc driver accepts timeout values specified by the user in an
ioctl command, and uses these timeouts for some usb_bulk_msg() calls.
Since the user can specify arbitrarily long timeouts and
usb_bulk_msg() uses unkillable waits, call usb_bulk_msg_killable()
instead to avoid the possibility of the user hanging a kernel thread
indefinitely.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 048c6d88a0214757926f264823829e79154fcd4f Version: 048c6d88a0214757926f264823829e79154fcd4f Version: 048c6d88a0214757926f264823829e79154fcd4f Version: 048c6d88a0214757926f264823829e79154fcd4f Version: 048c6d88a0214757926f264823829e79154fcd4f Version: 048c6d88a0214757926f264823829e79154fcd4f Version: 048c6d88a0214757926f264823829e79154fcd4f Version: 048c6d88a0214757926f264823829e79154fcd4f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/class/usbtmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e14a0dcdf468c3ad616bb06696c7c64c36e736d8",
"status": "affected",
"version": "048c6d88a0214757926f264823829e79154fcd4f",
"versionType": "git"
},
{
"lessThan": "7fa72c369c23c27d1f64883c1e276af950557fb1",
"status": "affected",
"version": "048c6d88a0214757926f264823829e79154fcd4f",
"versionType": "git"
},
{
"lessThan": "72c0a063489be183cfb99e7050aaef503bdb6449",
"status": "affected",
"version": "048c6d88a0214757926f264823829e79154fcd4f",
"versionType": "git"
},
{
"lessThan": "39bd4097292fd8564cf2cfba9356f8ab11e38d12",
"status": "affected",
"version": "048c6d88a0214757926f264823829e79154fcd4f",
"versionType": "git"
},
{
"lessThan": "0535f84cb94c9d8bcba0a2a5b3fac81b7d97235d",
"status": "affected",
"version": "048c6d88a0214757926f264823829e79154fcd4f",
"versionType": "git"
},
{
"lessThan": "6cb7dc91f057dd8ce44f6caa2995d8e22784ed0a",
"status": "affected",
"version": "048c6d88a0214757926f264823829e79154fcd4f",
"versionType": "git"
},
{
"lessThan": "d4f1c45bdff3f393f9ab7e76795901c442b9eb76",
"status": "affected",
"version": "048c6d88a0214757926f264823829e79154fcd4f",
"versionType": "git"
},
{
"lessThan": "7784caa413a89487dd14dd5c41db8753483b2acb",
"status": "affected",
"version": "048c6d88a0214757926f264823829e79154fcd4f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/class/usbtmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts\n\nThe usbtmc driver accepts timeout values specified by the user in an\nioctl command, and uses these timeouts for some usb_bulk_msg() calls.\nSince the user can specify arbitrarily long timeouts and\nusb_bulk_msg() uses unkillable waits, call usb_bulk_msg_killable()\ninstead to avoid the possibility of the user hanging a kernel thread\nindefinitely."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:25.178Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e14a0dcdf468c3ad616bb06696c7c64c36e736d8"
},
{
"url": "https://git.kernel.org/stable/c/7fa72c369c23c27d1f64883c1e276af950557fb1"
},
{
"url": "https://git.kernel.org/stable/c/72c0a063489be183cfb99e7050aaef503bdb6449"
},
{
"url": "https://git.kernel.org/stable/c/39bd4097292fd8564cf2cfba9356f8ab11e38d12"
},
{
"url": "https://git.kernel.org/stable/c/0535f84cb94c9d8bcba0a2a5b3fac81b7d97235d"
},
{
"url": "https://git.kernel.org/stable/c/6cb7dc91f057dd8ce44f6caa2995d8e22784ed0a"
},
{
"url": "https://git.kernel.org/stable/c/d4f1c45bdff3f393f9ab7e76795901c442b9eb76"
},
{
"url": "https://git.kernel.org/stable/c/7784caa413a89487dd14dd5c41db8753483b2acb"
}
],
"title": "USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43429",
"datePublished": "2026-05-08T14:22:01.739Z",
"dateReserved": "2026-05-01T14:12:56.009Z",
"dateUpdated": "2026-05-11T22:24:25.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53073 (GCVE-0-2026-53073)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
When hci_register_dev() fails in hci_uart_register_dev()
HCI_UART_PROTO_INIT is not cleared before calling hu->proto->close(hu)
and setting hu->hdev to NULL. This means incoming UART data will reach
the protocol-specific recv handler in hci_uart_tty_receive() after
resources are freed.
Clear HCI_UART_PROTO_INIT with a write lock before calling
hu->proto->close() and setting hu->hdev to NULL. The write lock ensures
all active readers have completed and no new reader can enter the
protocol recv path before resources are freed.
This allows the protocol-specific recv functions to remove the
"HCI_UART_REGISTERED" guard without risking a null pointer dereference
if hci_register_dev() fails.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a40f94f7caa8d3421b64f63ac31bc0f24c890f39 Version: 9e5a0f5777162e503400c70c6ed25fbbe2d38799 Version: 80f14e9de6a43a0bd8194cad1003a3e6dcbc3984 Version: 02e1bcdfdf769974e7e9fa285e295cd9852e2a38 Version: 281782d2c6730241e300d630bb9f200d831ede71 Version: 5df5dafc171b90d0b8d51547a82657cd5a1986c7 Version: 5df5dafc171b90d0b8d51547a82657cd5a1986c7 Version: 5df5dafc171b90d0b8d51547a82657cd5a1986c7 Version: 1dcf08fcff5ca529de6dc0395091f28854f4e54a Version: 8e5aff600539e5faea294d9612cca50220e602b8 Version: db7509fa110dd9b11134b75894677f30353b2c51 Version: 5.10.237 ≤ Version: 5.15.181 ≤ Version: 6.1.135 ≤ Version: 6.6.88 ≤ Version: 6.12.24 ≤ Version: 5.4.293 ≤ Version: 6.13.12 ≤ Version: 6.14.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/hci_ldisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07",
"status": "affected",
"version": "a40f94f7caa8d3421b64f63ac31bc0f24c890f39",
"versionType": "git"
},
{
"lessThan": "ed4033fb85ccaaf6c3983be3c7b037e48253d232",
"status": "affected",
"version": "9e5a0f5777162e503400c70c6ed25fbbe2d38799",
"versionType": "git"
},
{
"lessThan": "356dee1bcac4d0d9152390561fa63331ebff211b",
"status": "affected",
"version": "80f14e9de6a43a0bd8194cad1003a3e6dcbc3984",
"versionType": "git"
},
{
"lessThan": "a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40",
"status": "affected",
"version": "02e1bcdfdf769974e7e9fa285e295cd9852e2a38",
"versionType": "git"
},
{
"lessThan": "f4b69c35813c432973d340d3600c01de106ed474",
"status": "affected",
"version": "281782d2c6730241e300d630bb9f200d831ede71",
"versionType": "git"
},
{
"lessThan": "3daa5818e473ed60eb69d8b5c71b651909d28c5a",
"status": "affected",
"version": "5df5dafc171b90d0b8d51547a82657cd5a1986c7",
"versionType": "git"
},
{
"lessThan": "194f029a4d7f739e44ebc1f473120187b4de5104",
"status": "affected",
"version": "5df5dafc171b90d0b8d51547a82657cd5a1986c7",
"versionType": "git"
},
{
"lessThan": "68d39ea5e0adc9ecaea1ce8abd842ec972eb8718",
"status": "affected",
"version": "5df5dafc171b90d0b8d51547a82657cd5a1986c7",
"versionType": "git"
},
{
"status": "affected",
"version": "1dcf08fcff5ca529de6dc0395091f28854f4e54a",
"versionType": "git"
},
{
"status": "affected",
"version": "8e5aff600539e5faea294d9612cca50220e602b8",
"versionType": "git"
},
{
"status": "affected",
"version": "db7509fa110dd9b11134b75894677f30353b2c51",
"versionType": "git"
},
{
"lessThan": "5.10.258",
"status": "affected",
"version": "5.10.237",
"versionType": "semver"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.181",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.135",
"versionType": "semver"
},
{
"lessThan": "6.6.141",
"status": "affected",
"version": "6.6.88",
"versionType": "semver"
},
{
"lessThan": "6.12.91",
"status": "affected",
"version": "6.12.24",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.293",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.12",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/hci_ldisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10.237",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.181",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.135",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.6.88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.12.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.293",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error\n\nWhen hci_register_dev() fails in hci_uart_register_dev()\nHCI_UART_PROTO_INIT is not cleared before calling hu-\u003eproto-\u003eclose(hu)\nand setting hu-\u003ehdev to NULL. This means incoming UART data will reach\nthe protocol-specific recv handler in hci_uart_tty_receive() after\nresources are freed.\n\nClear HCI_UART_PROTO_INIT with a write lock before calling\nhu-\u003eproto-\u003eclose() and setting hu-\u003ehdev to NULL. The write lock ensures\nall active readers have completed and no new reader can enter the\nprotocol recv path before resources are freed.\n\nThis allows the protocol-specific recv functions to remove the\n\"HCI_UART_REGISTERED\" guard without risking a null pointer dereference\nif hci_register_dev() fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:14.463Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ebb39b2d81731b83ee71a1ba6dd0291a57b5ac07"
},
{
"url": "https://git.kernel.org/stable/c/ed4033fb85ccaaf6c3983be3c7b037e48253d232"
},
{
"url": "https://git.kernel.org/stable/c/356dee1bcac4d0d9152390561fa63331ebff211b"
},
{
"url": "https://git.kernel.org/stable/c/a673cf6c4ac702cb79ac1f4d7fc4de763a6a3e40"
},
{
"url": "https://git.kernel.org/stable/c/f4b69c35813c432973d340d3600c01de106ed474"
},
{
"url": "https://git.kernel.org/stable/c/3daa5818e473ed60eb69d8b5c71b651909d28c5a"
},
{
"url": "https://git.kernel.org/stable/c/194f029a4d7f739e44ebc1f473120187b4de5104"
},
{
"url": "https://git.kernel.org/stable/c/68d39ea5e0adc9ecaea1ce8abd842ec972eb8718"
}
],
"title": "Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53073",
"datePublished": "2026-06-24T16:30:14.463Z",
"dateReserved": "2026-06-09T07:44:35.383Z",
"dateUpdated": "2026-06-24T16:30:14.463Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53122 (GCVE-0-2026-53122)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix deadlock between reflink and transaction commit when using flushoncommit
When using the flushoncommit mount option, we can have a deadlock between
a transaction commit and a reflink operation that copied an inline extent
to an offset beyond the current i_size of the destination node.
The deadlock happens like this:
1) Task A clones an inline extent from inode X to an offset of inode Y
that is beyond Y's current i_size. This means we copied the inline
extent's data to a folio of inode Y that is beyond its EOF, using a
call to copy_inline_to_page();
2) Task B starts a transaction commit and calls
btrfs_start_delalloc_flush() to flush delalloc;
3) The delalloc flushing sees the new dirty folio of inode Y and when it
attempts to flush it, it ends up at extent_writepage() and sees that
the offset of the folio is beyond the i_size of inode Y, so it attempts
to invalidate the folio by calling folio_invalidate(), which ends up at
btrfs' folio invalidate callback - btrfs_invalidate_folio(). There it
tries to lock the folio's range in inode Y's extent io tree, but it
blocks since it's currently locked by task A - during a reflink we lock
the inodes and the source and destination ranges after flushing all
delalloc and waiting for ordered extent completion - after that we
don't expect to have dirty folios in the ranges, the exception is if
we have to copy an inline extent's data (because the destination offset
is not zero);
4) Task A then attempts to start a transaction to update the inode item,
and then it's blocked since the current transaction is in the
TRANS_STATE_COMMIT_START state. Therefore task A has to wait for the
current transaction to become unblocked (its state >=
TRANS_STATE_UNBLOCKED).
So task A is waiting for the transaction commit done by task B, and
the later waiting on the extent lock of inode Y that is currently
held by task A.
Syzbot recently reported this with the following stack traces:
INFO: task kworker/u8:7:1053 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:7 state:D stack:23520 pid:1053 tgid:1053 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: writeback wb_workfn (flush-btrfs-46)
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0x1553/0x5240 kernel/sched/core.c:6911
__schedule_loop kernel/sched/core.c:6993 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7008
wait_extent_bit fs/btrfs/extent-io-tree.c:811 [inline]
btrfs_lock_extent_bits+0x59c/0x700 fs/btrfs/extent-io-tree.c:1914
btrfs_lock_extent fs/btrfs/extent-io-tree.h:152 [inline]
btrfs_invalidate_folio+0x43d/0xc40 fs/btrfs/inode.c:7704
extent_writepage fs/btrfs/extent_io.c:1852 [inline]
extent_write_cache_pages fs/btrfs/extent_io.c:2580 [inline]
btrfs_writepages+0x12ff/0x2440 fs/btrfs/extent_io.c:2713
do_writepages+0x32e/0x550 mm/page-writeback.c:2554
__writeback_single_inode+0x133/0x11a0 fs/fs-writeback.c:1750
writeback_sb_inodes+0x995/0x19d0 fs/fs-writeback.c:2042
wb_writeback+0x456/0xb70 fs/fs-writeback.c:2227
wb_do_writeback fs/fs-writeback.c:2374 [inline]
wb_workfn+0x41a/0xf60 fs/fs-writeback.c:2414
process_one_work kernel/workqueue.c:3276 [inline]
process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
INFO: task syz.4.64:6910 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.64 state:D stack:22752 pid:6910 tgid:
---truncated---
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/reflink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "73be4a08306bb84f4d5d16f62cb80e1543109ffa",
"status": "affected",
"version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
"versionType": "git"
},
{
"lessThan": "9a24f0000876b8755cf21972b41632f4d6f3dafb",
"status": "affected",
"version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
"versionType": "git"
},
{
"lessThan": "6f0f9c0a368aa1fe078109091322d3b0632d9380",
"status": "affected",
"version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
"versionType": "git"
},
{
"lessThan": "b48c980b6a7e409050bb3067165db31cc6205e3e",
"status": "affected",
"version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/reflink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix deadlock between reflink and transaction commit when using flushoncommit\n\nWhen using the flushoncommit mount option, we can have a deadlock between\na transaction commit and a reflink operation that copied an inline extent\nto an offset beyond the current i_size of the destination node.\n\nThe deadlock happens like this:\n\n1) Task A clones an inline extent from inode X to an offset of inode Y\n that is beyond Y\u0027s current i_size. This means we copied the inline\n extent\u0027s data to a folio of inode Y that is beyond its EOF, using a\n call to copy_inline_to_page();\n\n2) Task B starts a transaction commit and calls\n btrfs_start_delalloc_flush() to flush delalloc;\n\n3) The delalloc flushing sees the new dirty folio of inode Y and when it\n attempts to flush it, it ends up at extent_writepage() and sees that\n the offset of the folio is beyond the i_size of inode Y, so it attempts\n to invalidate the folio by calling folio_invalidate(), which ends up at\n btrfs\u0027 folio invalidate callback - btrfs_invalidate_folio(). There it\n tries to lock the folio\u0027s range in inode Y\u0027s extent io tree, but it\n blocks since it\u0027s currently locked by task A - during a reflink we lock\n the inodes and the source and destination ranges after flushing all\n delalloc and waiting for ordered extent completion - after that we\n don\u0027t expect to have dirty folios in the ranges, the exception is if\n we have to copy an inline extent\u0027s data (because the destination offset\n is not zero);\n\n4) Task A then attempts to start a transaction to update the inode item,\n and then it\u0027s blocked since the current transaction is in the\n TRANS_STATE_COMMIT_START state. Therefore task A has to wait for the\n current transaction to become unblocked (its state \u003e=\n TRANS_STATE_UNBLOCKED).\n\n So task A is waiting for the transaction commit done by task B, and\n the later waiting on the extent lock of inode Y that is currently\n held by task A.\n\nSyzbot recently reported this with the following stack traces:\n\n INFO: task kworker/u8:7:1053 blocked for more than 143 seconds.\n Not tainted syzkaller #0\n \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:kworker/u8:7 state:D stack:23520 pid:1053 tgid:1053 ppid:2 task_flags:0x4208060 flags:0x00080000\n Workqueue: writeback wb_workfn (flush-btrfs-46)\n Call Trace:\n \u003cTASK\u003e\n context_switch kernel/sched/core.c:5298 [inline]\n __schedule+0x1553/0x5240 kernel/sched/core.c:6911\n __schedule_loop kernel/sched/core.c:6993 [inline]\n schedule+0x164/0x360 kernel/sched/core.c:7008\n wait_extent_bit fs/btrfs/extent-io-tree.c:811 [inline]\n btrfs_lock_extent_bits+0x59c/0x700 fs/btrfs/extent-io-tree.c:1914\n btrfs_lock_extent fs/btrfs/extent-io-tree.h:152 [inline]\n btrfs_invalidate_folio+0x43d/0xc40 fs/btrfs/inode.c:7704\n extent_writepage fs/btrfs/extent_io.c:1852 [inline]\n extent_write_cache_pages fs/btrfs/extent_io.c:2580 [inline]\n btrfs_writepages+0x12ff/0x2440 fs/btrfs/extent_io.c:2713\n do_writepages+0x32e/0x550 mm/page-writeback.c:2554\n __writeback_single_inode+0x133/0x11a0 fs/fs-writeback.c:1750\n writeback_sb_inodes+0x995/0x19d0 fs/fs-writeback.c:2042\n wb_writeback+0x456/0xb70 fs/fs-writeback.c:2227\n wb_do_writeback fs/fs-writeback.c:2374 [inline]\n wb_workfn+0x41a/0xf60 fs/fs-writeback.c:2414\n process_one_work kernel/workqueue.c:3276 [inline]\n process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359\n worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440\n kthread+0x388/0x470 kernel/kthread.c:436\n ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n INFO: task syz.4.64:6910 blocked for more than 143 seconds.\n Not tainted syzkaller #0\n \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:syz.4.64 state:D stack:22752 pid:6910 tgid:\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:51.941Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/73be4a08306bb84f4d5d16f62cb80e1543109ffa"
},
{
"url": "https://git.kernel.org/stable/c/9a24f0000876b8755cf21972b41632f4d6f3dafb"
},
{
"url": "https://git.kernel.org/stable/c/6f0f9c0a368aa1fe078109091322d3b0632d9380"
},
{
"url": "https://git.kernel.org/stable/c/b48c980b6a7e409050bb3067165db31cc6205e3e"
}
],
"title": "btrfs: fix deadlock between reflink and transaction commit when using flushoncommit",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53122",
"datePublished": "2026-06-24T16:30:51.941Z",
"dateReserved": "2026-06-09T07:44:35.386Z",
"dateUpdated": "2026-06-24T16:30:51.941Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43182 (GCVE-0-2026-43182)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: ccs: Avoid possible division by zero
Calculating maximum M for scaler configuration involves dividing by
MIN_X_OUTPUT_SIZE limit register's value. Albeit the value is presumably
non-zero, the driver was missing the check it in fact was. Fix this.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ccfc97bdb5ae8b8edc55169ac6924e08449836ac Version: ccfc97bdb5ae8b8edc55169ac6924e08449836ac Version: ccfc97bdb5ae8b8edc55169ac6924e08449836ac Version: ccfc97bdb5ae8b8edc55169ac6924e08449836ac Version: ccfc97bdb5ae8b8edc55169ac6924e08449836ac Version: ccfc97bdb5ae8b8edc55169ac6924e08449836ac Version: ccfc97bdb5ae8b8edc55169ac6924e08449836ac |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/i2c/ccs/ccs-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b6e0529c300e44153fc6f3b565e28163caf1f031",
"status": "affected",
"version": "ccfc97bdb5ae8b8edc55169ac6924e08449836ac",
"versionType": "git"
},
{
"lessThan": "9aae0f31d37a8facd25e37c0f0709ea08de83802",
"status": "affected",
"version": "ccfc97bdb5ae8b8edc55169ac6924e08449836ac",
"versionType": "git"
},
{
"lessThan": "c9af1818387f5c6f543e2e02c40b3038eae86be8",
"status": "affected",
"version": "ccfc97bdb5ae8b8edc55169ac6924e08449836ac",
"versionType": "git"
},
{
"lessThan": "32a21ed2ad743fe2d12af48e627089b921a032c2",
"status": "affected",
"version": "ccfc97bdb5ae8b8edc55169ac6924e08449836ac",
"versionType": "git"
},
{
"lessThan": "a8ff58cc8c7514c278ba0ea2c787d4bf9eeb355d",
"status": "affected",
"version": "ccfc97bdb5ae8b8edc55169ac6924e08449836ac",
"versionType": "git"
},
{
"lessThan": "8ca7df18e7a58a0e5b0ed9eaaa34e16fc5cb9680",
"status": "affected",
"version": "ccfc97bdb5ae8b8edc55169ac6924e08449836ac",
"versionType": "git"
},
{
"lessThan": "679f0b7b6a409750a25754c8833e268e5fdde742",
"status": "affected",
"version": "ccfc97bdb5ae8b8edc55169ac6924e08449836ac",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/i2c/ccs/ccs-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ccs: Avoid possible division by zero\n\nCalculating maximum M for scaler configuration involves dividing by\nMIN_X_OUTPUT_SIZE limit register\u0027s value. Albeit the value is presumably\nnon-zero, the driver was missing the check it in fact was. Fix this."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:19:25.995Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b6e0529c300e44153fc6f3b565e28163caf1f031"
},
{
"url": "https://git.kernel.org/stable/c/9aae0f31d37a8facd25e37c0f0709ea08de83802"
},
{
"url": "https://git.kernel.org/stable/c/c9af1818387f5c6f543e2e02c40b3038eae86be8"
},
{
"url": "https://git.kernel.org/stable/c/32a21ed2ad743fe2d12af48e627089b921a032c2"
},
{
"url": "https://git.kernel.org/stable/c/a8ff58cc8c7514c278ba0ea2c787d4bf9eeb355d"
},
{
"url": "https://git.kernel.org/stable/c/8ca7df18e7a58a0e5b0ed9eaaa34e16fc5cb9680"
},
{
"url": "https://git.kernel.org/stable/c/679f0b7b6a409750a25754c8833e268e5fdde742"
}
],
"title": "media: ccs: Avoid possible division by zero",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43182",
"datePublished": "2026-05-06T11:27:54.307Z",
"dateReserved": "2026-05-01T14:12:55.991Z",
"dateUpdated": "2026-05-11T22:19:25.995Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53072 (GCVE-0-2026-53072)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER
When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls
hci_connect_cfm(conn) without hdev->lock. Generally hci_connect_cfm()
assumes it is held, and if conn is deleted concurrently -> UAF.
Only SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen,
and HCI_EV_CONN_REQUEST is not generated for ISO. In the non-deferred
listening socket code paths, hci_connect_cfm(conn) is called with
hdev->lock held.
Fix by holding the lock.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 70c464256310e1c3716099b9d02ece4169272f73 Version: 70c464256310e1c3716099b9d02ece4169272f73 Version: 70c464256310e1c3716099b9d02ece4169272f73 Version: 70c464256310e1c3716099b9d02ece4169272f73 Version: 70c464256310e1c3716099b9d02ece4169272f73 Version: 70c464256310e1c3716099b9d02ece4169272f73 Version: 70c464256310e1c3716099b9d02ece4169272f73 Version: 70c464256310e1c3716099b9d02ece4169272f73 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4",
"status": "affected",
"version": "70c464256310e1c3716099b9d02ece4169272f73",
"versionType": "git"
},
{
"lessThan": "9d4a6c0f43fc5e4d4f062e8e450e5483eb74176e",
"status": "affected",
"version": "70c464256310e1c3716099b9d02ece4169272f73",
"versionType": "git"
},
{
"lessThan": "c7777f534a8018ae4bb1c80d8925af4df588a314",
"status": "affected",
"version": "70c464256310e1c3716099b9d02ece4169272f73",
"versionType": "git"
},
{
"lessThan": "6b4d226d01ab7da0d2027a2a1e3a6079152e5065",
"status": "affected",
"version": "70c464256310e1c3716099b9d02ece4169272f73",
"versionType": "git"
},
{
"lessThan": "541d5bf9b5afaf41090b2a3aa7b47f2db2ff801f",
"status": "affected",
"version": "70c464256310e1c3716099b9d02ece4169272f73",
"versionType": "git"
},
{
"lessThan": "385b2d0468a0871fc716c549fa3b0c257c7dbcb3",
"status": "affected",
"version": "70c464256310e1c3716099b9d02ece4169272f73",
"versionType": "git"
},
{
"lessThan": "c27224daf0b08efbb2b24ed64b6139b294f5473a",
"status": "affected",
"version": "70c464256310e1c3716099b9d02ece4169272f73",
"versionType": "git"
},
{
"lessThan": "5c7209a341ff2ac338b2b0375c34a307b37c9ac2",
"status": "affected",
"version": "70c464256310e1c3716099b9d02ece4169272f73",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER\n\nWhen protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls\nhci_connect_cfm(conn) without hdev-\u003elock. Generally hci_connect_cfm()\nassumes it is held, and if conn is deleted concurrently -\u003e UAF.\n\nOnly SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen,\nand HCI_EV_CONN_REQUEST is not generated for ISO. In the non-deferred\nlistening socket code paths, hci_connect_cfm(conn) is called with\nhdev-\u003elock held.\n\nFix by holding the lock."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable path is reached through Bluetooth HCI connection request handling for incoming SCO/eSCO connections from a nearby Bluetooth peer, so exploitation requires adjacency to the target Bluetooth radio.\nAC:L - The attacker can repeatedly initiate deferred SCO/eSCO connection attempts and race connection teardown/cleanup; when uncertain for this race, the higher-severity low-complexity rating is appropriate.\nPR:N - The remote Bluetooth peer reaches the pre-authentication connection request path without local privileges or verified credentials; local deferred-listener configuration is an environmental precondition, not attacker privilege.\nUI:N - Once the target has a deferred SCO/eSCO listener, the attacker can trigger the vulnerable HCI event without requiring a victim to perform an action.\nS:U - The bug is in the kernel Bluetooth stack and impacts the same kernel security authority; it is not a VM, sandbox, or hardware boundary escape by itself.\nC:H - The flaw is a use-after-free of an hci_conn object, and kernel heap UAFs can be leveraged for memory disclosure primitives in a plausible exploitation scenario.\nI:H - The freed hci_conn contains pointers, callback state, and protocol data used by confirmation callbacks, making control-flow or arbitrary memory corruption a defensible high-integrity impact for a kernel UAF.\nA:H - Even without full exploitation, dereferencing a concurrently freed hci_conn can crash or destabilize the kernel, causing high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:06.917Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/60e3f4ff02d1f2d55bfbf2ca32a97285a9771ee4"
},
{
"url": "https://git.kernel.org/stable/c/9d4a6c0f43fc5e4d4f062e8e450e5483eb74176e"
},
{
"url": "https://git.kernel.org/stable/c/c7777f534a8018ae4bb1c80d8925af4df588a314"
},
{
"url": "https://git.kernel.org/stable/c/6b4d226d01ab7da0d2027a2a1e3a6079152e5065"
},
{
"url": "https://git.kernel.org/stable/c/541d5bf9b5afaf41090b2a3aa7b47f2db2ff801f"
},
{
"url": "https://git.kernel.org/stable/c/385b2d0468a0871fc716c549fa3b0c257c7dbcb3"
},
{
"url": "https://git.kernel.org/stable/c/c27224daf0b08efbb2b24ed64b6139b294f5473a"
},
{
"url": "https://git.kernel.org/stable/c/5c7209a341ff2ac338b2b0375c34a307b37c9ac2"
}
],
"title": "Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53072",
"datePublished": "2026-06-24T16:30:13.570Z",
"dateReserved": "2026-06-09T07:44:35.383Z",
"dateUpdated": "2026-08-05T12:33:06.917Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53090 (GCVE-0-2026-53090)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-19 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix ld_{abs,ind} failure path analysis in subprogs
Usage of ld_{abs,ind} instructions got extended into subprogs some time
ago via commit 09b28d76eac4 ("bpf: Add abnormal return checks."). These
are only allowed in subprograms when the latter are BTF annotated and
have scalar return types.
The code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 +
exit) from legacy cBPF times. While the enforcement is on scalar return
types, the verifier must also simulate the path of abnormal exit if the
packet data load via ld_{abs,ind} failed.
This is currently not the case. Fix it by having the verifier simulate
both success and failure paths, and extend it in similar ways as we do
for tail calls. The success path (r0=unknown, continue to next insn) is
pushed onto stack for later validation and the r0=0 and return to the
caller is done on the fall-through side.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 09b28d76eac48e922dc293da1aa2b2b85c32aeee Version: 09b28d76eac48e922dc293da1aa2b2b85c32aeee Version: 09b28d76eac48e922dc293da1aa2b2b85c32aeee Version: 09b28d76eac48e922dc293da1aa2b2b85c32aeee Version: 09b28d76eac48e922dc293da1aa2b2b85c32aeee Version: 09b28d76eac48e922dc293da1aa2b2b85c32aeee Version: 09b28d76eac48e922dc293da1aa2b2b85c32aeee Version: 09b28d76eac48e922dc293da1aa2b2b85c32aeee |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Berkeley Packet Filter (BPF) verifier. When `ld_{abs,ind}` instructions are used in BPF subprograms, the verifier fails to correctly simulate the abnormal exit path if packet data loading fails. This oversight could lead to unexpected behavior or bypass of security checks within the BPF execution environment."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-253",
"description": "Incorrect Check of Function Return Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:45:02.069Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53090"
},
{
"name": "RHBZ#2492305",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492305"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53090.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: bpf: Fix ld_{abs,ind} failure path analysis in subprogs",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "928d354ae3557e8f755a227e67be88034eb3cd7f",
"status": "affected",
"version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
"versionType": "git"
},
{
"lessThan": "8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe",
"status": "affected",
"version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
"versionType": "git"
},
{
"lessThan": "de1055e7f9e67af32b1f3376066272b04e5223c0",
"status": "affected",
"version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
"versionType": "git"
},
{
"lessThan": "37ad2bb11e9de92cb7b94548705eeedd87f7d392",
"status": "affected",
"version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
"versionType": "git"
},
{
"lessThan": "8674e2db06cff6b50f2216eed9a761d15425bb34",
"status": "affected",
"version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
"versionType": "git"
},
{
"lessThan": "ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337",
"status": "affected",
"version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
"versionType": "git"
},
{
"lessThan": "d846d83bdacbd8f14fc45c63b8c1d22608452e1c",
"status": "affected",
"version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
"versionType": "git"
},
{
"lessThan": "ee861486e377edc55361c08dcbceab3f6b6577bd",
"status": "affected",
"version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix ld_{abs,ind} failure path analysis in subprogs\n\nUsage of ld_{abs,ind} instructions got extended into subprogs some time\nago via commit 09b28d76eac4 (\"bpf: Add abnormal return checks.\"). These\nare only allowed in subprograms when the latter are BTF annotated and\nhave scalar return types.\n\nThe code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 +\nexit) from legacy cBPF times. While the enforcement is on scalar return\ntypes, the verifier must also simulate the path of abnormal exit if the\npacket data load via ld_{abs,ind} failed.\n\nThis is currently not the case. Fix it by having the verifier simulate\nboth success and failure paths, and extend it in similar ways as we do\nfor tail calls. The success path (r0=unknown, continue to next insn) is\npushed onto stack for later validation and the r0=0 and return to the\ncaller is done on the fall-through side."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker must locally invoke the bpf() syscall to load a crafted BPF program; packets only trigger the already-loaded malicious program path.\nAC:L - The attacker controls the BPF bytecode, BTF annotations, and packet length needed to force the ld_abs/ld_ind failure path, with no race or external timing dependency.\nPR:L - The needed subprogram/BTF path requires CAP_BPF-equivalent BPF loading privileges, but BPF tokens can delegate these checks into a user namespace. Under the higher-severity rule, this is Low rather than High.\nUI:N - No victim action is required after the local attacker loads and triggers the crafted BPF program.\nS:U - The vulnerability compromises kernel execution within the same host security authority; it is standard local kernel privilege escalation, not a VM or hardware boundary escape.\nC:H - This is a verifier bypass where an unmodeled runtime path can execute code the verifier considered unreachable, enabling unsafe register and pointer use. Such BPF verifier bypasses can be developed into arbitrary kernel memory disclosure.\nI:H - The same unverified runtime path can be shaped into unsafe memory operations, making arbitrary kernel memory write or code execution defensible.\nA:H - Even without full exploitation, executing verifier-unchecked BPF operations can crash or panic the kernel, and the attacker can repeatedly trigger the path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:06.530Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/928d354ae3557e8f755a227e67be88034eb3cd7f"
},
{
"url": "https://git.kernel.org/stable/c/8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe"
},
{
"url": "https://git.kernel.org/stable/c/de1055e7f9e67af32b1f3376066272b04e5223c0"
},
{
"url": "https://git.kernel.org/stable/c/37ad2bb11e9de92cb7b94548705eeedd87f7d392"
},
{
"url": "https://git.kernel.org/stable/c/8674e2db06cff6b50f2216eed9a761d15425bb34"
},
{
"url": "https://git.kernel.org/stable/c/ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337"
},
{
"url": "https://git.kernel.org/stable/c/d846d83bdacbd8f14fc45c63b8c1d22608452e1c"
},
{
"url": "https://git.kernel.org/stable/c/ee861486e377edc55361c08dcbceab3f6b6577bd"
}
],
"title": "bpf: Fix ld_{abs,ind} failure path analysis in subprogs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53090",
"datePublished": "2026-06-24T16:30:29.413Z",
"dateReserved": "2026-06-09T07:44:35.384Z",
"dateUpdated": "2026-08-19T16:28:06.530Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46259 (GCVE-0-2026-46259)
Vulnerability from cvelistv5
Published
2026-06-03 15:49
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
procfs: fix missing RCU protection when reading real_parent in do_task_stat()
When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent
without proper RCU protection, which leads to:
cpu 0 cpu 1
----- -----
do_task_stat
var = task->real_parent
release_task
call_rcu(delayed_put_task_struct)
task_tgid_nr_ns(var)
rcu_read_lock <--- Too late to protect task->real_parent!
task_pid_ptr <--- UAF!
rcu_read_unlock
This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add
proper RCU protection for accessing task->real_parent.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 06fffb1267c9d986687b69d74a46ee332a50575e Version: 06fffb1267c9d986687b69d74a46ee332a50575e Version: 06fffb1267c9d986687b69d74a46ee332a50575e Version: 06fffb1267c9d986687b69d74a46ee332a50575e Version: 06fffb1267c9d986687b69d74a46ee332a50575e Version: 06fffb1267c9d986687b69d74a46ee332a50575e Version: 06fffb1267c9d986687b69d74a46ee332a50575e Version: 06fffb1267c9d986687b69d74a46ee332a50575e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/proc/array.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fefa0fcd78be465b7ad4c497fa6ec90d64194c04",
"status": "affected",
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
"versionType": "git"
},
{
"lessThan": "c93a33f28f915d446eea6fb3f0e1def0b3af1982",
"status": "affected",
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
"versionType": "git"
},
{
"lessThan": "1c8dc5b5517546c68ffae40b948336122bb61306",
"status": "affected",
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
"versionType": "git"
},
{
"lessThan": "0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e",
"status": "affected",
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
"versionType": "git"
},
{
"lessThan": "73ec7c96601d61d52310c659145bb06d933a0fa6",
"status": "affected",
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
"versionType": "git"
},
{
"lessThan": "4f9ae386861e280b7631ca252f798d25575627ee",
"status": "affected",
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
"versionType": "git"
},
{
"lessThan": "dd8b13cb4ff1a4545a214ed897fdf2bc341155b6",
"status": "affected",
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
"versionType": "git"
},
{
"lessThan": "76149d53502cf17ef3ae454ff384551236fba867",
"status": "affected",
"version": "06fffb1267c9d986687b69d74a46ee332a50575e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/proc/array.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nprocfs: fix missing RCU protection when reading real_parent in do_task_stat()\n\nWhen reading /proc/[pid]/stat, do_task_stat() accesses task-\u003ereal_parent\nwithout proper RCU protection, which leads to:\n\n cpu 0 cpu 1\n ----- -----\n do_task_stat\n var = task-\u003ereal_parent\n release_task\n call_rcu(delayed_put_task_struct)\n task_tgid_nr_ns(var)\n rcu_read_lock \u003c--- Too late to protect task-\u003ereal_parent!\n task_pid_ptr \u003c--- UAF!\n rcu_read_unlock\n\nThis patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add\nproper RCU protection for accessing task-\u003ereal_parent."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local `open()`/`read()` on procfs (`/proc/[pid]/stat` or thread `stat`); there is no network, adjacent-radio, or physical-device path to `do_task_stat()`.\nAC:L - An attacker can reliably race by running concurrent `read()` loops on `/proc/child/stat` while another thread exits and reaps the parent via `wait4()`, controlling both sides of the `release_task()`/`call_rcu()` window.\nPR:L - Triggering the bug needs only an unprivileged local account that can read procfs (default `hidepid=off` allows reading other users\u2019 `stat`); no real root or init-namespace-only capability is required.\nUI:N - Exploitation is fully attacker-driven through syscalls and process lifecycle control; no victim user action (clicks, mounts, etc.) is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain, not a cross-boundary escape such as VM guest-to-host.\nC:H - The UAF dereferences freed `task_struct` memory via `task_pid_ptr()`/`__task_pid_nr_ns()`, enabling disclosure of stale slab contents and kernel pointers that can be groomed into an arbitrary-read primitive.\nI:H - Use-after-free on a `task_struct` slab object can be leveraged with heap grooming for control of freed memory and potential arbitrary write or code execution, not merely a bounded or cosmetic change.\nA:H - Concurrent UAF access to a freed parent `task_struct` can cause kernel oops/panic (KASAN reports slab-use-after-free class failures) even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:48.120Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fefa0fcd78be465b7ad4c497fa6ec90d64194c04"
},
{
"url": "https://git.kernel.org/stable/c/c93a33f28f915d446eea6fb3f0e1def0b3af1982"
},
{
"url": "https://git.kernel.org/stable/c/1c8dc5b5517546c68ffae40b948336122bb61306"
},
{
"url": "https://git.kernel.org/stable/c/0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e"
},
{
"url": "https://git.kernel.org/stable/c/73ec7c96601d61d52310c659145bb06d933a0fa6"
},
{
"url": "https://git.kernel.org/stable/c/4f9ae386861e280b7631ca252f798d25575627ee"
},
{
"url": "https://git.kernel.org/stable/c/dd8b13cb4ff1a4545a214ed897fdf2bc341155b6"
},
{
"url": "https://git.kernel.org/stable/c/76149d53502cf17ef3ae454ff384551236fba867"
}
],
"title": "procfs: fix missing RCU protection when reading real_parent in do_task_stat()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46259",
"datePublished": "2026-06-03T15:49:56.428Z",
"dateReserved": "2026-05-13T15:03:33.108Z",
"dateUpdated": "2026-08-05T12:30:48.120Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53075 (GCVE-0-2026-53075)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
/dev/ppp open is currently authorized against file->f_cred->user_ns,
while unattached administrative ioctls operate on current->nsproxy->net_ns.
As a result, a local unprivileged user can create a new user namespace
with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,
and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against
an inherited network namespace.
Require CAP_NET_ADMIN in the user namespace that owns the target network
namespace before handling unattached PPP administrative ioctls.
This preserves normal pppd operation in the network namespace it is
actually privileged in, while rejecting the userns-only inherited-netns
case.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 273ec51dd7ceaa76e038875d85061ec856d8905e Version: 273ec51dd7ceaa76e038875d85061ec856d8905e Version: 273ec51dd7ceaa76e038875d85061ec856d8905e Version: 273ec51dd7ceaa76e038875d85061ec856d8905e Version: 273ec51dd7ceaa76e038875d85061ec856d8905e Version: 273ec51dd7ceaa76e038875d85061ec856d8905e Version: 273ec51dd7ceaa76e038875d85061ec856d8905e Version: 273ec51dd7ceaa76e038875d85061ec856d8905e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/ppp_generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c9edd90c57ae23692fff6b049fdfa4572a9fd532",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "5080e188c914110034bbc569d5cfa2f06204681d",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "67e901e28d177ac9a9bed76d69ce3471e704a89e",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "954745d0223e7caec917c0b2d1a889ff56fa6e54",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "3b2c2157dc2afc5c17cd7238afefca92f1ef330e",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "5013be175c7ffd8b39efbc3c9c4db5b10b85fea8",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "1a8a51ce85075a56a743b6f142606dd2696a391c",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
},
{
"lessThan": "2bb6379416fd19f44c3423a00bfd8626259f6067",
"status": "affected",
"version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ppp/ppp_generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: require CAP_NET_ADMIN in target netns for unattached ioctls\n\n/dev/ppp open is currently authorized against file-\u003ef_cred-\u003euser_ns,\nwhile unattached administrative ioctls operate on current-\u003ensproxy-\u003enet_ns.\n\nAs a result, a local unprivileged user can create a new user namespace\nwith CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,\nand still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against\nan inherited network namespace.\n\nRequire CAP_NET_ADMIN in the user namespace that owns the target network\nnamespace before handling unattached PPP administrative ioctls.\n\nThis preserves normal pppd operation in the network namespace it is\nactually privileged in, while rejecting the userns-only inherited-netns\ncase."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable PPP administrative ioctls are reached locally through `/dev/ppp` and the `ioctl` syscall, not by remote packets.\nAC:L - An attacker can deterministically create a user namespace, open `/dev/ppp`, and issue the unattached ioctls against the inherited target network namespace; no race or external condition is required.\nPR:L - A basic unprivileged local user can gain `CAP_NET_ADMIN` only inside a new user namespace and abuse the pre-fix check, so this does not require real root or host `CAP_NET_ADMIN`.\nUI:N - No victim action is required after the attacker has local code execution; the attacker directly invokes the namespace and ioctl operations.\nS:C - The bug crosses the user-namespace capability boundary by allowing capabilities in one user namespace to administer PPP resources in a network namespace owned by another user namespace.\nC:H - By attaching to existing PPP units or channels, an attacker can read PPP control/authentication traffic and can plausibly expose sensitive PPP-session data in affected deployments.\nI:H - The attacker can create PPP interfaces, attach to units/channels, alter PPP parameters, and inject or redirect PPP frames in a network namespace they should not administer.\nA:H - The attacker can disrupt PPP connectivity by changing interface/channel state, disconnecting or bridging channels, or exhausting PPP resources, causing loss of network availability in PPP-dependent systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:07.985Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c9edd90c57ae23692fff6b049fdfa4572a9fd532"
},
{
"url": "https://git.kernel.org/stable/c/5080e188c914110034bbc569d5cfa2f06204681d"
},
{
"url": "https://git.kernel.org/stable/c/67e901e28d177ac9a9bed76d69ce3471e704a89e"
},
{
"url": "https://git.kernel.org/stable/c/954745d0223e7caec917c0b2d1a889ff56fa6e54"
},
{
"url": "https://git.kernel.org/stable/c/3b2c2157dc2afc5c17cd7238afefca92f1ef330e"
},
{
"url": "https://git.kernel.org/stable/c/5013be175c7ffd8b39efbc3c9c4db5b10b85fea8"
},
{
"url": "https://git.kernel.org/stable/c/1a8a51ce85075a56a743b6f142606dd2696a391c"
},
{
"url": "https://git.kernel.org/stable/c/2bb6379416fd19f44c3423a00bfd8626259f6067"
}
],
"title": "ppp: require CAP_NET_ADMIN in target netns for unattached ioctls",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53075",
"datePublished": "2026-06-24T16:30:16.214Z",
"dateReserved": "2026-06-09T07:44:35.383Z",
"dateUpdated": "2026-08-05T12:33:07.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43120 (GCVE-0-2026-43120)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Fix double free related to rereg_user_mr
If IB_MR_REREG_TRANS is set during rereg_user_mr, the
umem will be released and a new one will be allocated
in irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans
fails after the new umem is allocated, it releases the umem,
but does not set iwmr->region to NULL. The problem is that
this failure is propagated to the user, who will then call
ibv_dereg_mr (as they should). Then, the dereg_mr path will
see a non-NULL umem and attempt to call ib_umem_release again.
Fix this by setting iwmr->region to NULL after ib_umem_release.
Fixed: 5ac388db27c4 ("RDMA/irdma: Add support to re-register a memory region")
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 715fdb3b30541cc8180b7cdc6aa9f8c307afdf25 Version: 5ac388db27c443dadfbb0b8b23fa7ccf429d901a Version: 5ac388db27c443dadfbb0b8b23fa7ccf429d901a Version: 5ac388db27c443dadfbb0b8b23fa7ccf429d901a Version: 5ac388db27c443dadfbb0b8b23fa7ccf429d901a Version: 6.6.120 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/irdma/verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "62298a48f8b8788ad8b8464e6ffdf1ddebd2217e",
"status": "affected",
"version": "715fdb3b30541cc8180b7cdc6aa9f8c307afdf25",
"versionType": "git"
},
{
"lessThan": "66964118f1f50ed85001c8fc9f7ab5bbdd021ee0",
"status": "affected",
"version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a",
"versionType": "git"
},
{
"lessThan": "0f22c32141acdcda266b26cab2b830baf870f3e0",
"status": "affected",
"version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a",
"versionType": "git"
},
{
"lessThan": "0c5d70bcb9d2275a1c8515a924016fcfeb4ab441",
"status": "affected",
"version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a",
"versionType": "git"
},
{
"lessThan": "29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2",
"status": "affected",
"version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a",
"versionType": "git"
},
{
"lessThan": "6.6.136",
"status": "affected",
"version": "6.6.120",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/irdma/verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "6.6.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix double free related to rereg_user_mr\n\nIf IB_MR_REREG_TRANS is set during rereg_user_mr, the\numem will be released and a new one will be allocated\nin irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans\nfails after the new umem is allocated, it releases the umem,\nbut does not set iwmr-\u003eregion to NULL. The problem is that\nthis failure is propagated to the user, who will then call\nibv_dereg_mr (as they should). Then, the dereg_mr path will\nsee a non-NULL umem and attempt to call ib_umem_release again.\n\nFix this by setting iwmr-\u003eregion to NULL after ib_umem_release.\n\nFixed: 5ac388db27c4 (\"RDMA/irdma: Add support to re-register a memory region\")"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local RDMA uverbs operations on `/dev/infiniband/uverbs*`, specifically MR re-registration and deregistration. Remote RDMA/iWARP traffic does not invoke this userspace verbs callback.\nAC:L - No race or victim state is required; the same local process controls the MR, the `IB_MR_REREG_TRANS` request, and the subsequent deregistration that triggers the second release. Post-allocation failure can be induced through controlled MR parameters or irdma resource exhaustion, and uncertainty is resolved toward the higher severity option.\nPR:L - The attacker needs local access to an RDMA uverbs device and enough normal memlock allowance to register user memory, but the path does not require real root or administrative capabilities. RDMA core checks object ownership/netns access, not a high-privilege capability gate.\nUI:N - After obtaining local access, the attacker can issue the uverbs commands directly. No victim user action is required.\nS:U - The bug corrupts kernel memory within the same host kernel security authority. It is not a guest-to-host escape or other cross-scope boundary bypass.\nC:H - The stale `ib_umem` pointer creates a kernel heap use-after-free/double-free condition, and the second `ib_umem_release()` dereferences freed object fields. Such memory corruption can be leveraged for kernel information disclosure.\nI:H - The double release can corrupt allocator state and operate on attacker-reused `struct ib_umem` contents, providing a plausible path to arbitrary kernel memory corruption or code execution. Kernel UAF/double-free is therefore scored as high integrity impact.\nA:H - The second release of the same umem can crash or panic the kernel through invalid scatter-gather, DMA unmap, page unpin, refcount, or allocator operations. This gives high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:04.967Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/62298a48f8b8788ad8b8464e6ffdf1ddebd2217e"
},
{
"url": "https://git.kernel.org/stable/c/66964118f1f50ed85001c8fc9f7ab5bbdd021ee0"
},
{
"url": "https://git.kernel.org/stable/c/0f22c32141acdcda266b26cab2b830baf870f3e0"
},
{
"url": "https://git.kernel.org/stable/c/0c5d70bcb9d2275a1c8515a924016fcfeb4ab441"
},
{
"url": "https://git.kernel.org/stable/c/29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2"
}
],
"title": "RDMA/irdma: Fix double free related to rereg_user_mr",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43120",
"datePublished": "2026-05-06T07:40:43.923Z",
"dateReserved": "2026-05-01T14:12:55.987Z",
"dateUpdated": "2026-08-05T12:26:04.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53239 (GCVE-0-2026-53239)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
Fix the race by pruning the bin while still holding xfrm_policy_lock,
before dropping it. Use __xfrm_policy_inexact_prune_bin() directly since
the lock is already held. The wrapper xfrm_policy_inexact_prune_bin()
becomes unused and is removed.
Race:
CPU0 (XFRM_MSG_DELPOLICY) CPU1 (XFRM_MSG_NEWSPDINFO)
========================== ==========================
xfrm_policy_bysel_ctx():
spin_lock_bh(xfrm_policy_lock)
bin = xfrm_policy_inexact_lookup()
__xfrm_policy_unlink(pol)
spin_unlock_bh(xfrm_policy_lock)
xfrm_policy_kill(ret)
// wide window, lock not held
xfrm_hash_rebuild():
spin_lock_bh(xfrm_policy_lock)
__xfrm_policy_inexact_flush():
kfree_rcu(bin) // bin freed
spin_unlock_bh(xfrm_policy_lock)
xfrm_policy_inexact_prune_bin(bin)
// UAF: bin is freed
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6be3b0db6db82cf056a72cc18042048edd27f8ee Version: 6be3b0db6db82cf056a72cc18042048edd27f8ee Version: 6be3b0db6db82cf056a72cc18042048edd27f8ee Version: 6be3b0db6db82cf056a72cc18042048edd27f8ee Version: 6be3b0db6db82cf056a72cc18042048edd27f8ee Version: 6be3b0db6db82cf056a72cc18042048edd27f8ee Version: 6be3b0db6db82cf056a72cc18042048edd27f8ee Version: 6be3b0db6db82cf056a72cc18042048edd27f8ee |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8fc536e9f6856230f19c7d13e71af064b6a77b22",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "c4c1ea36d83bf3c4569468ca5b8b614fda1bf821",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "25c8c7fb3b0b9668c7d05e209f58c158d2b020c7",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "42827d03f8009a6a218bacab153e21f39d6a121c",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "88697cf980222d5906a37bf47662dac0732e2a0f",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "b5316e2b8614a87d8736941972441cb47bfd4491",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "ec82ea4eb220164d854f8734ca5a35e23e577b94",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
},
{
"lessThan": "7f2d76c9c03257c0782afef9d95321fa04096f60",
"status": "affected",
"version": "6be3b0db6db82cf056a72cc18042048edd27f8ee",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()\n\nFix the race by pruning the bin while still holding xfrm_policy_lock,\nbefore dropping it. Use __xfrm_policy_inexact_prune_bin() directly since\nthe lock is already held. The wrapper xfrm_policy_inexact_prune_bin()\nbecomes unused and is removed.\n\nRace:\n\n CPU0 (XFRM_MSG_DELPOLICY) CPU1 (XFRM_MSG_NEWSPDINFO)\n ========================== ==========================\n xfrm_policy_bysel_ctx():\n spin_lock_bh(xfrm_policy_lock)\n bin = xfrm_policy_inexact_lookup()\n __xfrm_policy_unlink(pol)\n spin_unlock_bh(xfrm_policy_lock)\n xfrm_policy_kill(ret)\n // wide window, lock not held\n xfrm_hash_rebuild():\n spin_lock_bh(xfrm_policy_lock)\n __xfrm_policy_inexact_flush():\n kfree_rcu(bin) // bin freed\n spin_unlock_bh(xfrm_policy_lock)\n xfrm_policy_inexact_prune_bin(bin)\n // UAF: bin is freed"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through NETLINK_XFRM messages such as XFRM_MSG_DELPOLICY and XFRM_MSG_NEWSPDINFO, which require local netlink access rather than remote packet delivery.\nAC:L - The attacker controls both sides of the race by creating/deleting an inexact XFRM policy while concurrently triggering SPD hash rebuilds, with no required external victim state.\nPR:L - XFRM netlink operations require CAP_NET_ADMIN, but the check is namespace-scoped via netlink_net_capable() and is reachable with CAP_NET_ADMIN in a user-created network namespace on systems allowing user namespaces.\nUI:N - No victim action is required; the attacker can issue the needed netlink messages directly.\nS:U - The vulnerability corrupts kernel networking/XFRM state within the same kernel security authority and does not cross a hypervisor, IOMMU, or separate trust boundary.\nC:H - This is a use-after-free of an XFRM inexact policy bin, and the stale freed object can be dereferenced after attacker-controlled heap reuse, making high confidentiality impact defensible.\nI:H - The stale bin is not only read but also passed into pruning logic that writes list/rhashtable/seqcount state, so exploitation can plausibly yield memory corruption and control-flow or data integrity compromise.\nA:H - The UAF can trigger kernel memory corruption, KASAN splats, oopses, or panics, giving high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:25.656Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8fc536e9f6856230f19c7d13e71af064b6a77b22"
},
{
"url": "https://git.kernel.org/stable/c/c4c1ea36d83bf3c4569468ca5b8b614fda1bf821"
},
{
"url": "https://git.kernel.org/stable/c/25c8c7fb3b0b9668c7d05e209f58c158d2b020c7"
},
{
"url": "https://git.kernel.org/stable/c/42827d03f8009a6a218bacab153e21f39d6a121c"
},
{
"url": "https://git.kernel.org/stable/c/88697cf980222d5906a37bf47662dac0732e2a0f"
},
{
"url": "https://git.kernel.org/stable/c/b5316e2b8614a87d8736941972441cb47bfd4491"
},
{
"url": "https://git.kernel.org/stable/c/ec82ea4eb220164d854f8734ca5a35e23e577b94"
},
{
"url": "https://git.kernel.org/stable/c/7f2d76c9c03257c0782afef9d95321fa04096f60"
}
],
"title": "xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53239",
"datePublished": "2026-06-25T08:39:35.149Z",
"dateReserved": "2026-06-09T07:44:35.393Z",
"dateUpdated": "2026-08-05T12:34:25.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45963 (GCVE-0-2026-45963)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-05-27 12:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: nau8821: Cancel delayed work on component remove
Attempting to unload the driver while a jack detection work is pending
would likely crash the kernel when it is eventually scheduled for
execution:
[ 1984.896308] BUG: unable to handle page fault for address: ffffffffc10c2a20
[...]
[ 1984.896388] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0131 01/30/2024
[ 1984.896396] Workqueue: events nau8821_jdet_work [snd_soc_nau8821]
[ 1984.896414] RIP: 0010:__mutex_lock+0x9f/0x11d0
[...]
[ 1984.896504] Call Trace:
[ 1984.896511] <TASK>
[ 1984.896524] ? snd_soc_dapm_disable_pin+0x26/0x60 [snd_soc_core]
[ 1984.896572] ? snd_soc_dapm_disable_pin+0x26/0x60 [snd_soc_core]
[ 1984.896596] snd_soc_dapm_disable_pin+0x26/0x60 [snd_soc_core]
[ 1984.896622] nau8821_jdet_work+0xeb/0x1e0 [snd_soc_nau8821]
[ 1984.896636] process_one_work+0x211/0x590
[ 1984.896649] ? srso_return_thunk+0x5/0x5f
[ 1984.896670] worker_thread+0x1cd/0x3a0
Cancel unscheduled jdet_work or wait for its execution to finish before
the component driver gets removed.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/codecs/nau8821.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3955767ec39dcc0358470ffe6535703e2b7fd815",
"status": "affected",
"version": "aab1ad11d69fa7f35cb88105614ea7911598e1d6",
"versionType": "git"
},
{
"lessThan": "dbd3fd05cddfdeec1e49b0a66269881c09eebd17",
"status": "affected",
"version": "aab1ad11d69fa7f35cb88105614ea7911598e1d6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/codecs/nau8821.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: nau8821: Cancel delayed work on component remove\n\nAttempting to unload the driver while a jack detection work is pending\nwould likely crash the kernel when it is eventually scheduled for\nexecution:\n\n[ 1984.896308] BUG: unable to handle page fault for address: ffffffffc10c2a20\n[...]\n[ 1984.896388] Hardware name: Valve Jupiter/Jupiter, BIOS F7A0131 01/30/2024\n[ 1984.896396] Workqueue: events nau8821_jdet_work [snd_soc_nau8821]\n[ 1984.896414] RIP: 0010:__mutex_lock+0x9f/0x11d0\n[...]\n[ 1984.896504] Call Trace:\n[ 1984.896511] \u003cTASK\u003e\n[ 1984.896524] ? snd_soc_dapm_disable_pin+0x26/0x60 [snd_soc_core]\n[ 1984.896572] ? snd_soc_dapm_disable_pin+0x26/0x60 [snd_soc_core]\n[ 1984.896596] snd_soc_dapm_disable_pin+0x26/0x60 [snd_soc_core]\n[ 1984.896622] nau8821_jdet_work+0xeb/0x1e0 [snd_soc_nau8821]\n[ 1984.896636] process_one_work+0x211/0x590\n[ 1984.896649] ? srso_return_thunk+0x5/0x5f\n[ 1984.896670] worker_thread+0x1cd/0x3a0\n\nCancel unscheduled jdet_work or wait for its execution to finish before\nthe component driver gets removed."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:18:21.228Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3955767ec39dcc0358470ffe6535703e2b7fd815"
},
{
"url": "https://git.kernel.org/stable/c/dbd3fd05cddfdeec1e49b0a66269881c09eebd17"
}
],
"title": "ASoC: nau8821: Cancel delayed work on component remove",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45963",
"datePublished": "2026-05-27T12:18:21.228Z",
"dateReserved": "2026-05-13T15:03:33.089Z",
"dateUpdated": "2026-05-27T12:18:21.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46199 (GCVE-0-2026-46199)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
Check bounds against the end of the BO whenever we access the msg.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 87cc7f9ebf7ce10f82250002d667ef3e93a79d44 Version: 87cc7f9ebf7ce10f82250002d667ef3e93a79d44 Version: 87cc7f9ebf7ce10f82250002d667ef3e93a79d44 Version: 87cc7f9ebf7ce10f82250002d667ef3e93a79d44 Version: 87cc7f9ebf7ce10f82250002d667ef3e93a79d44 Version: 87cc7f9ebf7ce10f82250002d667ef3e93a79d44 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "88411caee8f576d6b5abf6531232fcc0ce756dc5",
"status": "affected",
"version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
"versionType": "git"
},
{
"lessThan": "c72a8b4dc6d598e3831ef3abd9c6527dfbf4810e",
"status": "affected",
"version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
"versionType": "git"
},
{
"lessThan": "7688143ca62edeecacb3ba0a2cea129dbd262a18",
"status": "affected",
"version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
"versionType": "git"
},
{
"lessThan": "63b51e8a9d54317d31cc3856c1e12407070d5fc2",
"status": "affected",
"version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
"versionType": "git"
},
{
"lessThan": "3c817a60b09eaab926e475088e750936efcc95ae",
"status": "affected",
"version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
"versionType": "git"
},
{
"lessThan": "0a78f2bac1424deb7c9d5e09c6b8e849d8e8b648",
"status": "affected",
"version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg\n\nCheck bounds against the end of the BO whenever we access the msg."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through the local DRM command-submission ioctl (DRM_IOCTL_AMDGPU_CS) on /dev/dri/renderD*; there is no network path to the GPU CS parser.\nAC:L - The attacker fully controls the decode-message contents (num_buffers, offset, size) and the BO size, so the out-of-bounds read is triggered deterministically with no race or uncontrolled condition.\nPR:L - The CS ioctl is DRM_RENDER_ALLOW, accessible to any unprivileged local user holding an fd to the render node; no root or special capability is required.\nUI:N - The attacker directly submits the crafted command buffer; no action by another user is needed.\nS:U - The OOB read is performed by the CPU within the kernel\u0027s own kmap of the BO; the impact stays within the kernel security authority with no IOMMU/VM boundary crossed.\nC:H - num_buffers and offset are attacker-controlled 32-bit values, producing an unbounded out-of-bounds read of kernel memory well beyond a few bytes, which per guidance is High.\nI:N - The flaw is purely an out-of-bounds read; no kernel memory is written or otherwise modified along the path.\nA:H - The unbounded OOB read into unmapped kernel memory triggers a page fault/oops, crashing the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:24.038Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/88411caee8f576d6b5abf6531232fcc0ce756dc5"
},
{
"url": "https://git.kernel.org/stable/c/c72a8b4dc6d598e3831ef3abd9c6527dfbf4810e"
},
{
"url": "https://git.kernel.org/stable/c/7688143ca62edeecacb3ba0a2cea129dbd262a18"
},
{
"url": "https://git.kernel.org/stable/c/63b51e8a9d54317d31cc3856c1e12407070d5fc2"
},
{
"url": "https://git.kernel.org/stable/c/3c817a60b09eaab926e475088e750936efcc95ae"
},
{
"url": "https://git.kernel.org/stable/c/0a78f2bac1424deb7c9d5e09c6b8e849d8e8b648"
}
],
"title": "drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46199",
"datePublished": "2026-05-28T09:40:16.061Z",
"dateReserved": "2026-05-13T15:03:33.104Z",
"dateUpdated": "2026-08-05T12:30:24.038Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46086 (GCVE-0-2026-46086)
Vulnerability from cvelistv5
Published
2026-05-27 12:58
Modified
2026-06-19 11:59
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: bridge: use a stable FDB dst snapshot in RCU readers
Local FDB entries can be rewritten in place by `fdb_delete_local()`, which
updates `f->dst` to another port or to `NULL` while keeping the entry
alive. Several bridge RCU readers inspect `f->dst`, including
`br_fdb_fillbuf()` through the `brforward_read()` sysfs path.
These readers currently load `f->dst` multiple times and can therefore
observe inconsistent values across the check and later dereference.
In `br_fdb_fillbuf()`, this means a concurrent local-FDB update can change
`f->dst` after the NULL check and before the `port_no` dereference,
leading to a NULL-ptr-deref.
Fix this by taking a single `READ_ONCE()` snapshot of `f->dst` in each
affected RCU reader and using that snapshot for the rest of the access
sequence. Also publish the in-place `f->dst` updates in `fdb_delete_local()`
with `WRITE_ONCE()` so the readers and writer use matching access patterns.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 960b589f86c74ce582922fcb996103271081f4de Version: 960b589f86c74ce582922fcb996103271081f4de Version: 960b589f86c74ce582922fcb996103271081f4de Version: 960b589f86c74ce582922fcb996103271081f4de Version: 960b589f86c74ce582922fcb996103271081f4de Version: 960b589f86c74ce582922fcb996103271081f4de Version: 960b589f86c74ce582922fcb996103271081f4de Version: 960b589f86c74ce582922fcb996103271081f4de |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/br_arp_nd_proxy.c",
"net/bridge/br_fdb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c502fa9f094cb03d1d1685c71e2105ab359bc2b8",
"status": "affected",
"version": "960b589f86c74ce582922fcb996103271081f4de",
"versionType": "git"
},
{
"lessThan": "a6ae4511c07b91f597e461406c6330f0d4ff810e",
"status": "affected",
"version": "960b589f86c74ce582922fcb996103271081f4de",
"versionType": "git"
},
{
"lessThan": "1406c4e0ed1eaf8a29801ab1163d00fb7ee4359a",
"status": "affected",
"version": "960b589f86c74ce582922fcb996103271081f4de",
"versionType": "git"
},
{
"lessThan": "0b9e4bbfb7c949151e3acd44ed4aa33614d2e110",
"status": "affected",
"version": "960b589f86c74ce582922fcb996103271081f4de",
"versionType": "git"
},
{
"lessThan": "81af4137a30c4c2dc694dea8cacb180bd66000ef",
"status": "affected",
"version": "960b589f86c74ce582922fcb996103271081f4de",
"versionType": "git"
},
{
"lessThan": "5424e678f9b304e148cf5dcc047cffc7a56a3bb5",
"status": "affected",
"version": "960b589f86c74ce582922fcb996103271081f4de",
"versionType": "git"
},
{
"lessThan": "9a2d9d4e657b23dc21f24cf139e3aeff0b61341f",
"status": "affected",
"version": "960b589f86c74ce582922fcb996103271081f4de",
"versionType": "git"
},
{
"lessThan": "df4601653201de21b487c3e7fffd464790cab808",
"status": "affected",
"version": "960b589f86c74ce582922fcb996103271081f4de",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/br_arp_nd_proxy.c",
"net/bridge/br_fdb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.14"
},
{
"lessThan": "3.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bridge: use a stable FDB dst snapshot in RCU readers\n\nLocal FDB entries can be rewritten in place by `fdb_delete_local()`, which\nupdates `f-\u003edst` to another port or to `NULL` while keeping the entry\nalive. Several bridge RCU readers inspect `f-\u003edst`, including\n`br_fdb_fillbuf()` through the `brforward_read()` sysfs path.\n\nThese readers currently load `f-\u003edst` multiple times and can therefore\nobserve inconsistent values across the check and later dereference.\nIn `br_fdb_fillbuf()`, this means a concurrent local-FDB update can change\n`f-\u003edst` after the NULL check and before the `port_no` dereference,\nleading to a NULL-ptr-deref.\n\nFix this by taking a single `READ_ONCE()` snapshot of `f-\u003edst` in each\naffected RCU reader and using that snapshot for the rest of the access\nsequence. Also publish the in-place `f-\u003edst` updates in `fdb_delete_local()`\nwith `WRITE_ONCE()` so the readers and writer use matching access patterns."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-19T11:59:23.674Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c502fa9f094cb03d1d1685c71e2105ab359bc2b8"
},
{
"url": "https://git.kernel.org/stable/c/a6ae4511c07b91f597e461406c6330f0d4ff810e"
},
{
"url": "https://git.kernel.org/stable/c/1406c4e0ed1eaf8a29801ab1163d00fb7ee4359a"
},
{
"url": "https://git.kernel.org/stable/c/0b9e4bbfb7c949151e3acd44ed4aa33614d2e110"
},
{
"url": "https://git.kernel.org/stable/c/81af4137a30c4c2dc694dea8cacb180bd66000ef"
},
{
"url": "https://git.kernel.org/stable/c/5424e678f9b304e148cf5dcc047cffc7a56a3bb5"
},
{
"url": "https://git.kernel.org/stable/c/9a2d9d4e657b23dc21f24cf139e3aeff0b61341f"
},
{
"url": "https://git.kernel.org/stable/c/df4601653201de21b487c3e7fffd464790cab808"
}
],
"title": "net: bridge: use a stable FDB dst snapshot in RCU readers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46086",
"datePublished": "2026-05-27T12:58:28.137Z",
"dateReserved": "2026-05-13T15:03:33.096Z",
"dateUpdated": "2026-06-19T11:59:23.674Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43468 (GCVE-0-2026-43468)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-11 22:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix deadlock between devlink lock and esw->wq
esw->work_queue executes esw_functions_changed_event_handler ->
esw_vfs_changed_event_handler and acquires the devlink lock.
.eswitch_mode_set (acquires devlink lock in devlink_nl_pre_doit) ->
mlx5_devlink_eswitch_mode_set -> mlx5_eswitch_disable_locked ->
mlx5_eswitch_event_handler_unregister -> flush_workqueue deadlocks
when esw_vfs_changed_event_handler executes.
Fix that by no longer flushing the work to avoid the deadlock, and using
a generation counter to keep track of work relevance. This avoids an old
handler manipulating an esw that has undergone one or more mode changes:
- the counter is incremented in mlx5_eswitch_event_handler_unregister.
- the counter is read and passed to the ephemeral mlx5_host_work struct.
- the work handler takes the devlink lock and bails out if the current
generation is different than the one it was scheduled to operate on.
- mlx5_eswitch_cleanup does the final draining before destroying the wq.
No longer flushing the workqueue has the side effect of maybe no longer
cancelling pending vport_change_handler work items, but that's ok since
those are disabled elsewhere:
- mlx5_eswitch_disable_locked disables the vport eq notifier.
- mlx5_esw_vport_disable disarms the HW EQ notification and marks
vport->enabled under state_lock to false to prevent pending vport
handler from doing anything.
- mlx5_eswitch_cleanup destroys the workqueue and makes sure all events
are disabled/finished.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f1bc646c9a06f09aad5d8bacb87103b5573ee45e Version: f1bc646c9a06f09aad5d8bacb87103b5573ee45e Version: f1bc646c9a06f09aad5d8bacb87103b5573ee45e Version: f1bc646c9a06f09aad5d8bacb87103b5573ee45e Version: f1bc646c9a06f09aad5d8bacb87103b5573ee45e Version: f1bc646c9a06f09aad5d8bacb87103b5573ee45e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/eswitch.c",
"drivers/net/ethernet/mellanox/mlx5/core/eswitch.h",
"drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0de867f6e34eae6907b367fd152c55e61cb98608",
"status": "affected",
"version": "f1bc646c9a06f09aad5d8bacb87103b5573ee45e",
"versionType": "git"
},
{
"lessThan": "957d2a58f7f8ebcbdd0a85935e0d2675134b890d",
"status": "affected",
"version": "f1bc646c9a06f09aad5d8bacb87103b5573ee45e",
"versionType": "git"
},
{
"lessThan": "3c7313cb41b1b427078440364d2f042c276a1c0b",
"status": "affected",
"version": "f1bc646c9a06f09aad5d8bacb87103b5573ee45e",
"versionType": "git"
},
{
"lessThan": "4a7838bebc38374f74baaf88bf2cf8d439a92923",
"status": "affected",
"version": "f1bc646c9a06f09aad5d8bacb87103b5573ee45e",
"versionType": "git"
},
{
"lessThan": "90e7e5d14d0bd25ffd019a3aa39d9f1c05fedbe1",
"status": "affected",
"version": "f1bc646c9a06f09aad5d8bacb87103b5573ee45e",
"versionType": "git"
},
{
"lessThan": "aed763abf0e905b4b8d747d1ba9e172961572f57",
"status": "affected",
"version": "f1bc646c9a06f09aad5d8bacb87103b5573ee45e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/eswitch.c",
"drivers/net/ethernet/mellanox/mlx5/core/eswitch.h",
"drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix deadlock between devlink lock and esw-\u003ewq\n\nesw-\u003ework_queue executes esw_functions_changed_event_handler -\u003e\nesw_vfs_changed_event_handler and acquires the devlink lock.\n\n.eswitch_mode_set (acquires devlink lock in devlink_nl_pre_doit) -\u003e\nmlx5_devlink_eswitch_mode_set -\u003e mlx5_eswitch_disable_locked -\u003e\nmlx5_eswitch_event_handler_unregister -\u003e flush_workqueue deadlocks\nwhen esw_vfs_changed_event_handler executes.\n\nFix that by no longer flushing the work to avoid the deadlock, and using\na generation counter to keep track of work relevance. This avoids an old\nhandler manipulating an esw that has undergone one or more mode changes:\n- the counter is incremented in mlx5_eswitch_event_handler_unregister.\n- the counter is read and passed to the ephemeral mlx5_host_work struct.\n- the work handler takes the devlink lock and bails out if the current\n generation is different than the one it was scheduled to operate on.\n- mlx5_eswitch_cleanup does the final draining before destroying the wq.\n\nNo longer flushing the workqueue has the side effect of maybe no longer\ncancelling pending vport_change_handler work items, but that\u0027s ok since\nthose are disabled elsewhere:\n- mlx5_eswitch_disable_locked disables the vport eq notifier.\n- mlx5_esw_vport_disable disarms the HW EQ notification and marks\n vport-\u003eenabled under state_lock to false to prevent pending vport\n handler from doing anything.\n- mlx5_eswitch_cleanup destroys the workqueue and makes sure all events\n are disabled/finished."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:25:11.471Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0de867f6e34eae6907b367fd152c55e61cb98608"
},
{
"url": "https://git.kernel.org/stable/c/957d2a58f7f8ebcbdd0a85935e0d2675134b890d"
},
{
"url": "https://git.kernel.org/stable/c/3c7313cb41b1b427078440364d2f042c276a1c0b"
},
{
"url": "https://git.kernel.org/stable/c/4a7838bebc38374f74baaf88bf2cf8d439a92923"
},
{
"url": "https://git.kernel.org/stable/c/90e7e5d14d0bd25ffd019a3aa39d9f1c05fedbe1"
},
{
"url": "https://git.kernel.org/stable/c/aed763abf0e905b4b8d747d1ba9e172961572f57"
}
],
"title": "net/mlx5: Fix deadlock between devlink lock and esw-\u003ewq",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43468",
"datePublished": "2026-05-08T14:22:28.889Z",
"dateReserved": "2026-05-01T14:12:56.011Z",
"dateUpdated": "2026-05-11T22:25:11.471Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46197 (GCVE-0-2026-46197)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: validate SVM ioctl nattr against buffer size
Validate nattr field against the buffer size, preventing
out-of-bounds buffer access via user-controlled attribute count.
(cherry picked from commit 5eca8bfdfa456c3304ca77523718fe24254c172f)
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 42de677f79999791bee4e21be318c32d90ab62c6 Version: 42de677f79999791bee4e21be318c32d90ab62c6 Version: 42de677f79999791bee4e21be318c32d90ab62c6 Version: 42de677f79999791bee4e21be318c32d90ab62c6 Version: 42de677f79999791bee4e21be318c32d90ab62c6 Version: 42de677f79999791bee4e21be318c32d90ab62c6 Version: 42de677f79999791bee4e21be318c32d90ab62c6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_chardev.c",
"drivers/gpu/drm/amd/amdkfd/kfd_priv.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "daa8bc5f83814b55b71d2b5b3a090d57a5219c21",
"status": "affected",
"version": "42de677f79999791bee4e21be318c32d90ab62c6",
"versionType": "git"
},
{
"lessThan": "fb07a0c9c8419164812e07274947f11b1d92dd61",
"status": "affected",
"version": "42de677f79999791bee4e21be318c32d90ab62c6",
"versionType": "git"
},
{
"lessThan": "91c6dc5a41695d02dfc6299f106ac38a6c493e52",
"status": "affected",
"version": "42de677f79999791bee4e21be318c32d90ab62c6",
"versionType": "git"
},
{
"lessThan": "ccd060b5c7cc75ae7e211c250b97c5b6272e7efc",
"status": "affected",
"version": "42de677f79999791bee4e21be318c32d90ab62c6",
"versionType": "git"
},
{
"lessThan": "db9530a9873a7c85d2266a922589ebcf427fa631",
"status": "affected",
"version": "42de677f79999791bee4e21be318c32d90ab62c6",
"versionType": "git"
},
{
"lessThan": "6abd3a4417cb73a7d0db7e25bf11fae1074bdba3",
"status": "affected",
"version": "42de677f79999791bee4e21be318c32d90ab62c6",
"versionType": "git"
},
{
"lessThan": "045e0ff208f0838a246c10204105126611b267a1",
"status": "affected",
"version": "42de677f79999791bee4e21be318c32d90ab62c6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_chardev.c",
"drivers/gpu/drm/amd/amdkfd/kfd_priv.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: validate SVM ioctl nattr against buffer size\n\nValidate nattr field against the buffer size, preventing\nout-of-bounds buffer access via user-controlled attribute count.\n\n(cherry picked from commit 5eca8bfdfa456c3304ca77523718fe24254c172f)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached through an ioctl (AMDKFD_IOC_SVM) on the /dev/kfd character device, requiring local system access; there is no network or adjacent vector.\nAC:L - The attacker fully controls both the buffer size (usize via _IOC_SIZE) and the nattr count, so the out-of-bounds access is triggered reliably with no conditions outside the attacker\u0027s control.\nPR:L - The SVM ioctl descriptor has flags=0 with no capability check, so only the ability to open /dev/kfd (a basic local user, e.g. render-group membership on compute systems) is required \u2014 no real root.\nUI:N - The attacker issues the ioctl directly; no action by another user or victim is needed.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no IOMMU/DMA or VM boundary crossing.\nC:H - The unbounded nattr loop reads kernel heap/stack memory far past the buffer (an unbounded OOB read), and the resulting memory corruption can be leveraged for information disclosure.\nI:H - The svm_range_get_attr fill-values loop writes attrs[i].value/type out of bounds into adjacent kernel memory, an OOB write that can be leveraged for control-flow corruption or arbitrary write.\nA:H - A large nattr reliably drives the attribute loops past the allocation into unmapped memory, causing a kernel oops/panic (denial of service)."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:21.898Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/daa8bc5f83814b55b71d2b5b3a090d57a5219c21"
},
{
"url": "https://git.kernel.org/stable/c/fb07a0c9c8419164812e07274947f11b1d92dd61"
},
{
"url": "https://git.kernel.org/stable/c/91c6dc5a41695d02dfc6299f106ac38a6c493e52"
},
{
"url": "https://git.kernel.org/stable/c/ccd060b5c7cc75ae7e211c250b97c5b6272e7efc"
},
{
"url": "https://git.kernel.org/stable/c/db9530a9873a7c85d2266a922589ebcf427fa631"
},
{
"url": "https://git.kernel.org/stable/c/6abd3a4417cb73a7d0db7e25bf11fae1074bdba3"
},
{
"url": "https://git.kernel.org/stable/c/045e0ff208f0838a246c10204105126611b267a1"
}
],
"title": "drm/amdkfd: validate SVM ioctl nattr against buffer size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46197",
"datePublished": "2026-05-28T09:40:13.722Z",
"dateReserved": "2026-05-13T15:03:33.104Z",
"dateUpdated": "2026-08-05T12:30:21.898Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46254 (GCVE-0-2026-46254)
Vulnerability from cvelistv5
Published
2026-06-03 15:49
Modified
2026-06-03 15:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
AppArmor: Allow apparmor to handle unaligned dfa tables
The dfa tables can originate from kernel or userspace and 8-byte alignment
isn't always guaranteed and as such may trigger unaligned memory accesses
on various architectures. Resulting in the following
[ 73.901376] WARNING: CPU: 0 PID: 341 at security/apparmor/match.c:316 aa_dfa_unpack+0x6cc/0x720
[ 74.015867] Modules linked in: binfmt_misc evdev flash sg drm drm_panel_orientation_quirks backlight i2c_core configfs nfnetlink autofs4 ext4 crc16 mbcache jbd2 hid_generic usbhid sr_mod hid cdrom
sd_mod ata_generic ohci_pci ehci_pci ehci_hcd ohci_hcd pata_ali libata sym53c8xx scsi_transport_spi tg3 scsi_mod usbcore libphy scsi_common mdio_bus usb_common
[ 74.428977] CPU: 0 UID: 0 PID: 341 Comm: apparmor_parser Not tainted 6.18.0-rc6+ #9 NONE
[ 74.536543] Call Trace:
[ 74.568561] [<0000000000434c24>] dump_stack+0x8/0x18
[ 74.633757] [<0000000000476438>] __warn+0xd8/0x100
[ 74.696664] [<00000000004296d4>] warn_slowpath_fmt+0x34/0x74
[ 74.771006] [<00000000008db28c>] aa_dfa_unpack+0x6cc/0x720
[ 74.843062] [<00000000008e643c>] unpack_pdb+0xbc/0x7e0
[ 74.910545] [<00000000008e7740>] unpack_profile+0xbe0/0x1300
[ 74.984888] [<00000000008e82e0>] aa_unpack+0xe0/0x6a0
[ 75.051226] [<00000000008e3ec4>] aa_replace_profiles+0x64/0x1160
[ 75.130144] [<00000000008d4d90>] policy_update+0xf0/0x280
[ 75.201057] [<00000000008d4fc8>] profile_replace+0xa8/0x100
[ 75.274258] [<0000000000766bd0>] vfs_write+0x90/0x420
[ 75.340594] [<00000000007670cc>] ksys_write+0x4c/0xe0
[ 75.406932] [<0000000000767174>] sys_write+0x14/0x40
[ 75.472126] [<0000000000406174>] linux_sparc_syscall+0x34/0x44
[ 75.548802] ---[ end trace 0000000000000000 ]---
[ 75.609503] dfa blob stream 0xfff0000008926b96 not aligned.
[ 75.682695] Kernel unaligned access at TPC[8db2a8] aa_dfa_unpack+0x6e8/0x720
Work around it by using the get_unaligned_xx() helpers.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/apparmor/match.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ec737e7fdf2f0ba7b203d4ec72cc915978b10e7e",
"status": "affected",
"version": "e6e8bf418850d7958311a96ccfb594f2bcc8313e",
"versionType": "git"
},
{
"lessThan": "23f112bd6144e815153462e12d313ac3e7027168",
"status": "affected",
"version": "e6e8bf418850d7958311a96ccfb594f2bcc8313e",
"versionType": "git"
},
{
"lessThan": "cded636008bde2b397a7cf63b8299d7c303aaf6a",
"status": "affected",
"version": "e6e8bf418850d7958311a96ccfb594f2bcc8313e",
"versionType": "git"
},
{
"lessThan": "64802f731214a51dfe3c6c27636b3ddafd003eb0",
"status": "affected",
"version": "e6e8bf418850d7958311a96ccfb594f2bcc8313e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/apparmor/match.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nAppArmor: Allow apparmor to handle unaligned dfa tables\n\nThe dfa tables can originate from kernel or userspace and 8-byte alignment\nisn\u0027t always guaranteed and as such may trigger unaligned memory accesses\non various architectures. Resulting in the following\n\n[\u00a0\u00a0 73.901376] WARNING: CPU: 0 PID: 341 at security/apparmor/match.c:316 aa_dfa_unpack+0x6cc/0x720\n[\u00a0\u00a0 74.015867] Modules linked in: binfmt_misc evdev flash sg drm drm_panel_orientation_quirks backlight i2c_core configfs nfnetlink autofs4 ext4 crc16 mbcache jbd2 hid_generic usbhid sr_mod hid cdrom\nsd_mod ata_generic ohci_pci ehci_pci ehci_hcd ohci_hcd pata_ali libata sym53c8xx scsi_transport_spi tg3 scsi_mod usbcore libphy scsi_common mdio_bus usb_common\n[\u00a0\u00a0 74.428977] CPU: 0 UID: 0 PID: 341 Comm: apparmor_parser Not tainted 6.18.0-rc6+ #9 NONE\n[\u00a0\u00a0 74.536543] Call Trace:\n[\u00a0\u00a0 74.568561] [\u003c0000000000434c24\u003e] dump_stack+0x8/0x18\n[\u00a0\u00a0 74.633757] [\u003c0000000000476438\u003e] __warn+0xd8/0x100\n[\u00a0\u00a0 74.696664] [\u003c00000000004296d4\u003e] warn_slowpath_fmt+0x34/0x74\n[\u00a0\u00a0 74.771006] [\u003c00000000008db28c\u003e] aa_dfa_unpack+0x6cc/0x720\n[\u00a0\u00a0 74.843062] [\u003c00000000008e643c\u003e] unpack_pdb+0xbc/0x7e0\n[\u00a0\u00a0 74.910545] [\u003c00000000008e7740\u003e] unpack_profile+0xbe0/0x1300\n[\u00a0\u00a0 74.984888] [\u003c00000000008e82e0\u003e] aa_unpack+0xe0/0x6a0\n[\u00a0\u00a0 75.051226] [\u003c00000000008e3ec4\u003e] aa_replace_profiles+0x64/0x1160\n[\u00a0\u00a0 75.130144] [\u003c00000000008d4d90\u003e] policy_update+0xf0/0x280\n[\u00a0\u00a0 75.201057] [\u003c00000000008d4fc8\u003e] profile_replace+0xa8/0x100\n[\u00a0\u00a0 75.274258] [\u003c0000000000766bd0\u003e] vfs_write+0x90/0x420\n[\u00a0\u00a0 75.340594] [\u003c00000000007670cc\u003e] ksys_write+0x4c/0xe0\n[\u00a0\u00a0 75.406932] [\u003c0000000000767174\u003e] sys_write+0x14/0x40\n[\u00a0\u00a0 75.472126] [\u003c0000000000406174\u003e] linux_sparc_syscall+0x34/0x44\n[\u00a0\u00a0 75.548802] ---[ end trace 0000000000000000 ]---\n[\u00a0\u00a0 75.609503] dfa blob stream 0xfff0000008926b96 not aligned.\n[\u00a0\u00a0 75.682695] Kernel unaligned access at TPC[8db2a8] aa_dfa_unpack+0x6e8/0x720\n\nWork around it by using the get_unaligned_xx() helpers."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T15:49:50.994Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ec737e7fdf2f0ba7b203d4ec72cc915978b10e7e"
},
{
"url": "https://git.kernel.org/stable/c/23f112bd6144e815153462e12d313ac3e7027168"
},
{
"url": "https://git.kernel.org/stable/c/cded636008bde2b397a7cf63b8299d7c303aaf6a"
},
{
"url": "https://git.kernel.org/stable/c/64802f731214a51dfe3c6c27636b3ddafd003eb0"
}
],
"title": "AppArmor: Allow apparmor to handle unaligned dfa tables",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46254",
"datePublished": "2026-06-03T15:49:50.994Z",
"dateReserved": "2026-05-13T15:03:33.107Z",
"dateUpdated": "2026-06-03T15:49:50.994Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53013 (GCVE-0-2026-53013)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF
macvlan_get_size() does not account for IFLA_MACVLAN_BC_CUTOFF, but
macvlan_fill_info() conditionally includes it when port->bc_cutoff != 1.
This causes nla_put_s32() to fail with -EMSGSIZE when the netlink skb
runs out of space, triggering a WARN_ON in rtnetlink and preventing the
interface from being dumped.
The bug can be reproduced with:
ip link add macvlan0 link eth0 type macvlan mode bridge
ip link set macvlan0 type macvlan bc_cutoff 0
ip -d link show macvlan0 # fails with -EMSGSIZE
The bc_cutoff feature was added in commit 954d1fa1ac93 ("macvlan: Add
netlink attribute for broadcast cutoff"), which added the nla_put_s32()
call in macvlan_fill_info() but missed adding the corresponding
nla_total_size(4) in macvlan_get_size(). A follow-up commit
55cef78c244d ("macvlan: add forgotten nla_policy for
IFLA_MACVLAN_BC_CUTOFF") fixed the missing nla_policy entry but still
did not fix the size calculation.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/macvlan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4979252758387b338ca968ba7e0515b0ae2257e3",
"status": "affected",
"version": "954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348",
"versionType": "git"
},
{
"lessThan": "77ecfa4e27f282d224215895ddfbeb916fc75e24",
"status": "affected",
"version": "954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348",
"versionType": "git"
},
{
"lessThan": "b6b7154e9f5d75b608ceb2d05b376de8c638c40e",
"status": "affected",
"version": "954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348",
"versionType": "git"
},
{
"lessThan": "1c004f14ccdc11585625c168bb9a7c5e1b8afb0c",
"status": "affected",
"version": "954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348",
"versionType": "git"
},
{
"lessThan": "fa92a77b0ed4d5f11a71665a232ac5a54a4b055d",
"status": "affected",
"version": "954d1fa1ac93aa8a66f7d9a9ba545cf7f020d348",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/macvlan.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF\n\nmacvlan_get_size() does not account for IFLA_MACVLAN_BC_CUTOFF, but\nmacvlan_fill_info() conditionally includes it when port-\u003ebc_cutoff != 1.\nThis causes nla_put_s32() to fail with -EMSGSIZE when the netlink skb\nruns out of space, triggering a WARN_ON in rtnetlink and preventing the\ninterface from being dumped.\n\nThe bug can be reproduced with:\n\n ip link add macvlan0 link eth0 type macvlan mode bridge\n ip link set macvlan0 type macvlan bc_cutoff 0\n ip -d link show macvlan0 # fails with -EMSGSIZE\n\nThe bc_cutoff feature was added in commit 954d1fa1ac93 (\"macvlan: Add\nnetlink attribute for broadcast cutoff\"), which added the nla_put_s32()\ncall in macvlan_fill_info() but missed adding the corresponding\nnla_total_size(4) in macvlan_get_size(). A follow-up commit\n55cef78c244d (\"macvlan: add forgotten nla_policy for\nIFLA_MACVLAN_BC_CUTOFF\") fixed the missing nla_policy entry but still\ndid not fix the size calculation."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:23.856Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4979252758387b338ca968ba7e0515b0ae2257e3"
},
{
"url": "https://git.kernel.org/stable/c/77ecfa4e27f282d224215895ddfbeb916fc75e24"
},
{
"url": "https://git.kernel.org/stable/c/b6b7154e9f5d75b608ceb2d05b376de8c638c40e"
},
{
"url": "https://git.kernel.org/stable/c/1c004f14ccdc11585625c168bb9a7c5e1b8afb0c"
},
{
"url": "https://git.kernel.org/stable/c/fa92a77b0ed4d5f11a71665a232ac5a54a4b055d"
}
],
"title": "macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53013",
"datePublished": "2026-06-24T16:29:23.856Z",
"dateReserved": "2026-06-09T07:44:35.378Z",
"dateUpdated": "2026-06-24T16:29:23.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31533 (GCVE-0-2026-31533)
Vulnerability from cvelistv5
Published
2026-04-23 15:11
Modified
2026-08-05 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
The -EBUSY handling in tls_do_encryption(), introduced by commit
859054147318 ("net: tls: handle backlogging of crypto requests"), has
a use-after-free due to double cleanup of encrypt_pending and the
scatterlist entry.
When crypto_aead_encrypt() returns -EBUSY, the request is enqueued to
the cryptd backlog and the async callback tls_encrypt_done() will be
invoked upon completion. That callback unconditionally restores the
scatterlist entry (sge->offset, sge->length) and decrements
ctx->encrypt_pending. However, if tls_encrypt_async_wait() returns an
error, the synchronous error path in tls_do_encryption() performs the
same cleanup again, double-decrementing encrypt_pending and
double-restoring the scatterlist.
The double-decrement corrupts the encrypt_pending sentinel (initialized
to 1), making tls_encrypt_async_wait() permanently skip the wait for
pending async callbacks. A subsequent sendmsg can then free the
tls_rec via bpf_exec_tx_verdict() while a cryptd callback is still
pending, resulting in a use-after-free when the callback fires on the
freed record.
Fix this by skipping the synchronous cleanup when the -EBUSY async
wait returns an error, since the callback has already handled
encrypt_pending and sge restoration.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3ade391adc584f17b5570fd205de3ad029090368 Version: cd1bbca03f3c1d845ce274c0d0a66de8e5929f72 Version: 13eca403876bbea3716e82cdfe6f1e6febb38754 Version: 8590541473188741055d27b955db0777569438e3 Version: 8590541473188741055d27b955db0777569438e3 Version: 8590541473188741055d27b955db0777569438e3 Version: 8590541473188741055d27b955db0777569438e3 Version: ab6397f072e5097f267abf5cb08a8004e6b17694 Version: 5.15.160 ≤ Version: 6.1.84 ≤ Version: 6.6.18 ≤ Version: 6.7.6 ≤ |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:17.645Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tls/tls_sw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "414fc5e5a5aff776c150f1b86770e0a25a35df3a",
"status": "affected",
"version": "3ade391adc584f17b5570fd205de3ad029090368",
"versionType": "git"
},
{
"lessThan": "02f3ecadb23558bbe068e6504118f1b712d4ece0",
"status": "affected",
"version": "cd1bbca03f3c1d845ce274c0d0a66de8e5929f72",
"versionType": "git"
},
{
"lessThan": "0e43e0a3c94044acc74b8e0927c27972eb5a59e8",
"status": "affected",
"version": "13eca403876bbea3716e82cdfe6f1e6febb38754",
"versionType": "git"
},
{
"lessThan": "aa9facde6c5005205874c37db3fd25799d741baf",
"status": "affected",
"version": "8590541473188741055d27b955db0777569438e3",
"versionType": "git"
},
{
"lessThan": "5d70eb25b41e9b010828cd12818b06a0c3b04412",
"status": "affected",
"version": "8590541473188741055d27b955db0777569438e3",
"versionType": "git"
},
{
"lessThan": "2694d408b0e595024e0fc1d64ff9db0358580f74",
"status": "affected",
"version": "8590541473188741055d27b955db0777569438e3",
"versionType": "git"
},
{
"lessThan": "a9b8b18364fffce4c451e6f6fd218fa4ab646705",
"status": "affected",
"version": "8590541473188741055d27b955db0777569438e3",
"versionType": "git"
},
{
"status": "affected",
"version": "ab6397f072e5097f267abf5cb08a8004e6b17694",
"versionType": "git"
},
{
"lessThan": "5.15.203",
"status": "affected",
"version": "5.15.160",
"versionType": "semver"
},
{
"lessThan": "6.1.169",
"status": "affected",
"version": "6.1.84",
"versionType": "semver"
},
{
"lessThan": "6.6.135",
"status": "affected",
"version": "6.6.18",
"versionType": "semver"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tls/tls_sw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.169",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.135",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.15.160",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.169",
"versionStartIncluding": "6.1.84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.135",
"versionStartIncluding": "6.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.82",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tls: fix use-after-free in -EBUSY error path of tls_do_encryption\n\nThe -EBUSY handling in tls_do_encryption(), introduced by commit\n859054147318 (\"net: tls: handle backlogging of crypto requests\"), has\na use-after-free due to double cleanup of encrypt_pending and the\nscatterlist entry.\n\nWhen crypto_aead_encrypt() returns -EBUSY, the request is enqueued to\nthe cryptd backlog and the async callback tls_encrypt_done() will be\ninvoked upon completion. That callback unconditionally restores the\nscatterlist entry (sge-\u003eoffset, sge-\u003elength) and decrements\nctx-\u003eencrypt_pending. However, if tls_encrypt_async_wait() returns an\nerror, the synchronous error path in tls_do_encryption() performs the\nsame cleanup again, double-decrementing encrypt_pending and\ndouble-restoring the scatterlist.\n\nThe double-decrement corrupts the encrypt_pending sentinel (initialized\nto 1), making tls_encrypt_async_wait() permanently skip the wait for\npending async callbacks. A subsequent sendmsg can then free the\ntls_rec via bpf_exec_tx_verdict() while a cryptd callback is still\npending, resulting in a use-after-free when the callback fires on the\nfreed record.\n\nFix this by skipping the synchronous cleanup when the -EBUSY async\nwait returns an error, since the callback has already handled\nencrypt_pending and sge restoration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in the kTLS TX path reached when a kTLS-enabled network service sends TLS records to a peer; a remote client can plausibly trigger repeated encrypted responses and connection errors over the network.\nAC:L - The vulnerable condition is the normal async crypto backlog/error path, and an attacker can drive request volume and connection aborts/retries rather than depending on an uncontrollable race. Under the required rule, the defensible choice for a kTLS UAF is low complexity.\nPR:N - In the network-service scenario, the attacker only needs to connect to and interact with the exposed TLS service; no local account or kernel capability is required.\nUI:N - No user interaction is required once the vulnerable kTLS-enabled service is reachable; the attacker can trigger sends by network requests.\nS:U - The corruption is within the kernel handling of the same host and does not cross a separate security authority such as a VM boundary.\nC:H - This is a use-after-free of a heap-allocated tls_rec used later by an async crypto callback, giving memory corruption potential consistent with kernel information disclosure.\nI:H - The async callback writes through fields in the freed record, so heap reuse can turn the UAF into kernel memory corruption/control-flow impact.\nA:H - Even without full exploitation, the stale callback can dereference or modify freed memory and crash or oops the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:23:20.687Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/414fc5e5a5aff776c150f1b86770e0a25a35df3a"
},
{
"url": "https://git.kernel.org/stable/c/02f3ecadb23558bbe068e6504118f1b712d4ece0"
},
{
"url": "https://git.kernel.org/stable/c/0e43e0a3c94044acc74b8e0927c27972eb5a59e8"
},
{
"url": "https://git.kernel.org/stable/c/aa9facde6c5005205874c37db3fd25799d741baf"
},
{
"url": "https://git.kernel.org/stable/c/5d70eb25b41e9b010828cd12818b06a0c3b04412"
},
{
"url": "https://git.kernel.org/stable/c/2694d408b0e595024e0fc1d64ff9db0358580f74"
},
{
"url": "https://git.kernel.org/stable/c/a9b8b18364fffce4c451e6f6fd218fa4ab646705"
}
],
"title": "net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31533",
"datePublished": "2026-04-23T15:11:06.955Z",
"dateReserved": "2026-03-09T15:48:24.113Z",
"dateUpdated": "2026-08-05T12:23:20.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45997 (GCVE-0-2026-45997)
Vulnerability from cvelistv5
Published
2026-05-27 12:55
Modified
2026-06-14 17:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails
If device_add(&sdkp->disk_dev) fails, put_device() runs
scsi_disk_release(), which frees the scsi_disk but leaves the gendisk
referenced. The device_add_disk() error path in sd_probe() calls
put_disk(gd); call put_disk(gd) here to mirror that cleanup.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 265dfe8ebbabae7959060bd1c3f75c2473b697ed Version: 265dfe8ebbabae7959060bd1c3f75c2473b697ed Version: 265dfe8ebbabae7959060bd1c3f75c2473b697ed Version: 265dfe8ebbabae7959060bd1c3f75c2473b697ed Version: 265dfe8ebbabae7959060bd1c3f75c2473b697ed Version: 265dfe8ebbabae7959060bd1c3f75c2473b697ed Version: d56459d361a9a99bead8b594635353053271356c Version: a3e5a9208466b63f27a2509a691023b446ea5105 Version: 4e8e6427319de323f613caa8fd37120df83138d0 Version: eadb60bcc2005247d97dcb3becee57aba4024ff4 Version: 350d048cc506368a316f0bc4082426b24a2a9fc0 Version: 60df9f55562a57173a11b6c7011eee40dfa48157 Version: e95f62013a1159eeea752bb52df0683ee77f70ca Version: 4.4.288 ≤ Version: 4.9.286 ≤ Version: 4.14.250 ≤ Version: 4.19.210 ≤ Version: 5.4.152 ≤ Version: 5.10.72 ≤ Version: 5.14.11 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/sd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2c2c14b7dfccad8c5a28802849e40c21252e4c28",
"status": "affected",
"version": "265dfe8ebbabae7959060bd1c3f75c2473b697ed",
"versionType": "git"
},
{
"lessThan": "262152ec37101f9dc524743ccdbd6c7641d14573",
"status": "affected",
"version": "265dfe8ebbabae7959060bd1c3f75c2473b697ed",
"versionType": "git"
},
{
"lessThan": "b64b4f499801b12d0e2785447e4df6c164c608a9",
"status": "affected",
"version": "265dfe8ebbabae7959060bd1c3f75c2473b697ed",
"versionType": "git"
},
{
"lessThan": "13e550fbfccdb311e76ec96892dfe35f0dba0657",
"status": "affected",
"version": "265dfe8ebbabae7959060bd1c3f75c2473b697ed",
"versionType": "git"
},
{
"lessThan": "a95d38c5701431bfc826e7b18acc0785919d5c88",
"status": "affected",
"version": "265dfe8ebbabae7959060bd1c3f75c2473b697ed",
"versionType": "git"
},
{
"lessThan": "1e111c4b3a726df1254670a5cc4868cedb946d37",
"status": "affected",
"version": "265dfe8ebbabae7959060bd1c3f75c2473b697ed",
"versionType": "git"
},
{
"status": "affected",
"version": "d56459d361a9a99bead8b594635353053271356c",
"versionType": "git"
},
{
"status": "affected",
"version": "a3e5a9208466b63f27a2509a691023b446ea5105",
"versionType": "git"
},
{
"status": "affected",
"version": "4e8e6427319de323f613caa8fd37120df83138d0",
"versionType": "git"
},
{
"status": "affected",
"version": "eadb60bcc2005247d97dcb3becee57aba4024ff4",
"versionType": "git"
},
{
"status": "affected",
"version": "350d048cc506368a316f0bc4082426b24a2a9fc0",
"versionType": "git"
},
{
"status": "affected",
"version": "60df9f55562a57173a11b6c7011eee40dfa48157",
"versionType": "git"
},
{
"status": "affected",
"version": "e95f62013a1159eeea752bb52df0683ee77f70ca",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.288",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.286",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.250",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.210",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.152",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.72",
"versionType": "semver"
},
{
"lessThan": "5.15",
"status": "affected",
"version": "5.14.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/sd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.288",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.286",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.250",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.210",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.152",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.14.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: sd: fix missing put_disk() when device_add(\u0026disk_dev) fails\n\nIf device_add(\u0026sdkp-\u003edisk_dev) fails, put_device() runs\nscsi_disk_release(), which frees the scsi_disk but leaves the gendisk\nreferenced. The device_add_disk() error path in sd_probe() calls\nput_disk(gd); call put_disk(gd) here to mirror that cleanup."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:47:03.622Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c2c14b7dfccad8c5a28802849e40c21252e4c28"
},
{
"url": "https://git.kernel.org/stable/c/262152ec37101f9dc524743ccdbd6c7641d14573"
},
{
"url": "https://git.kernel.org/stable/c/b64b4f499801b12d0e2785447e4df6c164c608a9"
},
{
"url": "https://git.kernel.org/stable/c/13e550fbfccdb311e76ec96892dfe35f0dba0657"
},
{
"url": "https://git.kernel.org/stable/c/a95d38c5701431bfc826e7b18acc0785919d5c88"
},
{
"url": "https://git.kernel.org/stable/c/1e111c4b3a726df1254670a5cc4868cedb946d37"
}
],
"title": "scsi: sd: fix missing put_disk() when device_add(\u0026disk_dev) fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45997",
"datePublished": "2026-05-27T12:55:51.154Z",
"dateReserved": "2026-05-13T15:03:33.091Z",
"dateUpdated": "2026-06-14T17:47:03.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45970 (GCVE-0-2026-45970)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bonding: alb: fix UAF in rlb_arp_recv during bond up/down
The ALB RX path may access rx_hashtbl concurrently with bond
teardown. During rapid bond up/down cycles, rlb_deinitialize()
frees rx_hashtbl while RX handlers are still running, leading
to a null pointer dereference detected by KASAN.
However, the root cause is that rlb_arp_recv() can still be accessed
after setting recv_probe to NULL, which is actually a use-after-free
(UAF) issue. That is the reason for using the referenced commit in the
Fixes tag.
[ 214.174138] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001d: 0000 [#1] SMP KASAN PTI
[ 214.186478] KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
[ 214.194933] CPU: 30 UID: 0 PID: 2375 Comm: ping Kdump: loaded Not tainted 6.19.0-rc8+ #2 PREEMPT(voluntary)
[ 214.205907] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.14.0 01/14/2022
[ 214.214357] RIP: 0010:rlb_arp_recv+0x505/0xab0 [bonding]
[ 214.220320] Code: 0f 85 2b 05 00 00 48 b8 00 00 00 00 00 fc ff df 40 0f b6 ed 48 c1 e5 06 49 03 ad 78 01 00 00 48 8d 7d 28 48 89 fa 48 c1 ea 03 <0f> b6
04 02 84 c0 74 06 0f 8e 12 05 00 00 80 7d 28 00 0f 84 8c 00
[ 214.241280] RSP: 0018:ffffc900073d8870 EFLAGS: 00010206
[ 214.247116] RAX: dffffc0000000000 RBX: ffff888168556822 RCX: ffff88816855681e
[ 214.255082] RDX: 000000000000001d RSI: dffffc0000000000 RDI: 00000000000000e8
[ 214.263048] RBP: 00000000000000c0 R08: 0000000000000002 R09: ffffed11192021c8
[ 214.271013] R10: ffff8888c9010e43 R11: 0000000000000001 R12: 1ffff92000e7b119
[ 214.278978] R13: ffff8888c9010e00 R14: ffff888168556822 R15: ffff888168556810
[ 214.286943] FS: 00007f85d2d9cb80(0000) GS:ffff88886ccb3000(0000) knlGS:0000000000000000
[ 214.295966] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 214.302380] CR2: 00007f0d047b5e34 CR3: 00000008a1c2e002 CR4: 00000000001726f0
[ 214.310347] Call Trace:
[ 214.313070] <IRQ>
[ 214.315318] ? __pfx_rlb_arp_recv+0x10/0x10 [bonding]
[ 214.320975] bond_handle_frame+0x166/0xb60 [bonding]
[ 214.326537] ? __pfx_bond_handle_frame+0x10/0x10 [bonding]
[ 214.332680] __netif_receive_skb_core.constprop.0+0x576/0x2710
[ 214.339199] ? __pfx_arp_process+0x10/0x10
[ 214.343775] ? sched_balance_find_src_group+0x98/0x630
[ 214.349513] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10
[ 214.356513] ? arp_rcv+0x307/0x690
[ 214.360311] ? __pfx_arp_rcv+0x10/0x10
[ 214.364499] ? __lock_acquire+0x58c/0xbd0
[ 214.368975] __netif_receive_skb_one_core+0xae/0x1b0
[ 214.374518] ? __pfx___netif_receive_skb_one_core+0x10/0x10
[ 214.380743] ? lock_acquire+0x10b/0x140
[ 214.385026] process_backlog+0x3f1/0x13a0
[ 214.389502] ? process_backlog+0x3aa/0x13a0
[ 214.394174] __napi_poll.constprop.0+0x9f/0x370
[ 214.399233] net_rx_action+0x8c1/0xe60
[ 214.403423] ? __pfx_net_rx_action+0x10/0x10
[ 214.408193] ? lock_acquire.part.0+0xbd/0x260
[ 214.413058] ? sched_clock_cpu+0x6c/0x540
[ 214.417540] ? mark_held_locks+0x40/0x70
[ 214.421920] handle_softirqs+0x1fd/0x860
[ 214.426302] ? __pfx_handle_softirqs+0x10/0x10
[ 214.431264] ? __neigh_event_send+0x2d6/0xf50
[ 214.436131] do_softirq+0xb1/0xf0
[ 214.439830] </IRQ>
The issue is reproducible by repeatedly running
ip link set bond0 up/down while receiving ARP messages, where
rlb_arp_recv() can race with rlb_deinitialize() and dereference
a freed rx_hashtbl entry.
Fix this by setting recv_probe to NULL and then calling
synchronize_net() to wait for any concurrent RX processing to finish.
This ensures that no RX handler can access rx_hashtbl after it is freed
in bond_alb_deinitialize().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3aba891dde3842d89ad022237b99c1ed308040b0 Version: 3aba891dde3842d89ad022237b99c1ed308040b0 Version: 3aba891dde3842d89ad022237b99c1ed308040b0 Version: 3aba891dde3842d89ad022237b99c1ed308040b0 Version: 3aba891dde3842d89ad022237b99c1ed308040b0 Version: 3aba891dde3842d89ad022237b99c1ed308040b0 Version: 3aba891dde3842d89ad022237b99c1ed308040b0 Version: 3aba891dde3842d89ad022237b99c1ed308040b0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fd54ddc929be1d6c3b3b7b35d6d4642a5d9e803c",
"status": "affected",
"version": "3aba891dde3842d89ad022237b99c1ed308040b0",
"versionType": "git"
},
{
"lessThan": "de7c097800f07f3c108185c7a38b53a530ba30ff",
"status": "affected",
"version": "3aba891dde3842d89ad022237b99c1ed308040b0",
"versionType": "git"
},
{
"lessThan": "db5435b5342e3aaa4521d0f3ccfe94316b253ca1",
"status": "affected",
"version": "3aba891dde3842d89ad022237b99c1ed308040b0",
"versionType": "git"
},
{
"lessThan": "f94a0de7b9f32745a14a1621c63087a092823587",
"status": "affected",
"version": "3aba891dde3842d89ad022237b99c1ed308040b0",
"versionType": "git"
},
{
"lessThan": "c65cdf46ce340c9c00fbbaf84599d2daff43626e",
"status": "affected",
"version": "3aba891dde3842d89ad022237b99c1ed308040b0",
"versionType": "git"
},
{
"lessThan": "fef13c403be3fb685cb06419e6b3623106aab5ba",
"status": "affected",
"version": "3aba891dde3842d89ad022237b99c1ed308040b0",
"versionType": "git"
},
{
"lessThan": "d31065526f160ee0244a719230aa069daca2bf4d",
"status": "affected",
"version": "3aba891dde3842d89ad022237b99c1ed308040b0",
"versionType": "git"
},
{
"lessThan": "e6834a4c474697df23ab9948fd3577b26bf48656",
"status": "affected",
"version": "3aba891dde3842d89ad022237b99c1ed308040b0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: fix UAF in rlb_arp_recv during bond up/down\n\nThe ALB RX path may access rx_hashtbl concurrently with bond\nteardown. During rapid bond up/down cycles, rlb_deinitialize()\nfrees rx_hashtbl while RX handlers are still running, leading\nto a null pointer dereference detected by KASAN.\n\nHowever, the root cause is that rlb_arp_recv() can still be accessed\nafter setting recv_probe to NULL, which is actually a use-after-free\n(UAF) issue. That is the reason for using the referenced commit in the\nFixes tag.\n\n[ 214.174138] Oops: general protection fault, probably for non-canonical address 0xdffffc000000001d: 0000 [#1] SMP KASAN PTI\n[ 214.186478] KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]\n[ 214.194933] CPU: 30 UID: 0 PID: 2375 Comm: ping Kdump: loaded Not tainted 6.19.0-rc8+ #2 PREEMPT(voluntary)\n[ 214.205907] Hardware name: Dell Inc. PowerEdge R730/0WCJNT, BIOS 2.14.0 01/14/2022\n[ 214.214357] RIP: 0010:rlb_arp_recv+0x505/0xab0 [bonding]\n[ 214.220320] Code: 0f 85 2b 05 00 00 48 b8 00 00 00 00 00 fc ff df 40 0f b6 ed 48 c1 e5 06 49 03 ad 78 01 00 00 48 8d 7d 28 48 89 fa 48 c1 ea 03 \u003c0f\u003e b6\n 04 02 84 c0 74 06 0f 8e 12 05 00 00 80 7d 28 00 0f 84 8c 00\n[ 214.241280] RSP: 0018:ffffc900073d8870 EFLAGS: 00010206\n[ 214.247116] RAX: dffffc0000000000 RBX: ffff888168556822 RCX: ffff88816855681e\n[ 214.255082] RDX: 000000000000001d RSI: dffffc0000000000 RDI: 00000000000000e8\n[ 214.263048] RBP: 00000000000000c0 R08: 0000000000000002 R09: ffffed11192021c8\n[ 214.271013] R10: ffff8888c9010e43 R11: 0000000000000001 R12: 1ffff92000e7b119\n[ 214.278978] R13: ffff8888c9010e00 R14: ffff888168556822 R15: ffff888168556810\n[ 214.286943] FS: 00007f85d2d9cb80(0000) GS:ffff88886ccb3000(0000) knlGS:0000000000000000\n[ 214.295966] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 214.302380] CR2: 00007f0d047b5e34 CR3: 00000008a1c2e002 CR4: 00000000001726f0\n[ 214.310347] Call Trace:\n[ 214.313070] \u003cIRQ\u003e\n[ 214.315318] ? __pfx_rlb_arp_recv+0x10/0x10 [bonding]\n[ 214.320975] bond_handle_frame+0x166/0xb60 [bonding]\n[ 214.326537] ? __pfx_bond_handle_frame+0x10/0x10 [bonding]\n[ 214.332680] __netif_receive_skb_core.constprop.0+0x576/0x2710\n[ 214.339199] ? __pfx_arp_process+0x10/0x10\n[ 214.343775] ? sched_balance_find_src_group+0x98/0x630\n[ 214.349513] ? __pfx___netif_receive_skb_core.constprop.0+0x10/0x10\n[ 214.356513] ? arp_rcv+0x307/0x690\n[ 214.360311] ? __pfx_arp_rcv+0x10/0x10\n[ 214.364499] ? __lock_acquire+0x58c/0xbd0\n[ 214.368975] __netif_receive_skb_one_core+0xae/0x1b0\n[ 214.374518] ? __pfx___netif_receive_skb_one_core+0x10/0x10\n[ 214.380743] ? lock_acquire+0x10b/0x140\n[ 214.385026] process_backlog+0x3f1/0x13a0\n[ 214.389502] ? process_backlog+0x3aa/0x13a0\n[ 214.394174] __napi_poll.constprop.0+0x9f/0x370\n[ 214.399233] net_rx_action+0x8c1/0xe60\n[ 214.403423] ? __pfx_net_rx_action+0x10/0x10\n[ 214.408193] ? lock_acquire.part.0+0xbd/0x260\n[ 214.413058] ? sched_clock_cpu+0x6c/0x540\n[ 214.417540] ? mark_held_locks+0x40/0x70\n[ 214.421920] handle_softirqs+0x1fd/0x860\n[ 214.426302] ? __pfx_handle_softirqs+0x10/0x10\n[ 214.431264] ? __neigh_event_send+0x2d6/0xf50\n[ 214.436131] do_softirq+0xb1/0xf0\n[ 214.439830] \u003c/IRQ\u003e\n\nThe issue is reproducible by repeatedly running\nip link set bond0 up/down while receiving ARP messages, where\nrlb_arp_recv() can race with rlb_deinitialize() and dereference\na freed rx_hashtbl entry.\n\nFix this by setting recv_probe to NULL and then calling\nsynchronize_net() to wait for any concurrent RX processing to finish.\nThis ensures that no RX handler can access rx_hashtbl after it is freed\nin bond_alb_deinitialize()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached via a received ARP frame on a bond slave; an unprivileged local user can reproduce the entire scenario inside a user namespace (`unshare -Urn`) by creating a balance-alb bond over veths, injecting ARP locally, and cycling the bond up/down, so no network/adjacent position is required.\nAC:L - In the user-namespace scenario the attacker controls both sides of the race \u2014 the ARP injection (RX side) and the bond up/down cycling (free side) \u2014 and the upstream report confirms it is readily reproducible by repeated cycling, so the race can be won reliably.\nPR:L - Triggering the free requires CAP_NET_ADMIN on the bond, but this is obtainable by any unprivileged user via a user+network namespace (which also grants CAP_NET_RAW for ARP injection), so only basic local user privileges are needed.\nUI:N - No victim interaction is required; the attacker drives both the packet receipt and the bond teardown themselves.\nS:U - The vulnerability and its impact are confined to the kernel\u0027s own security authority; there is no crossing of a VM/IOMMU/sandbox boundary.\nC:H - The UAF reads the contents of the freed `rx_hashtbl` object (after potential reallocation), which can be leveraged to disclose attacker-influenced or adjacent kernel heap data.\nI:H - The UAF writes into the freed/reallocated object, including copying 6 attacker-controlled bytes (the ARP source MAC) and link-pointer updates, providing a write primitive into reclaimed heap memory exploitable for control-flow corruption.\nA:H - The bug causes a KASAN-detected general protection fault / kernel oops (as shown in the report), reliably crashing the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:58.557Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fd54ddc929be1d6c3b3b7b35d6d4642a5d9e803c"
},
{
"url": "https://git.kernel.org/stable/c/de7c097800f07f3c108185c7a38b53a530ba30ff"
},
{
"url": "https://git.kernel.org/stable/c/db5435b5342e3aaa4521d0f3ccfe94316b253ca1"
},
{
"url": "https://git.kernel.org/stable/c/f94a0de7b9f32745a14a1621c63087a092823587"
},
{
"url": "https://git.kernel.org/stable/c/c65cdf46ce340c9c00fbbaf84599d2daff43626e"
},
{
"url": "https://git.kernel.org/stable/c/fef13c403be3fb685cb06419e6b3623106aab5ba"
},
{
"url": "https://git.kernel.org/stable/c/d31065526f160ee0244a719230aa069daca2bf4d"
},
{
"url": "https://git.kernel.org/stable/c/e6834a4c474697df23ab9948fd3577b26bf48656"
}
],
"title": "bonding: alb: fix UAF in rlb_arp_recv during bond up/down",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45970",
"datePublished": "2026-05-27T12:18:29.878Z",
"dateReserved": "2026-05-13T15:03:33.089Z",
"dateUpdated": "2026-08-05T12:28:58.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52980 (GCVE-0-2026-52980)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-06-24 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sched/fair: Clear rel_deadline when initializing forked entities
A yield-triggered crash can happen when a newly forked sched_entity
enters the fair class with se->rel_deadline unexpectedly set.
The failing sequence is:
1. A task is forked while se->rel_deadline is still set.
2. __sched_fork() initializes vruntime, vlag and other sched_entity
state, but does not clear rel_deadline.
3. On the first enqueue, enqueue_entity() calls place_entity().
4. Because se->rel_deadline is set, place_entity() treats se->deadline
as a relative deadline and converts it to an absolute deadline by
adding the current vruntime.
5. However, the forked entity's deadline is not a valid inherited
relative deadline for this new scheduling instance, so the conversion
produces an abnormally large deadline.
6. If the task later calls sched_yield(), yield_task_fair() advances
se->vruntime to se->deadline.
7. The inflated vruntime is then used by the following enqueue path,
where the vruntime-derived key can overflow when multiplied by the
entity weight.
8. This corrupts cfs_rq->sum_w_vruntime, breaks EEVDF eligibility
calculation, and can eventually make all entities appear ineligible.
pick_next_entity() may then return NULL unexpectedly, leading to a
later NULL dereference.
A captured trace shows the effect clearly. Before yield, the entity's
vruntime was around:
9834017729983308
After yield_task_fair() executed:
se->vruntime = se->deadline
the vruntime jumped to:
19668035460670230
and the deadline was later advanced further to:
19668035463470230
This shows that the deadline had already become abnormally large before
yield_task_fair() copied it into vruntime.
rel_deadline is only meaningful when se->deadline really carries a
relative deadline that still needs to be placed against vruntime. A
freshly forked sched_entity should not inherit or retain this state.
Clear se->rel_deadline in __sched_fork(), together with the other
sched_entity runtime state, so that the first enqueue does not interpret
the new entity's deadline as a stale relative deadline.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/sched/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c71bf35caba12bfd9bc23e32b0bcd9e02d1cf1ac",
"status": "affected",
"version": "82e9d0456e06cebe2c89f3c73cdbc9e3805e9437",
"versionType": "git"
},
{
"lessThan": "f3c16e1f4a314a20717ab90a41885f8111a242ab",
"status": "affected",
"version": "82e9d0456e06cebe2c89f3c73cdbc9e3805e9437",
"versionType": "git"
},
{
"lessThan": "8f4a16200785f49cf02c5b71bdfe7a9dab63f23a",
"status": "affected",
"version": "82e9d0456e06cebe2c89f3c73cdbc9e3805e9437",
"versionType": "git"
},
{
"lessThan": "3da56dc063cd77b9c0b40add930767fab4e389f3",
"status": "affected",
"version": "82e9d0456e06cebe2c89f3c73cdbc9e3805e9437",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/sched/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/fair: Clear rel_deadline when initializing forked entities\n\nA yield-triggered crash can happen when a newly forked sched_entity\nenters the fair class with se-\u003erel_deadline unexpectedly set.\n\nThe failing sequence is:\n\n 1. A task is forked while se-\u003erel_deadline is still set.\n 2. __sched_fork() initializes vruntime, vlag and other sched_entity\n state, but does not clear rel_deadline.\n 3. On the first enqueue, enqueue_entity() calls place_entity().\n 4. Because se-\u003erel_deadline is set, place_entity() treats se-\u003edeadline\n as a relative deadline and converts it to an absolute deadline by\n adding the current vruntime.\n 5. However, the forked entity\u0027s deadline is not a valid inherited\n relative deadline for this new scheduling instance, so the conversion\n produces an abnormally large deadline.\n 6. If the task later calls sched_yield(), yield_task_fair() advances\n se-\u003evruntime to se-\u003edeadline.\n 7. The inflated vruntime is then used by the following enqueue path,\n where the vruntime-derived key can overflow when multiplied by the\n entity weight.\n 8. This corrupts cfs_rq-\u003esum_w_vruntime, breaks EEVDF eligibility\n calculation, and can eventually make all entities appear ineligible.\n pick_next_entity() may then return NULL unexpectedly, leading to a\n later NULL dereference.\n\nA captured trace shows the effect clearly. Before yield, the entity\u0027s\nvruntime was around:\n\n 9834017729983308\n\nAfter yield_task_fair() executed:\n\n se-\u003evruntime = se-\u003edeadline\n\nthe vruntime jumped to:\n\n 19668035460670230\n\nand the deadline was later advanced further to:\n\n 19668035463470230\n\nThis shows that the deadline had already become abnormally large before\nyield_task_fair() copied it into vruntime.\n\nrel_deadline is only meaningful when se-\u003edeadline really carries a\nrelative deadline that still needs to be placed against vruntime. A\nfreshly forked sched_entity should not inherit or retain this state.\nClear se-\u003erel_deadline in __sched_fork(), together with the other\nsched_entity runtime state, so that the first enqueue does not interpret\nthe new entity\u0027s deadline as a stale relative deadline."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:28:56.457Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c71bf35caba12bfd9bc23e32b0bcd9e02d1cf1ac"
},
{
"url": "https://git.kernel.org/stable/c/f3c16e1f4a314a20717ab90a41885f8111a242ab"
},
{
"url": "https://git.kernel.org/stable/c/8f4a16200785f49cf02c5b71bdfe7a9dab63f23a"
},
{
"url": "https://git.kernel.org/stable/c/3da56dc063cd77b9c0b40add930767fab4e389f3"
}
],
"title": "sched/fair: Clear rel_deadline when initializing forked entities",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52980",
"datePublished": "2026-06-24T16:28:56.457Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-06-24T16:28:56.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43238 (GCVE-0-2026-43238)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()
Commit 38a6f0865796 ("net: sched: support hash selecting tx queue")
added SKBEDIT_F_TXQ_SKBHASH support. The inclusive range size is
computed as:
mapping_mod = queue_mapping_max - queue_mapping + 1;
The range size can be 65536 when the requested range covers all possible
u16 queue IDs (e.g. queue_mapping=0 and queue_mapping_max=U16_MAX).
That value cannot be represented in a u16 and previously wrapped to 0,
so tcf_skbedit_hash() could trigger a divide-by-zero:
queue_mapping += skb_get_hash(skb) % params->mapping_mod;
Compute mapping_mod in a wider type and reject ranges larger than U16_MAX
to prevent params->mapping_mod from becoming 0 and avoid the crash.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 38a6f0865796e26fc38fff4858f681d9ae76fa0f Version: 38a6f0865796e26fc38fff4858f681d9ae76fa0f Version: 38a6f0865796e26fc38fff4858f681d9ae76fa0f Version: 38a6f0865796e26fc38fff4858f681d9ae76fa0f Version: 38a6f0865796e26fc38fff4858f681d9ae76fa0f Version: 38a6f0865796e26fc38fff4858f681d9ae76fa0f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/act_skbedit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "59809fda4da7730cfe84a948033f47eb45db073d",
"status": "affected",
"version": "38a6f0865796e26fc38fff4858f681d9ae76fa0f",
"versionType": "git"
},
{
"lessThan": "9c735a7d98c982a786b0db71eb6566ee00aaa04f",
"status": "affected",
"version": "38a6f0865796e26fc38fff4858f681d9ae76fa0f",
"versionType": "git"
},
{
"lessThan": "015cebdfcb97b5347fb7f598ea712a281cb35840",
"status": "affected",
"version": "38a6f0865796e26fc38fff4858f681d9ae76fa0f",
"versionType": "git"
},
{
"lessThan": "4ece5eb4836f8ff03b9004dc2430a7169f282851",
"status": "affected",
"version": "38a6f0865796e26fc38fff4858f681d9ae76fa0f",
"versionType": "git"
},
{
"lessThan": "3c2b95b26860bd6f8e2310d31ea1200d3f8f173e",
"status": "affected",
"version": "38a6f0865796e26fc38fff4858f681d9ae76fa0f",
"versionType": "git"
},
{
"lessThan": "be054cc66f739a9ba615dba9012a07fab8e7dd6f",
"status": "affected",
"version": "38a6f0865796e26fc38fff4858f681d9ae76fa0f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/act_skbedit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()\n\nCommit 38a6f0865796 (\"net: sched: support hash selecting tx queue\")\nadded SKBEDIT_F_TXQ_SKBHASH support. The inclusive range size is\ncomputed as:\n\nmapping_mod = queue_mapping_max - queue_mapping + 1;\n\nThe range size can be 65536 when the requested range covers all possible\nu16 queue IDs (e.g. queue_mapping=0 and queue_mapping_max=U16_MAX).\nThat value cannot be represented in a u16 and previously wrapped to 0,\nso tcf_skbedit_hash() could trigger a divide-by-zero:\n\nqueue_mapping += skb_get_hash(skb) % params-\u003emapping_mod;\n\nCompute mapping_mod in a wider type and reject ranges larger than U16_MAX\nto prevent params-\u003emapping_mod from becoming 0 and avoid the crash."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:20:40.634Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/59809fda4da7730cfe84a948033f47eb45db073d"
},
{
"url": "https://git.kernel.org/stable/c/9c735a7d98c982a786b0db71eb6566ee00aaa04f"
},
{
"url": "https://git.kernel.org/stable/c/015cebdfcb97b5347fb7f598ea712a281cb35840"
},
{
"url": "https://git.kernel.org/stable/c/4ece5eb4836f8ff03b9004dc2430a7169f282851"
},
{
"url": "https://git.kernel.org/stable/c/3c2b95b26860bd6f8e2310d31ea1200d3f8f173e"
},
{
"url": "https://git.kernel.org/stable/c/be054cc66f739a9ba615dba9012a07fab8e7dd6f"
}
],
"title": "net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43238",
"datePublished": "2026-05-06T11:28:32.950Z",
"dateReserved": "2026-05-01T14:12:55.995Z",
"dateUpdated": "2026-05-11T22:20:40.634Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53146 (GCVE-0-2026-53146)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Limit XDomain response copy to actual frame size
tb_xdomain_copy() copies req->response_size bytes from the received
packet buffer regardless of the actual frame size. When a short
response arrives, this reads past the valid frame data in the DMA
pool buffer into stale contents from previous transactions.
Use the minimum of frame size and expected response size for the
copy length.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/xdomain.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c55da494dfb445fb28df3a9d293c2be6a299cd01",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "7720654b4842bcdfeb64bc002f6186041849e1e7",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "033dfa63bf6be2653441a1dccae4a8313a91bb9d",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "fc261397295b8ad0654cec747b0ec25ea0011995",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "a15b6d3136accb2bf84b04d9a3ddd991f7fbf1cb",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "b5daa920f44cb582272fc9bfaeb67408776cbaef",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "b2c1e5d9f1598cc1a4736d5c6bd1218f90805ee4",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "4db2bd2ed4785dbadaeeab9f4e346b21ac5fb8eb",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/xdomain.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Limit XDomain response copy to actual frame size\n\ntb_xdomain_copy() copies req-\u003eresponse_size bytes from the received\npacket buffer regardless of the actual frame size. When a short\nresponse arrives, this reads past the valid frame data in the DMA\npool buffer into stale contents from previous transactions.\n\nUse the minimum of frame size and expected response size for the\ncopy length."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - Exploitation requires a malicious peer on the same Thunderbolt/USB4 XDomain fabric to send crafted control-channel responses. This is not internet-routable, but it is reachable over the adjacent local interconnect once the peer is connected.\nAC:L - The attacker can reply to automatic XDomain handshake requests with a short, CRC-valid response matching the observed route and protocol UUID. No race or external timing condition is required.\nPR:N - The attacker is the external XDomain peer and does not need credentials or privileges on the victim Linux system. The module parameter and ACPI allowance are deployment gates, not attacker privilege checks.\nUI:N - After the malicious peer is present on the Thunderbolt/USB4 link, XDomain discovery runs automatically. No victim user action is required to trigger the vulnerable copy.\nS:U - The vulnerable code and impacts are within the victim kernel/Thunderbolt domain. This does not cross a VM, IOMMU, or separate security authority boundary.\nC:H - The bug is an out-of-bounds source read from the Thunderbolt control DMA frame buffer into kernel response objects, exposing stale contents from previous transactions. Because the over-read is not limited to only a few bytes and can influence/reflection paths such as XDomain UUID/properties handling, confidentiality is High.\nI:L - Stale bytes copied into trusted XDomain response structures can alter limited kernel protocol state such as peer identity, route, link status, or advertised properties. There is no direct arbitrary write or control-flow corruption from this fix alone.\nA:N - The copy destination is sized for the expected response, and the over-read stays within the DMA frame allocation rather than causing an immediate kernel crash. A malicious peer can disrupt its own XDomain handshake, but this bug does not create a distinct system availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:29.560Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c55da494dfb445fb28df3a9d293c2be6a299cd01"
},
{
"url": "https://git.kernel.org/stable/c/7720654b4842bcdfeb64bc002f6186041849e1e7"
},
{
"url": "https://git.kernel.org/stable/c/033dfa63bf6be2653441a1dccae4a8313a91bb9d"
},
{
"url": "https://git.kernel.org/stable/c/fc261397295b8ad0654cec747b0ec25ea0011995"
},
{
"url": "https://git.kernel.org/stable/c/a15b6d3136accb2bf84b04d9a3ddd991f7fbf1cb"
},
{
"url": "https://git.kernel.org/stable/c/b5daa920f44cb582272fc9bfaeb67408776cbaef"
},
{
"url": "https://git.kernel.org/stable/c/b2c1e5d9f1598cc1a4736d5c6bd1218f90805ee4"
},
{
"url": "https://git.kernel.org/stable/c/4db2bd2ed4785dbadaeeab9f4e346b21ac5fb8eb"
}
],
"title": "thunderbolt: Limit XDomain response copy to actual frame size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53146",
"datePublished": "2026-06-25T08:38:32.877Z",
"dateReserved": "2026-06-09T07:44:35.387Z",
"dateUpdated": "2026-08-05T12:33:29.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46102 (GCVE-0-2026-46102)
Vulnerability from cvelistv5
Published
2026-05-27 12:59
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: strparser: fix skb_head leak in strp_abort_strp()
When the stream parser is aborted, for example after a message assembly timeout,
it can still hold a reference to a partially assembled message in
strp->skb_head.
That skb is not released in strp_abort_strp(), which leaks the partially
assembled message and can be triggered repeatedly to exhaust memory.
Fix this by freeing strp->skb_head and resetting the parser state in the
abort path. Leave strp_stop() unchanged so final cleanup still happens in
strp_done() after the work and timer have been synchronized.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a Version: 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a Version: 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a Version: 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a Version: 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a Version: 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a Version: 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a Version: 43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/strparser/strparser.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d6668ce0e78d23eabecef9a6bc4f0f739cb28ad3",
"status": "affected",
"version": "43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a",
"versionType": "git"
},
{
"lessThan": "a470ed71c906cc8cbad0d74c9942216698911f8b",
"status": "affected",
"version": "43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a",
"versionType": "git"
},
{
"lessThan": "c2e57695ec9ff9d42f23de70f3805199153d007b",
"status": "affected",
"version": "43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a",
"versionType": "git"
},
{
"lessThan": "e9ae00490d474757c0f9c65073de83e6bb1e5a00",
"status": "affected",
"version": "43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a",
"versionType": "git"
},
{
"lessThan": "5327dad2ffe9c1b49881dd6d51ff3c6893847568",
"status": "affected",
"version": "43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a",
"versionType": "git"
},
{
"lessThan": "19ca9475f18f991735f98a22e735c43e95e6298d",
"status": "affected",
"version": "43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a",
"versionType": "git"
},
{
"lessThan": "56082f442023db9be1a5a29d4ee361de4017c0b7",
"status": "affected",
"version": "43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a",
"versionType": "git"
},
{
"lessThan": "fe72340daaf1af588be88056faf98965f39e6032",
"status": "affected",
"version": "43a0c6751a322847cb6fa0ab8cbf77a1d08bfc0a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/strparser/strparser.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: strparser: fix skb_head leak in strp_abort_strp()\n\nWhen the stream parser is aborted, for example after a message assembly timeout,\nit can still hold a reference to a partially assembled message in\nstrp-\u003eskb_head.\n\nThat skb is not released in strp_abort_strp(), which leaks the partially\nassembled message and can be triggered repeatedly to exhaust memory.\n\nFix this by freeing strp-\u003eskb_head and resetting the parser state in the\nabort path. Leave strp_stop() unchanged so final cleanup still happens in\nstrp_done() after the work and timer have been synchronized."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The strparser parses data received from a remote TCP peer (espintcp ESP-in-TCP framing, sockmap framed protocols); the leak is driven by a remote peer sending a partial length-prefixed frame that never completes.\nAC:L - The attacker reliably sends an incomplete framed message and simply lets the message-assembly timer expire; this trigger is fully under the attacker\u0027s control.\nPR:N - The framing parse (length-prefix read) occurs at the stream layer before any authentication of the payload, so a remote peer needs no privileges on the target to send partial frames and trigger the leak.\nUI:N - No victim interaction is required; the leak is triggered solely by the attacker\u0027s network data and the timeout firing.\nS:U - The leaked skb is kernel memory within the same security authority; no security boundary is crossed.\nC:N - The leaked partial-message skb is orphaned, not exposed to the attacker; the bug discloses no information.\nI:N - Nothing is overwritten or modified; the parser is stopped and the dangling pointer is never reused, so there is no integrity impact.\nA:H - Each abort leaks a partial message (up to sk_rcvbuf) and the commit notes it can be triggered repeatedly to exhaust memory, leading to kernel-wide memory exhaustion / OOM denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:38.661Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d6668ce0e78d23eabecef9a6bc4f0f739cb28ad3"
},
{
"url": "https://git.kernel.org/stable/c/a470ed71c906cc8cbad0d74c9942216698911f8b"
},
{
"url": "https://git.kernel.org/stable/c/c2e57695ec9ff9d42f23de70f3805199153d007b"
},
{
"url": "https://git.kernel.org/stable/c/e9ae00490d474757c0f9c65073de83e6bb1e5a00"
},
{
"url": "https://git.kernel.org/stable/c/5327dad2ffe9c1b49881dd6d51ff3c6893847568"
},
{
"url": "https://git.kernel.org/stable/c/19ca9475f18f991735f98a22e735c43e95e6298d"
},
{
"url": "https://git.kernel.org/stable/c/56082f442023db9be1a5a29d4ee361de4017c0b7"
},
{
"url": "https://git.kernel.org/stable/c/fe72340daaf1af588be88056faf98965f39e6032"
}
],
"title": "net: strparser: fix skb_head leak in strp_abort_strp()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46102",
"datePublished": "2026-05-27T12:59:09.526Z",
"dateReserved": "2026-05-13T15:03:33.097Z",
"dateUpdated": "2026-08-05T12:29:38.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45964 (GCVE-0-2026-45964)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-05-27 12:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path
Commit 5940d1cf9f42 ("SUNRPC: Rebalance a kref in auth_gss.c") added
a kref_get(&gss_auth->kref) call to balance the gss_put_auth() done
in gss_release_msg(), but forgot to add a corresponding kref_put()
on the error path when kstrdup_const() fails.
If service_name is non-NULL and kstrdup_const() fails, the function
jumps to err_put_pipe_version which calls put_pipe_version() and
kfree(gss_msg), but never releases the gss_auth reference. This leads
to a kref leak where the gss_auth structure is never freed.
Add a forward declaration for gss_free_callback() and call kref_put()
in the err_put_pipe_version error path to properly release the
reference taken earlier.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5940d1cf9f42f67e9cc3f7df9eda39f5888d6e9e Version: 5940d1cf9f42f67e9cc3f7df9eda39f5888d6e9e Version: 5940d1cf9f42f67e9cc3f7df9eda39f5888d6e9e Version: 5940d1cf9f42f67e9cc3f7df9eda39f5888d6e9e Version: 5940d1cf9f42f67e9cc3f7df9eda39f5888d6e9e Version: 5940d1cf9f42f67e9cc3f7df9eda39f5888d6e9e Version: 5940d1cf9f42f67e9cc3f7df9eda39f5888d6e9e Version: 5940d1cf9f42f67e9cc3f7df9eda39f5888d6e9e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/auth_gss/auth_gss.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3b2b6c42070ce4204936288253baf101e995c2d3",
"status": "affected",
"version": "5940d1cf9f42f67e9cc3f7df9eda39f5888d6e9e",
"versionType": "git"
},
{
"lessThan": "b559be2ec6cdb2e9c2c36c23fbbd4690d8a5c3f7",
"status": "affected",
"version": "5940d1cf9f42f67e9cc3f7df9eda39f5888d6e9e",
"versionType": "git"
},
{
"lessThan": "a1bc9561b617ec7e2d09e6c134d1db8fcf9ca4a6",
"status": "affected",
"version": "5940d1cf9f42f67e9cc3f7df9eda39f5888d6e9e",
"versionType": "git"
},
{
"lessThan": "655c9ba9915f05266998dbbf4b76b3c79b8a70aa",
"status": "affected",
"version": "5940d1cf9f42f67e9cc3f7df9eda39f5888d6e9e",
"versionType": "git"
},
{
"lessThan": "e464e26b2457005c87e158570498274b9f3b90c7",
"status": "affected",
"version": "5940d1cf9f42f67e9cc3f7df9eda39f5888d6e9e",
"versionType": "git"
},
{
"lessThan": "c20f925214249bb4fc04f7e197bea142a6438af6",
"status": "affected",
"version": "5940d1cf9f42f67e9cc3f7df9eda39f5888d6e9e",
"versionType": "git"
},
{
"lessThan": "a2d4e9a76de0b2178001214ba5de5bf94a7354aa",
"status": "affected",
"version": "5940d1cf9f42f67e9cc3f7df9eda39f5888d6e9e",
"versionType": "git"
},
{
"lessThan": "dd2fdc3504592d85e549c523b054898a036a6afe",
"status": "affected",
"version": "5940d1cf9f42f67e9cc3f7df9eda39f5888d6e9e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/auth_gss/auth_gss.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: fix gss_auth kref leak in gss_alloc_msg error path\n\nCommit 5940d1cf9f42 (\"SUNRPC: Rebalance a kref in auth_gss.c\") added\na kref_get(\u0026gss_auth-\u003ekref) call to balance the gss_put_auth() done\nin gss_release_msg(), but forgot to add a corresponding kref_put()\non the error path when kstrdup_const() fails.\n\nIf service_name is non-NULL and kstrdup_const() fails, the function\njumps to err_put_pipe_version which calls put_pipe_version() and\nkfree(gss_msg), but never releases the gss_auth reference. This leads\nto a kref leak where the gss_auth structure is never freed.\n\nAdd a forward declaration for gss_free_callback() and call kref_put()\nin the err_put_pipe_version error path to properly release the\nreference taken earlier."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:18:22.052Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3b2b6c42070ce4204936288253baf101e995c2d3"
},
{
"url": "https://git.kernel.org/stable/c/b559be2ec6cdb2e9c2c36c23fbbd4690d8a5c3f7"
},
{
"url": "https://git.kernel.org/stable/c/a1bc9561b617ec7e2d09e6c134d1db8fcf9ca4a6"
},
{
"url": "https://git.kernel.org/stable/c/655c9ba9915f05266998dbbf4b76b3c79b8a70aa"
},
{
"url": "https://git.kernel.org/stable/c/e464e26b2457005c87e158570498274b9f3b90c7"
},
{
"url": "https://git.kernel.org/stable/c/c20f925214249bb4fc04f7e197bea142a6438af6"
},
{
"url": "https://git.kernel.org/stable/c/a2d4e9a76de0b2178001214ba5de5bf94a7354aa"
},
{
"url": "https://git.kernel.org/stable/c/dd2fdc3504592d85e549c523b054898a036a6afe"
}
],
"title": "SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45964",
"datePublished": "2026-05-27T12:18:22.052Z",
"dateReserved": "2026-05-13T15:03:33.089Z",
"dateUpdated": "2026-05-27T12:18:22.052Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53203 (GCVE-0-2026-53203)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
accel/ivpu: Add buffer overflow check in MS get_info_ioctl
Add validation that the info size returned from the metric stream info
query is not exceeded when checked against the allocated buffer size.
If the firmware returns a size larger than the buffer, reject the
operation with -EOVERFLOW instead of proceeding with an incorrect
buffer copy.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s `accel/ivpu` component. This vulnerability, a buffer overflow, occurs when the firmware returns a size larger than the allocated buffer during a metric stream information query. This can lead to an incorrect buffer copy, potentially causing system instability or denial of service."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:44:29.981Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53203"
},
{
"name": "RHBZ#2492798",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492798"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53203.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: accel/ivpu: Add buffer overflow check in MS get_info_ioctl",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/accel/ivpu/ivpu_ms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d3c12ed33e8923f3090909a1738f3e59292996a6",
"status": "affected",
"version": "cdfad4db7756563db7d458216d9e3c2651dddc7d",
"versionType": "git"
},
{
"lessThan": "fa598556ecef412edcb391f144b7642e18fdfd45",
"status": "affected",
"version": "cdfad4db7756563db7d458216d9e3c2651dddc7d",
"versionType": "git"
},
{
"lessThan": "4e5047cc94bea1cc7b670b7f503358e9af0542df",
"status": "affected",
"version": "cdfad4db7756563db7d458216d9e3c2651dddc7d",
"versionType": "git"
},
{
"lessThan": "fb176425837693f50c5c9fc8db6fbb04af22bd0a",
"status": "affected",
"version": "cdfad4db7756563db7d458216d9e3c2651dddc7d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/accel/ivpu/ivpu_ms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/ivpu: Add buffer overflow check in MS get_info_ioctl\n\nAdd validation that the info size returned from the metric stream info\nquery is not exceeded when checked against the allocated buffer size.\nIf the firmware returns a size larger than the buffer, reject the\noperation with -EOVERFLOW instead of proceeding with an incorrect\nbuffer copy."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is a DRM accel ioctl on the local `/dev/accel/accel*` device, reached through `DRM_IOCTL_IVPU_METRIC_STREAMER_GET_INFO`. It is not reachable over the network or by adjacent/physical input.\nAC:L - The attacker controls the ioctl arguments, including the metric group mask and user buffer size, and there is no race or hard-to-win timing condition. Triggering the overlong copy depends on normal firmware response data for selected metrics, not on conditions outside the attacker\u2019s control in the vulnerable path.\nPR:L - A local user with access to the accelerator device node can open the device and issue the ioctl; the driver ioctl has no capability, master, or root-only check. This does not require real root/admin privileges.\nUI:N - After the attacker has local access to the device node, exploitation is performed directly by issuing ioctls. No victim action such as opening a file or mounting a filesystem is required.\nS:U - The issue is within the kernel driver and impacts kernel-managed resources on the same system. It is not a VM escape, IOMMU boundary bypass, or cross-authority scope change.\nC:H - The firmware-reported `info_size` was used as the `copy_to_user()` length without verifying it fits in the fixed 64 KiB kernel buffer, enabling an out-of-bounds kernel read into userspace. Under the higher-severity rule, this is treated as high confidentiality impact because adjacent kernel memory may be disclosed.\nI:N - The vulnerable host-side operation is an overlong copy from kernel memory to userspace, and the fix prevents that incorrect buffer copy. No kernel write primitive or data modification path is evident from this bug.\nA:H - An overlong kernel-source copy can run past the mapped buffer into invalid or sensitive kernel virtual memory and may fault or destabilize the kernel. Under the required higher-severity rule, the plausible local DoS impact is scored high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:07.179Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d3c12ed33e8923f3090909a1738f3e59292996a6"
},
{
"url": "https://git.kernel.org/stable/c/fa598556ecef412edcb391f144b7642e18fdfd45"
},
{
"url": "https://git.kernel.org/stable/c/4e5047cc94bea1cc7b670b7f503358e9af0542df"
},
{
"url": "https://git.kernel.org/stable/c/fb176425837693f50c5c9fc8db6fbb04af22bd0a"
}
],
"title": "accel/ivpu: Add buffer overflow check in MS get_info_ioctl",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53203",
"datePublished": "2026-06-25T08:39:10.950Z",
"dateReserved": "2026-06-09T07:44:35.391Z",
"dateUpdated": "2026-08-05T12:34:07.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43384 (GCVE-0-2026-43384)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/tcp-ao: Fix MAC comparison to be constant-time
To prevent timing attacks, MACs need to be compared in constant
time. Use the appropriate helper function for this.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/Kconfig",
"net/ipv4/tcp_ao.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8be6ed64966da48b6c4726918f106c18742a5125",
"status": "affected",
"version": "0a3a809089eb1d4a0a2fd0c16b520d603988c859",
"versionType": "git"
},
{
"lessThan": "a269cbdc442f8658bca35383e34b9d0b0ff95a1c",
"status": "affected",
"version": "0a3a809089eb1d4a0a2fd0c16b520d603988c859",
"versionType": "git"
},
{
"lessThan": "080b0e210088296dd50d6637c06c1db14246adfe",
"status": "affected",
"version": "0a3a809089eb1d4a0a2fd0c16b520d603988c859",
"versionType": "git"
},
{
"lessThan": "67edfec516d30d3e62925c397be4a1e5185802fc",
"status": "affected",
"version": "0a3a809089eb1d4a0a2fd0c16b520d603988c859",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/Kconfig",
"net/ipv4/tcp_ao.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tcp-ao: Fix MAC comparison to be constant-time\n\nTo prevent timing attacks, MACs need to be compared in constant\ntime. Use the appropriate helper function for this."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable comparison is reached by inbound IPv4/IPv6 TCP packets carrying a TCP-AO option, before normal TCP processing of the segment.\nAC:L - The attacker controls the candidate MAC bytes and can send repeated chosen packets to average timing differences; no race or condition outside the attacker\u2019s control is required once a TCP-AO-protected socket is reachable.\nPR:N - The vulnerable path is the TCP-AO authentication check itself, so the attacker does not need the AO key or any local privilege before sending probes.\nUI:N - No victim user action is required; packet receipt by the configured TCP-AO endpoint is sufficient.\nS:U - The impact remains within the kernel/network endpoint and the TCP sessions protected by that endpoint, with no VM, sandbox, or separate security-authority escape.\nC:H - A successful MAC-forgery timing attack can let an unauthenticated network attacker impersonate a trusted TCP-AO peer and receive data made available to that authenticated peer.\nI:H - Forged valid TCP-AO segments can inject or alter arbitrary TCP stream/control data for protected connections, defeating the integrity guarantee TCP-AO is meant to provide.\nA:H - Forged valid TCP-AO control segments such as RST/FIN or malicious stream data can tear down or disrupt protected long-lived sessions such as routing/control-plane connections."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:42.918Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8be6ed64966da48b6c4726918f106c18742a5125"
},
{
"url": "https://git.kernel.org/stable/c/a269cbdc442f8658bca35383e34b9d0b0ff95a1c"
},
{
"url": "https://git.kernel.org/stable/c/080b0e210088296dd50d6637c06c1db14246adfe"
},
{
"url": "https://git.kernel.org/stable/c/67edfec516d30d3e62925c397be4a1e5185802fc"
}
],
"title": "net/tcp-ao: Fix MAC comparison to be constant-time",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43384",
"datePublished": "2026-05-08T14:21:31.355Z",
"dateReserved": "2026-05-01T14:12:56.006Z",
"dateUpdated": "2026-08-05T12:27:42.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43497 (GCVE-0-2026-43497)
Vulnerability from cvelistv5
Published
2026-05-21 12:12
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
dlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages
to userspace but sets no vm_ops on the VMA. This means the kernel cannot
track active mmaps. When dlfb_realloc_framebuffer() replaces the backing
buffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated.
On USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages
while userspace PTEs still reference them, resulting in a use-after-free:
the process retains read/write access to freed kernel pages.
Add vm_operations_struct with open/close callbacks that maintain an
atomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(),
check mmap_count and return -EBUSY if the buffer is currently mapped,
preventing buffer replacement while userspace holds stale PTEs.
Tested with PoC using dummy_hcd + raw_gadget USB device emulation.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7433914efd584b22bb49d3e1eee001f5d0525ecd Version: 7433914efd584b22bb49d3e1eee001f5d0525ecd Version: 7433914efd584b22bb49d3e1eee001f5d0525ecd Version: 7433914efd584b22bb49d3e1eee001f5d0525ecd Version: 7433914efd584b22bb49d3e1eee001f5d0525ecd Version: 7433914efd584b22bb49d3e1eee001f5d0525ecd Version: 7433914efd584b22bb49d3e1eee001f5d0525ecd Version: 7433914efd584b22bb49d3e1eee001f5d0525ecd |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/udlfb.c",
"include/video/udlfb.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "60f711cfd580f86fea8284146ac133804e728f9a",
"status": "affected",
"version": "7433914efd584b22bb49d3e1eee001f5d0525ecd",
"versionType": "git"
},
{
"lessThan": "5931f5651ee32bd41b3323256b31fcc8e71336ed",
"status": "affected",
"version": "7433914efd584b22bb49d3e1eee001f5d0525ecd",
"versionType": "git"
},
{
"lessThan": "e3d9865dacd7435b8465848428210d0f0c673311",
"status": "affected",
"version": "7433914efd584b22bb49d3e1eee001f5d0525ecd",
"versionType": "git"
},
{
"lessThan": "4f312c30f0368e8d2a76aa650dff73f23490b5e7",
"status": "affected",
"version": "7433914efd584b22bb49d3e1eee001f5d0525ecd",
"versionType": "git"
},
{
"lessThan": "18dd358de72d57993422cbb5dfb29ccd74efe192",
"status": "affected",
"version": "7433914efd584b22bb49d3e1eee001f5d0525ecd",
"versionType": "git"
},
{
"lessThan": "da9b065cedfd3b574f229d5be594e6aa47a27ae6",
"status": "affected",
"version": "7433914efd584b22bb49d3e1eee001f5d0525ecd",
"versionType": "git"
},
{
"lessThan": "a2c53a3822ee26e8d758071815b9ed3bf6669fc1",
"status": "affected",
"version": "7433914efd584b22bb49d3e1eee001f5d0525ecd",
"versionType": "git"
},
{
"lessThan": "8de779dc40d35d39fa07387b6f921eb11df0f511",
"status": "affected",
"version": "7433914efd584b22bb49d3e1eee001f5d0525ecd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/udlfb.c",
"include/video/udlfb.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free\n\ndlfb_ops_mmap() uses remap_pfn_range() to map vmalloc framebuffer pages\nto userspace but sets no vm_ops on the VMA. This means the kernel cannot\ntrack active mmaps. When dlfb_realloc_framebuffer() replaces the backing\nbuffer via FBIOPUT_VSCREENINFO, existing mmap PTEs are not invalidated.\nOn USB disconnect, dlfb_ops_destroy() calls vfree() on the old pages\nwhile userspace PTEs still reference them, resulting in a use-after-free:\nthe process retains read/write access to freed kernel pages.\n\nAdd vm_operations_struct with open/close callbacks that maintain an\natomic mmap_count on struct dlfb_data. In dlfb_realloc_framebuffer(),\ncheck mmap_count and return -EBUSY if the buffer is currently mapped,\npreventing buffer replacement while userspace holds stale PTEs.\n\nTested with PoC using dummy_hcd + raw_gadget USB device emulation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The entire exploit is driven by local syscalls (open/mmap/FBIOPUT_VSCREENINFO/close) on the /dev/fbN character device; the attacker is a local software user, not a malicious USB device feeding crafted data, so the vector to the vulnerable component is local rather than physical.\nAC:L - The attacker reliably performs the mmap + realloc-via-ioctl + close sequence and can detect the disconnect before closing; the freed-page mapping is then deterministic with no race or uncontrolled memory-layout condition required to trigger the UAF.\nPR:L - Exploitation requires read/write access to the framebuffer device node, which is available to an ordinary logged-in/video-group user (or kiosk app user) but not to a fully unprivileged unauthenticated actor.\nUI:R - The freeing vfree only runs after a USB disconnect (unregister_framebuffer), so completing the exploit depends on a disconnect event (undock/unplug) performed by the user or environment rather than by the attacker\u0027s own code.\nS:U - The use-after-free corrupts kernel memory within the same security authority (the kernel); there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The process keeps a read mapping to freed pages that are recycled for arbitrary kernel allocations, allowing disclosure of arbitrary kernel memory.\nI:H - The same mapping retains write access to the freed pages once reused by other kernel objects, providing an arbitrary-write primitive suitable for privilege escalation or control-flow hijack.\nA:H - A use-after-free of freed kernel pages readily causes memory corruption and a kernel panic/oops."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:19.915Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/60f711cfd580f86fea8284146ac133804e728f9a"
},
{
"url": "https://git.kernel.org/stable/c/5931f5651ee32bd41b3323256b31fcc8e71336ed"
},
{
"url": "https://git.kernel.org/stable/c/e3d9865dacd7435b8465848428210d0f0c673311"
},
{
"url": "https://git.kernel.org/stable/c/4f312c30f0368e8d2a76aa650dff73f23490b5e7"
},
{
"url": "https://git.kernel.org/stable/c/18dd358de72d57993422cbb5dfb29ccd74efe192"
},
{
"url": "https://git.kernel.org/stable/c/da9b065cedfd3b574f229d5be594e6aa47a27ae6"
},
{
"url": "https://git.kernel.org/stable/c/a2c53a3822ee26e8d758071815b9ed3bf6669fc1"
},
{
"url": "https://git.kernel.org/stable/c/8de779dc40d35d39fa07387b6f921eb11df0f511"
}
],
"title": "fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43497",
"datePublished": "2026-05-21T12:12:47.150Z",
"dateReserved": "2026-05-01T14:12:56.013Z",
"dateUpdated": "2026-08-05T12:28:19.915Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45851 (GCVE-0-2026-45851)
Vulnerability from cvelistv5
Published
2026-05-27 12:15
Modified
2026-05-27 12:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
efi: Fix reservation of unaccepted memory table
The reserve_unaccepted() function incorrectly calculates the size of the
memblock reservation for the unaccepted memory table. It aligns the
size of the table, but fails to account for cases where the table's
starting physical address (efi.unaccepted) is not page-aligned.
If the table starts at an offset within a page and its end crosses into
a subsequent page that the aligned size does not cover, the end of the
table will not be reserved. This can lead to the table being overwritten
or inaccessible, causing a kernel panic in accept_memory().
This issue was observed when starting Intel TDX VMs with specific memory
sizes (e.g., > 64GB).
Fix this by calculating the end address first (including the unaligned
start) and then aligning it up, ensuring the entire range is covered
by the reservation.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/efi/efi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b7bc182ec1846be437351e44164089d988f9d0dd",
"status": "affected",
"version": "8dbe33956d96c9d066ef15ca933ede30748198b2",
"versionType": "git"
},
{
"lessThan": "ba6b6f1502fa55621d1db23f253d54322bdbe4e0",
"status": "affected",
"version": "8dbe33956d96c9d066ef15ca933ede30748198b2",
"versionType": "git"
},
{
"lessThan": "9b18bf59977f5c5bc3b11b210520f62500a7adf3",
"status": "affected",
"version": "8dbe33956d96c9d066ef15ca933ede30748198b2",
"versionType": "git"
},
{
"lessThan": "e649b5916725c68f44ebf45fb396df563c5dbaf2",
"status": "affected",
"version": "8dbe33956d96c9d066ef15ca933ede30748198b2",
"versionType": "git"
},
{
"lessThan": "0862438c90487e79822d5647f854977d50381505",
"status": "affected",
"version": "8dbe33956d96c9d066ef15ca933ede30748198b2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/efi/efi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi: Fix reservation of unaccepted memory table\n\nThe reserve_unaccepted() function incorrectly calculates the size of the\nmemblock reservation for the unaccepted memory table. It aligns the\nsize of the table, but fails to account for cases where the table\u0027s\nstarting physical address (efi.unaccepted) is not page-aligned.\n\nIf the table starts at an offset within a page and its end crosses into\na subsequent page that the aligned size does not cover, the end of the\ntable will not be reserved. This can lead to the table being overwritten\nor inaccessible, causing a kernel panic in accept_memory().\n\nThis issue was observed when starting Intel TDX VMs with specific memory\nsizes (e.g., \u003e 64GB).\n\nFix this by calculating the end address first (including the unaligned\nstart) and then aligning it up, ensuring the entire range is covered\nby the reservation."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:15:23.221Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b7bc182ec1846be437351e44164089d988f9d0dd"
},
{
"url": "https://git.kernel.org/stable/c/ba6b6f1502fa55621d1db23f253d54322bdbe4e0"
},
{
"url": "https://git.kernel.org/stable/c/9b18bf59977f5c5bc3b11b210520f62500a7adf3"
},
{
"url": "https://git.kernel.org/stable/c/e649b5916725c68f44ebf45fb396df563c5dbaf2"
},
{
"url": "https://git.kernel.org/stable/c/0862438c90487e79822d5647f854977d50381505"
}
],
"title": "efi: Fix reservation of unaccepted memory table",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45851",
"datePublished": "2026-05-27T12:15:23.221Z",
"dateReserved": "2026-05-13T15:03:33.079Z",
"dateUpdated": "2026-05-27T12:15:23.221Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43221 (GCVE-0-2026-43221)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipmi: ipmb: initialise event handler read bytes
IPMB doesn't use i2c reads, but the handler needs to set a value.
Otherwise an i2c read will return an uninitialised value from the bus
driver.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 63c4eb347164845b380089012fe43992511c0ad3 Version: 63c4eb347164845b380089012fe43992511c0ad3 Version: 63c4eb347164845b380089012fe43992511c0ad3 Version: 63c4eb347164845b380089012fe43992511c0ad3 Version: 63c4eb347164845b380089012fe43992511c0ad3 Version: 63c4eb347164845b380089012fe43992511c0ad3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_ipmb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "905554ebd76aeee370bfd5136ea11e0b9d75c6f1",
"status": "affected",
"version": "63c4eb347164845b380089012fe43992511c0ad3",
"versionType": "git"
},
{
"lessThan": "56d5c0557e53c4d8d92a619fa83eaae178165e07",
"status": "affected",
"version": "63c4eb347164845b380089012fe43992511c0ad3",
"versionType": "git"
},
{
"lessThan": "2dfbc8c17dd161885336e77e71c336cd62cf6748",
"status": "affected",
"version": "63c4eb347164845b380089012fe43992511c0ad3",
"versionType": "git"
},
{
"lessThan": "f726b3a57e00bb6249c67714c11ae8b4b31719a1",
"status": "affected",
"version": "63c4eb347164845b380089012fe43992511c0ad3",
"versionType": "git"
},
{
"lessThan": "102712417bb6aa9a00d852bc59cb0a276db486c4",
"status": "affected",
"version": "63c4eb347164845b380089012fe43992511c0ad3",
"versionType": "git"
},
{
"lessThan": "9f235ccecd03c436cb1683eac16b12f119e54aa9",
"status": "affected",
"version": "63c4eb347164845b380089012fe43992511c0ad3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_ipmb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: ipmb: initialise event handler read bytes\n\nIPMB doesn\u0027t use i2c reads, but the handler needs to set a value.\nOtherwise an i2c read will return an uninitialised value from the bus\ndriver."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:20:20.815Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/905554ebd76aeee370bfd5136ea11e0b9d75c6f1"
},
{
"url": "https://git.kernel.org/stable/c/56d5c0557e53c4d8d92a619fa83eaae178165e07"
},
{
"url": "https://git.kernel.org/stable/c/2dfbc8c17dd161885336e77e71c336cd62cf6748"
},
{
"url": "https://git.kernel.org/stable/c/f726b3a57e00bb6249c67714c11ae8b4b31719a1"
},
{
"url": "https://git.kernel.org/stable/c/102712417bb6aa9a00d852bc59cb0a276db486c4"
},
{
"url": "https://git.kernel.org/stable/c/9f235ccecd03c436cb1683eac16b12f119e54aa9"
}
],
"title": "ipmi: ipmb: initialise event handler read bytes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43221",
"datePublished": "2026-05-06T11:28:21.579Z",
"dateReserved": "2026-05-01T14:12:55.994Z",
"dateUpdated": "2026-05-11T22:20:20.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43204 (GCVE-0-2026-43204)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: qcom: q6asm: drop DSP responses for closed data streams
'Commit a354f030dbce ("ASoC: qcom: q6asm: handle the responses
after closing")' attempted to ignore DSP responses arriving
after a stream had been closed.
However, those responses were still handled, causing lockups.
Fix this by unconditionally dropping all DSP responses associated with
closed data streams.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/qcom/qdsp6/q6asm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3249251eac6081d5169ba09f2d9cca66ab0cab0d",
"status": "affected",
"version": "68fd8480bb7baaf361e983f75d8571f25e017c67",
"versionType": "git"
},
{
"lessThan": "8a066a81ee0c1b6cdbd81393536c3b2d19ccef25",
"status": "affected",
"version": "68fd8480bb7baaf361e983f75d8571f25e017c67",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/qcom/qdsp6/q6asm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: q6asm: drop DSP responses for closed data streams\n\n\u0027Commit a354f030dbce (\"ASoC: qcom: q6asm: handle the responses\nafter closing\")\u0027 attempted to ignore DSP responses arriving\nafter a stream had been closed.\n\nHowever, those responses were still handled, causing lockups.\n\nFix this by unconditionally dropping all DSP responses associated with\nclosed data streams."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:19:59.847Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3249251eac6081d5169ba09f2d9cca66ab0cab0d"
},
{
"url": "https://git.kernel.org/stable/c/8a066a81ee0c1b6cdbd81393536c3b2d19ccef25"
}
],
"title": "ASoC: qcom: q6asm: drop DSP responses for closed data streams",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43204",
"datePublished": "2026-05-06T11:28:09.617Z",
"dateReserved": "2026-05-01T14:12:55.992Z",
"dateUpdated": "2026-05-11T22:19:59.847Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46089 (GCVE-0-2026-46089)
Vulnerability from cvelistv5
Published
2026-05-27 12:58
Modified
2026-06-14 17:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
zram: do not forget to endio for partial discard requests
As reported by Qu Wenruo and Avinesh Kumar, the following
getconf PAGESIZE
65536
blkdiscard -p 4k /dev/zram0
takes literally forever to complete. zram doesn't support partial
discards and just returns immediately w/o doing any discard work in such
cases. The problem is that we forget to endio on our way out, so
blkdiscard sleeps forever in submit_bio_wait(). Fix this by jumping to
end_bio label, which does bio_endio().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/block/zram/zram_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2d1f18efccdb8b29552399d024c36b705447e975",
"status": "affected",
"version": "0120dd6e4e202e19a0e011e486fb2da40a5ea279",
"versionType": "git"
},
{
"lessThan": "35d3300f6357cfaa72db2721dc2b345b19bac5df",
"status": "affected",
"version": "0120dd6e4e202e19a0e011e486fb2da40a5ea279",
"versionType": "git"
},
{
"lessThan": "a02363f71a79b755daa78a70d6b217f9c13c8c85",
"status": "affected",
"version": "0120dd6e4e202e19a0e011e486fb2da40a5ea279",
"versionType": "git"
},
{
"lessThan": "68ce397e8236088fc53b9532d383a722288c8194",
"status": "affected",
"version": "0120dd6e4e202e19a0e011e486fb2da40a5ea279",
"versionType": "git"
},
{
"lessThan": "e3668b371329ea036ff022ce8ecc82f8befcf003",
"status": "affected",
"version": "0120dd6e4e202e19a0e011e486fb2da40a5ea279",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/block/zram/zram_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nzram: do not forget to endio for partial discard requests\n\nAs reported by Qu Wenruo and Avinesh Kumar, the following\n\n getconf PAGESIZE\n 65536\n blkdiscard -p 4k /dev/zram0\n\ntakes literally forever to complete. zram doesn\u0027t support partial\ndiscards and just returns immediately w/o doing any discard work in such\ncases. The problem is that we forget to endio on our way out, so\nblkdiscard sleeps forever in submit_bio_wait(). Fix this by jumping to\nend_bio label, which does bio_endio()."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:53:34.164Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2d1f18efccdb8b29552399d024c36b705447e975"
},
{
"url": "https://git.kernel.org/stable/c/35d3300f6357cfaa72db2721dc2b345b19bac5df"
},
{
"url": "https://git.kernel.org/stable/c/a02363f71a79b755daa78a70d6b217f9c13c8c85"
},
{
"url": "https://git.kernel.org/stable/c/68ce397e8236088fc53b9532d383a722288c8194"
},
{
"url": "https://git.kernel.org/stable/c/e3668b371329ea036ff022ce8ecc82f8befcf003"
}
],
"title": "zram: do not forget to endio for partial discard requests",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46089",
"datePublished": "2026-05-27T12:58:32.606Z",
"dateReserved": "2026-05-13T15:03:33.096Z",
"dateUpdated": "2026-06-14T17:53:34.164Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43381 (GCVE-0-2026-43381)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-05-11 22:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
If we have runtime suspended, and userspace wants to use /dev/drm_dp_*
then just tell it the device is busy instead of crashing in the GSP
code.
WARNING: CPU: 2 PID: 565741 at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c:164 r535_gsp_msgq_wait+0x9a/0xb0 [nouveau]
CPU: 2 UID: 0 PID: 565741 Comm: fwupd Not tainted 6.18.10-200.fc43.x86_64 #1 PREEMPT(lazy)
Hardware name: LENOVO 20QTS0PQ00/20QTS0PQ00, BIOS N2OET65W (1.52 ) 08/05/2024
RIP: 0010:r535_gsp_msgq_wait+0x9a/0xb0 [nouveau]
This is a simple fix to get backported. We should probably engineer a
proper power domain solution to wake up devices and keep them awake
while fw updates are happening.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8894f4919bc43f821775db2cfff4b917871b2102 Version: 8894f4919bc43f821775db2cfff4b917871b2102 Version: 8894f4919bc43f821775db2cfff4b917871b2102 Version: 8894f4919bc43f821775db2cfff4b917871b2102 Version: 8894f4919bc43f821775db2cfff4b917871b2102 Version: 8894f4919bc43f821775db2cfff4b917871b2102 Version: 8894f4919bc43f821775db2cfff4b917871b2102 Version: 8894f4919bc43f821775db2cfff4b917871b2102 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/nouveau/nouveau_connector.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "178df7c91e6c202579284df9f79d1592a514cdcf",
"status": "affected",
"version": "8894f4919bc43f821775db2cfff4b917871b2102",
"versionType": "git"
},
{
"lessThan": "4df518aa196085909fd7e32518ecd27fba60ed69",
"status": "affected",
"version": "8894f4919bc43f821775db2cfff4b917871b2102",
"versionType": "git"
},
{
"lessThan": "cd24cab2023aa46b595bc6b9cc39d8973d9d0a8c",
"status": "affected",
"version": "8894f4919bc43f821775db2cfff4b917871b2102",
"versionType": "git"
},
{
"lessThan": "fad178ae894930520519ead3c8e0150641466360",
"status": "affected",
"version": "8894f4919bc43f821775db2cfff4b917871b2102",
"versionType": "git"
},
{
"lessThan": "6bdd2d70c338d52c387d3b3aadc596784ae81b01",
"status": "affected",
"version": "8894f4919bc43f821775db2cfff4b917871b2102",
"versionType": "git"
},
{
"lessThan": "ad8fa5bff53f5d1f8394f996850da8ce070eaee3",
"status": "affected",
"version": "8894f4919bc43f821775db2cfff4b917871b2102",
"versionType": "git"
},
{
"lessThan": "24639553a016578222ac597db924dfb6fa5ec8b5",
"status": "affected",
"version": "8894f4919bc43f821775db2cfff4b917871b2102",
"versionType": "git"
},
{
"lessThan": "8f3c6f08ababad2e3bdd239728cf66a9949446b4",
"status": "affected",
"version": "8894f4919bc43f821775db2cfff4b917871b2102",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/nouveau/nouveau_connector.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnouveau/dpcd: return EBUSY for aux xfer if the device is asleep\n\nIf we have runtime suspended, and userspace wants to use /dev/drm_dp_*\nthen just tell it the device is busy instead of crashing in the GSP\ncode.\n\nWARNING: CPU: 2 PID: 565741 at drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/rpc.c:164 r535_gsp_msgq_wait+0x9a/0xb0 [nouveau]\nCPU: 2 UID: 0 PID: 565741 Comm: fwupd Not tainted 6.18.10-200.fc43.x86_64 #1 PREEMPT(lazy)\nHardware name: LENOVO 20QTS0PQ00/20QTS0PQ00, BIOS N2OET65W (1.52 ) 08/05/2024\nRIP: 0010:r535_gsp_msgq_wait+0x9a/0xb0 [nouveau]\n\nThis is a simple fix to get backported. We should probably engineer a\nproper power domain solution to wake up devices and keep them awake\nwhile fw updates are happening."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:23:29.324Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/178df7c91e6c202579284df9f79d1592a514cdcf"
},
{
"url": "https://git.kernel.org/stable/c/4df518aa196085909fd7e32518ecd27fba60ed69"
},
{
"url": "https://git.kernel.org/stable/c/cd24cab2023aa46b595bc6b9cc39d8973d9d0a8c"
},
{
"url": "https://git.kernel.org/stable/c/fad178ae894930520519ead3c8e0150641466360"
},
{
"url": "https://git.kernel.org/stable/c/6bdd2d70c338d52c387d3b3aadc596784ae81b01"
},
{
"url": "https://git.kernel.org/stable/c/ad8fa5bff53f5d1f8394f996850da8ce070eaee3"
},
{
"url": "https://git.kernel.org/stable/c/24639553a016578222ac597db924dfb6fa5ec8b5"
},
{
"url": "https://git.kernel.org/stable/c/8f3c6f08ababad2e3bdd239728cf66a9949446b4"
}
],
"title": "nouveau/dpcd: return EBUSY for aux xfer if the device is asleep",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43381",
"datePublished": "2026-05-08T14:21:29.340Z",
"dateReserved": "2026-05-01T14:12:56.006Z",
"dateUpdated": "2026-05-11T22:23:29.324Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31758 (GCVE-0-2026-31758)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-08-05 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: usbtmc: Flush anchored URBs in usbtmc_release
When calling usbtmc_release, pending anchored URBs must be flushed or
killed to prevent use-after-free errors (e.g. in the HCD giveback
path). Call usbtmc_draw_down() to allow anchored URBs to be completed.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4f3c8d6eddc272b386464524235440a418ed2029 Version: 4f3c8d6eddc272b386464524235440a418ed2029 Version: 4f3c8d6eddc272b386464524235440a418ed2029 Version: 4f3c8d6eddc272b386464524235440a418ed2029 Version: 4f3c8d6eddc272b386464524235440a418ed2029 Version: 4f3c8d6eddc272b386464524235440a418ed2029 Version: 4f3c8d6eddc272b386464524235440a418ed2029 Version: 4f3c8d6eddc272b386464524235440a418ed2029 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/class/usbtmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "959ef329071136e4335b54822fe2f607659b4569",
"status": "affected",
"version": "4f3c8d6eddc272b386464524235440a418ed2029",
"versionType": "git"
},
{
"lessThan": "e189d443767f7cd390c52f2e122e1fc41c7562d6",
"status": "affected",
"version": "4f3c8d6eddc272b386464524235440a418ed2029",
"versionType": "git"
},
{
"lessThan": "7fa8f61bab3fb75b5deba8a0f3abb74dc5068d9f",
"status": "affected",
"version": "4f3c8d6eddc272b386464524235440a418ed2029",
"versionType": "git"
},
{
"lessThan": "95e09b07e50290254b28b8395509473104518f8c",
"status": "affected",
"version": "4f3c8d6eddc272b386464524235440a418ed2029",
"versionType": "git"
},
{
"lessThan": "d13318dec0c1e0e2ac16f8ecbd522db14cea4bb1",
"status": "affected",
"version": "4f3c8d6eddc272b386464524235440a418ed2029",
"versionType": "git"
},
{
"lessThan": "977b632db51d231dec0bc571089a5c2402674139",
"status": "affected",
"version": "4f3c8d6eddc272b386464524235440a418ed2029",
"versionType": "git"
},
{
"lessThan": "d40198de50232e04c14c6e2092e896766c95ea48",
"status": "affected",
"version": "4f3c8d6eddc272b386464524235440a418ed2029",
"versionType": "git"
},
{
"lessThan": "8a768552f7a8276fb9e01d49773d2094ace7c8f1",
"status": "affected",
"version": "4f3c8d6eddc272b386464524235440a418ed2029",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/class/usbtmc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usbtmc: Flush anchored URBs in usbtmc_release\n\nWhen calling usbtmc_release, pending anchored URBs must be flushed or\nkilled to prevent use-after-free errors (e.g. in the HCD giveback\npath). Call usbtmc_draw_down() to allow anchored URBs to be completed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local syscalls on the registered /dev/usbtmc* character device: open, asynchronous ioctl/read/write submission, then release. A USBTMC device must be present, but exploitation is driven from local device-file operations rather than network traffic.\nAC:L - The attacker can deliberately submit asynchronous URBs and drop the file reference before completion; the missing release-time drawdown makes the UAF deterministic enough to trigger. Any completion timing needed can be influenced by repeated attempts and, in the strongest scenario, by a controlled USBTMC device.\nPR:L - There are no capability or namespace-sensitive privilege checks in the usbtmc open/ioctl/release path. The attacker only needs ordinary local access sufficient to open the /dev/usbtmc* node.\nUI:N - No separate victim action is required once the attacker can access the device node. The attacker can open the file, issue the async operation, and cause release themselves.\nS:U - The corruption occurs within kernel USB/driver memory and affects the same kernel security authority. This is standard kernel memory corruption, not a VM, IOMMU, or sandbox boundary escape by itself.\nC:H - This is a use-after-free of per-file kernel state containing embedded USB anchors and callback context. Per the kernel scoring guidance, UAF memory corruption can be leveraged for high-impact information disclosure.\nI:H - The HCD giveback path and completion callbacks write through freed file_data/anchor memory, giving a heap corruption primitive. UAF corruption is defensibly scored as high integrity impact because it can support arbitrary write or control-flow exploitation.\nA:H - Syzbot reproduced a KASAN slab-use-after-free write in the USB giveback path after usbtmc_release freed the object. Even without full exploitation, this can crash or destabilize the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:58.211Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/959ef329071136e4335b54822fe2f607659b4569"
},
{
"url": "https://git.kernel.org/stable/c/e189d443767f7cd390c52f2e122e1fc41c7562d6"
},
{
"url": "https://git.kernel.org/stable/c/7fa8f61bab3fb75b5deba8a0f3abb74dc5068d9f"
},
{
"url": "https://git.kernel.org/stable/c/95e09b07e50290254b28b8395509473104518f8c"
},
{
"url": "https://git.kernel.org/stable/c/d13318dec0c1e0e2ac16f8ecbd522db14cea4bb1"
},
{
"url": "https://git.kernel.org/stable/c/977b632db51d231dec0bc571089a5c2402674139"
},
{
"url": "https://git.kernel.org/stable/c/d40198de50232e04c14c6e2092e896766c95ea48"
},
{
"url": "https://git.kernel.org/stable/c/8a768552f7a8276fb9e01d49773d2094ace7c8f1"
}
],
"title": "usb: usbtmc: Flush anchored URBs in usbtmc_release",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31758",
"datePublished": "2026-05-01T14:14:48.390Z",
"dateReserved": "2026-03-09T15:48:24.139Z",
"dateUpdated": "2026-08-05T12:24:58.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46179 (GCVE-0-2026-46179)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-06-14 18:00
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Don't allow pointer operations on unconfigured streams
When reporting the pointer for a compressed stream we report the current
I/O frame position by dividing the position by the number of channels
multiplied by the number of container bytes. These values default to 0 and
are only configured as part of setting the stream parameters so this allows
a divide by zero to be configured. Validate that they are non zero,
returning an error if not
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c1a731c71359407eae4fd0a5fd675ef25a582764 Version: c1a731c71359407eae4fd0a5fd675ef25a582764 Version: c1a731c71359407eae4fd0a5fd675ef25a582764 Version: c1a731c71359407eae4fd0a5fd675ef25a582764 Version: c1a731c71359407eae4fd0a5fd675ef25a582764 Version: c1a731c71359407eae4fd0a5fd675ef25a582764 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/compress.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "76ff6bfc9a809571793f425ba99f6a759108dcf8",
"status": "affected",
"version": "c1a731c71359407eae4fd0a5fd675ef25a582764",
"versionType": "git"
},
{
"lessThan": "327a64241f30c74b6f35537eb9e1fc6c3cbe060b",
"status": "affected",
"version": "c1a731c71359407eae4fd0a5fd675ef25a582764",
"versionType": "git"
},
{
"lessThan": "98ed1383f597f8a45b6cb816bb20b96d46eeceda",
"status": "affected",
"version": "c1a731c71359407eae4fd0a5fd675ef25a582764",
"versionType": "git"
},
{
"lessThan": "0f0c0c1397a42aacaacae828206ee1b921623952",
"status": "affected",
"version": "c1a731c71359407eae4fd0a5fd675ef25a582764",
"versionType": "git"
},
{
"lessThan": "4f42dd01f5217465f23a763e27b3984e114d0972",
"status": "affected",
"version": "c1a731c71359407eae4fd0a5fd675ef25a582764",
"versionType": "git"
},
{
"lessThan": "c5b6285aae050ff1c3ea824ca3d88ac4be1e69c8",
"status": "affected",
"version": "c1a731c71359407eae4fd0a5fd675ef25a582764",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/sof/compress.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: SOF: Don\u0027t allow pointer operations on unconfigured streams\n\nWhen reporting the pointer for a compressed stream we report the current\nI/O frame position by dividing the position by the number of channels\nmultiplied by the number of container bytes. These values default to 0 and\nare only configured as part of setting the stream parameters so this allows\na divide by zero to be configured. Validate that they are non zero,\nreturning an error if not"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:00:36.371Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/76ff6bfc9a809571793f425ba99f6a759108dcf8"
},
{
"url": "https://git.kernel.org/stable/c/327a64241f30c74b6f35537eb9e1fc6c3cbe060b"
},
{
"url": "https://git.kernel.org/stable/c/98ed1383f597f8a45b6cb816bb20b96d46eeceda"
},
{
"url": "https://git.kernel.org/stable/c/0f0c0c1397a42aacaacae828206ee1b921623952"
},
{
"url": "https://git.kernel.org/stable/c/4f42dd01f5217465f23a763e27b3984e114d0972"
},
{
"url": "https://git.kernel.org/stable/c/c5b6285aae050ff1c3ea824ca3d88ac4be1e69c8"
}
],
"title": "ASoC: SOF: Don\u0027t allow pointer operations on unconfigured streams",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46179",
"datePublished": "2026-05-28T09:36:33.062Z",
"dateReserved": "2026-05-13T15:03:33.103Z",
"dateUpdated": "2026-06-14T18:00:36.371Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23393 (GCVE-0-2026-23393)
Vulnerability from cvelistv5
Published
2026-03-25 10:33
Modified
2026-08-05 12:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bridge: cfm: Fix race condition in peer_mep deletion
When a peer MEP is being deleted, cancel_delayed_work_sync() is called
on ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in
softirq context under rcu_read_lock (without RTNL) and can re-schedule
ccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync()
returning and kfree_rcu() being called.
The following is a simple race scenario:
cpu0 cpu1
mep_delete_implementation()
cancel_delayed_work_sync(ccm_rx_dwork);
br_cfm_frame_rx()
// peer_mep still in hlist
if (peer_mep->ccm_defect)
ccm_rx_timer_start()
queue_delayed_work(ccm_rx_dwork)
hlist_del_rcu(&peer_mep->head);
kfree_rcu(peer_mep, rcu);
ccm_rx_work_expired()
// on freed peer_mep
To prevent this, cancel_delayed_work_sync() is replaced with
disable_delayed_work_sync() in both peer MEP deletion paths, so
that subsequent queue_delayed_work() calls from br_cfm_frame_rx()
are silently rejected.
The cc_peer_disable() helper retains cancel_delayed_work_sync()
because it is also used for the CC enable/disable toggle path where
the work must remain re-schedulable.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/br_cfm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e89dbd2736a45f0507949af4748cbbf3ff793146",
"status": "affected",
"version": "dc32cbb3dbd7da38c700d6e0fc6354df24920525",
"versionType": "git"
},
{
"lessThan": "d8f35767bacb3c7769d470a41cf161e3f3c07e70",
"status": "affected",
"version": "dc32cbb3dbd7da38c700d6e0fc6354df24920525",
"versionType": "git"
},
{
"lessThan": "1fd81151f65927fd9edb8ecd12ad45527dbbe5ab",
"status": "affected",
"version": "dc32cbb3dbd7da38c700d6e0fc6354df24920525",
"versionType": "git"
},
{
"lessThan": "3715a00855316066cdda69d43648336367422127",
"status": "affected",
"version": "dc32cbb3dbd7da38c700d6e0fc6354df24920525",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/br_cfm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: cfm: Fix race condition in peer_mep deletion\n\nWhen a peer MEP is being deleted, cancel_delayed_work_sync() is called\non ccm_rx_dwork before freeing. However, br_cfm_frame_rx() runs in\nsoftirq context under rcu_read_lock (without RTNL) and can re-schedule\nccm_rx_dwork via ccm_rx_timer_start() between cancel_delayed_work_sync()\nreturning and kfree_rcu() being called.\n\nThe following is a simple race scenario:\n\n cpu0 cpu1\n\nmep_delete_implementation()\n cancel_delayed_work_sync(ccm_rx_dwork);\n br_cfm_frame_rx()\n // peer_mep still in hlist\n if (peer_mep-\u003eccm_defect)\n ccm_rx_timer_start()\n queue_delayed_work(ccm_rx_dwork)\n hlist_del_rcu(\u0026peer_mep-\u003ehead);\n kfree_rcu(peer_mep, rcu);\n ccm_rx_work_expired()\n // on freed peer_mep\n\nTo prevent this, cancel_delayed_work_sync() is replaced with\ndisable_delayed_work_sync() in both peer MEP deletion paths, so\nthat subsequent queue_delayed_work() calls from br_cfm_frame_rx()\nare silently rejected.\n\nThe cc_peer_disable() helper retains cancel_delayed_work_sync()\nbecause it is also used for the CC enable/disable toggle path where\nthe work must remain re-schedulable."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability requires local access to configure bridge CFM via netlink (RTM_SETLINK requiring CAP_NET_ADMIN) and send CFM frames on virtual bridge interfaces, all achievable from a local user namespace.\nAC:L - The attacker controls both sides of the race \u2014 they can simultaneously delete peer MEPs via netlink and send CFM frames on virtual bridge port interfaces, making the race reliably triggerable.\nPR:L - CAP_NET_ADMIN is required for bridge CFM configuration, but it is obtainable via user namespaces (unshare -Urn) since netlink_net_capable checks against the namespace\u0027s user_ns.\nUI:N - No user interaction is needed; the attacker can set up the bridge, configure CFM, and trigger the race entirely autonomously.\nS:U - This is a standard kernel use-after-free with no cross-boundary impact such as VM escape or IOMMU bypass.\nC:H - The use-after-free allows the attacker to read freed memory that may be reallocated with controlled data, enabling arbitrary kernel memory disclosure.\nI:H - The use-after-free on the peer_mep structure enables heap spraying and potential arbitrary write primitives through control of the freed object\u0027s contents.\nA:H - The use-after-free causes ccm_rx_work_expired to operate on freed memory, reliably causing a kernel crash or panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:21:24.386Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e89dbd2736a45f0507949af4748cbbf3ff793146"
},
{
"url": "https://git.kernel.org/stable/c/d8f35767bacb3c7769d470a41cf161e3f3c07e70"
},
{
"url": "https://git.kernel.org/stable/c/1fd81151f65927fd9edb8ecd12ad45527dbbe5ab"
},
{
"url": "https://git.kernel.org/stable/c/3715a00855316066cdda69d43648336367422127"
}
],
"title": "bridge: cfm: Fix race condition in peer_mep deletion",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23393",
"datePublished": "2026-03-25T10:33:17.407Z",
"dateReserved": "2026-01-13T15:37:46.011Z",
"dateUpdated": "2026-08-05T12:21:24.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31776 (GCVE-0-2026-31776)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-05-11 22:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ctxfi: Fix missing SPDIFI1 index handling
SPDIF1 DAIO type isn't properly handled in daio_device_index() for
hw20k2, and it returned -EINVAL, which ended up with the out-of-bounds
array access. Follow the hw20k1 pattern and return the proper index
for this type, too.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/pci/ctxfi/ctdaio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "950decf59d4e978b60a792ce0b3e1555a608f489",
"status": "affected",
"version": "a2dbaeb5c61ef110ceefe0d48fe94d428d3bcf16",
"versionType": "git"
},
{
"lessThan": "b045ab3dff97edae6d538eeff900a34c098761f8",
"status": "affected",
"version": "a2dbaeb5c61ef110ceefe0d48fe94d428d3bcf16",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/pci/ctxfi/ctdaio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Fix missing SPDIFI1 index handling\n\nSPDIF1 DAIO type isn\u0027t properly handled in daio_device_index() for\nhw20k2, and it returned -EINVAL, which ended up with the out-of-bounds\narray access. Follow the hw20k1 pattern and return the proper index\nfor this type, too."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:15:35.385Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/950decf59d4e978b60a792ce0b3e1555a608f489"
},
{
"url": "https://git.kernel.org/stable/c/b045ab3dff97edae6d538eeff900a34c098761f8"
}
],
"title": "ALSA: ctxfi: Fix missing SPDIFI1 index handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31776",
"datePublished": "2026-05-01T14:15:04.423Z",
"dateReserved": "2026-03-09T15:48:24.140Z",
"dateUpdated": "2026-05-11T22:15:35.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43189 (GCVE-0-2026-43189)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-async: Fix error handling on steps after finding a match
Once an async connection is found to be matching with an fwnode, a
sub-device may be registered (in case it wasn't already), its bound
operation is called, ancillary links are created, the async connection
is added to the sub-device's list of connections and removed from the
global waiting connection list. Further on, the sub-device's possible own
notifier is searched for possible additional matches.
Fix these specific issues:
- If v4l2_async_match_notify() failed before the sub-notifier handling,
the async connection was unbound and its entry removed from the
sub-device's async connection list. The latter part was also done in
v4l2_async_match_notify().
- The async connection's sd field was only set after creating ancillary
links in v4l2_async_match_notify(). It was however dereferenced in
v4l2_async_unbind_subdev_one(), which was called on error path of
v4l2_async_match_notify() failure.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/v4l2-core/v4l2-async.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "30aaed311f973f13ba13a0cd2dc0202f595fff48",
"status": "affected",
"version": "28a1295795d85a25f2e7dd391c43969e95fcb341",
"versionType": "git"
},
{
"lessThan": "461733d83e67ba7e3a5b750c0d203f738e01244f",
"status": "affected",
"version": "28a1295795d85a25f2e7dd391c43969e95fcb341",
"versionType": "git"
},
{
"lessThan": "b02bcb378efa8af07827f49b3afcc5e825318c55",
"status": "affected",
"version": "28a1295795d85a25f2e7dd391c43969e95fcb341",
"versionType": "git"
},
{
"lessThan": "2de0a3c8148fc3dbea21981e6569f550b3626119",
"status": "affected",
"version": "28a1295795d85a25f2e7dd391c43969e95fcb341",
"versionType": "git"
},
{
"lessThan": "7345d6d356336c448d6b9230ed8704f39679fd12",
"status": "affected",
"version": "28a1295795d85a25f2e7dd391c43969e95fcb341",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/v4l2-core/v4l2-async.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: v4l2-async: Fix error handling on steps after finding a match\n\nOnce an async connection is found to be matching with an fwnode, a\nsub-device may be registered (in case it wasn\u0027t already), its bound\noperation is called, ancillary links are created, the async connection\nis added to the sub-device\u0027s list of connections and removed from the\nglobal waiting connection list. Further on, the sub-device\u0027s possible own\nnotifier is searched for possible additional matches.\n\nFix these specific issues:\n\n- If v4l2_async_match_notify() failed before the sub-notifier handling,\n the async connection was unbound and its entry removed from the\n sub-device\u0027s async connection list. The latter part was also done in\n v4l2_async_match_notify().\n\n- The async connection\u0027s sd field was only set after creating ancillary\n links in v4l2_async_match_notify(). It was however dereferenced in\n v4l2_async_unbind_subdev_one(), which was called on error path of\n v4l2_async_match_notify() failure."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:19:34.106Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/30aaed311f973f13ba13a0cd2dc0202f595fff48"
},
{
"url": "https://git.kernel.org/stable/c/461733d83e67ba7e3a5b750c0d203f738e01244f"
},
{
"url": "https://git.kernel.org/stable/c/b02bcb378efa8af07827f49b3afcc5e825318c55"
},
{
"url": "https://git.kernel.org/stable/c/2de0a3c8148fc3dbea21981e6569f550b3626119"
},
{
"url": "https://git.kernel.org/stable/c/7345d6d356336c448d6b9230ed8704f39679fd12"
}
],
"title": "media: v4l2-async: Fix error handling on steps after finding a match",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43189",
"datePublished": "2026-05-06T11:27:59.108Z",
"dateReserved": "2026-05-01T14:12:55.992Z",
"dateUpdated": "2026-05-11T22:19:34.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46312 (GCVE-0-2026-46312)
Vulnerability from cvelistv5
Published
2026-06-08 15:50
Modified
2026-06-14 18:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
vb2_dma_contig sets VMA flags VM_DONTEXPAND and VM_DONTDUMP and I do not
see a reason why vb2_dma_sg should behave differently. This avoids
hitting `WARN_ON(!(vma->vm_flags & VM_DONTEXPAND));` in
drm_gem_mmap_obj() during mmap() of an imported dma-buf from the out of
tree Apple ISP camera capture driver which uses vb2_dma_sg_memops.
gst-launch-1.0 v4l2src ! gtk4paintablesink
[ 38.201528] ------------[ cut here ]------------
[ 38.202135] WARNING: CPU: 7 PID: 2362 at drivers/gpu/drm/drm_gem.c:1144 drm_gem_mmap_obj+0x1f8/0x210
[ 38.203278] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer
snd_seq snd_seq_device uinput nf_conntrack_netbios_ns
nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib
nft_reject_inet nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat
nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables qrtr bnep
nls_ascii i2c_dev loop fuse dm_multipath nfnetlink brcmfmac_wcc
hid_magicmouse hci_bcm4377 brcmfmac brcmutil bluetooth ecdh_generic
cfg80211 ecc btrfs xor xor_neon rfkill hid_apple raid6_pq joydev
aop_als apple_nvmem_spmi industrialio snd_soc_aop apple_z2
snd_soc_cs42l84 tps6598x snd_soc_tas2764 macsmc_reboot spi_nor
macsmc_hwmon rtc_macsmc gpio_macsmc macsmc_power regmap_spmi
macsmc_input dockchannel_hid panel_summit appledrm nvme_apple dwc3
snd_soc_macaudio drm_client_lib nvme_core phy_apple_atc hwmon
apple_sart apple_dockchannel macsmc apple_rtkit_helper
spmi_apple_controller aop apple_wdt mfd_core nvmem_apple_efuses
pinctrl_apple_gpio apple_isp apple_dcp videobuf2_dma_sg mux_core
spi_apple
[ 38.203300] videobuf2_memops i2c_pasemi_platform snd_soc_apple_mca videobuf2_v4l2 videodev clk_apple_nco videobuf2_common snd_pcm_dmaengine adpdrm asahi apple_admac adpdrm_mipi drm_dma_helper pwm_apple i2c_pasemi_core drm_display_helper mc cec apple_dart ofpart apple_soc_cpufreq leds_pwm phram
[ 38.217677] CPU: 7 UID: 1000 PID: 2362 Comm: gst-launch-1.0 Tainted: G W 6.17.6+ #asahi-dev PREEMPT(full)
[ 38.219040] Tainted: [W]=WARN
[ 38.219398] Hardware name: Apple MacBook Pro (13-inch, M2, 2022) (DT)
[ 38.220213] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
[ 38.221088] pc : drm_gem_mmap_obj+0x1f8/0x210
[ 38.221643] lr : drm_gem_mmap_obj+0x78/0x210
[ 38.222178] sp : ffffc0008dc678e0
[ 38.222579] x29: ffffc0008dc678e0 x28: 0000000000042a97 x27: ffff8000b701b480
[ 38.223465] x26: 00000000000000fb x25: ffffc0008dc67d20 x24: ffffc0008dc67968
[ 38.224402] x23: ffff8000e3ca5600 x22: ffff8000265b7800 x21: ffff80003000c0c0
[ 38.225279] x20: 0000000000000000 x19: ffff8000b68c5200 x18: ffffc0008dc67968
[ 38.226151] x17: 0000000000000000 x16: 0000000000000000 x15: ffffc000810a30a8
[ 38.227042] x14: 00007fff637effff x13: 00005555de91ffff x12: 00007fff63293fff
[ 38.227942] x11: 0000000000000000 x10: ffff8000184ecf08 x9 : ffffc0007a1900c8
[ 38.228824] x8 : ffffc0008dc67968 x7 : 0000000000000012 x6 : ffffc0015cf1c000
[ 38.229703] x5 : ffffc0008dc676a0 x4 : ffffc00081a27dc0 x3 : 0000000000000038
[ 38.230607] x2 : 0000000000000003 x1 : 0000000000000003 x0 : 00000000100000fb
[ 38.231488] Call trace:
[ 38.231806] drm_gem_mmap_obj+0x1f8/0x210 (P)
[ 38.232342] drm_gem_mmap+0x140/0x260
[ 38.232813] __mmap_region+0x488/0x9a0
[ 38.233277] mmap_region+0xd0/0x148
[ 38.233703] do_mmap+0x350/0x5c0
[ 38.234148] vm_mmap_pgoff+0x14c/0x200
[ 38.234612] ksys_mmap_pgoff+0x150/0x208
[ 38.235107] __arm64_sys_mmap+0x34/0x50
[ 38.235611] invoke_syscall+0x50/0x120
[ 38.236075] el0_svc_common.constprop.0+0x48/0xf0
[ 38.236680] do_el0_svc+0x24/0x38
[ 38.237113] el0_svc+0x38/0x168
[ 38.237507] el0t_64_sync_handler+0xa0/0xe8
[ 38.238034] el0t_64_sync+0x198/0x1a0
[ 38.238491] ---[ end trace 0000000000000000 ]---
There were discussions in [1] at the end of 2023 that mmap() on imported
---truncated---
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/common/videobuf2/videobuf2-dma-sg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "feb17524aa4ec337749344be0db52b88663e25ab",
"status": "affected",
"version": "5ba3f757f0592ca001266b4a6214d0332349909c",
"versionType": "git"
},
{
"lessThan": "1a1360264f699521e001e7739009ee3ee3c6a4f5",
"status": "affected",
"version": "5ba3f757f0592ca001266b4a6214d0332349909c",
"versionType": "git"
},
{
"lessThan": "21fade52ab9fb13368a5709e60b0d9909197aeae",
"status": "affected",
"version": "5ba3f757f0592ca001266b4a6214d0332349909c",
"versionType": "git"
},
{
"lessThan": "b4cf91658a636618f1437beec971dec25dec28eb",
"status": "affected",
"version": "5ba3f757f0592ca001266b4a6214d0332349909c",
"versionType": "git"
},
{
"lessThan": "7254b31a13aaa0c2c0f9ffbc335b718656117ff4",
"status": "affected",
"version": "5ba3f757f0592ca001266b4a6214d0332349909c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/common/videobuf2/videobuf2-dma-sg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.39"
},
{
"lessThan": "2.6.39",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "2.6.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.39",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: videobuf2: Set vma_flags in vb2_dma_sg_mmap\n\nvb2_dma_contig sets VMA flags VM_DONTEXPAND and VM_DONTDUMP and I do not\nsee a reason why vb2_dma_sg should behave differently. This avoids\nhitting `WARN_ON(!(vma-\u003evm_flags \u0026 VM_DONTEXPAND));` in\ndrm_gem_mmap_obj() during mmap() of an imported dma-buf from the out of\ntree Apple ISP camera capture driver which uses vb2_dma_sg_memops.\n\ngst-launch-1.0 v4l2src ! gtk4paintablesink\n\n[ 38.201528] ------------[ cut here ]------------\n[ 38.202135] WARNING: CPU: 7 PID: 2362 at drivers/gpu/drm/drm_gem.c:1144 drm_gem_mmap_obj+0x1f8/0x210\n[ 38.203278] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer\nsnd_seq snd_seq_device uinput nf_conntrack_netbios_ns\nnf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib\nnft_reject_inet nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat\nnf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables qrtr bnep\nnls_ascii i2c_dev loop fuse dm_multipath nfnetlink brcmfmac_wcc\nhid_magicmouse hci_bcm4377 brcmfmac brcmutil bluetooth ecdh_generic\ncfg80211 ecc btrfs xor xor_neon rfkill hid_apple raid6_pq joydev\naop_als apple_nvmem_spmi industrialio snd_soc_aop apple_z2\nsnd_soc_cs42l84 tps6598x snd_soc_tas2764 macsmc_reboot spi_nor\nmacsmc_hwmon rtc_macsmc gpio_macsmc macsmc_power regmap_spmi\nmacsmc_input dockchannel_hid panel_summit appledrm nvme_apple dwc3\nsnd_soc_macaudio drm_client_lib nvme_core phy_apple_atc hwmon\napple_sart apple_dockchannel macsmc apple_rtkit_helper\nspmi_apple_controller aop apple_wdt mfd_core nvmem_apple_efuses\npinctrl_apple_gpio apple_isp apple_dcp videobuf2_dma_sg mux_core\nspi_apple\n[ 38.203300] videobuf2_memops i2c_pasemi_platform snd_soc_apple_mca videobuf2_v4l2 videodev clk_apple_nco videobuf2_common snd_pcm_dmaengine adpdrm asahi apple_admac adpdrm_mipi drm_dma_helper pwm_apple i2c_pasemi_core drm_display_helper mc cec apple_dart ofpart apple_soc_cpufreq leds_pwm phram\n[ 38.217677] CPU: 7 UID: 1000 PID: 2362 Comm: gst-launch-1.0 Tainted: G W 6.17.6+ #asahi-dev PREEMPT(full)\n[ 38.219040] Tainted: [W]=WARN\n[ 38.219398] Hardware name: Apple MacBook Pro (13-inch, M2, 2022) (DT)\n[ 38.220213] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n[ 38.221088] pc : drm_gem_mmap_obj+0x1f8/0x210\n[ 38.221643] lr : drm_gem_mmap_obj+0x78/0x210\n[ 38.222178] sp : ffffc0008dc678e0\n[ 38.222579] x29: ffffc0008dc678e0 x28: 0000000000042a97 x27: ffff8000b701b480\n[ 38.223465] x26: 00000000000000fb x25: ffffc0008dc67d20 x24: ffffc0008dc67968\n[ 38.224402] x23: ffff8000e3ca5600 x22: ffff8000265b7800 x21: ffff80003000c0c0\n[ 38.225279] x20: 0000000000000000 x19: ffff8000b68c5200 x18: ffffc0008dc67968\n[ 38.226151] x17: 0000000000000000 x16: 0000000000000000 x15: ffffc000810a30a8\n[ 38.227042] x14: 00007fff637effff x13: 00005555de91ffff x12: 00007fff63293fff\n[ 38.227942] x11: 0000000000000000 x10: ffff8000184ecf08 x9 : ffffc0007a1900c8\n[ 38.228824] x8 : ffffc0008dc67968 x7 : 0000000000000012 x6 : ffffc0015cf1c000\n[ 38.229703] x5 : ffffc0008dc676a0 x4 : ffffc00081a27dc0 x3 : 0000000000000038\n[ 38.230607] x2 : 0000000000000003 x1 : 0000000000000003 x0 : 00000000100000fb\n[ 38.231488] Call trace:\n[ 38.231806] drm_gem_mmap_obj+0x1f8/0x210 (P)\n[ 38.232342] drm_gem_mmap+0x140/0x260\n[ 38.232813] __mmap_region+0x488/0x9a0\n[ 38.233277] mmap_region+0xd0/0x148\n[ 38.233703] do_mmap+0x350/0x5c0\n[ 38.234148] vm_mmap_pgoff+0x14c/0x200\n[ 38.234612] ksys_mmap_pgoff+0x150/0x208\n[ 38.235107] __arm64_sys_mmap+0x34/0x50\n[ 38.235611] invoke_syscall+0x50/0x120\n[ 38.236075] el0_svc_common.constprop.0+0x48/0xf0\n[ 38.236680] do_el0_svc+0x24/0x38\n[ 38.237113] el0_svc+0x38/0x168\n[ 38.237507] el0t_64_sync_handler+0xa0/0xe8\n[ 38.238034] el0t_64_sync+0x198/0x1a0\n[ 38.238491] ---[ end trace 0000000000000000 ]---\n\nThere were discussions in [1] at the end of 2023 that mmap() on imported\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:08:26.067Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/feb17524aa4ec337749344be0db52b88663e25ab"
},
{
"url": "https://git.kernel.org/stable/c/1a1360264f699521e001e7739009ee3ee3c6a4f5"
},
{
"url": "https://git.kernel.org/stable/c/21fade52ab9fb13368a5709e60b0d9909197aeae"
},
{
"url": "https://git.kernel.org/stable/c/b4cf91658a636618f1437beec971dec25dec28eb"
},
{
"url": "https://git.kernel.org/stable/c/7254b31a13aaa0c2c0f9ffbc335b718656117ff4"
}
],
"title": "media: videobuf2: Set vma_flags in vb2_dma_sg_mmap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46312",
"datePublished": "2026-06-08T15:50:42.964Z",
"dateReserved": "2026-05-13T15:03:33.111Z",
"dateUpdated": "2026-06-14T18:08:26.067Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52914 (GCVE-0-2026-52914)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: fix fragment reassembly length accounting
batman-adv keeps a running payload length for queued fragments and uses it
to validate a fragment chain before reassembly.
That accounting currently allows the accumulated fragment length to be
truncated during updates. As a result, malformed fragment chains can
bypass the intended validation and drive reassembly with inconsistent
length state, leading to a local denial of service.
Fix the accounting by storing the accumulated length in a length-typed
field and rejecting update overflows before the existing validation logic
runs.
The fix was verified against the original reproducer and against valid
fragment reassembly paths.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605 Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605 Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605 Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605 Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605 Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605 Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605 Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/fragmentation.c",
"net/batman-adv/types.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e4f3f6b818aa6a678bc54a2d4e0bece2303c6a64",
"status": "affected",
"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
"versionType": "git"
},
{
"lessThan": "37be61825b15534a16ff9cfc9546de155b6df982",
"status": "affected",
"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
"versionType": "git"
},
{
"lessThan": "975563c5de1123dde1ec7946bf5556d20c89d74e",
"status": "affected",
"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
"versionType": "git"
},
{
"lessThan": "f653b040dad1af70fa5cd4fe085e4758925480c9",
"status": "affected",
"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
"versionType": "git"
},
{
"lessThan": "e910dbf509125fe51ad68e4fa74dc8ab0a8e787a",
"status": "affected",
"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
"versionType": "git"
},
{
"lessThan": "3eb8bcb823391bd58997831b3c9c152a4ba8e255",
"status": "affected",
"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
"versionType": "git"
},
{
"lessThan": "fdb2c96efb2baeb3725e9ce3ede8f1e36f5490f0",
"status": "affected",
"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
"versionType": "git"
},
{
"lessThan": "9cd3f16c320bfdadd4509358122368deb56a5741",
"status": "affected",
"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/fragmentation.c",
"net/batman-adv/types.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix fragment reassembly length accounting\n\nbatman-adv keeps a running payload length for queued fragments and uses it\nto validate a fragment chain before reassembly.\n\nThat accounting currently allows the accumulated fragment length to be\ntruncated during updates. As a result, malformed fragment chains can\nbypass the intended validation and drive reassembly with inconsistent\nlength state, leading to a local denial of service.\n\nFix the accounting by storing the accumulated length in a length-typed\nfield and rejecting update overflows before the existing validation logic\nruns.\n\nThe fix was verified against the original reproducer and against valid\nfragment reassembly paths."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable path is reached by received ETH_P_BATMAN BATADV_UNICAST_FRAG network frames through batadv_batman_skb_recv(). A remote BATMAN-adv mesh peer can deliver crafted fragments to the target node without using a local syscall or device file.\nAC:L - The attacker controls the fragment sequence number, fragment number, total_size field, and payload lengths needed to trigger the wrapped accounting. In a reasonable high-MTU BATMAN-adv deployment, no race or victim-specific state beyond an active mesh interface is required.\nPR:N - The receive path performs packet-format, destination-MAC, mesh-state, and originator lookups, but no authentication or privilege check on the sender. An attacker sending accepted BATMAN-adv frames needs no privileges on the target.\nUI:N - Exploitation is triggered solely by delivery of crafted BATMAN-adv fragments to an active interface. No victim user action is required.\nS:U - The vulnerability corrupts or crashes the kernel handling the same BATMAN-adv/networking security authority. It does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The truncated length state can drive reassembly with inconsistent sizing and attacker-controlled fragment data, creating plausible kernel memory corruption. Under the overestimate rule, such corruption can be leveraged for kernel memory disclosure.\nI:H - The reassembly path can size the output skb from the wrapped total while copying more attacker-controlled fragment data than accounted. This is defensibly an out-of-bounds write/kernel memory corruption condition.\nA:H - At minimum, the malformed chain can hit skb tail overrun BUG/panic behavior or otherwise corrupt kernel memory. That gives a reliable kernel crash/denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:36.920Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e4f3f6b818aa6a678bc54a2d4e0bece2303c6a64"
},
{
"url": "https://git.kernel.org/stable/c/37be61825b15534a16ff9cfc9546de155b6df982"
},
{
"url": "https://git.kernel.org/stable/c/975563c5de1123dde1ec7946bf5556d20c89d74e"
},
{
"url": "https://git.kernel.org/stable/c/f653b040dad1af70fa5cd4fe085e4758925480c9"
},
{
"url": "https://git.kernel.org/stable/c/e910dbf509125fe51ad68e4fa74dc8ab0a8e787a"
},
{
"url": "https://git.kernel.org/stable/c/3eb8bcb823391bd58997831b3c9c152a4ba8e255"
},
{
"url": "https://git.kernel.org/stable/c/fdb2c96efb2baeb3725e9ce3ede8f1e36f5490f0"
},
{
"url": "https://git.kernel.org/stable/c/9cd3f16c320bfdadd4509358122368deb56a5741"
}
],
"title": "batman-adv: fix fragment reassembly length accounting",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52914",
"datePublished": "2026-06-24T07:14:11.906Z",
"dateReserved": "2026-06-09T07:44:35.367Z",
"dateUpdated": "2026-08-05T12:31:36.920Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31587 (GCVE-0-2026-31587)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-08-05 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: qcom: q6apm: move component registration to unmanaged version
q6apm component registers dais dynamically from ASoC toplology, which
are allocated using device managed version apis. Allocating both
component and dynamic dais using managed version could lead to incorrect
free ordering, dai will be freed while component still holding references
to it.
Fix this issue by moving component to unmanged version so
that the dai pointers are only freeded after the component is removed.
==================================================================
BUG: KASAN: slab-use-after-free in snd_soc_del_component_unlocked+0x3d4/0x400 [snd_soc_core]
Read of size 8 at addr ffff00084493a6e8 by task kworker/u48:0/3426
Tainted: [W]=WARN
Hardware name: LENOVO 21N2ZC5PUS/21N2ZC5PUS, BIOS N42ET57W (1.31 ) 08/08/2024
Workqueue: pdr_notifier_wq pdr_notifier_work [pdr_interface]
Call trace:
show_stack+0x28/0x7c (C)
dump_stack_lvl+0x60/0x80
print_report+0x160/0x4b4
kasan_report+0xac/0xfc
__asan_report_load8_noabort+0x20/0x34
snd_soc_del_component_unlocked+0x3d4/0x400 [snd_soc_core]
snd_soc_unregister_component_by_driver+0x50/0x88 [snd_soc_core]
devm_component_release+0x30/0x5c [snd_soc_core]
devres_release_all+0x13c/0x210
device_unbind_cleanup+0x20/0x190
device_release_driver_internal+0x350/0x468
device_release_driver+0x18/0x30
bus_remove_device+0x1a0/0x35c
device_del+0x314/0x7f0
device_unregister+0x20/0xbc
apr_remove_device+0x5c/0x7c [apr]
device_for_each_child+0xd8/0x160
apr_pd_status+0x7c/0xa8 [apr]
pdr_notifier_work+0x114/0x240 [pdr_interface]
process_one_work+0x500/0xb70
worker_thread+0x630/0xfb0
kthread+0x370/0x6c0
ret_from_fork+0x10/0x20
Allocated by task 77:
kasan_save_stack+0x40/0x68
kasan_save_track+0x20/0x40
kasan_save_alloc_info+0x44/0x58
__kasan_kmalloc+0xbc/0xdc
__kmalloc_node_track_caller_noprof+0x1f4/0x620
devm_kmalloc+0x7c/0x1c8
snd_soc_register_dai+0x50/0x4f0 [snd_soc_core]
soc_tplg_pcm_elems_load+0x55c/0x1eb8 [snd_soc_core]
snd_soc_tplg_component_load+0x4f8/0xb60 [snd_soc_core]
audioreach_tplg_init+0x124/0x1fc [snd_q6apm]
q6apm_audio_probe+0x10/0x1c [snd_q6apm]
snd_soc_component_probe+0x5c/0x118 [snd_soc_core]
soc_probe_component+0x44c/0xaf0 [snd_soc_core]
snd_soc_bind_card+0xad0/0x2370 [snd_soc_core]
snd_soc_register_card+0x3b0/0x4c0 [snd_soc_core]
devm_snd_soc_register_card+0x50/0xc8 [snd_soc_core]
x1e80100_platform_probe+0x208/0x368 [snd_soc_x1e80100]
platform_probe+0xc0/0x188
really_probe+0x188/0x804
__driver_probe_device+0x158/0x358
driver_probe_device+0x60/0x190
__device_attach_driver+0x16c/0x2a8
bus_for_each_drv+0x100/0x194
__device_attach+0x174/0x380
device_initial_probe+0x14/0x20
bus_probe_device+0x124/0x154
deferred_probe_work_func+0x140/0x220
process_one_work+0x500/0xb70
worker_thread+0x630/0xfb0
kthread+0x370/0x6c0
ret_from_fork+0x10/0x20
Freed by task 3426:
kasan_save_stack+0x40/0x68
kasan_save_track+0x20/0x40
__kasan_save_free_info+0x4c/0x80
__kasan_slab_free+0x78/0xa0
kfree+0x100/0x4a4
devres_release_all+0x144/0x210
device_unbind_cleanup+0x20/0x190
device_release_driver_internal+0x350/0x468
device_release_driver+0x18/0x30
bus_remove_device+0x1a0/0x35c
device_del+0x314/0x7f0
device_unregister+0x20/0xbc
apr_remove_device+0x5c/0x7c [apr]
device_for_each_child+0xd8/0x160
apr_pd_status+0x7c/0xa8 [apr]
pdr_notifier_work+0x114/0x240 [pdr_interface]
process_one_work+0x500/0xb70
worker_thread+0x630/0xfb0
kthread+0x370/0x6c0
ret_from_fork+0x10/0x20
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5477518b8a0e8a45239646acd80c9bafc4401522 Version: 5477518b8a0e8a45239646acd80c9bafc4401522 Version: 5477518b8a0e8a45239646acd80c9bafc4401522 Version: 5477518b8a0e8a45239646acd80c9bafc4401522 Version: 5477518b8a0e8a45239646acd80c9bafc4401522 Version: 5477518b8a0e8a45239646acd80c9bafc4401522 Version: 5477518b8a0e8a45239646acd80c9bafc4401522 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/qcom/qdsp6/q6apm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "110769a9aa51135ac7ce479a47dfb41924f37664",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
},
{
"lessThan": "887632163b546a8944b46ef465f1d74e838b727a",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
},
{
"lessThan": "b7412ed789ffb1e59c8d6f5ab6a6a718963c85e2",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
},
{
"lessThan": "30383b7780ffa140bc124de5b66cae7c84133dbb",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
},
{
"lessThan": "f7b790531cdad3b2075ab937aa06d7b802403be4",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
},
{
"lessThan": "a561a55b79a9c55f0443377f2d4dcf6149d057af",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
},
{
"lessThan": "6ec1235fc941dac6c011b30ee01d9220ff87e0cd",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/qcom/qdsp6/q6apm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: q6apm: move component registration to unmanaged version\n\nq6apm component registers dais dynamically from ASoC toplology, which\nare allocated using device managed version apis. Allocating both\ncomponent and dynamic dais using managed version could lead to incorrect\nfree ordering, dai will be freed while component still holding references\nto it.\n\nFix this issue by moving component to unmanged version so\nthat the dai pointers are only freeded after the component is removed.\n\n==================================================================\nBUG: KASAN: slab-use-after-free in snd_soc_del_component_unlocked+0x3d4/0x400 [snd_soc_core]\nRead of size 8 at addr ffff00084493a6e8 by task kworker/u48:0/3426\nTainted: [W]=WARN\nHardware name: LENOVO 21N2ZC5PUS/21N2ZC5PUS, BIOS N42ET57W (1.31 ) 08/08/2024\nWorkqueue: pdr_notifier_wq pdr_notifier_work [pdr_interface]\nCall trace:\n show_stack+0x28/0x7c (C)\n dump_stack_lvl+0x60/0x80\n print_report+0x160/0x4b4\n kasan_report+0xac/0xfc\n __asan_report_load8_noabort+0x20/0x34\n snd_soc_del_component_unlocked+0x3d4/0x400 [snd_soc_core]\n snd_soc_unregister_component_by_driver+0x50/0x88 [snd_soc_core]\n devm_component_release+0x30/0x5c [snd_soc_core]\n devres_release_all+0x13c/0x210\n device_unbind_cleanup+0x20/0x190\n device_release_driver_internal+0x350/0x468\n device_release_driver+0x18/0x30\n bus_remove_device+0x1a0/0x35c\n device_del+0x314/0x7f0\n device_unregister+0x20/0xbc\n apr_remove_device+0x5c/0x7c [apr]\n device_for_each_child+0xd8/0x160\n apr_pd_status+0x7c/0xa8 [apr]\n pdr_notifier_work+0x114/0x240 [pdr_interface]\n process_one_work+0x500/0xb70\n worker_thread+0x630/0xfb0\n kthread+0x370/0x6c0\n ret_from_fork+0x10/0x20\n\nAllocated by task 77:\n kasan_save_stack+0x40/0x68\n kasan_save_track+0x20/0x40\n kasan_save_alloc_info+0x44/0x58\n __kasan_kmalloc+0xbc/0xdc\n __kmalloc_node_track_caller_noprof+0x1f4/0x620\n devm_kmalloc+0x7c/0x1c8\n snd_soc_register_dai+0x50/0x4f0 [snd_soc_core]\n soc_tplg_pcm_elems_load+0x55c/0x1eb8 [snd_soc_core]\n snd_soc_tplg_component_load+0x4f8/0xb60 [snd_soc_core]\n audioreach_tplg_init+0x124/0x1fc [snd_q6apm]\n q6apm_audio_probe+0x10/0x1c [snd_q6apm]\n snd_soc_component_probe+0x5c/0x118 [snd_soc_core]\n soc_probe_component+0x44c/0xaf0 [snd_soc_core]\n snd_soc_bind_card+0xad0/0x2370 [snd_soc_core]\n snd_soc_register_card+0x3b0/0x4c0 [snd_soc_core]\n devm_snd_soc_register_card+0x50/0xc8 [snd_soc_core]\n x1e80100_platform_probe+0x208/0x368 [snd_soc_x1e80100]\n platform_probe+0xc0/0x188\n really_probe+0x188/0x804\n __driver_probe_device+0x158/0x358\n driver_probe_device+0x60/0x190\n __device_attach_driver+0x16c/0x2a8\n bus_for_each_drv+0x100/0x194\n __device_attach+0x174/0x380\n device_initial_probe+0x14/0x20\n bus_probe_device+0x124/0x154\n deferred_probe_work_func+0x140/0x220\n process_one_work+0x500/0xb70\n worker_thread+0x630/0xfb0\n kthread+0x370/0x6c0\n ret_from_fork+0x10/0x20\n\nFreed by task 3426:\n kasan_save_stack+0x40/0x68\n kasan_save_track+0x20/0x40\n __kasan_save_free_info+0x4c/0x80\n __kasan_slab_free+0x78/0xa0\n kfree+0x100/0x4a4\n devres_release_all+0x144/0x210\n device_unbind_cleanup+0x20/0x190\n device_release_driver_internal+0x350/0x468\n device_release_driver+0x18/0x30\n bus_remove_device+0x1a0/0x35c\n device_del+0x314/0x7f0\n device_unregister+0x20/0xbc\n apr_remove_device+0x5c/0x7c [apr]\n device_for_each_child+0xd8/0x160\n apr_pd_status+0x7c/0xa8 [apr]\n pdr_notifier_work+0x114/0x240 [pdr_interface]\n process_one_work+0x500/0xb70\n worker_thread+0x630/0xfb0\n kthread+0x370/0x6c0\n ret_from_fork+0x10/0x20"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable q6apm/ASoC teardown path is reachable from local kernel interfaces, including Qualcomm QRTR/QMI PDR notifications and local audio device activity, not from a network-facing protocol.\nAC:L - No attacker-uncontrolled race is required; once the affected Qualcomm AudioReach q6apm component is present, a local attacker can plausibly drive repeated ADSP/PDR down/up teardown events.\nPR:L - The practical attacker is an unprivileged local user with access to local QRTR/audio interfaces; the relevant path is not gated by a real init-namespace root-only capability check.\nUI:N - Exploitation does not require a victim user to open a file, mount anything, or perform an action after the attacker starts triggering the local teardown path.\nS:U - The bug corrupts kernel ASoC component/DAI state within the same kernel security authority; it is a standard local kernel memory-corruption issue rather than a cross-scope VM or IOMMU boundary escape.\nC:H - The flaw is a slab use-after-free of topology-created snd_soc_dai objects during component unregister, and kernel UAF memory corruption can be leveraged for high-impact information disclosure.\nI:H - The unregister path walks and deletes list nodes from freed DAI objects, giving a plausible kernel heap corruption primitive rather than a pure NULL dereference.\nA:H - The reported KASAN trace shows a slab-use-after-free during q6apm device removal, and the affected path can crash/oops the kernel during ADSP/PDR teardown."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:23:38.154Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/110769a9aa51135ac7ce479a47dfb41924f37664"
},
{
"url": "https://git.kernel.org/stable/c/887632163b546a8944b46ef465f1d74e838b727a"
},
{
"url": "https://git.kernel.org/stable/c/b7412ed789ffb1e59c8d6f5ab6a6a718963c85e2"
},
{
"url": "https://git.kernel.org/stable/c/30383b7780ffa140bc124de5b66cae7c84133dbb"
},
{
"url": "https://git.kernel.org/stable/c/f7b790531cdad3b2075ab937aa06d7b802403be4"
},
{
"url": "https://git.kernel.org/stable/c/a561a55b79a9c55f0443377f2d4dcf6149d057af"
},
{
"url": "https://git.kernel.org/stable/c/6ec1235fc941dac6c011b30ee01d9220ff87e0cd"
}
],
"title": "ASoC: qcom: q6apm: move component registration to unmanaged version",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31587",
"datePublished": "2026-04-24T14:42:15.625Z",
"dateReserved": "2026-03-09T15:48:24.120Z",
"dateUpdated": "2026-08-05T12:23:38.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31618 (GCVE-0-2026-31618)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide
by zero error"), we also need to prevent that same crash from happening
in the udlfb driver as it uses pixclock directly when dividing, which
will crash.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/tdfxfb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2f207e46c62688bb7eb4e3feaf9a0d94020fb0c9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6c05191598eca87a87329b3f6e4a0825775f09cf",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "59bde9e0930efef1286768cb65fc78d5e5267f93",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "859a239d58a812b61267d9944b701affe6a6244e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "53cb4e79a07124d2ebe502983c29800104080b47",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "fc386daa6846551a88d338ba9864fc2812cd9030",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6567d3e1aaadfebf44ce7dc9ea2630323cd4c736",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "63dfb0b4741f46d65b667c4275132b3d1966acc8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8f98b81fe011e1879e6a7b1247e69e06a5e17af2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/tdfxfb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO\n\nMuch like commit 19f953e74356 (\"fbdev: fb_pm2fb: Avoid potential divide\nby zero error\"), we also need to prevent that same crash from happening\nin the udlfb driver as it uses pixclock directly when dividing, which\nwill crash."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:43:03.888Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2f207e46c62688bb7eb4e3feaf9a0d94020fb0c9"
},
{
"url": "https://git.kernel.org/stable/c/6c05191598eca87a87329b3f6e4a0825775f09cf"
},
{
"url": "https://git.kernel.org/stable/c/59bde9e0930efef1286768cb65fc78d5e5267f93"
},
{
"url": "https://git.kernel.org/stable/c/859a239d58a812b61267d9944b701affe6a6244e"
},
{
"url": "https://git.kernel.org/stable/c/53cb4e79a07124d2ebe502983c29800104080b47"
},
{
"url": "https://git.kernel.org/stable/c/fc386daa6846551a88d338ba9864fc2812cd9030"
},
{
"url": "https://git.kernel.org/stable/c/6567d3e1aaadfebf44ce7dc9ea2630323cd4c736"
},
{
"url": "https://git.kernel.org/stable/c/63dfb0b4741f46d65b667c4275132b3d1966acc8"
},
{
"url": "https://git.kernel.org/stable/c/8f98b81fe011e1879e6a7b1247e69e06a5e17af2"
}
],
"title": "fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31618",
"datePublished": "2026-04-24T14:42:37.173Z",
"dateReserved": "2026-03-09T15:48:24.123Z",
"dateUpdated": "2026-06-14T17:43:03.888Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31626 (GCVE-0-2026-31626)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-08-05 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()
Initialize le_tmp64 to zero in rtw_BIP_verify() to prevent using
uninitialized data.
Smatch warns that only 6 bytes are copied to this 8-byte (u64)
variable, leaving the last two bytes uninitialized:
drivers/staging/rtl8723bs/core/rtw_security.c:1308 rtw_BIP_verify()
warn: not copying enough bytes for '&le_tmp64' (8 vs 6 bytes)
Initializing the variable at the start of the function fixes this
warning and ensures predictable behavior.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_security.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6792624d933146e2757b07092e93ad915cb58930",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "51532c7c1d357145f4ac561648499f7a6847f739",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "9e911eead187240193516edf55a0e1ab3425aa5b",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "c65ee4d3be5df395e48afbcd0946dd5fce4338a9",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "d5b8f5f8d6fc09a8af5ed139c688660f578ed732",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "b487a7754d874230299d5a9c2710ec4df8b2ed8a",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "c2026c6b603ebec52f55015496703fe79077accf",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "ef74ce5f0bc0e53ce702d8a794f3957884a26efc",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "8c964b82a4e97ec7f25e17b803ee196009b38a57",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_security.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()\n\nInitialize le_tmp64 to zero in rtw_BIP_verify() to prevent using\nuninitialized data.\n\nSmatch warns that only 6 bytes are copied to this 8-byte (u64)\nvariable, leaving the last two bytes uninitialized:\n\ndrivers/staging/rtl8723bs/core/rtw_security.c:1308 rtw_BIP_verify()\nwarn: not copying enough bytes for \u0027\u0026le_tmp64\u0027 (8 vs 6 bytes)\n\nInitializing the variable at the start of the function fixes this\nwarning and ensures predictable behavior."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable code is reached from received 802.11 management frames handled by the rtl8723bs WiFi driver, so the attacker must be within WiFi radio range rather than on an IP network or local shell.\nAC:L - Once the station is linked with 802.11w/BIP enabled, frame injection or replay is attacker-controlled and the vulnerable uninitialized IPN comparison is reached reliably; repeated attempts can exercise the favorable cases.\nPR:N - No local account or kernel privilege is required on the victim. The relevant gate is wireless/BIP frame validity, not an attacker privilege level on the vulnerable system.\nUI:N - After the device is connected to a protected WiFi network, exploitation is driven by received management frames and does not require user action at the time of attack.\nS:U - The impact remains within the same kernel/driver and network-interface security authority. There is no VM, IOMMU, or separate sandbox boundary crossed.\nC:N - The uninitialized stack bytes are consumed internally as high bits of the BIP packet number and are not copied to userspace or transmitted back to the attacker. No practical kernel memory disclosure primitive is exposed.\nI:L - The bug can corrupt the logical BIP replay comparison, potentially allowing acceptance of replayed valid protected deauth/disassoc frames or rejection of legitimate ones. This affects management-frame state but does not provide arbitrary data modification or code execution.\nA:H - Accepted replayed protected deauth/disassoc frames can disconnect the station, and repeated adjacent injection can deny WiFi connectivity for the affected interface. There is no kernel crash, but the vulnerable component\u0027s network availability can be fully disrupted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:23:53.335Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6792624d933146e2757b07092e93ad915cb58930"
},
{
"url": "https://git.kernel.org/stable/c/51532c7c1d357145f4ac561648499f7a6847f739"
},
{
"url": "https://git.kernel.org/stable/c/9e911eead187240193516edf55a0e1ab3425aa5b"
},
{
"url": "https://git.kernel.org/stable/c/c65ee4d3be5df395e48afbcd0946dd5fce4338a9"
},
{
"url": "https://git.kernel.org/stable/c/d5b8f5f8d6fc09a8af5ed139c688660f578ed732"
},
{
"url": "https://git.kernel.org/stable/c/b487a7754d874230299d5a9c2710ec4df8b2ed8a"
},
{
"url": "https://git.kernel.org/stable/c/c2026c6b603ebec52f55015496703fe79077accf"
},
{
"url": "https://git.kernel.org/stable/c/ef74ce5f0bc0e53ce702d8a794f3957884a26efc"
},
{
"url": "https://git.kernel.org/stable/c/8c964b82a4e97ec7f25e17b803ee196009b38a57"
}
],
"title": "staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31626",
"datePublished": "2026-04-24T14:42:47.493Z",
"dateReserved": "2026-03-09T15:48:24.124Z",
"dateUpdated": "2026-08-05T12:23:53.335Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31728 (GCVE-0-2026-31728)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-05-11 22:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
A race condition between gether_disconnect() and eth_stop() leads to a
NULL pointer dereference. Specifically, if eth_stop() is triggered
concurrently while gether_disconnect() is tearing down the endpoints,
eth_stop() attempts to access the cleared endpoint descriptor, causing
the following NPE:
Unable to handle kernel NULL pointer dereference
Call trace:
__dwc3_gadget_ep_enable+0x60/0x788
dwc3_gadget_ep_enable+0x70/0xe4
usb_ep_enable+0x60/0x15c
eth_stop+0xb8/0x108
Because eth_stop() crashes while holding the dev->lock, the thread
running gether_disconnect() fails to acquire the same lock and spins
forever, resulting in a hardlockup:
Core - Debugging Information for Hardlockup core(7)
Call trace:
queued_spin_lock_slowpath+0x94/0x488
_raw_spin_lock+0x64/0x6c
gether_disconnect+0x19c/0x1e8
ncm_set_alt+0x68/0x1a0
composite_setup+0x6a0/0xc50
The root cause is that the clearing of dev->port_usb in
gether_disconnect() is delayed until the end of the function.
Move the clearing of dev->port_usb to the very beginning of
gether_disconnect() while holding dev->lock. This cuts off the link
immediately, ensuring eth_stop() will see dev->port_usb as NULL and
safely bail out.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2b3d942c4878084a37991a65e66512c02b8fa2ad Version: 2b3d942c4878084a37991a65e66512c02b8fa2ad Version: 2b3d942c4878084a37991a65e66512c02b8fa2ad Version: 2b3d942c4878084a37991a65e66512c02b8fa2ad Version: 2b3d942c4878084a37991a65e66512c02b8fa2ad Version: 2b3d942c4878084a37991a65e66512c02b8fa2ad Version: 2b3d942c4878084a37991a65e66512c02b8fa2ad Version: 2b3d942c4878084a37991a65e66512c02b8fa2ad |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/u_ether.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f02980594deef751e42133714aee25228f1494c6",
"status": "affected",
"version": "2b3d942c4878084a37991a65e66512c02b8fa2ad",
"versionType": "git"
},
{
"lessThan": "e1e7a66584bf0aff3becb73c19fa31527889fc9e",
"status": "affected",
"version": "2b3d942c4878084a37991a65e66512c02b8fa2ad",
"versionType": "git"
},
{
"lessThan": "a259ba0bce3b192c04334499690372a250f7d0b1",
"status": "affected",
"version": "2b3d942c4878084a37991a65e66512c02b8fa2ad",
"versionType": "git"
},
{
"lessThan": "f6813c2b2ae78def76b69e0f9d72f80e4a1c4aca",
"status": "affected",
"version": "2b3d942c4878084a37991a65e66512c02b8fa2ad",
"versionType": "git"
},
{
"lessThan": "bbb09bb89ffa571475f66daca9482b974cd29d6a",
"status": "affected",
"version": "2b3d942c4878084a37991a65e66512c02b8fa2ad",
"versionType": "git"
},
{
"lessThan": "6ad77458637b78ec655e3da5f112c862e6690a9d",
"status": "affected",
"version": "2b3d942c4878084a37991a65e66512c02b8fa2ad",
"versionType": "git"
},
{
"lessThan": "8ff689edfeceb5e3ec1623e09af2b2aa0f1098a8",
"status": "affected",
"version": "2b3d942c4878084a37991a65e66512c02b8fa2ad",
"versionType": "git"
},
{
"lessThan": "e1eabb072c75681f78312c484ccfffb7430f206e",
"status": "affected",
"version": "2b3d942c4878084a37991a65e66512c02b8fa2ad",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/u_ether.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.169",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.169",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_ether: Fix race between gether_disconnect and eth_stop\n\nA race condition between gether_disconnect() and eth_stop() leads to a\nNULL pointer dereference. Specifically, if eth_stop() is triggered\nconcurrently while gether_disconnect() is tearing down the endpoints,\neth_stop() attempts to access the cleared endpoint descriptor, causing\nthe following NPE:\n\n Unable to handle kernel NULL pointer dereference\n Call trace:\n __dwc3_gadget_ep_enable+0x60/0x788\n dwc3_gadget_ep_enable+0x70/0xe4\n usb_ep_enable+0x60/0x15c\n eth_stop+0xb8/0x108\n\nBecause eth_stop() crashes while holding the dev-\u003elock, the thread\nrunning gether_disconnect() fails to acquire the same lock and spins\nforever, resulting in a hardlockup:\n\n Core - Debugging Information for Hardlockup core(7)\n Call trace:\n queued_spin_lock_slowpath+0x94/0x488\n _raw_spin_lock+0x64/0x6c\n gether_disconnect+0x19c/0x1e8\n ncm_set_alt+0x68/0x1a0\n composite_setup+0x6a0/0xc50\n\nThe root cause is that the clearing of dev-\u003eport_usb in\ngether_disconnect() is delayed until the end of the function.\n\nMove the clearing of dev-\u003eport_usb to the very beginning of\ngether_disconnect() while holding dev-\u003elock. This cuts off the link\nimmediately, ensuring eth_stop() will see dev-\u003eport_usb as NULL and\nsafely bail out."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:14:36.858Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f02980594deef751e42133714aee25228f1494c6"
},
{
"url": "https://git.kernel.org/stable/c/e1e7a66584bf0aff3becb73c19fa31527889fc9e"
},
{
"url": "https://git.kernel.org/stable/c/a259ba0bce3b192c04334499690372a250f7d0b1"
},
{
"url": "https://git.kernel.org/stable/c/f6813c2b2ae78def76b69e0f9d72f80e4a1c4aca"
},
{
"url": "https://git.kernel.org/stable/c/bbb09bb89ffa571475f66daca9482b974cd29d6a"
},
{
"url": "https://git.kernel.org/stable/c/6ad77458637b78ec655e3da5f112c862e6690a9d"
},
{
"url": "https://git.kernel.org/stable/c/8ff689edfeceb5e3ec1623e09af2b2aa0f1098a8"
},
{
"url": "https://git.kernel.org/stable/c/e1eabb072c75681f78312c484ccfffb7430f206e"
}
],
"title": "usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31728",
"datePublished": "2026-05-01T14:14:28.231Z",
"dateReserved": "2026-03-09T15:48:24.134Z",
"dateUpdated": "2026-05-11T22:14:36.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31585 (GCVE-0-2026-31585)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: vidtv: fix nfeeds state corruption on start_streaming failure
syzbot reported a memory leak in vidtv_psi_service_desc_init [1].
When vidtv_start_streaming() fails inside vidtv_start_feed(), the
nfeeds counter is left incremented even though no feed was actually
started. This corrupts the driver state: subsequent start_feed calls
see nfeeds > 1 and skip starting the mux, while stop_feed calls
eventually try to stop a non-existent stream.
This state corruption can also lead to memory leaks, since the mux
and channel resources may be partially allocated during a failed
start_streaming but never cleaned up, as the stop path finds
dvb->streaming == false and returns early.
Fix by decrementing nfeeds back when start_streaming fails, keeping
the counter in sync with the actual number of active feeds.
[1]
BUG: memory leak
unreferenced object 0xffff888145b50820 (size 32):
comm "syz.0.17", pid 6068, jiffies 4294944486
backtrace (crc 90a0c7d4):
vidtv_psi_service_desc_init+0x74/0x1b0 drivers/media/test-drivers/vidtv/vidtv_psi.c:288
vidtv_channel_s302m_init+0xb1/0x2a0 drivers/media/test-drivers/vidtv/vidtv_channel.c:83
vidtv_channels_init+0x1b/0x40 drivers/media/test-drivers/vidtv/vidtv_channel.c:524
vidtv_mux_init+0x516/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:518
vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline]
vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 Version: f90cf6079bf67988f8b1ad1ade70fc89d0080905 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/test-drivers/vidtv/vidtv_bridge.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f8cccb427e65d725fc0ba05e8900b4676eda268e",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "60f768d46df561e06d92ffcacc00909f37a0f23d",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "80900b5424f3454256153ce386388df43b324f63",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "17cb7957c979529cc98ff57f7ac331532f1f7c83",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "98c22210aeadce67d9d20059f0dbbd01ba7fdbba",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "25f19e476ab15defe698504212899fdb9f7cd61b",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "83110c2c8c46c035c2e0fc8ff3e4991183bf9ccd",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "4bf95f797edd63c93330eafb6d6e670982344b9b",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
},
{
"lessThan": "a0e5a598fe9a4612b852406b51153b881592aede",
"status": "affected",
"version": "f90cf6079bf67988f8b1ad1ade70fc89d0080905",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/test-drivers/vidtv/vidtv_bridge.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vidtv: fix nfeeds state corruption on start_streaming failure\n\nsyzbot reported a memory leak in vidtv_psi_service_desc_init [1].\n\nWhen vidtv_start_streaming() fails inside vidtv_start_feed(), the\nnfeeds counter is left incremented even though no feed was actually\nstarted. This corrupts the driver state: subsequent start_feed calls\nsee nfeeds \u003e 1 and skip starting the mux, while stop_feed calls\neventually try to stop a non-existent stream.\n\nThis state corruption can also lead to memory leaks, since the mux\nand channel resources may be partially allocated during a failed\nstart_streaming but never cleaned up, as the stop path finds\ndvb-\u003estreaming == false and returns early.\n\nFix by decrementing nfeeds back when start_streaming fails, keeping\nthe counter in sync with the actual number of active feeds.\n\n[1]\nBUG: memory leak\nunreferenced object 0xffff888145b50820 (size 32):\n comm \"syz.0.17\", pid 6068, jiffies 4294944486\n backtrace (crc 90a0c7d4):\n vidtv_psi_service_desc_init+0x74/0x1b0 drivers/media/test-drivers/vidtv/vidtv_psi.c:288\n vidtv_channel_s302m_init+0xb1/0x2a0 drivers/media/test-drivers/vidtv/vidtv_channel.c:83\n vidtv_channels_init+0x1b/0x40 drivers/media/test-drivers/vidtv/vidtv_channel.c:524\n vidtv_mux_init+0x516/0xbe0 drivers/media/test-drivers/vidtv/vidtv_mux.c:518\n vidtv_start_streaming drivers/media/test-drivers/vidtv/vidtv_bridge.c:194 [inline]\n vidtv_start_feed+0x33e/0x4d0 drivers/media/test-drivers/vidtv/vidtv_bridge.c:239"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:42:17.844Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f8cccb427e65d725fc0ba05e8900b4676eda268e"
},
{
"url": "https://git.kernel.org/stable/c/60f768d46df561e06d92ffcacc00909f37a0f23d"
},
{
"url": "https://git.kernel.org/stable/c/80900b5424f3454256153ce386388df43b324f63"
},
{
"url": "https://git.kernel.org/stable/c/17cb7957c979529cc98ff57f7ac331532f1f7c83"
},
{
"url": "https://git.kernel.org/stable/c/98c22210aeadce67d9d20059f0dbbd01ba7fdbba"
},
{
"url": "https://git.kernel.org/stable/c/25f19e476ab15defe698504212899fdb9f7cd61b"
},
{
"url": "https://git.kernel.org/stable/c/83110c2c8c46c035c2e0fc8ff3e4991183bf9ccd"
},
{
"url": "https://git.kernel.org/stable/c/4bf95f797edd63c93330eafb6d6e670982344b9b"
},
{
"url": "https://git.kernel.org/stable/c/a0e5a598fe9a4612b852406b51153b881592aede"
}
],
"title": "media: vidtv: fix nfeeds state corruption on start_streaming failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31585",
"datePublished": "2026-04-24T14:42:14.266Z",
"dateReserved": "2026-03-09T15:48:24.120Z",
"dateUpdated": "2026-06-14T17:42:17.844Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43382 (GCVE-0-2026-43382)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-05-23 16:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: Avoid double-rtnl_lock ELP metric worker
batadv_v_elp_get_throughput() might be called when the RTNL lock is already
held. This could be problematic when the work queue item is cancelled via
cancel_delayed_work_sync() in batadv_v_elp_iface_disable(). In this case,
an rtnl_lock() would cause a deadlock.
To avoid this, rtnl_trylock() was used in this function to skip the
retrieval of the ethtool information in case the RTNL lock was already
held.
But for cfg80211 interfaces, batadv_get_real_netdev() was called - which
also uses rtnl_lock(). The approach for __ethtool_get_link_ksettings() must
also be used instead and the lockless version __batadv_get_real_netdev()
has to be called.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a0019971f340ae02ba54cf1861f72da7e03e6b66 Version: 3c0e0aecb78cb2a2ca1dc701982d08fedb088dc6 Version: 781a06fd265a8151f7601122d9c2e985663828ff Version: a7aa2317285806640c844acd4cd2cd768e395264 Version: 0fdc3c166ac17b26014313fa2b93696354511b24 Version: 8c8ecc98f5c65947b0070a24bac11e12e47cc65d Version: 8c8ecc98f5c65947b0070a24bac11e12e47cc65d Version: 8c8ecc98f5c65947b0070a24bac11e12e47cc65d Version: 1c334629176c2d644befc31a20d4bf75542f7631 Version: af264c2a9adc37f4bdf88ca7f3affa15d8c7de9e Version: 5.10.235 ≤ Version: 5.15.179 ≤ Version: 6.1.129 ≤ Version: 6.6.79 ≤ Version: 6.12.16 ≤ Version: 5.4.291 ≤ Version: 6.13.4 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/bat_v_elp.c",
"net/batman-adv/hard-interface.c",
"net/batman-adv/hard-interface.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4c3ae249431b4fcb315d7dfb4c3a13f9e443fd9b",
"status": "affected",
"version": "a0019971f340ae02ba54cf1861f72da7e03e6b66",
"versionType": "git"
},
{
"lessThan": "192f40ad8a7dac58dae9199a065dbf7e6e67b75b",
"status": "affected",
"version": "3c0e0aecb78cb2a2ca1dc701982d08fedb088dc6",
"versionType": "git"
},
{
"lessThan": "fa7b4edfbabdf9235b0ab4bea297fc12b3bec9ca",
"status": "affected",
"version": "781a06fd265a8151f7601122d9c2e985663828ff",
"versionType": "git"
},
{
"lessThan": "f3ca45673dab0514a887231de6f3243a699d5bfd",
"status": "affected",
"version": "a7aa2317285806640c844acd4cd2cd768e395264",
"versionType": "git"
},
{
"lessThan": "b7e5d8ddfdf1d6e9e0808d1adf7736a107372d77",
"status": "affected",
"version": "0fdc3c166ac17b26014313fa2b93696354511b24",
"versionType": "git"
},
{
"lessThan": "2ab9f2531d37775cd79228c1f5d80e6bd08d11d3",
"status": "affected",
"version": "8c8ecc98f5c65947b0070a24bac11e12e47cc65d",
"versionType": "git"
},
{
"lessThan": "77808fe7d03ad0062840b95f431869a8b3d88b24",
"status": "affected",
"version": "8c8ecc98f5c65947b0070a24bac11e12e47cc65d",
"versionType": "git"
},
{
"lessThan": "cfc83a3c71517b59c1047db57da31e26a9dc2f33",
"status": "affected",
"version": "8c8ecc98f5c65947b0070a24bac11e12e47cc65d",
"versionType": "git"
},
{
"status": "affected",
"version": "1c334629176c2d644befc31a20d4bf75542f7631",
"versionType": "git"
},
{
"status": "affected",
"version": "af264c2a9adc37f4bdf88ca7f3affa15d8c7de9e",
"versionType": "git"
},
{
"lessThan": "5.10.253",
"status": "affected",
"version": "5.10.235",
"versionType": "semver"
},
{
"lessThan": "5.15.203",
"status": "affected",
"version": "5.15.179",
"versionType": "semver"
},
{
"lessThan": "6.1.167",
"status": "affected",
"version": "6.1.129",
"versionType": "semver"
},
{
"lessThan": "6.6.130",
"status": "affected",
"version": "6.6.79",
"versionType": "semver"
},
{
"lessThan": "6.12.78",
"status": "affected",
"version": "6.12.16",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.291",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/bat_v_elp.c",
"net/batman-adv/hard-interface.c",
"net/batman-adv/hard-interface.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.10.235",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.15.179",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "6.1.129",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.6.79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.12.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.291",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: Avoid double-rtnl_lock ELP metric worker\n\nbatadv_v_elp_get_throughput() might be called when the RTNL lock is already\nheld. This could be problematic when the work queue item is cancelled via\ncancel_delayed_work_sync() in batadv_v_elp_iface_disable(). In this case,\nan rtnl_lock() would cause a deadlock.\n\nTo avoid this, rtnl_trylock() was used in this function to skip the\nretrieval of the ethtool information in case the RTNL lock was already\nheld.\n\nBut for cfg80211 interfaces, batadv_get_real_netdev() was called - which\nalso uses rtnl_lock(). The approach for __ethtool_get_link_ksettings() must\nalso be used instead and the lockless version __batadv_get_real_netdev()\nhas to be called."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:06:54.305Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4c3ae249431b4fcb315d7dfb4c3a13f9e443fd9b"
},
{
"url": "https://git.kernel.org/stable/c/192f40ad8a7dac58dae9199a065dbf7e6e67b75b"
},
{
"url": "https://git.kernel.org/stable/c/fa7b4edfbabdf9235b0ab4bea297fc12b3bec9ca"
},
{
"url": "https://git.kernel.org/stable/c/f3ca45673dab0514a887231de6f3243a699d5bfd"
},
{
"url": "https://git.kernel.org/stable/c/b7e5d8ddfdf1d6e9e0808d1adf7736a107372d77"
},
{
"url": "https://git.kernel.org/stable/c/2ab9f2531d37775cd79228c1f5d80e6bd08d11d3"
},
{
"url": "https://git.kernel.org/stable/c/77808fe7d03ad0062840b95f431869a8b3d88b24"
},
{
"url": "https://git.kernel.org/stable/c/cfc83a3c71517b59c1047db57da31e26a9dc2f33"
}
],
"title": "batman-adv: Avoid double-rtnl_lock ELP metric worker",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43382",
"datePublished": "2026-05-08T14:21:30.062Z",
"dateReserved": "2026-05-01T14:12:56.006Z",
"dateUpdated": "2026-05-23T16:06:54.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53287 (GCVE-0-2026-53287)
Vulnerability from cvelistv5
Published
2026-06-26 19:40
Modified
2026-06-26 19:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
audit: fix incorrect inheritable capability in CAPSET records
__audit_log_capset() records the effective capability set into the
inheritable field due to a copy-paste error. Every CAPSET audit
record therefore reports cap_pi (process inheritable) with the value
of cap_effective instead of cap_inheritable.
This silently corrupts audit data used for compliance and forensic
analysis: an attacker who modifies inheritable capabilities to
prepare for a privilege-escalating exec would have the change masked
in the audit trail.
The bug has been present since the original introduction of CAPSET
audit records in 2008.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e68b75a027bb94066576139ee33676264f867b87 Version: e68b75a027bb94066576139ee33676264f867b87 Version: e68b75a027bb94066576139ee33676264f867b87 Version: e68b75a027bb94066576139ee33676264f867b87 Version: e68b75a027bb94066576139ee33676264f867b87 Version: e68b75a027bb94066576139ee33676264f867b87 Version: e68b75a027bb94066576139ee33676264f867b87 Version: e68b75a027bb94066576139ee33676264f867b87 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/auditsc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "75bd76c9eb2de9afeca03dc5152ebca5fb8fc816",
"status": "affected",
"version": "e68b75a027bb94066576139ee33676264f867b87",
"versionType": "git"
},
{
"lessThan": "febb4bf373ac565d3fb8d1f429827bdd983be496",
"status": "affected",
"version": "e68b75a027bb94066576139ee33676264f867b87",
"versionType": "git"
},
{
"lessThan": "95de7bb4bf535a9288549d401ebde83cdcbf2792",
"status": "affected",
"version": "e68b75a027bb94066576139ee33676264f867b87",
"versionType": "git"
},
{
"lessThan": "151ee470edc3d7ed29fe72df678f8357d2ad8ced",
"status": "affected",
"version": "e68b75a027bb94066576139ee33676264f867b87",
"versionType": "git"
},
{
"lessThan": "0a065c51a225854768b772a0b733a44d77162582",
"status": "affected",
"version": "e68b75a027bb94066576139ee33676264f867b87",
"versionType": "git"
},
{
"lessThan": "e35f3550c5b4fab33103c18654c293cee9850b0a",
"status": "affected",
"version": "e68b75a027bb94066576139ee33676264f867b87",
"versionType": "git"
},
{
"lessThan": "d782e4d200cd9036ef353eeb29525bfbfd13a14e",
"status": "affected",
"version": "e68b75a027bb94066576139ee33676264f867b87",
"versionType": "git"
},
{
"lessThan": "e4a640475e43f406fdfd56d370b1f34b0cbbc18d",
"status": "affected",
"version": "e68b75a027bb94066576139ee33676264f867b87",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/auditsc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naudit: fix incorrect inheritable capability in CAPSET records\n\n__audit_log_capset() records the effective capability set into the\ninheritable field due to a copy-paste error. Every CAPSET audit\nrecord therefore reports cap_pi (process inheritable) with the value\nof cap_effective instead of cap_inheritable.\n\nThis silently corrupts audit data used for compliance and forensic\nanalysis: an attacker who modifies inheritable capabilities to\nprepare for a privilege-escalating exec would have the change masked\nin the audit trail.\n\nThe bug has been present since the original introduction of CAPSET\naudit records in 2008."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T19:40:47.946Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/75bd76c9eb2de9afeca03dc5152ebca5fb8fc816"
},
{
"url": "https://git.kernel.org/stable/c/febb4bf373ac565d3fb8d1f429827bdd983be496"
},
{
"url": "https://git.kernel.org/stable/c/95de7bb4bf535a9288549d401ebde83cdcbf2792"
},
{
"url": "https://git.kernel.org/stable/c/151ee470edc3d7ed29fe72df678f8357d2ad8ced"
},
{
"url": "https://git.kernel.org/stable/c/0a065c51a225854768b772a0b733a44d77162582"
},
{
"url": "https://git.kernel.org/stable/c/e35f3550c5b4fab33103c18654c293cee9850b0a"
},
{
"url": "https://git.kernel.org/stable/c/d782e4d200cd9036ef353eeb29525bfbfd13a14e"
},
{
"url": "https://git.kernel.org/stable/c/e4a640475e43f406fdfd56d370b1f34b0cbbc18d"
}
],
"title": "audit: fix incorrect inheritable capability in CAPSET records",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53287",
"datePublished": "2026-06-26T19:40:47.946Z",
"dateReserved": "2026-06-09T07:44:35.396Z",
"dateUpdated": "2026-06-26T19:40:47.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46233 (GCVE-0-2026-46233)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-06-14 18:04
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: bla: only purge non-released claims
When batadv_bla_purge_claims() goes through the list of claims, it is only
traversing the hash list with an rcu_read_lock(). Due to a potential
parallel batadv_claim_put(), it can happen that it encounters a claim which
was actually in the process of being released+freed by
batadv_claim_release(). In this case, backbone_gw is set to NULL before the
delayed RCU kfree is started. Calling batadv_bla_claim_get_backbone_gw() is
then no longer allowed because it would cause a NULL-ptr derefence.
To avoid this, only claims with a valid reference counter must be purged.
All others are already taken care of.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/bridge_loop_avoidance.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a9f58d5e3261f3deeae69ec1e237f38ef3ff5cbe",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "6725c523a35eeca611ff37e7d4a8712fae92aefd",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "afb5436f6028fd68f408f189230fbaa19c910d72",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "7b8fbcee3184d848b5aee085ca16d0cf05c9b641",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "7b7ebb7222a5524ce58e48cc9c6d688320ea6cfe",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "b65365d2b1e6095c538d49baeb140dd1c166c1b3",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "ab3dbd07a809a8eb30c7ddfab9ac886ed30dce8d",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "cf6b604011591865ae39ac82de8978c1120d17af",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/bridge_loop_avoidance.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: bla: only purge non-released claims\n\nWhen batadv_bla_purge_claims() goes through the list of claims, it is only\ntraversing the hash list with an rcu_read_lock(). Due to a potential\nparallel batadv_claim_put(), it can happen that it encounters a claim which\nwas actually in the process of being released+freed by\nbatadv_claim_release(). In this case, backbone_gw is set to NULL before the\ndelayed RCU kfree is started. Calling batadv_bla_claim_get_backbone_gw() is\nthen no longer allowed because it would cause a NULL-ptr derefence.\n\nTo avoid this, only claims with a valid reference counter must be purged.\nAll others are already taken care of."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:04:36.157Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a9f58d5e3261f3deeae69ec1e237f38ef3ff5cbe"
},
{
"url": "https://git.kernel.org/stable/c/6725c523a35eeca611ff37e7d4a8712fae92aefd"
},
{
"url": "https://git.kernel.org/stable/c/afb5436f6028fd68f408f189230fbaa19c910d72"
},
{
"url": "https://git.kernel.org/stable/c/7b8fbcee3184d848b5aee085ca16d0cf05c9b641"
},
{
"url": "https://git.kernel.org/stable/c/7b7ebb7222a5524ce58e48cc9c6d688320ea6cfe"
},
{
"url": "https://git.kernel.org/stable/c/b65365d2b1e6095c538d49baeb140dd1c166c1b3"
},
{
"url": "https://git.kernel.org/stable/c/ab3dbd07a809a8eb30c7ddfab9ac886ed30dce8d"
},
{
"url": "https://git.kernel.org/stable/c/cf6b604011591865ae39ac82de8978c1120d17af"
}
],
"title": "batman-adv: bla: only purge non-released claims",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46233",
"datePublished": "2026-05-28T09:40:55.019Z",
"dateReserved": "2026-05-13T15:03:33.106Z",
"dateUpdated": "2026-06-14T18:04:36.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43316 (GCVE-0-2026-43316)
Vulnerability from cvelistv5
Published
2026-05-08 13:26
Modified
2026-05-11 22:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: solo6x10: Check for out of bounds chip_id
Clang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type
(literal "1" is an "int") could end up being shifted beyond 32 bits,
so instrumentation was added (and due to the double is_tw286x() call
seen via inlining), Clang decides the second one must now be undefined
behavior and elides the rest of the function[1]. This is a known problem
with Clang (that is still being worked on), but we can avoid the entire
problem by actually checking the existing max chip ID, and now there is
no runtime instrumentation added at all since everything is known to be
within bounds.
Additionally use an unsigned value for the shift to remove the
instrumentation even without the explicit bounds checking.
[hverkuil: fix checkpatch warning for is_tw286x]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: faa4fd2a09517b39cc1f5d622453f97a59acfdac Version: faa4fd2a09517b39cc1f5d622453f97a59acfdac Version: faa4fd2a09517b39cc1f5d622453f97a59acfdac Version: faa4fd2a09517b39cc1f5d622453f97a59acfdac Version: faa4fd2a09517b39cc1f5d622453f97a59acfdac Version: faa4fd2a09517b39cc1f5d622453f97a59acfdac Version: faa4fd2a09517b39cc1f5d622453f97a59acfdac Version: faa4fd2a09517b39cc1f5d622453f97a59acfdac |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/solo6x10/solo6x10-tw28.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c327192ca26670cf6e588c1eeda66cd2fa97630e",
"status": "affected",
"version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac",
"versionType": "git"
},
{
"lessThan": "0b3dadada2417782a63ce32dae05bafe1c949e3f",
"status": "affected",
"version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac",
"versionType": "git"
},
{
"lessThan": "603e3859393ee2ce91393b7d05e6e56e4b66e5cd",
"status": "affected",
"version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac",
"versionType": "git"
},
{
"lessThan": "33af366211ee78e3b074ff44a16121e537e86826",
"status": "affected",
"version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac",
"versionType": "git"
},
{
"lessThan": "5849ae68d7b8b6ad55cc1bf0d227dd2ae6362528",
"status": "affected",
"version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac",
"versionType": "git"
},
{
"lessThan": "d29f33b2cf98e4901cd5457d1ee34062e808df73",
"status": "affected",
"version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac",
"versionType": "git"
},
{
"lessThan": "4d6db0c6bbbfd8d7bbdbf7ab6a9c003752abf116",
"status": "affected",
"version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac",
"versionType": "git"
},
{
"lessThan": "0fdf6323c35a134f206dcad5babb4ff488552076",
"status": "affected",
"version": "faa4fd2a09517b39cc1f5d622453f97a59acfdac",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/solo6x10/solo6x10-tw28.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"lessThan": "2.6.36",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: solo6x10: Check for out of bounds chip_id\n\nClang with CONFIG_UBSAN_SHIFT=y noticed a condition where a signed type\n(literal \"1\" is an \"int\") could end up being shifted beyond 32 bits,\nso instrumentation was added (and due to the double is_tw286x() call\nseen via inlining), Clang decides the second one must now be undefined\nbehavior and elides the rest of the function[1]. This is a known problem\nwith Clang (that is still being worked on), but we can avoid the entire\nproblem by actually checking the existing max chip ID, and now there is\nno runtime instrumentation added at all since everything is known to be\nwithin bounds.\n\nAdditionally use an unsigned value for the shift to remove the\ninstrumentation even without the explicit bounds checking.\n\n[hverkuil: fix checkpatch warning for is_tw286x]"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:22:12.135Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c327192ca26670cf6e588c1eeda66cd2fa97630e"
},
{
"url": "https://git.kernel.org/stable/c/0b3dadada2417782a63ce32dae05bafe1c949e3f"
},
{
"url": "https://git.kernel.org/stable/c/603e3859393ee2ce91393b7d05e6e56e4b66e5cd"
},
{
"url": "https://git.kernel.org/stable/c/33af366211ee78e3b074ff44a16121e537e86826"
},
{
"url": "https://git.kernel.org/stable/c/5849ae68d7b8b6ad55cc1bf0d227dd2ae6362528"
},
{
"url": "https://git.kernel.org/stable/c/d29f33b2cf98e4901cd5457d1ee34062e808df73"
},
{
"url": "https://git.kernel.org/stable/c/4d6db0c6bbbfd8d7bbdbf7ab6a9c003752abf116"
},
{
"url": "https://git.kernel.org/stable/c/0fdf6323c35a134f206dcad5babb4ff488552076"
}
],
"title": "media: solo6x10: Check for out of bounds chip_id",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43316",
"datePublished": "2026-05-08T13:26:12.217Z",
"dateReserved": "2026-05-01T14:12:56.001Z",
"dateUpdated": "2026-05-11T22:22:12.135Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53016 (GCVE-0-2026-53016)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-26 12:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp - copy IV using skcipher ivsize
AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver.
ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV
buffer while RFC3686 skciphers expose an 8-byte IV, so the restore
overruns the provided buffer.
Use crypto_skcipher_ivsize() to copy only the algorithm's IV length.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2b789435d7f36ed918d92db647f3a2f3fec9bb1f Version: 2b789435d7f36ed918d92db647f3a2f3fec9bb1f Version: 2b789435d7f36ed918d92db647f3a2f3fec9bb1f Version: 2b789435d7f36ed918d92db647f3a2f3fec9bb1f Version: 2b789435d7f36ed918d92db647f3a2f3fec9bb1f Version: 2b789435d7f36ed918d92db647f3a2f3fec9bb1f Version: 2b789435d7f36ed918d92db647f3a2f3fec9bb1f Version: 2b789435d7f36ed918d92db647f3a2f3fec9bb1f |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.34.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.156.1.rt7.497.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.156.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.208.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.208.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.25.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.146.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.135.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s cryptographic coprocessor (CCP) driver. When processing AF_ALG rfc3686-ctr-aes-ccp requests, the ccp_aes_complete() function attempts to restore more data than the allocated buffer for the Initialization Vector (IV) can hold. This leads to a buffer overrun, which can result in memory corruption within the kernel."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-805",
"description": "Buffer Access with Incorrect Length Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:05:05.937Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53016"
},
{
"name": "RHBZ#2492269",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492269"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53016.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:39494"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59544"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:56574"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:38491"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55764"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59473"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55765"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:39494: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:59544: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:56574: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:38491: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:55764: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:59473: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:55765: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: crypto: ccp - copy IV using skcipher ivsize",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, prevent module ccp-crypto from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/ccp/ccp-crypto-aes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "939061b2d0f7f15114e34b4ce878ef50ff4089c3",
"status": "affected",
"version": "2b789435d7f36ed918d92db647f3a2f3fec9bb1f",
"versionType": "git"
},
{
"lessThan": "798d409a8949f3f495f238549b86de2886b129bd",
"status": "affected",
"version": "2b789435d7f36ed918d92db647f3a2f3fec9bb1f",
"versionType": "git"
},
{
"lessThan": "dfb2cf434829819268fe50f41542aad318ad62b2",
"status": "affected",
"version": "2b789435d7f36ed918d92db647f3a2f3fec9bb1f",
"versionType": "git"
},
{
"lessThan": "eecee15e263ccb8cd77170a56ab6c969cb54dd6a",
"status": "affected",
"version": "2b789435d7f36ed918d92db647f3a2f3fec9bb1f",
"versionType": "git"
},
{
"lessThan": "bb01d8f1f385bc9034ca114d3508c7fdea24fc9a",
"status": "affected",
"version": "2b789435d7f36ed918d92db647f3a2f3fec9bb1f",
"versionType": "git"
},
{
"lessThan": "df9784bb5b637ac80f4a2768a58ca9a50bef28a9",
"status": "affected",
"version": "2b789435d7f36ed918d92db647f3a2f3fec9bb1f",
"versionType": "git"
},
{
"lessThan": "227c1e1d9e2aa4cfc65ba446d5690da1f546cda4",
"status": "affected",
"version": "2b789435d7f36ed918d92db647f3a2f3fec9bb1f",
"versionType": "git"
},
{
"lessThan": "a7a1f3cdd64d8a165d9b8c9e9ad7fb46ac19dfc4",
"status": "affected",
"version": "2b789435d7f36ed918d92db647f3a2f3fec9bb1f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/ccp/ccp-crypto-aes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.14"
},
{
"lessThan": "3.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - copy IV using skcipher ivsize\n\nAF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver.\n\nccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller\u0027s IV\nbuffer while RFC3686 skciphers expose an 8-byte IV, so the restore\noverruns the provided buffer.\n\nUse crypto_skcipher_ivsize() to copy only the algorithm\u0027s IV length."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable CCP skcipher path is reached through local AF_ALG socket syscalls, not by processing remote packets. An attacker binds an AF_ALG skcipher socket to `rfc3686-ctr-aes-ccp` and submits a request locally.\nAC:L - Once the affected CCP algorithm is present, the trigger is a deterministic AF_ALG request with an 8-byte RFC3686 IV. No race or condition outside the attacker\u0027s control is required.\nPR:L - AF_ALG socket creation, bind, key setup, accept, sendmsg, and recvmsg have no capability checks, so a basic unprivileged local user can reach the bug. The driver-only flag can be selected through the allowed AF_ALG feature/mask fields.\nUI:N - Exploitation is entirely driven by the attacker\u0027s local syscalls. No separate victim action is required.\nS:U - The vulnerability corrupts kernel memory within the same kernel security authority. It does not cross a VM, IOMMU, or similar security boundary.\nC:H - The bug is an attacker-reachable kernel heap out-of-bounds write caused by copying 16 IV bytes into an 8-byte AF_ALG IV buffer. Kernel memory corruption can reasonably be developed into information disclosure primitives.\nI:H - The overwrite corrupts adjacent kernel heap memory from an unprivileged request path. As an out-of-bounds write, it is defensibly scored as potentially enabling arbitrary memory modification or control-flow compromise.\nA:H - Even without full exploitation, the heap corruption can crash or destabilize the kernel. Repeated unprivileged triggering can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:39.711Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/939061b2d0f7f15114e34b4ce878ef50ff4089c3"
},
{
"url": "https://git.kernel.org/stable/c/798d409a8949f3f495f238549b86de2886b129bd"
},
{
"url": "https://git.kernel.org/stable/c/dfb2cf434829819268fe50f41542aad318ad62b2"
},
{
"url": "https://git.kernel.org/stable/c/eecee15e263ccb8cd77170a56ab6c969cb54dd6a"
},
{
"url": "https://git.kernel.org/stable/c/bb01d8f1f385bc9034ca114d3508c7fdea24fc9a"
},
{
"url": "https://git.kernel.org/stable/c/df9784bb5b637ac80f4a2768a58ca9a50bef28a9"
},
{
"url": "https://git.kernel.org/stable/c/227c1e1d9e2aa4cfc65ba446d5690da1f546cda4"
},
{
"url": "https://git.kernel.org/stable/c/a7a1f3cdd64d8a165d9b8c9e9ad7fb46ac19dfc4"
}
],
"title": "crypto: ccp - copy IV using skcipher ivsize",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53016",
"datePublished": "2026-06-24T16:29:26.272Z",
"dateReserved": "2026-06-09T07:44:35.378Z",
"dateUpdated": "2026-08-26T12:05:05.937Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31616 (GCVE-0-2026-31616)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()
A broken/bored/mean USB host can overflow the skb_shared_info->frags[]
array on a Linux gadget exposing a Phonet function by sending an
unbounded sequence of full-page OUT transfers.
pn_rx_complete() finalizes the skb only when req->actual < req->length,
where req->length is set to PAGE_SIZE by the gadget. If the host always
sends exactly PAGE_SIZE bytes per transfer, fp->rx.skb will never be
reset and each completion will add another fragment via
skb_add_rx_frag(). Once nr_frags exceeds MAX_SKB_FRAGS (default 17),
subsequent frag stores overwrite memory adjacent to the shinfo on the
heap.
Drop the skb and account a length error when the frag limit is reached,
matching the fix applied in t7xx by commit f0813bcd2d9d ("net: wwan:
t7xx: fix potential skb->frags overflow in RX path").
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b91cd1440870f7a0649e570498b7b93caf9f781c Version: b91cd1440870f7a0649e570498b7b93caf9f781c Version: b91cd1440870f7a0649e570498b7b93caf9f781c Version: b91cd1440870f7a0649e570498b7b93caf9f781c Version: b91cd1440870f7a0649e570498b7b93caf9f781c Version: b91cd1440870f7a0649e570498b7b93caf9f781c Version: b91cd1440870f7a0649e570498b7b93caf9f781c Version: b91cd1440870f7a0649e570498b7b93caf9f781c Version: b91cd1440870f7a0649e570498b7b93caf9f781c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_phonet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d7f7e0c842242878c24b2facff8d6eda23ee1e9",
"status": "affected",
"version": "b91cd1440870f7a0649e570498b7b93caf9f781c",
"versionType": "git"
},
{
"lessThan": "b5ec49fa198bd08967a3102bd41f53ccadce72c9",
"status": "affected",
"version": "b91cd1440870f7a0649e570498b7b93caf9f781c",
"versionType": "git"
},
{
"lessThan": "7424f0287da73d3d8c5fa5e9d25d26fce762708e",
"status": "affected",
"version": "b91cd1440870f7a0649e570498b7b93caf9f781c",
"versionType": "git"
},
{
"lessThan": "9ceff1251904901b0b4e5fe6350fcaffa368ce83",
"status": "affected",
"version": "b91cd1440870f7a0649e570498b7b93caf9f781c",
"versionType": "git"
},
{
"lessThan": "c9315ce9da3632c591666a29de82d3e92d46bec1",
"status": "affected",
"version": "b91cd1440870f7a0649e570498b7b93caf9f781c",
"versionType": "git"
},
{
"lessThan": "4e476c25bfcab0535ba7c76a903ae77ca8747711",
"status": "affected",
"version": "b91cd1440870f7a0649e570498b7b93caf9f781c",
"versionType": "git"
},
{
"lessThan": "bd44ce09b9b569f49ed13e2d87d23d853fc7d6a7",
"status": "affected",
"version": "b91cd1440870f7a0649e570498b7b93caf9f781c",
"versionType": "git"
},
{
"lessThan": "66f7471c4042e4eb300e30b5b9d87d1406862673",
"status": "affected",
"version": "b91cd1440870f7a0649e570498b7b93caf9f781c",
"versionType": "git"
},
{
"lessThan": "c088d5dd2fffb4de1fb8e7f57751c8b82942180a",
"status": "affected",
"version": "b91cd1440870f7a0649e570498b7b93caf9f781c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_phonet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.32"
},
{
"lessThan": "2.6.32",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()\n\nA broken/bored/mean USB host can overflow the skb_shared_info-\u003efrags[]\narray on a Linux gadget exposing a Phonet function by sending an\nunbounded sequence of full-page OUT transfers.\n\npn_rx_complete() finalizes the skb only when req-\u003eactual \u003c req-\u003elength,\nwhere req-\u003elength is set to PAGE_SIZE by the gadget. If the host always\nsends exactly PAGE_SIZE bytes per transfer, fp-\u003erx.skb will never be\nreset and each completion will add another fragment via\nskb_add_rx_frag(). Once nr_frags exceeds MAX_SKB_FRAGS (default 17),\nsubsequent frag stores overwrite memory adjacent to the shinfo on the\nheap.\n\nDrop the skb and account a length error when the frag limit is reached,\nmatching the fix applied in t7xx by commit f0813bcd2d9d (\"net: wwan:\nt7xx: fix potential skb-\u003efrags overflow in RX path\")."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:43:01.212Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d7f7e0c842242878c24b2facff8d6eda23ee1e9"
},
{
"url": "https://git.kernel.org/stable/c/b5ec49fa198bd08967a3102bd41f53ccadce72c9"
},
{
"url": "https://git.kernel.org/stable/c/7424f0287da73d3d8c5fa5e9d25d26fce762708e"
},
{
"url": "https://git.kernel.org/stable/c/9ceff1251904901b0b4e5fe6350fcaffa368ce83"
},
{
"url": "https://git.kernel.org/stable/c/c9315ce9da3632c591666a29de82d3e92d46bec1"
},
{
"url": "https://git.kernel.org/stable/c/4e476c25bfcab0535ba7c76a903ae77ca8747711"
},
{
"url": "https://git.kernel.org/stable/c/bd44ce09b9b569f49ed13e2d87d23d853fc7d6a7"
},
{
"url": "https://git.kernel.org/stable/c/66f7471c4042e4eb300e30b5b9d87d1406862673"
},
{
"url": "https://git.kernel.org/stable/c/c088d5dd2fffb4de1fb8e7f57751c8b82942180a"
}
],
"title": "usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31616",
"datePublished": "2026-04-24T14:42:35.480Z",
"dateReserved": "2026-03-09T15:48:24.123Z",
"dateUpdated": "2026-06-14T17:43:01.212Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43443 (GCVE-0-2026-43443)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-11 22:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: amd: acp-mach-common: Add missing error check for clock acquisition
The acp_card_rt5682_init() and acp_card_rt5682s_init() functions did not
check the return values of clk_get(). This could lead to a kernel crash
when the invalid pointers are later dereferenced by clock core
functions.
Fix this by:
1. Changing clk_get() to the device-managed devm_clk_get().
2. Adding IS_ERR() checks immediately after each clock acquisition.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/amd/acp/acp-mach-common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0cee68fb7f4cf1562e067c5a82d25062a973b0d0",
"status": "affected",
"version": "d4c750f2c7d44b5b39e197308bc3f510205bba4b",
"versionType": "git"
},
{
"lessThan": "30c64fb9839949f085c8eb55b979cbd8a4c51f00",
"status": "affected",
"version": "d4c750f2c7d44b5b39e197308bc3f510205bba4b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/amd/acp/acp-mach-common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: acp-mach-common: Add missing error check for clock acquisition\n\nThe acp_card_rt5682_init() and acp_card_rt5682s_init() functions did not\ncheck the return values of clk_get(). This could lead to a kernel crash\nwhen the invalid pointers are later dereferenced by clock core\nfunctions.\n\nFix this by:\n1. Changing clk_get() to the device-managed devm_clk_get().\n2. Adding IS_ERR() checks immediately after each clock acquisition."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:41.338Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0cee68fb7f4cf1562e067c5a82d25062a973b0d0"
},
{
"url": "https://git.kernel.org/stable/c/30c64fb9839949f085c8eb55b979cbd8a4c51f00"
}
],
"title": "ASoC: amd: acp-mach-common: Add missing error check for clock acquisition",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43443",
"datePublished": "2026-05-08T14:22:11.303Z",
"dateReserved": "2026-05-01T14:12:56.009Z",
"dateUpdated": "2026-05-11T22:24:41.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43225 (GCVE-0-2026-43225)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix memory leak on failure path
cfg80211_inform_bss_frame() may return NULL on failure. In that case,
the allocated buffer 'buf' is not freed and the function returns early,
leading to potential memory leak.
Fix this by ensuring that 'buf' is freed on both success and failure paths.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9874e33ce52ba449ab0ade78752a2d37a2294617",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "a968c6a39607c129b8ac2c3c2a5e8923574e90d0",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "8311bb40698ba027649d5d1ca84ad4bf25270546",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "9f70f78e22b321429afc77befecedf05543d4e2c",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "af48c1a0abe849e167fc754b6c260b6d8350b6fd",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "017295b17bf1f477246c95bd253a7ef0cb4684c9",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "abe850d82c8cb72d28700673678724e779b1826e",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix memory leak on failure path\n\ncfg80211_inform_bss_frame() may return NULL on failure. In that case,\nthe allocated buffer \u0027buf\u0027 is not freed and the function returns early,\nleading to potential memory leak.\nFix this by ensuring that \u0027buf\u0027 is freed on both success and failure paths."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:20:25.453Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9874e33ce52ba449ab0ade78752a2d37a2294617"
},
{
"url": "https://git.kernel.org/stable/c/a968c6a39607c129b8ac2c3c2a5e8923574e90d0"
},
{
"url": "https://git.kernel.org/stable/c/8311bb40698ba027649d5d1ca84ad4bf25270546"
},
{
"url": "https://git.kernel.org/stable/c/9f70f78e22b321429afc77befecedf05543d4e2c"
},
{
"url": "https://git.kernel.org/stable/c/af48c1a0abe849e167fc754b6c260b6d8350b6fd"
},
{
"url": "https://git.kernel.org/stable/c/017295b17bf1f477246c95bd253a7ef0cb4684c9"
},
{
"url": "https://git.kernel.org/stable/c/abe850d82c8cb72d28700673678724e779b1826e"
}
],
"title": "staging: rtl8723bs: fix memory leak on failure path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43225",
"datePublished": "2026-05-06T11:28:24.289Z",
"dateReserved": "2026-05-01T14:12:55.994Z",
"dateUpdated": "2026-05-11T22:20:25.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46230 (GCVE-0-2026-46230)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
Check bounds against the end of the BO whenever we access the msg.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 87cc7f9ebf7ce10f82250002d667ef3e93a79d44 Version: 87cc7f9ebf7ce10f82250002d667ef3e93a79d44 Version: 87cc7f9ebf7ce10f82250002d667ef3e93a79d44 Version: 87cc7f9ebf7ce10f82250002d667ef3e93a79d44 Version: 87cc7f9ebf7ce10f82250002d667ef3e93a79d44 Version: 87cc7f9ebf7ce10f82250002d667ef3e93a79d44 Version: 87cc7f9ebf7ce10f82250002d667ef3e93a79d44 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f55552adb100eb54a6e6dabff4fbdc8679bd3fa0",
"status": "affected",
"version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
"versionType": "git"
},
{
"lessThan": "82c535eff05490c71153af57de9fe85502fcb5d5",
"status": "affected",
"version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
"versionType": "git"
},
{
"lessThan": "638d3e0b9eb77aa53fdd60e2b928761d16ba76fa",
"status": "affected",
"version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
"versionType": "git"
},
{
"lessThan": "870c8738c3774336baedddd0240951d078a703b8",
"status": "affected",
"version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
"versionType": "git"
},
{
"lessThan": "638e48ee39d0f2af9336f917a6f5d6692dd64d93",
"status": "affected",
"version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
"versionType": "git"
},
{
"lessThan": "e382e0b81a3e7bd21504fee1d01ae8b08f84d3a7",
"status": "affected",
"version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
"versionType": "git"
},
{
"lessThan": "b193019860d61e92da395eae2011f2f6716b182f",
"status": "affected",
"version": "87cc7f9ebf7ce10f82250002d667ef3e93a79d44",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg\n\nCheck bounds against the end of the BO whenever we access the msg."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Reached only via the local DRM_IOCTL_AMDGPU_CS ioctl on the GPU render node; the malicious message must be submitted by a local process holding a device fd, not over any network.\nAC:L - The attacker fully controls the message BO it allocates and references (length, num_buffers, offset/size), so it can deterministically set out-of-range values to trigger the OOB read with no race or uncontrolled condition.\nPR:L - The CS ioctl is DRM_RENDER_ALLOW, reachable by any unprivileged local user/sandboxed client with access to a render node; no root or special capability is required.\nUI:N - The attacker submits the crafted command stream directly; no victim action is needed.\nS:U - The out-of-bounds access stays within the kernel\u0027s own memory and security authority; no VM/IOMMU/sandbox boundary is crossed.\nC:H - Attacker-controlled num_buffers and offset drive an unbounded out-of-bounds read of kernel memory well beyond a few bytes, which per guidance is treated as High confidentiality impact.\nI:N - The flaw is purely an out-of-bounds read; no out-of-range data is ever written back, so there is no memory-modification or control-flow-corruption primitive.\nA:H - Iterating over an attacker-supplied huge num_buffers reads past the kmapped buffer into unmapped memory, causing a kernel page fault/oops (crash)."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:37.247Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f55552adb100eb54a6e6dabff4fbdc8679bd3fa0"
},
{
"url": "https://git.kernel.org/stable/c/82c535eff05490c71153af57de9fe85502fcb5d5"
},
{
"url": "https://git.kernel.org/stable/c/638d3e0b9eb77aa53fdd60e2b928761d16ba76fa"
},
{
"url": "https://git.kernel.org/stable/c/870c8738c3774336baedddd0240951d078a703b8"
},
{
"url": "https://git.kernel.org/stable/c/638e48ee39d0f2af9336f917a6f5d6692dd64d93"
},
{
"url": "https://git.kernel.org/stable/c/e382e0b81a3e7bd21504fee1d01ae8b08f84d3a7"
},
{
"url": "https://git.kernel.org/stable/c/b193019860d61e92da395eae2011f2f6716b182f"
}
],
"title": "drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46230",
"datePublished": "2026-05-28T09:40:52.696Z",
"dateReserved": "2026-05-13T15:03:33.106Z",
"dateUpdated": "2026-08-05T12:30:37.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53355 (GCVE-0-2026-53355)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-08-05 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: rds: clear i_sends on setup unwind
The RDS IB connection teardown path is written so it can run during
partial startup and on repeated shutdown attempts. It uses NULL
pointers to distinguish resources that are still owned from resources
that have already been released.
When rds_ib_setup_qp() fails after allocating i_sends but before
allocating i_recvs, the sends_out path frees i_sends without clearing
the pointer. A later shutdown pass can still treat that stale pointer
as a live send ring allocation.
Clear i_sends after vfree() in the error unwind path so the existing
shutdown logic continues to use the correct ownership state.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3b12f73a5c2977153f28a224392fd4729b50d1dc Version: 3b12f73a5c2977153f28a224392fd4729b50d1dc Version: 3b12f73a5c2977153f28a224392fd4729b50d1dc Version: 3b12f73a5c2977153f28a224392fd4729b50d1dc Version: 3b12f73a5c2977153f28a224392fd4729b50d1dc Version: 3b12f73a5c2977153f28a224392fd4729b50d1dc Version: 3b12f73a5c2977153f28a224392fd4729b50d1dc Version: 3b12f73a5c2977153f28a224392fd4729b50d1dc Version: 75a12b2fa80c2e4cc40a9f9305f95899850b7426 Version: c9459693fae9a1bf3f51f3db98617f694112e897 Version: 13099ee9c7d54b0a25f6c8397675aed99e9cfa45 Version: 5c6712ab4efb6cf60e16719ab6bcaface9cc268c Version: 3.18.74 ≤ Version: 4.1.46 ≤ Version: 4.4.91 ≤ Version: 4.9.54 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/ib_cm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "66cccec111421a10efdc2c74499d15b93e7acae5",
"status": "affected",
"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
"versionType": "git"
},
{
"lessThan": "2c5e5e4a5970c41f16e3ad801a78719ed5d5c71b",
"status": "affected",
"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
"versionType": "git"
},
{
"lessThan": "29d940026dce39e3018dab6f67c9427249321270",
"status": "affected",
"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
"versionType": "git"
},
{
"lessThan": "e7cf30aa5f1fc6c2a86df65df8b731df20e44d79",
"status": "affected",
"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
"versionType": "git"
},
{
"lessThan": "f16ad421a4e3e7db2d14bdf3b16f583bc4f3b30a",
"status": "affected",
"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
"versionType": "git"
},
{
"lessThan": "1d4ec754ee3871f7e3670c67bb0298c9c5760926",
"status": "affected",
"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
"versionType": "git"
},
{
"lessThan": "27040bbca289a704eafcacca167d310c6ce2b1bc",
"status": "affected",
"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
"versionType": "git"
},
{
"lessThan": "20cf0fb715c41111469577e85e35d15f099473e0",
"status": "affected",
"version": "3b12f73a5c2977153f28a224392fd4729b50d1dc",
"versionType": "git"
},
{
"status": "affected",
"version": "75a12b2fa80c2e4cc40a9f9305f95899850b7426",
"versionType": "git"
},
{
"status": "affected",
"version": "c9459693fae9a1bf3f51f3db98617f694112e897",
"versionType": "git"
},
{
"status": "affected",
"version": "13099ee9c7d54b0a25f6c8397675aed99e9cfa45",
"versionType": "git"
},
{
"status": "affected",
"version": "5c6712ab4efb6cf60e16719ab6bcaface9cc268c",
"versionType": "git"
},
{
"lessThan": "3.19",
"status": "affected",
"version": "3.18.74",
"versionType": "semver"
},
{
"lessThan": "4.2",
"status": "affected",
"version": "4.1.46",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.91",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.54",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/ib_cm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.1.46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.54",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rds: clear i_sends on setup unwind\n\nThe RDS IB connection teardown path is written so it can run during\npartial startup and on repeated shutdown attempts. It uses NULL\npointers to distinguish resources that are still owned from resources\nthat have already been released.\n\nWhen rds_ib_setup_qp() fails after allocating i_sends but before\nallocating i_recvs, the sends_out path frees i_sends without clearing\nthe pointer. A later shutdown pass can still treat that stale pointer\nas a live send ring allocation.\n\nClear i_sends after vfree() in the error unwind path so the existing\nshutdown logic continues to use the correct ownership state."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable RDS/IB setup path is reachable by a remote RDMA/RDS peer through RDMA CM connection requests handled by the kernel listener, before any RDS-level authentication. It is also reachable locally via AF_RDS send-triggered connects, but the remote network path is the higher-severity reasonable scenario.\nAC:L - The bug is triggered when `i_recvs` allocation fails after `i_sends` was allocated, and an attacker can drive repeated connection setup/resource pressure to reach that condition. No race or victim-controlled timing is required.\nPR:N - The incoming RDMA CM connect path requires no local account or authenticated RDS credentials. Local AF_RDS access is unprivileged in the initial network namespace, but the remote path makes privileges none.\nUI:N - No victim user action is needed once the RDS/IB listener is present. Connection setup and teardown are handled by kernel workqueues/CM callbacks.\nS:U - The corruption occurs inside the host kernel RDS/IB connection state and does not cross a separate security authority such as a guest-host or IOMMU boundary. This is standard kernel compromise/DoS scope.\nC:H - The stale `i_sends` pointer creates a use-after-free/double-free of kernel memory and the teardown path reads the freed send ring. Under the required high-severity assumption for UAF-style memory corruption, this can support kernel memory disclosure.\nI:H - The same stale-pointer/double-free condition can corrupt kernel allocator state or operate on attacker-reused freed memory. As kernel memory corruption, it is defensibly scored as capable of arbitrary write/control-flow impact.\nA:H - At minimum, the later shutdown pass can dereference and free an already freed kernel allocation, causing an oops, panic, or allocator corruption. Repeated unauthenticated connection attempts can therefore crash or destabilize the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:35:04.534Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/66cccec111421a10efdc2c74499d15b93e7acae5"
},
{
"url": "https://git.kernel.org/stable/c/2c5e5e4a5970c41f16e3ad801a78719ed5d5c71b"
},
{
"url": "https://git.kernel.org/stable/c/29d940026dce39e3018dab6f67c9427249321270"
},
{
"url": "https://git.kernel.org/stable/c/e7cf30aa5f1fc6c2a86df65df8b731df20e44d79"
},
{
"url": "https://git.kernel.org/stable/c/f16ad421a4e3e7db2d14bdf3b16f583bc4f3b30a"
},
{
"url": "https://git.kernel.org/stable/c/1d4ec754ee3871f7e3670c67bb0298c9c5760926"
},
{
"url": "https://git.kernel.org/stable/c/27040bbca289a704eafcacca167d310c6ce2b1bc"
},
{
"url": "https://git.kernel.org/stable/c/20cf0fb715c41111469577e85e35d15f099473e0"
}
],
"title": "net: rds: clear i_sends on setup unwind",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53355",
"datePublished": "2026-07-01T13:32:30.831Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-08-05T12:35:04.534Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43141 (GCVE-0-2026-43141)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut
Number of MW LUTs depends on NTB configuration and can be set to zero,
in such scenario rounddown_pow_of_two will cause undefined behaviour and
should not be performed.
This patch ensures that rounddown_pow_of_two is called on valid value.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ec0467ccbdeb69a86c8729073057bda7bce00eec Version: ec0467ccbdeb69a86c8729073057bda7bce00eec Version: ec0467ccbdeb69a86c8729073057bda7bce00eec Version: ec0467ccbdeb69a86c8729073057bda7bce00eec Version: ec0467ccbdeb69a86c8729073057bda7bce00eec Version: ec0467ccbdeb69a86c8729073057bda7bce00eec Version: ec0467ccbdeb69a86c8729073057bda7bce00eec Version: ec0467ccbdeb69a86c8729073057bda7bce00eec |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/ntb/hw/mscc/ntb_hw_switchtec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d652ef399f131fcd5f8f34266167449ee7c9e5b3",
"status": "affected",
"version": "ec0467ccbdeb69a86c8729073057bda7bce00eec",
"versionType": "git"
},
{
"lessThan": "5590cd04d6845c01a6bad985a491c58af6fb5389",
"status": "affected",
"version": "ec0467ccbdeb69a86c8729073057bda7bce00eec",
"versionType": "git"
},
{
"lessThan": "a11d03d116eef138a7249202bd772c8e61915aec",
"status": "affected",
"version": "ec0467ccbdeb69a86c8729073057bda7bce00eec",
"versionType": "git"
},
{
"lessThan": "d0559d07afabfddaaded6a61a16154486b956764",
"status": "affected",
"version": "ec0467ccbdeb69a86c8729073057bda7bce00eec",
"versionType": "git"
},
{
"lessThan": "2e4d5e8d86a969318340be95470bb76e52392082",
"status": "affected",
"version": "ec0467ccbdeb69a86c8729073057bda7bce00eec",
"versionType": "git"
},
{
"lessThan": "a133e3caf844a3f56b6eef89ddaa66115874f6bd",
"status": "affected",
"version": "ec0467ccbdeb69a86c8729073057bda7bce00eec",
"versionType": "git"
},
{
"lessThan": "1a867d0d79a4a570a33f2f433919ad2bd7a27b67",
"status": "affected",
"version": "ec0467ccbdeb69a86c8729073057bda7bce00eec",
"versionType": "git"
},
{
"lessThan": "186615f8855a0be4ee7d3fcd09a8ecc10e783b08",
"status": "affected",
"version": "ec0467ccbdeb69a86c8729073057bda7bce00eec",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/ntb/hw/mscc/ntb_hw_switchtec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut\n\nNumber of MW LUTs depends on NTB configuration and can be set to zero,\nin such scenario rounddown_pow_of_two will cause undefined behaviour and\nshould not be performed.\nThis patch ensures that rounddown_pow_of_two is called on valid value."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:18:33.118Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d652ef399f131fcd5f8f34266167449ee7c9e5b3"
},
{
"url": "https://git.kernel.org/stable/c/5590cd04d6845c01a6bad985a491c58af6fb5389"
},
{
"url": "https://git.kernel.org/stable/c/a11d03d116eef138a7249202bd772c8e61915aec"
},
{
"url": "https://git.kernel.org/stable/c/d0559d07afabfddaaded6a61a16154486b956764"
},
{
"url": "https://git.kernel.org/stable/c/2e4d5e8d86a969318340be95470bb76e52392082"
},
{
"url": "https://git.kernel.org/stable/c/a133e3caf844a3f56b6eef89ddaa66115874f6bd"
},
{
"url": "https://git.kernel.org/stable/c/1a867d0d79a4a570a33f2f433919ad2bd7a27b67"
},
{
"url": "https://git.kernel.org/stable/c/186615f8855a0be4ee7d3fcd09a8ecc10e783b08"
}
],
"title": "ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43141",
"datePublished": "2026-05-06T11:27:26.193Z",
"dateReserved": "2026-05-01T14:12:55.989Z",
"dateUpdated": "2026-05-11T22:18:33.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43319 (GCVE-0-2026-43319)
Vulnerability from cvelistv5
Published
2026-05-08 13:26
Modified
2026-06-01 16:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
spi: spidev: fix lock inversion between spi_lock and buf_lock
The spidev driver previously used two mutexes, spi_lock and buf_lock,
but acquired them in different orders depending on the code path:
write()/read(): buf_lock -> spi_lock
ioctl(): spi_lock -> buf_lock
This AB-BA locking pattern triggers lockdep warnings and can
cause real deadlocks:
WARNING: possible circular locking dependency detected
spidev_ioctl() -> mutex_lock(&spidev->buf_lock)
spidev_sync_write() -> mutex_lock(&spidev->spi_lock)
*** DEADLOCK ***
The issue is reproducible with a simple userspace program that
performs write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from
separate threads on the same spidev file descriptor.
Fix this by simplifying the locking model and removing the lock
inversion entirely. spidev_sync() no longer performs any locking,
and all callers serialize access using spi_lock.
buf_lock is removed since its functionality is fully covered by
spi_lock, eliminating the possibility of lock ordering issues.
This removes the lock inversion and prevents deadlocks without
changing userspace ABI or behaviour.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/spi/spidev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fabfed1afe273717ea33b8aee46b767360edbb80",
"status": "affected",
"version": "a720416d94634068951773cb9e9d6f1b73769e5b",
"versionType": "git"
},
{
"lessThan": "f8431b8672231d378b03176fe74c95adfd3522cf",
"status": "affected",
"version": "a720416d94634068951773cb9e9d6f1b73769e5b",
"versionType": "git"
},
{
"lessThan": "e341e18215030af2136836b78508e0d798916df7",
"status": "affected",
"version": "a720416d94634068951773cb9e9d6f1b73769e5b",
"versionType": "git"
},
{
"lessThan": "41ccfac7d302968a4f32b5f7b012d066c5f5cdf8",
"status": "affected",
"version": "a720416d94634068951773cb9e9d6f1b73769e5b",
"versionType": "git"
},
{
"lessThan": "40534d19ed2afb880ecf202dab26a8e7a5808d16",
"status": "affected",
"version": "a720416d94634068951773cb9e9d6f1b73769e5b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/spi/spidev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spidev: fix lock inversion between spi_lock and buf_lock\n\nThe spidev driver previously used two mutexes, spi_lock and buf_lock,\nbut acquired them in different orders depending on the code path:\n\n write()/read(): buf_lock -\u003e spi_lock\n ioctl(): spi_lock -\u003e buf_lock\n\nThis AB-BA locking pattern triggers lockdep warnings and can\ncause real deadlocks:\n\n WARNING: possible circular locking dependency detected\n spidev_ioctl() -\u003e mutex_lock(\u0026spidev-\u003ebuf_lock)\n spidev_sync_write() -\u003e mutex_lock(\u0026spidev-\u003espi_lock)\n *** DEADLOCK ***\n\nThe issue is reproducible with a simple userspace program that\nperforms write() and SPI_IOC_WR_MAX_SPEED_HZ ioctl() calls from\nseparate threads on the same spidev file descriptor.\n\nFix this by simplifying the locking model and removing the lock\ninversion entirely. spidev_sync() no longer performs any locking,\nand all callers serialize access using spi_lock.\n\nbuf_lock is removed since its functionality is fully covered by\nspi_lock, eliminating the possibility of lock ordering issues.\n\nThis removes the lock inversion and prevents deadlocks without\nchanging userspace ABI or behaviour."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T16:15:35.875Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fabfed1afe273717ea33b8aee46b767360edbb80"
},
{
"url": "https://git.kernel.org/stable/c/f8431b8672231d378b03176fe74c95adfd3522cf"
},
{
"url": "https://git.kernel.org/stable/c/e341e18215030af2136836b78508e0d798916df7"
},
{
"url": "https://git.kernel.org/stable/c/41ccfac7d302968a4f32b5f7b012d066c5f5cdf8"
},
{
"url": "https://git.kernel.org/stable/c/40534d19ed2afb880ecf202dab26a8e7a5808d16"
}
],
"title": "spi: spidev: fix lock inversion between spi_lock and buf_lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43319",
"datePublished": "2026-05-08T13:26:14.231Z",
"dateReserved": "2026-05-01T14:12:56.001Z",
"dateUpdated": "2026-06-01T16:15:35.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43104 (GCVE-0-2026-43104)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-06-01 16:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Fix a memory leak in hang state error path
When vc4_save_hang_state() encounters an early return condition, it
returns without freeing the previously allocated `kernel_state`,
leaking memory.
Add the missing kfree() calls by consolidating the early return paths
into a single place.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 214613656b5179f0daab6e0a080814b5100d45f0 Version: 214613656b5179f0daab6e0a080814b5100d45f0 Version: 214613656b5179f0daab6e0a080814b5100d45f0 Version: 214613656b5179f0daab6e0a080814b5100d45f0 Version: 214613656b5179f0daab6e0a080814b5100d45f0 Version: 214613656b5179f0daab6e0a080814b5100d45f0 Version: 214613656b5179f0daab6e0a080814b5100d45f0 Version: 214613656b5179f0daab6e0a080814b5100d45f0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_gem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c197def3834cbee3fd824ce4c57d08cb24e18955",
"status": "affected",
"version": "214613656b5179f0daab6e0a080814b5100d45f0",
"versionType": "git"
},
{
"lessThan": "9487daa18e627ac6b5ed5911be79f23362554b70",
"status": "affected",
"version": "214613656b5179f0daab6e0a080814b5100d45f0",
"versionType": "git"
},
{
"lessThan": "259e2bba3fd7005c62cbd42365a48b3221b244e3",
"status": "affected",
"version": "214613656b5179f0daab6e0a080814b5100d45f0",
"versionType": "git"
},
{
"lessThan": "dd5c49787a32da96a2b154427eb17cbf12a83c28",
"status": "affected",
"version": "214613656b5179f0daab6e0a080814b5100d45f0",
"versionType": "git"
},
{
"lessThan": "d8fdd6adc07b78ad3e9ee0004876d90cb59ca941",
"status": "affected",
"version": "214613656b5179f0daab6e0a080814b5100d45f0",
"versionType": "git"
},
{
"lessThan": "e352e9adc9f6df54d63150ff832f71c04e30744b",
"status": "affected",
"version": "214613656b5179f0daab6e0a080814b5100d45f0",
"versionType": "git"
},
{
"lessThan": "3eb7dd55021d0f4308fbea0bea21d2118984d8e7",
"status": "affected",
"version": "214613656b5179f0daab6e0a080814b5100d45f0",
"versionType": "git"
},
{
"lessThan": "9525d169e5fd481538cf8c663cc5839e54f2e481",
"status": "affected",
"version": "214613656b5179f0daab6e0a080814b5100d45f0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/vc4/vc4_gem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vc4: Fix a memory leak in hang state error path\n\nWhen vc4_save_hang_state() encounters an early return condition, it\nreturns without freeing the previously allocated `kernel_state`,\nleaking memory.\n\nAdd the missing kfree() calls by consolidating the early return paths\ninto a single place."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T16:14:51.659Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c197def3834cbee3fd824ce4c57d08cb24e18955"
},
{
"url": "https://git.kernel.org/stable/c/9487daa18e627ac6b5ed5911be79f23362554b70"
},
{
"url": "https://git.kernel.org/stable/c/259e2bba3fd7005c62cbd42365a48b3221b244e3"
},
{
"url": "https://git.kernel.org/stable/c/dd5c49787a32da96a2b154427eb17cbf12a83c28"
},
{
"url": "https://git.kernel.org/stable/c/d8fdd6adc07b78ad3e9ee0004876d90cb59ca941"
},
{
"url": "https://git.kernel.org/stable/c/e352e9adc9f6df54d63150ff832f71c04e30744b"
},
{
"url": "https://git.kernel.org/stable/c/3eb7dd55021d0f4308fbea0bea21d2118984d8e7"
},
{
"url": "https://git.kernel.org/stable/c/9525d169e5fd481538cf8c663cc5839e54f2e481"
}
],
"title": "drm/vc4: Fix a memory leak in hang state error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43104",
"datePublished": "2026-05-06T07:40:33.036Z",
"dateReserved": "2026-05-01T14:12:55.984Z",
"dateUpdated": "2026-06-01T16:14:51.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45961 (GCVE-0-2026-45961)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-05-27 12:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
gfs2: fix memory leaks in gfs2_fill_super error path
Fix two memory leaks in the gfs2_fill_super() error handling path when
transitioning a filesystem to read-write mode fails.
First leak: kthread objects (thread_struct, task_struct, etc.)
When gfs2_freeze_lock_shared() fails after init_threads() succeeds, the
created kernel threads (logd and quotad) are never destroyed. This
occurs because the fail_per_node label doesn't call
gfs2_destroy_threads().
Second leak: quota bitmap buffer (8192 bytes)
When gfs2_make_fs_rw() fails after gfs2_quota_init() succeeds but
before other operations complete, the allocated quota bitmap is never
freed.
The fix moves thread cleanup to the fail_per_node label to handle all
error paths uniformly. gfs2_destroy_threads() is safe to call
unconditionally as it checks for NULL pointers. Quota cleanup is added
in gfs2_make_fs_rw() to properly handle the withdrawal case where
quota initialization succeeds but the filesystem is then withdrawn.
Thread leak backtrace (gfs2_freeze_lock_shared failure):
unreferenced object 0xffff88801d7bca80 (size 4480):
copy_process+0x3a1/0x4670 kernel/fork.c:2422
kernel_clone+0xf3/0x6e0 kernel/fork.c:2779
kthread_create_on_node+0x100/0x150 kernel/kthread.c:478
init_threads+0xab/0x350 fs/gfs2/ops_fstype.c:611
gfs2_fill_super+0xe5c/0x1240 fs/gfs2/ops_fstype.c:1265
Quota leak backtrace (gfs2_make_fs_rw failure):
unreferenced object 0xffff88812de7c000 (size 8192):
gfs2_quota_init+0xe5/0x820 fs/gfs2/quota.c:1409
gfs2_make_fs_rw+0x7a/0xe0 fs/gfs2/super.c:149
gfs2_fill_super+0xfbb/0x1240 fs/gfs2/ops_fstype.c:1275
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b66f723bb552ad59c2acb5d45ea45c890f84498b Version: b66f723bb552ad59c2acb5d45ea45c890f84498b Version: 2f8623377f3e0cfaa80558631b8694d02a492b4c Version: c713ebf2fe3f469e4af4de60a3427689ffb7c5d7 Version: c2191e507147b1a22e9170ebb2aaa0f2902fcbfa Version: 9fc32dad3cdba18669c71893f3e6d96905b39b3f Version: 5.10.173 ≤ Version: 5.15.99 ≤ Version: 6.1.16 ≤ Version: 6.2.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/gfs2/ops_fstype.c",
"fs/gfs2/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e54229ecf49add8451d5f765a32c86ab4446e06c",
"status": "affected",
"version": "b66f723bb552ad59c2acb5d45ea45c890f84498b",
"versionType": "git"
},
{
"lessThan": "da6f5bbc2e7902f578b503f2a4c3d8d09ca4b102",
"status": "affected",
"version": "b66f723bb552ad59c2acb5d45ea45c890f84498b",
"versionType": "git"
},
{
"status": "affected",
"version": "2f8623377f3e0cfaa80558631b8694d02a492b4c",
"versionType": "git"
},
{
"status": "affected",
"version": "c713ebf2fe3f469e4af4de60a3427689ffb7c5d7",
"versionType": "git"
},
{
"status": "affected",
"version": "c2191e507147b1a22e9170ebb2aaa0f2902fcbfa",
"versionType": "git"
},
{
"status": "affected",
"version": "9fc32dad3cdba18669c71893f3e6d96905b39b3f",
"versionType": "git"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.173",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.99",
"versionType": "semver"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.16",
"versionType": "semver"
},
{
"lessThan": "6.3",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/gfs2/ops_fstype.c",
"fs/gfs2/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.173",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fix memory leaks in gfs2_fill_super error path\n\nFix two memory leaks in the gfs2_fill_super() error handling path when\ntransitioning a filesystem to read-write mode fails.\n\nFirst leak: kthread objects (thread_struct, task_struct, etc.)\nWhen gfs2_freeze_lock_shared() fails after init_threads() succeeds, the\ncreated kernel threads (logd and quotad) are never destroyed. This\noccurs because the fail_per_node label doesn\u0027t call\ngfs2_destroy_threads().\n\nSecond leak: quota bitmap buffer (8192 bytes)\nWhen gfs2_make_fs_rw() fails after gfs2_quota_init() succeeds but\nbefore other operations complete, the allocated quota bitmap is never\nfreed.\n\nThe fix moves thread cleanup to the fail_per_node label to handle all\nerror paths uniformly. gfs2_destroy_threads() is safe to call\nunconditionally as it checks for NULL pointers. Quota cleanup is added\nin gfs2_make_fs_rw() to properly handle the withdrawal case where\nquota initialization succeeds but the filesystem is then withdrawn.\n\nThread leak backtrace (gfs2_freeze_lock_shared failure):\n unreferenced object 0xffff88801d7bca80 (size 4480):\n copy_process+0x3a1/0x4670 kernel/fork.c:2422\n kernel_clone+0xf3/0x6e0 kernel/fork.c:2779\n kthread_create_on_node+0x100/0x150 kernel/kthread.c:478\n init_threads+0xab/0x350 fs/gfs2/ops_fstype.c:611\n gfs2_fill_super+0xe5c/0x1240 fs/gfs2/ops_fstype.c:1265\n\nQuota leak backtrace (gfs2_make_fs_rw failure):\n unreferenced object 0xffff88812de7c000 (size 8192):\n gfs2_quota_init+0xe5/0x820 fs/gfs2/quota.c:1409\n gfs2_make_fs_rw+0x7a/0xe0 fs/gfs2/super.c:149\n gfs2_fill_super+0xfbb/0x1240 fs/gfs2/ops_fstype.c:1275"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:18:17.637Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e54229ecf49add8451d5f765a32c86ab4446e06c"
},
{
"url": "https://git.kernel.org/stable/c/da6f5bbc2e7902f578b503f2a4c3d8d09ca4b102"
}
],
"title": "gfs2: fix memory leaks in gfs2_fill_super error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45961",
"datePublished": "2026-05-27T12:18:17.637Z",
"dateReserved": "2026-05-13T15:03:33.089Z",
"dateUpdated": "2026-05-27T12:18:17.637Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46063 (GCVE-0-2026-46063)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-06-14 17:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/shstk: Prevent deadlock during shstk sigreturn
During sigreturn the shadow stack signal frame is popped. The kernel does
this by reading the shadow stack using normal read accesses. When it can't
assume the memory is shadow stack, it takes extra steps to makes sure it is
reading actual shadow stack memory and not other normal readable memory. It
does this by holding the mmap read lock while doing the access and checking
the flags of the VMA.
Unfortunately that is not safe. If the read of the shadow stack sigframe
hits a page fault, the fault handler will try to recursively grab another
mmap read lock. This normally works ok, but if a writer on another CPU is
also waiting, the second read lock could fail and cause a deadlock.
Fix this by not holding mmap lock during the read access to userspace.
Instead use mmap_lock_speculate_...() to watch for changes between dropping
mmap lock and the userspace access. Retry if anything grabbed an mmap write
lock in between and could have changed the VMA.
These mmap_lock_speculate_...() helpers use mm::mm_lock_seq, which is only
available when PER_VMA_LOCK is configured. So make X86_USER_SHADOW_STACK
depend on it. On x86, PER_VMA_LOCK is a default configuration for SMP
kernels. So drop support for the other configs under the assumption that
the !SMP shadow stack user base does not exist.
Currently there is a check that skips the lookup work when the SSP can be
assumed to be on a shadow stack. While reorganizing the function, remove
the optimization to make the tricky code flows more common, such that
issues like this cannot escape detection for so long.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/Kconfig",
"arch/x86/kernel/shstk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e2c2b044458cbf22da05264fa707308e8d4f86f9",
"status": "affected",
"version": "7fad2a432cd35bbf104d2d9d426e74902f22aa95",
"versionType": "git"
},
{
"lessThan": "d042d69b417515959e49021fef008c9b04a99bd5",
"status": "affected",
"version": "7fad2a432cd35bbf104d2d9d426e74902f22aa95",
"versionType": "git"
},
{
"lessThan": "4f3374c990fb2adec06d20fd6d780927811c9aa0",
"status": "affected",
"version": "7fad2a432cd35bbf104d2d9d426e74902f22aa95",
"versionType": "git"
},
{
"lessThan": "3d29db827502067626062f5c74dd502d14ab15bc",
"status": "affected",
"version": "7fad2a432cd35bbf104d2d9d426e74902f22aa95",
"versionType": "git"
},
{
"lessThan": "9874b2917b9fbc30956fee209d3c4aa47201c64e",
"status": "affected",
"version": "7fad2a432cd35bbf104d2d9d426e74902f22aa95",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/Kconfig",
"arch/x86/kernel/shstk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/shstk: Prevent deadlock during shstk sigreturn\n\nDuring sigreturn the shadow stack signal frame is popped. The kernel does\nthis by reading the shadow stack using normal read accesses. When it can\u0027t\nassume the memory is shadow stack, it takes extra steps to makes sure it is\nreading actual shadow stack memory and not other normal readable memory. It\ndoes this by holding the mmap read lock while doing the access and checking\nthe flags of the VMA.\n\nUnfortunately that is not safe. If the read of the shadow stack sigframe\nhits a page fault, the fault handler will try to recursively grab another\nmmap read lock. This normally works ok, but if a writer on another CPU is\nalso waiting, the second read lock could fail and cause a deadlock.\n\nFix this by not holding mmap lock during the read access to userspace.\n\nInstead use mmap_lock_speculate_...() to watch for changes between dropping\nmmap lock and the userspace access. Retry if anything grabbed an mmap write\nlock in between and could have changed the VMA.\n\nThese mmap_lock_speculate_...() helpers use mm::mm_lock_seq, which is only\navailable when PER_VMA_LOCK is configured. So make X86_USER_SHADOW_STACK\ndepend on it. On x86, PER_VMA_LOCK is a default configuration for SMP\nkernels. So drop support for the other configs under the assumption that\nthe !SMP shadow stack user base does not exist.\n\nCurrently there is a check that skips the lookup work when the SSP can be\nassumed to be on a shadow stack. While reorganizing the function, remove\nthe optimization to make the tricky code flows more common, such that\nissues like this cannot escape detection for so long."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:51:37.005Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e2c2b044458cbf22da05264fa707308e8d4f86f9"
},
{
"url": "https://git.kernel.org/stable/c/d042d69b417515959e49021fef008c9b04a99bd5"
},
{
"url": "https://git.kernel.org/stable/c/4f3374c990fb2adec06d20fd6d780927811c9aa0"
},
{
"url": "https://git.kernel.org/stable/c/3d29db827502067626062f5c74dd502d14ab15bc"
},
{
"url": "https://git.kernel.org/stable/c/9874b2917b9fbc30956fee209d3c4aa47201c64e"
}
],
"title": "x86/shstk: Prevent deadlock during shstk sigreturn",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46063",
"datePublished": "2026-05-27T12:57:27.336Z",
"dateReserved": "2026-05-13T15:03:33.095Z",
"dateUpdated": "2026-06-14T17:51:37.005Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43093 (GCVE-0-2026-43093)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xsk: tighten UMEM headroom validation to account for tailroom and min frame
The current headroom validation in xdp_umem_reg() could leave us with
insufficient space dedicated to even receive minimum-sized ethernet
frame. Furthermore if multi-buffer would come to play then
skb_shared_info stored at the end of XSK frame would be corrupted.
HW typically works with 128-aligned sizes so let us provide this value
as bare minimum.
Multi-buffer setting is known later in the configuration process so
besides accounting for 128 bytes, let us also take care of tailroom space
upfront.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 Version: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 Version: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 Version: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 Version: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 Version: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 Version: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 Version: 99e3a236dd43d06c65af0a2ef9cb44306aef6e02 Version: ad8fb61c184fe0f8d1e0b5b954d010fb9f94a6ee Version: 25c9cdef57488578da21d99eb614b97ffcf6e59f Version: 98d3c852e63b49129515dd18c875999efaf8530a Version: 4.19.118 ≤ Version: 5.4.35 ≤ Version: 5.6.7 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xdp/xdp_umem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5f123bc278bf4e3283d8606321bebbfd299f4384",
"status": "affected",
"version": "99e3a236dd43d06c65af0a2ef9cb44306aef6e02",
"versionType": "git"
},
{
"lessThan": "1a6051cd7e3e4c54ff3854a43b638b9292af5e67",
"status": "affected",
"version": "99e3a236dd43d06c65af0a2ef9cb44306aef6e02",
"versionType": "git"
},
{
"lessThan": "8769708add9eadeea8041a9761771bb715a87104",
"status": "affected",
"version": "99e3a236dd43d06c65af0a2ef9cb44306aef6e02",
"versionType": "git"
},
{
"lessThan": "a03975beb9f6af0d8ac051e30b2abeabe618414f",
"status": "affected",
"version": "99e3a236dd43d06c65af0a2ef9cb44306aef6e02",
"versionType": "git"
},
{
"lessThan": "0ec4d3f6e6934deb843b561ae048cd17218e5ad1",
"status": "affected",
"version": "99e3a236dd43d06c65af0a2ef9cb44306aef6e02",
"versionType": "git"
},
{
"lessThan": "9ea6ba4f3195dcba6e8b3e7b2e748593b7cafb12",
"status": "affected",
"version": "99e3a236dd43d06c65af0a2ef9cb44306aef6e02",
"versionType": "git"
},
{
"lessThan": "6523bc1b40e69301f24c14338b762af4739d6d39",
"status": "affected",
"version": "99e3a236dd43d06c65af0a2ef9cb44306aef6e02",
"versionType": "git"
},
{
"lessThan": "a315e022a72d95ef5f1d4e58e903cb492b0ad931",
"status": "affected",
"version": "99e3a236dd43d06c65af0a2ef9cb44306aef6e02",
"versionType": "git"
},
{
"status": "affected",
"version": "ad8fb61c184fe0f8d1e0b5b954d010fb9f94a6ee",
"versionType": "git"
},
{
"status": "affected",
"version": "25c9cdef57488578da21d99eb614b97ffcf6e59f",
"versionType": "git"
},
{
"status": "affected",
"version": "98d3c852e63b49129515dd18c875999efaf8530a",
"versionType": "git"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.118",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.35",
"versionType": "semver"
},
{
"lessThan": "5.7",
"status": "affected",
"version": "5.6.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xdp/xdp_umem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: tighten UMEM headroom validation to account for tailroom and min frame\n\nThe current headroom validation in xdp_umem_reg() could leave us with\ninsufficient space dedicated to even receive minimum-sized ethernet\nframe. Furthermore if multi-buffer would come to play then\nskb_shared_info stored at the end of XSK frame would be corrupted.\n\nHW typically works with 128-aligned sizes so let us provide this value\nas bare minimum.\n\nMulti-buffer setting is known later in the configuration process so\nbesides accounting for 128 bytes, let us also take care of tailroom space\nupfront."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable UMEM headroom value is supplied through local AF_XDP socket setup via socket(), setsockopt(SOL_XDP, XDP_UMEM_REG), and bind(); network packets may later exercise the bad layout, but they do not create it.\nAC:L - The attacker controls the UMEM chunk size/headroom and AF_XDP setup parameters, and no race or rare timing condition is required.\nPR:L - AF_XDP socket creation requires CAP_NET_RAW in the network namespace and related XDP/BPF setup uses namespace-capable networking privileges, which are reachable by a low-privileged local user through user namespaces in reasonable configurations.\nUI:N - No victim action is needed once the attacker can run the local setup and drive traffic through the socket.\nS:U - The impact remains within the kernel/networking security authority and does not cross a VM, IOMMU, or similar scope boundary.\nC:H - The invalid UMEM geometry can corrupt skb_shared_info/fragment metadata consumed by kernel XDP/AF_XDP paths; under the required overestimation rule, this kernel metadata corruption is treated as capable of enabling high-impact information disclosure.\nI:H - The bug permits attacker-controlled layout overlap with kernel-used XDP fragment metadata, creating a plausible memory-corruption primitive rather than a mere validation failure.\nA:H - Malformed AF_XDP receive geometry can leave insufficient space even for minimum frames and corrupt multi-buffer metadata, making kernel/network path crashes or severe disruption plausible."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:53.221Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5f123bc278bf4e3283d8606321bebbfd299f4384"
},
{
"url": "https://git.kernel.org/stable/c/1a6051cd7e3e4c54ff3854a43b638b9292af5e67"
},
{
"url": "https://git.kernel.org/stable/c/8769708add9eadeea8041a9761771bb715a87104"
},
{
"url": "https://git.kernel.org/stable/c/a03975beb9f6af0d8ac051e30b2abeabe618414f"
},
{
"url": "https://git.kernel.org/stable/c/0ec4d3f6e6934deb843b561ae048cd17218e5ad1"
},
{
"url": "https://git.kernel.org/stable/c/9ea6ba4f3195dcba6e8b3e7b2e748593b7cafb12"
},
{
"url": "https://git.kernel.org/stable/c/6523bc1b40e69301f24c14338b762af4739d6d39"
},
{
"url": "https://git.kernel.org/stable/c/a315e022a72d95ef5f1d4e58e903cb492b0ad931"
}
],
"title": "xsk: tighten UMEM headroom validation to account for tailroom and min frame",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43093",
"datePublished": "2026-05-06T07:40:25.266Z",
"dateReserved": "2026-05-01T14:12:55.984Z",
"dateUpdated": "2026-08-05T12:25:53.221Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43016 (GCVE-0-2026-43016)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready().
syzbot reported use-after-free of AF_UNIX socket's sk->sk_socket
in sk_psock_verdict_data_ready(). [0]
In unix_stream_sendmsg(), the peer socket's ->sk_data_ready() is
called after dropping its unix_state_lock().
Although the sender socket holds the peer's refcount, it does not
prevent the peer's sock_orphan(), and the peer's sk_socket might
be freed after one RCU grace period.
Let's fetch the peer's sk->sk_socket and sk->sk_socket->ops under
RCU in sk_psock_verdict_data_ready().
[0]:
BUG: KASAN: slab-use-after-free in sk_psock_verdict_data_ready+0xec/0x590 net/core/skmsg.c:1278
Read of size 8 at addr ffff8880594da860 by task syz.4.1842/11013
CPU: 1 UID: 0 PID: 11013 Comm: syz.4.1842 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
sk_psock_verdict_data_ready+0xec/0x590 net/core/skmsg.c:1278
unix_stream_sendmsg+0x8a3/0xe80 net/unix/af_unix.c:2482
sock_sendmsg_nosec net/socket.c:721 [inline]
__sock_sendmsg net/socket.c:736 [inline]
____sys_sendmsg+0x972/0x9f0 net/socket.c:2585
___sys_sendmsg+0x2a5/0x360 net/socket.c:2639
__sys_sendmsg net/socket.c:2671 [inline]
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2674
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7facf899c819
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007facf9827028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007facf8c15fa0 RCX: 00007facf899c819
RDX: 0000000000000000 RSI: 0000200000000500 RDI: 0000000000000004
RBP: 00007facf8a32c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007facf8c16038 R14: 00007facf8c15fa0 R15: 00007ffd41b01c78
</TASK>
Allocated by task 11013:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4538 [inline]
slab_alloc_node mm/slub.c:4866 [inline]
kmem_cache_alloc_lru_noprof+0x2b8/0x640 mm/slub.c:4885
sock_alloc_inode+0x28/0xc0 net/socket.c:316
alloc_inode+0x6a/0x1b0 fs/inode.c:347
new_inode_pseudo include/linux/fs.h:3003 [inline]
sock_alloc net/socket.c:631 [inline]
__sock_create+0x12d/0x9d0 net/socket.c:1562
sock_create net/socket.c:1656 [inline]
__sys_socketpair+0x1c4/0x560 net/socket.c:1803
__do_sys_socketpair net/socket.c:1856 [inline]
__se_sys_socketpair net/socket.c:1853 [inline]
__x64_sys_socketpair+0x9b/0xb0 net/socket.c:1853
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 15:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2685 [inline]
slab_free mm/slub.c:6165 [inline]
kmem_cache_free+0x187/0x630 mm/slub.c:6295
rcu_do_batch kernel/rcu/tree.c:
---truncated---
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/skmsg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8d597e3e74027900ffa81b8ff47ab51999a3e110",
"status": "affected",
"version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
"versionType": "git"
},
{
"lessThan": "68187f18a89be4b6237d28ae1313b5adf76238c6",
"status": "affected",
"version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
"versionType": "git"
},
{
"lessThan": "18861f87a043e78b1f901cae4237e755ed7ef095",
"status": "affected",
"version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
"versionType": "git"
},
{
"lessThan": "af95bc39a83d82ae6ad253986335037256888b3f",
"status": "affected",
"version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
"versionType": "git"
},
{
"lessThan": "ad8391d37f334ee73ba91926f8b4e4cf6d31ea04",
"status": "affected",
"version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/skmsg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready().\n\nsyzbot reported use-after-free of AF_UNIX socket\u0027s sk-\u003esk_socket\nin sk_psock_verdict_data_ready(). [0]\n\nIn unix_stream_sendmsg(), the peer socket\u0027s -\u003esk_data_ready() is\ncalled after dropping its unix_state_lock().\n\nAlthough the sender socket holds the peer\u0027s refcount, it does not\nprevent the peer\u0027s sock_orphan(), and the peer\u0027s sk_socket might\nbe freed after one RCU grace period.\n\nLet\u0027s fetch the peer\u0027s sk-\u003esk_socket and sk-\u003esk_socket-\u003eops under\nRCU in sk_psock_verdict_data_ready().\n\n[0]:\nBUG: KASAN: slab-use-after-free in sk_psock_verdict_data_ready+0xec/0x590 net/core/skmsg.c:1278\nRead of size 8 at addr ffff8880594da860 by task syz.4.1842/11013\n\nCPU: 1 UID: 0 PID: 11013 Comm: syz.4.1842 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xba/0x230 mm/kasan/report.c:482\n kasan_report+0x117/0x150 mm/kasan/report.c:595\n sk_psock_verdict_data_ready+0xec/0x590 net/core/skmsg.c:1278\n unix_stream_sendmsg+0x8a3/0xe80 net/unix/af_unix.c:2482\n sock_sendmsg_nosec net/socket.c:721 [inline]\n __sock_sendmsg net/socket.c:736 [inline]\n ____sys_sendmsg+0x972/0x9f0 net/socket.c:2585\n ___sys_sendmsg+0x2a5/0x360 net/socket.c:2639\n __sys_sendmsg net/socket.c:2671 [inline]\n __do_sys_sendmsg net/socket.c:2676 [inline]\n __se_sys_sendmsg net/socket.c:2674 [inline]\n __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2674\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7facf899c819\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007facf9827028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007facf8c15fa0 RCX: 00007facf899c819\nRDX: 0000000000000000 RSI: 0000200000000500 RDI: 0000000000000004\nRBP: 00007facf8a32c91 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007facf8c16038 R14: 00007facf8c15fa0 R15: 00007ffd41b01c78\n \u003c/TASK\u003e\n\nAllocated by task 11013:\n kasan_save_stack mm/kasan/common.c:57 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:78\n unpoison_slab_object mm/kasan/common.c:340 [inline]\n __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366\n kasan_slab_alloc include/linux/kasan.h:253 [inline]\n slab_post_alloc_hook mm/slub.c:4538 [inline]\n slab_alloc_node mm/slub.c:4866 [inline]\n kmem_cache_alloc_lru_noprof+0x2b8/0x640 mm/slub.c:4885\n sock_alloc_inode+0x28/0xc0 net/socket.c:316\n alloc_inode+0x6a/0x1b0 fs/inode.c:347\n new_inode_pseudo include/linux/fs.h:3003 [inline]\n sock_alloc net/socket.c:631 [inline]\n __sock_create+0x12d/0x9d0 net/socket.c:1562\n sock_create net/socket.c:1656 [inline]\n __sys_socketpair+0x1c4/0x560 net/socket.c:1803\n __do_sys_socketpair net/socket.c:1856 [inline]\n __se_sys_socketpair net/socket.c:1853 [inline]\n __x64_sys_socketpair+0x9b/0xb0 net/socket.c:1853\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 15:\n kasan_save_stack mm/kasan/common.c:57 [inline]\n kasan_save_track+0x3e/0x80 mm/kasan/common.c:78\n kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584\n poison_slab_object mm/kasan/common.c:253 [inline]\n __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285\n kasan_slab_free include/linux/kasan.h:235 [inline]\n slab_free_hook mm/slub.c:2685 [inline]\n slab_free mm/slub.c:6165 [inline]\n kmem_cache_free+0x187/0x630 mm/slub.c:6295\n rcu_do_batch kernel/rcu/tree.c:\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable callback is reached through local BPF sockmap setup and local AF_UNIX send/close activity, not by unauthenticated network packets alone.\nAC:L - The attacker can create the socketpair, install the sockmap verdict path, and race sendmsg against close/orphaning of the peer socket; both sides of the race are attacker-controlled.\nPR:L - Creating and attaching the required sockmap/SK_SKB or SK_MSG BPF objects requires BPF/CAP_NET_ADMIN-style privileges, but these can be available to a low-privileged local user in delegated or user-namespace BPF deployments; choosing the higher severity option gives PR:L.\nUI:N - No victim action is needed after the attacker has local execution and the required BPF access; triggering is done with attacker-controlled syscalls.\nS:U - The impact is within the kernel security authority and represents ordinary kernel memory corruption or privilege escalation, not a cross-scope boundary such as guest-to-host escape.\nC:H - This is a use-after-free of the socket object used to fetch proto_ops, and kernel UAFs can be shaped into information disclosure primitives.\nI:H - The stale socket pointer can lead to use of attacker-influenced freed memory and function-pointer-oriented control flow, making arbitrary modification or code execution defensible.\nA:H - The reported KASAN splat demonstrates a kernel use-after-free reachable from sendmsg, and repeated triggering can crash or destabilize the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:16.418Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8d597e3e74027900ffa81b8ff47ab51999a3e110"
},
{
"url": "https://git.kernel.org/stable/c/68187f18a89be4b6237d28ae1313b5adf76238c6"
},
{
"url": "https://git.kernel.org/stable/c/18861f87a043e78b1f901cae4237e755ed7ef095"
},
{
"url": "https://git.kernel.org/stable/c/af95bc39a83d82ae6ad253986335037256888b3f"
},
{
"url": "https://git.kernel.org/stable/c/ad8391d37f334ee73ba91926f8b4e4cf6d31ea04"
}
],
"title": "bpf: sockmap: Fix use-after-free of sk-\u003esk_socket in sk_psock_verdict_data_ready().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43016",
"datePublished": "2026-05-01T14:15:20.887Z",
"dateReserved": "2026-05-01T14:12:55.974Z",
"dateUpdated": "2026-08-05T12:25:16.418Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31469 (GCVE-0-2026-31469)
Vulnerability from cvelistv5
Published
2026-04-22 13:53
Modified
2026-08-05 12:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
A UAF issue occurs when the virtio_net driver is configured with napi_tx=N
and the device's IFF_XMIT_DST_RELEASE flag is cleared
(e.g., during the configuration of tc route filter rules).
When IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack
expects the driver to hold the reference to skb->dst until the packet
is fully transmitted and freed. In virtio_net with napi_tx=N,
skbs may remain in the virtio transmit ring for an extended period.
If the network namespace is destroyed while these skbs are still pending,
the corresponding dst_ops structure has freed. When a subsequent packet
is transmitted, free_old_xmit() is triggered to clean up old skbs.
It then calls dst_release() on the skb associated with the stale dst_entry.
Since the dst_ops (referenced by the dst_entry) has already been freed,
a UAF kernel paging request occurs.
fix it by adds skb_dst_drop(skb) in start_xmit to explicitly release
the dst reference before the skb is queued in virtio_net.
Call Trace:
Unable to handle kernel paging request at virtual address ffff80007e150000
CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT
...
percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)
dst_release+0xe0/0x110 net/core/dst.c:177
skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177
sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255
dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469
napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527
__free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net]
free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]
start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]
...
Reproduction Steps:
NETDEV="enp3s0"
config_qdisc_route_filter() {
tc qdisc del dev $NETDEV root
tc qdisc add dev $NETDEV root handle 1: prio
tc filter add dev $NETDEV parent 1:0 \
protocol ip prio 100 route to 100 flowid 1:1
ip route add 192.168.1.100/32 dev $NETDEV realm 100
}
test_ns() {
ip netns add testns
ip link set $NETDEV netns testns
ip netns exec testns ifconfig $NETDEV 10.0.32.46/24
ip netns exec testns ping -c 1 10.0.32.1
ip netns del testns
}
config_qdisc_route_filter
test_ns
sleep 2
test_ns
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f2fc6a54585a1be6669613a31fbaba2ecbadcd36 Version: f2fc6a54585a1be6669613a31fbaba2ecbadcd36 Version: f2fc6a54585a1be6669613a31fbaba2ecbadcd36 Version: f2fc6a54585a1be6669613a31fbaba2ecbadcd36 Version: f2fc6a54585a1be6669613a31fbaba2ecbadcd36 Version: f2fc6a54585a1be6669613a31fbaba2ecbadcd36 Version: f2fc6a54585a1be6669613a31fbaba2ecbadcd36 Version: f2fc6a54585a1be6669613a31fbaba2ecbadcd36 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:00.401Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/virtio_net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "be0e63f3b97bbaf453c542e8a15ba2a536e2ac01",
"status": "affected",
"version": "f2fc6a54585a1be6669613a31fbaba2ecbadcd36",
"versionType": "git"
},
{
"lessThan": "c1ec36cb3768574b916f20d2d7415fd14fa1bf12",
"status": "affected",
"version": "f2fc6a54585a1be6669613a31fbaba2ecbadcd36",
"versionType": "git"
},
{
"lessThan": "8a4790850e710fd6771e4d2112168ed1dd6c0e54",
"status": "affected",
"version": "f2fc6a54585a1be6669613a31fbaba2ecbadcd36",
"versionType": "git"
},
{
"lessThan": "fedd2e1630cac920844997227ccbe7b26a76375a",
"status": "affected",
"version": "f2fc6a54585a1be6669613a31fbaba2ecbadcd36",
"versionType": "git"
},
{
"lessThan": "f04733c4dc40c43899c3d1c97afbae5831a3770f",
"status": "affected",
"version": "f2fc6a54585a1be6669613a31fbaba2ecbadcd36",
"versionType": "git"
},
{
"lessThan": "9a18629f2525781f0f3dda7be72b204e4cf77d08",
"status": "affected",
"version": "f2fc6a54585a1be6669613a31fbaba2ecbadcd36",
"versionType": "git"
},
{
"lessThan": "63d45077b97bb0e0fe0c75931acbbca7a47af141",
"status": "affected",
"version": "f2fc6a54585a1be6669613a31fbaba2ecbadcd36",
"versionType": "git"
},
{
"lessThan": "ba8bda9a0896746053aa97ac6c3e08168729172c",
"status": "affected",
"version": "f2fc6a54585a1be6669613a31fbaba2ecbadcd36",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/virtio_net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false\n\nA UAF issue occurs when the virtio_net driver is configured with napi_tx=N\nand the device\u0027s IFF_XMIT_DST_RELEASE flag is cleared\n(e.g., during the configuration of tc route filter rules).\n\nWhen IFF_XMIT_DST_RELEASE is removed from the net_device, the network stack\nexpects the driver to hold the reference to skb-\u003edst until the packet\nis fully transmitted and freed. In virtio_net with napi_tx=N,\nskbs may remain in the virtio transmit ring for an extended period.\n\nIf the network namespace is destroyed while these skbs are still pending,\nthe corresponding dst_ops structure has freed. When a subsequent packet\nis transmitted, free_old_xmit() is triggered to clean up old skbs.\nIt then calls dst_release() on the skb associated with the stale dst_entry.\nSince the dst_ops (referenced by the dst_entry) has already been freed,\na UAF kernel paging request occurs.\n\nfix it by adds skb_dst_drop(skb) in start_xmit to explicitly release\nthe dst reference before the skb is queued in virtio_net.\n\nCall Trace:\n Unable to handle kernel paging request at virtual address ffff80007e150000\n CPU: 2 UID: 0 PID: 6236 Comm: ping Kdump: loaded Not tainted 7.0.0-rc1+ #6 PREEMPT\n ...\n percpu_counter_add_batch+0x3c/0x158 lib/percpu_counter.c:98 (P)\n dst_release+0xe0/0x110 net/core/dst.c:177\n skb_release_head_state+0xe8/0x108 net/core/skbuff.c:1177\n sk_skb_reason_drop+0x54/0x2d8 net/core/skbuff.c:1255\n dev_kfree_skb_any_reason+0x64/0x78 net/core/dev.c:3469\n napi_consume_skb+0x1c4/0x3a0 net/core/skbuff.c:1527\n __free_old_xmit+0x164/0x230 drivers/net/virtio_net.c:611 [virtio_net]\n free_old_xmit drivers/net/virtio_net.c:1081 [virtio_net]\n start_xmit+0x7c/0x530 drivers/net/virtio_net.c:3329 [virtio_net]\n ...\n\nReproduction Steps:\nNETDEV=\"enp3s0\"\n\nconfig_qdisc_route_filter() {\n tc qdisc del dev $NETDEV root\n tc qdisc add dev $NETDEV root handle 1: prio\n tc filter add dev $NETDEV parent 1:0 \\\n\tprotocol ip prio 100 route to 100 flowid 1:1\n ip route add 192.168.1.100/32 dev $NETDEV realm 100\n}\n\ntest_ns() {\n ip netns add testns\n ip link set $NETDEV netns testns\n ip netns exec testns ifconfig $NETDEV 10.0.32.46/24\n ip netns exec testns ping -c 1 10.0.32.1\n ip netns del testns\n}\n\nconfig_qdisc_route_filter\n\ntest_ns\nsleep 2\ntest_ns"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable virtio_net transmit/free path is reached through local packet transmission plus local netlink/ethtool namespace setup on a virtio_net interface. Remote traffic alone does not provide the required control over tc/qdisc, TX NAPI state, and namespace/device lifecycle.\nAC:L - The required conditions are attacker-controllable once the attacker has the needed network administration rights: disable TX NAPI, clear IFF_XMIT_DST_RELEASE via tc route filtering, queue packets, destroy the namespace, then trigger another transmit. There is no uncontrollable race; the pending-ring timing can be induced with normal traffic.\nPR:L - The setup requires CAP_NET_ADMIN for tc/qdisc, ethtool coalescing, and net namespace/device operations. In a reasonable delegated container or network-namespace deployment with a virtio_net interface, that maps to low privileges rather than init-namespace root, and uncertainty is resolved toward higher severity.\nUI:N - No victim user action is required after the attacker has the relevant local privileges. The attacker can perform the configuration, traffic generation, namespace teardown, and retrigger steps directly.\nS:U - The bug is in the kernel networking/virtio_net path and impacts the same kernel security authority. This is not a VM escape, IOMMU bypass, or other cross-scope boundary by itself.\nC:H - This is a use-after-free involving dst_ops referenced from an skb-held dst_entry after namespace teardown. Kernel UAFs are treated as high confidentiality impact because freed object reuse can enable memory disclosure primitives.\nI:H - The stale dst_ops/percpu-counter access is memory corruption in kernel context. As a kernel UAF, it is defensibly treated as exploitable for control-flow or write-primitive development.\nA:H - The reported failure is a kernel paging request/oops in dst_release via free_old_xmit. Even without full exploitation, the UAF can crash the kernel, causing high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:48.560Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/be0e63f3b97bbaf453c542e8a15ba2a536e2ac01"
},
{
"url": "https://git.kernel.org/stable/c/c1ec36cb3768574b916f20d2d7415fd14fa1bf12"
},
{
"url": "https://git.kernel.org/stable/c/8a4790850e710fd6771e4d2112168ed1dd6c0e54"
},
{
"url": "https://git.kernel.org/stable/c/fedd2e1630cac920844997227ccbe7b26a76375a"
},
{
"url": "https://git.kernel.org/stable/c/f04733c4dc40c43899c3d1c97afbae5831a3770f"
},
{
"url": "https://git.kernel.org/stable/c/9a18629f2525781f0f3dda7be72b204e4cf77d08"
},
{
"url": "https://git.kernel.org/stable/c/63d45077b97bb0e0fe0c75931acbbca7a47af141"
},
{
"url": "https://git.kernel.org/stable/c/ba8bda9a0896746053aa97ac6c3e08168729172c"
}
],
"title": "virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31469",
"datePublished": "2026-04-22T13:53:58.266Z",
"dateReserved": "2026-03-09T15:48:24.097Z",
"dateUpdated": "2026-08-05T12:22:48.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46218 (GCVE-0-2026-46218)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Add bounds checking to ib_{get,set}_value
The uvd/vce/vcn code accesses the IB at predefined offsets without
checking that the IB is large enough. Check the bounds here. The caller
is responsible for making sure it can handle arbitrary return values.
Also make the idx a uint32_t to prevent overflows causing the condition
to fail.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 Version: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5da6c6430be0acb25b4242bce0323fc514d4e3cf",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "0fb5cb556b249b2b64c0f818136c4c3e838ef53f",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "a853178d23e774adfe3a35073c375b04b3b20f7d",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "fec8b11b55e53ff51a741e56894fe331a516f5c6",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "ee26fcf7c5cf131f0b6a732faa27d79ec61b8ec7",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "66085e206431ef88ce36f53c1f53d570790ccc9e",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Add bounds checking to ib_{get,set}_value\n\nThe uvd/vce/vcn code accesses the IB at predefined offsets without\nchecking that the IB is large enough. Check the bounds here. The caller\nis responsible for making sure it can handle arbitrary return values.\n\nAlso make the idx a uint32_t to prevent overflows causing the condition\nto fail."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Triggered through the amdgpu command-submission ioctl (DRM_IOCTL_AMDGPU_CS), a local device-file interface; there is no network or adjacent-network path to the IB parser.\nAC:L - The attacker fully controls the IB contents and length, so a command stream that places the last command near the buffer end reliably forces the out-of-bounds access on every attempt.\nPR:L - The CS ioctl is DRM_RENDER_ALLOW, reachable through the render node (/dev/dri/renderD*) by any unprivileged local user (e.g. desktop/Android VA-API video decode/encode); no root, DRM master, or capability is required.\nUI:N - The attacking process submits the malicious command buffer itself; no action by another user is needed.\nS:U - The out-of-bounds access occurs in CPU-side kernel memory during command parsing, within the kernel\u0027s own security authority \u2014 no VM, IOMMU, or sandbox boundary is crossed.\nC:H - An attacker-controlled out-of-bounds read reads kernel IB-pool memory adjacent to the buffer; it is not strictly bounded (vcn_v4_0_enc_find_ib_param walks past the end with no limit) and the read values feed address/buffer processing, so per kernel guidance an unbounded OOB read is High.\nI:N - The defect is a read-only out-of-bounds access; all amdgpu_ib_set_value sites are already bounded by their callers, so there is no out-of-bounds write or other data-modification primitive.\nA:H - Reading past the end of the kernel sub-allocated IB pool buffer can hit an unmapped page and oops the kernel, and the unbounded VCN v4 parse walk can run far past the buffer, causing a crash/DoS."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:34.974Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5da6c6430be0acb25b4242bce0323fc514d4e3cf"
},
{
"url": "https://git.kernel.org/stable/c/0fb5cb556b249b2b64c0f818136c4c3e838ef53f"
},
{
"url": "https://git.kernel.org/stable/c/a853178d23e774adfe3a35073c375b04b3b20f7d"
},
{
"url": "https://git.kernel.org/stable/c/fec8b11b55e53ff51a741e56894fe331a516f5c6"
},
{
"url": "https://git.kernel.org/stable/c/ee26fcf7c5cf131f0b6a732faa27d79ec61b8ec7"
},
{
"url": "https://git.kernel.org/stable/c/66085e206431ef88ce36f53c1f53d570790ccc9e"
}
],
"title": "drm/amdgpu: Add bounds checking to ib_{get,set}_value",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46218",
"datePublished": "2026-05-28T09:40:34.367Z",
"dateReserved": "2026-05-13T15:03:33.105Z",
"dateUpdated": "2026-08-05T12:30:34.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43162 (GCVE-0-2026-43162)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: tegra-video: Fix memory leak in __tegra_channel_try_format()
The state object allocated by __v4l2_subdev_state_alloc() must be freed
with __v4l2_subdev_state_free() when it is no longer needed.
In __tegra_channel_try_format(), two error paths return directly after
v4l2_subdev_call() fails, without freeing the allocated 'sd_state'
object. This violates the requirement and causes a memory leak.
Fix this by introducing a cleanup label and using goto statements in the
error paths to ensure that __v4l2_subdev_state_free() is always called
before the function returns.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1ebaeb09830f36c1111b72a95420814225bd761c Version: 1ebaeb09830f36c1111b72a95420814225bd761c Version: 1ebaeb09830f36c1111b72a95420814225bd761c Version: 1ebaeb09830f36c1111b72a95420814225bd761c Version: 1ebaeb09830f36c1111b72a95420814225bd761c Version: 1ebaeb09830f36c1111b72a95420814225bd761c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/media/tegra-video/vi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6c6f419fa9c44a4b7149b0292e01bff47308ba14",
"status": "affected",
"version": "1ebaeb09830f36c1111b72a95420814225bd761c",
"versionType": "git"
},
{
"lessThan": "ca921be7a1174d5d58b28f84b683c2c0079f18c5",
"status": "affected",
"version": "1ebaeb09830f36c1111b72a95420814225bd761c",
"versionType": "git"
},
{
"lessThan": "3ca2f09061736e72ef25eec2597d00f7f44094d3",
"status": "affected",
"version": "1ebaeb09830f36c1111b72a95420814225bd761c",
"versionType": "git"
},
{
"lessThan": "2dff8966a3a889dd9d248a7e15d963b4097efcc5",
"status": "affected",
"version": "1ebaeb09830f36c1111b72a95420814225bd761c",
"versionType": "git"
},
{
"lessThan": "d92e9a18f97a1d19d4c2ff81dcfbe43591f75b5a",
"status": "affected",
"version": "1ebaeb09830f36c1111b72a95420814225bd761c",
"versionType": "git"
},
{
"lessThan": "43e5302d22334f1183dec3e0d5d8007eefe2817c",
"status": "affected",
"version": "1ebaeb09830f36c1111b72a95420814225bd761c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/media/tegra-video/vi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: tegra-video: Fix memory leak in __tegra_channel_try_format()\n\nThe state object allocated by __v4l2_subdev_state_alloc() must be freed\nwith __v4l2_subdev_state_free() when it is no longer needed.\n\nIn __tegra_channel_try_format(), two error paths return directly after\nv4l2_subdev_call() fails, without freeing the allocated \u0027sd_state\u0027\nobject. This violates the requirement and causes a memory leak.\n\nFix this by introducing a cleanup label and using goto statements in the\nerror paths to ensure that __v4l2_subdev_state_free() is always called\nbefore the function returns."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:18:57.725Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6c6f419fa9c44a4b7149b0292e01bff47308ba14"
},
{
"url": "https://git.kernel.org/stable/c/ca921be7a1174d5d58b28f84b683c2c0079f18c5"
},
{
"url": "https://git.kernel.org/stable/c/3ca2f09061736e72ef25eec2597d00f7f44094d3"
},
{
"url": "https://git.kernel.org/stable/c/2dff8966a3a889dd9d248a7e15d963b4097efcc5"
},
{
"url": "https://git.kernel.org/stable/c/d92e9a18f97a1d19d4c2ff81dcfbe43591f75b5a"
},
{
"url": "https://git.kernel.org/stable/c/43e5302d22334f1183dec3e0d5d8007eefe2817c"
}
],
"title": "media: tegra-video: Fix memory leak in __tegra_channel_try_format()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43162",
"datePublished": "2026-05-06T11:27:40.580Z",
"dateReserved": "2026-05-01T14:12:55.990Z",
"dateUpdated": "2026-05-11T22:18:57.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46122 (GCVE-0-2026-46122)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-06-14 17:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: b43: enforce bounds check on firmware key index in b43_rx()
The firmware-controlled key index in b43_rx() can exceed the dev->key[]
array size (58 entries). The existing B43_WARN_ON is non-enforcing in
production builds, allowing an out-of-bounds read.
Make the B43_WARN_ON check enforcing by dropping the frame when the
firmware returns an invalid key index.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e4d6b7951812d98417feb10784e400e253caf633 Version: e4d6b7951812d98417feb10784e400e253caf633 Version: e4d6b7951812d98417feb10784e400e253caf633 Version: e4d6b7951812d98417feb10784e400e253caf633 Version: e4d6b7951812d98417feb10784e400e253caf633 Version: e4d6b7951812d98417feb10784e400e253caf633 Version: e4d6b7951812d98417feb10784e400e253caf633 Version: e4d6b7951812d98417feb10784e400e253caf633 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/b43/xmit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "135cb49c9a42a02cceeac7b49ec03e267f7ed6d6",
"status": "affected",
"version": "e4d6b7951812d98417feb10784e400e253caf633",
"versionType": "git"
},
{
"lessThan": "3157ad40b084a8f3932da2641749ab45e99b933e",
"status": "affected",
"version": "e4d6b7951812d98417feb10784e400e253caf633",
"versionType": "git"
},
{
"lessThan": "765709720e6af9a178abc40244a8d1aa39ac4e71",
"status": "affected",
"version": "e4d6b7951812d98417feb10784e400e253caf633",
"versionType": "git"
},
{
"lessThan": "c3d7b90dc95020cd9282c4630e402fe224f7644e",
"status": "affected",
"version": "e4d6b7951812d98417feb10784e400e253caf633",
"versionType": "git"
},
{
"lessThan": "1e9e55cf66f0fa4799f4d86ef3aaba8e606b5c14",
"status": "affected",
"version": "e4d6b7951812d98417feb10784e400e253caf633",
"versionType": "git"
},
{
"lessThan": "d7029879bafdac2006c67553807d122283dc6cbf",
"status": "affected",
"version": "e4d6b7951812d98417feb10784e400e253caf633",
"versionType": "git"
},
{
"lessThan": "219ba67e69e49681e48c822d6eaafb5def032f34",
"status": "affected",
"version": "e4d6b7951812d98417feb10784e400e253caf633",
"versionType": "git"
},
{
"lessThan": "1f4f78bf8549e6ac4f04fba4176854f3a6e0c332",
"status": "affected",
"version": "e4d6b7951812d98417feb10784e400e253caf633",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/b43/xmit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: b43: enforce bounds check on firmware key index in b43_rx()\n\nThe firmware-controlled key index in b43_rx() can exceed the dev-\u003ekey[]\narray size (58 entries). The existing B43_WARN_ON is non-enforcing in\nproduction builds, allowing an out-of-bounds read.\n\nMake the B43_WARN_ON check enforcing by dropping the frame when the\nfirmware returns an invalid key index."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:56:03.781Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/135cb49c9a42a02cceeac7b49ec03e267f7ed6d6"
},
{
"url": "https://git.kernel.org/stable/c/3157ad40b084a8f3932da2641749ab45e99b933e"
},
{
"url": "https://git.kernel.org/stable/c/765709720e6af9a178abc40244a8d1aa39ac4e71"
},
{
"url": "https://git.kernel.org/stable/c/c3d7b90dc95020cd9282c4630e402fe224f7644e"
},
{
"url": "https://git.kernel.org/stable/c/1e9e55cf66f0fa4799f4d86ef3aaba8e606b5c14"
},
{
"url": "https://git.kernel.org/stable/c/d7029879bafdac2006c67553807d122283dc6cbf"
},
{
"url": "https://git.kernel.org/stable/c/219ba67e69e49681e48c822d6eaafb5def032f34"
},
{
"url": "https://git.kernel.org/stable/c/1f4f78bf8549e6ac4f04fba4176854f3a6e0c332"
}
],
"title": "wifi: b43: enforce bounds check on firmware key index in b43_rx()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46122",
"datePublished": "2026-05-28T09:35:37.141Z",
"dateReserved": "2026-05-13T15:03:33.098Z",
"dateUpdated": "2026-06-14T17:56:03.781Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52989 (GCVE-0-2026-52989)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-24 12:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
Currently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds
PDU length or offset, it triggers nvmet_tcp_fatal_error(cmd->queue)
and returns early. However, because the function returns void, the
callers are entirely unaware that a fatal error has occurred and
that the cmd->recv_msg.msg_iter was left uninitialized.
Callers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly
overwrite the queue state with queue->rcv_state = NVMET_TCP_RECV_DATA
Consequently, the socket receiving loop may attempt to read incoming
network data into the uninitialized iterator.
Fix this by shifting the error handling responsibility to the callers.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1385be357e8acd09b36e026567f3a9d5c61139de Version: dca1a6ba0da9f472ef040525fab10fd9956db59f Version: 19672ae68d52ff75347ebe2420dde1b07adca09f Version: ab200d71553bdcf4de554a5985b05b2dd606bc57 Version: 52a0a98549344ca20ad81a4176d68d28e3c05a5c Version: 52a0a98549344ca20ad81a4176d68d28e3c05a5c Version: 043b4307a99f902697349128fde93b2ddde4686c Version: 42afe8ed8ad2de9c19457156244ef3e1eca94b5d Version: 6.1.163 ≤ Version: 6.6.124 ≤ Version: 6.12.70 ≤ Version: 6.18.10 ≤ Version: 5.10.250 ≤ Version: 5.15.200 ≤ |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the `nvmet-tcp` component of the Linux kernel. The `nvmet_tcp_build_pdu_iovec()` function fails to propagate errors when detecting out-of-bounds PDU lengths or offsets. This can lead to uninitialized memory being used by subsequent operations, such as reading incoming network data into an uninitialized iterator. A remote attacker could potentially exploit this memory corruption to cause a denial of service or achieve arbitrary code execution."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-390",
"description": "Detection of Error Condition Without Action",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T12:07:11.778Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52989"
},
{
"name": "RHBZ#2492443",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492443"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52989.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers",
"workarounds": [
{
"lang": "en",
"value": "For Red Hat Enterprise Linux, mitigation for this issue is not applicable as the product is not affected.\n\nFor Red Hat In-Vehicle OS, if the NVM Express over TCP (nvmet-tcp) functionality is not required, the `nvmet_tcp` kernel module can be prevented from loading. To do this, create a file named `/etc/modprobe.d/disable-nvmet-tcp.conf` with the following content:\n`install nvmet_tcp /bin/true`\n`blacklist nvmet_tcp`\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Disabling this module may impact storage functionality if NVMe over TCP is in use."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3df42a854686fa06484e37ac1a3931c8e3e3453c",
"status": "affected",
"version": "1385be357e8acd09b36e026567f3a9d5c61139de",
"versionType": "git"
},
{
"lessThan": "d7c8f95f599b3b38a717d2e771c3f8c174f657c3",
"status": "affected",
"version": "dca1a6ba0da9f472ef040525fab10fd9956db59f",
"versionType": "git"
},
{
"lessThan": "f9204a2b78dd18374d3bcf9bf93d9021ce22de1b",
"status": "affected",
"version": "19672ae68d52ff75347ebe2420dde1b07adca09f",
"versionType": "git"
},
{
"lessThan": "c2a11441538bdbbc5aa003f190995eba93a89b88",
"status": "affected",
"version": "ab200d71553bdcf4de554a5985b05b2dd606bc57",
"versionType": "git"
},
{
"lessThan": "046fa5c72d15cd8e2d592e275697ea399d8f76b0",
"status": "affected",
"version": "52a0a98549344ca20ad81a4176d68d28e3c05a5c",
"versionType": "git"
},
{
"lessThan": "ea8e356acb165cb1fd75537a52e1f66e5e76c538",
"status": "affected",
"version": "52a0a98549344ca20ad81a4176d68d28e3c05a5c",
"versionType": "git"
},
{
"status": "affected",
"version": "043b4307a99f902697349128fde93b2ddde4686c",
"versionType": "git"
},
{
"status": "affected",
"version": "42afe8ed8ad2de9c19457156244ef3e1eca94b5d",
"versionType": "git"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.163",
"versionType": "semver"
},
{
"lessThan": "6.6.141",
"status": "affected",
"version": "6.6.124",
"versionType": "semver"
},
{
"lessThan": "6.12.91",
"status": "affected",
"version": "6.12.70",
"versionType": "semver"
},
{
"lessThan": "6.18.33",
"status": "affected",
"version": "6.18.10",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.250",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.200",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.163",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.6.124",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.12.70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.18.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.250",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.200",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers\n\nCurrently, when nvmet_tcp_build_pdu_iovec() detects an out-of-bounds\nPDU length or offset, it triggers nvmet_tcp_fatal_error(cmd-\u003equeue)\nand returns early. However, because the function returns void, the\ncallers are entirely unaware that a fatal error has occurred and\nthat the cmd-\u003erecv_msg.msg_iter was left uninitialized.\n\nCallers such as nvmet_tcp_handle_h2c_data_pdu() proceed to blindly\noverwrite the queue state with queue-\u003ercv_state = NVMET_TCP_RECV_DATA\nConsequently, the socket receiving loop may attempt to read incoming\nnetwork data into the uninitialized iterator.\n\nFix this by shifting the error handling responsibility to the callers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - nvmet-tcp is a network-facing NVMe-over-TCP target transport, and the vulnerable path is reached by sending crafted NVMe/TCP PDUs over an accepted TCP connection.\nAC:L - The attacker controls the NVMe/TCP command and H2CData PDU lengths/offsets needed to make nvmet_tcp_build_pdu_iovec() fail; no race or hard-to-influence condition is required.\nPR:N - In a reasonable deployment without DH-HMAC-CHAP/TLS enforcement, a remote initiator can connect and send the crafted sequence without prior privileges, and host NQN based admission is not a strong privilege boundary.\nUI:N - No victim action is required after the nvmet-tcp service is listening; exploitation is driven entirely by network traffic from the attacker.\nS:U - The impact is within the vulnerable kernel/NVMe target security authority and does not cross a separate scope such as guest-to-host or IOMMU isolation.\nC:H - The bug can cause attacker-controlled network data to be received through an uninitialized or stale kernel iterator, creating memory corruption that is plausibly usable to disclose kernel or target memory.\nI:H - The stale destination iterator can turn received network data into a kernel memory write primitive, making arbitrary corruption or code execution defensible.\nA:H - Even without full exploitation, the invalid receive through an uninitialized/stale iterator can trigger kernel oops, GPF/KASAN failures, or panic, causing high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:25.683Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3df42a854686fa06484e37ac1a3931c8e3e3453c"
},
{
"url": "https://git.kernel.org/stable/c/d7c8f95f599b3b38a717d2e771c3f8c174f657c3"
},
{
"url": "https://git.kernel.org/stable/c/f9204a2b78dd18374d3bcf9bf93d9021ce22de1b"
},
{
"url": "https://git.kernel.org/stable/c/c2a11441538bdbbc5aa003f190995eba93a89b88"
},
{
"url": "https://git.kernel.org/stable/c/046fa5c72d15cd8e2d592e275697ea399d8f76b0"
},
{
"url": "https://git.kernel.org/stable/c/ea8e356acb165cb1fd75537a52e1f66e5e76c538"
}
],
"title": "nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52989",
"datePublished": "2026-06-24T16:29:03.398Z",
"dateReserved": "2026-06-09T07:44:35.376Z",
"dateUpdated": "2026-08-24T12:07:11.778Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31673 (GCVE-0-2026-31673)
Vulnerability from cvelistv5
Published
2026-04-25 08:46
Modified
2026-08-05 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
af_unix: read UNIX_DIAG_VFS data under unix_state_lock
Exact UNIX diag lookups hold a reference to the socket, but not to
u->path. Meanwhile, unix_release_sock() clears u->path under
unix_state_lock() and drops the path reference after unlocking.
Read the inode and device numbers for UNIX_DIAG_VFS while holding
unix_state_lock(), then emit the netlink attribute after dropping the
lock.
This keeps the VFS data stable while the reply is being built.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5f7b0569460b7d8d01ca776430a00505a68b7584 Version: 5f7b0569460b7d8d01ca776430a00505a68b7584 Version: 5f7b0569460b7d8d01ca776430a00505a68b7584 Version: 5f7b0569460b7d8d01ca776430a00505a68b7584 Version: 5f7b0569460b7d8d01ca776430a00505a68b7584 Version: 5f7b0569460b7d8d01ca776430a00505a68b7584 Version: 5f7b0569460b7d8d01ca776430a00505a68b7584 Version: 5f7b0569460b7d8d01ca776430a00505a68b7584 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/unix/diag.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e7339db13b9ddb63417b12da55fd6191e59f7442",
"status": "affected",
"version": "5f7b0569460b7d8d01ca776430a00505a68b7584",
"versionType": "git"
},
{
"lessThan": "4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7",
"status": "affected",
"version": "5f7b0569460b7d8d01ca776430a00505a68b7584",
"versionType": "git"
},
{
"lessThan": "c3ec44ab4526bbc4b6c9fc845af86488244f4c9b",
"status": "affected",
"version": "5f7b0569460b7d8d01ca776430a00505a68b7584",
"versionType": "git"
},
{
"lessThan": "b9232421a77a649c9376c99fdfc8cb7f79cad34c",
"status": "affected",
"version": "5f7b0569460b7d8d01ca776430a00505a68b7584",
"versionType": "git"
},
{
"lessThan": "0c739f3785f84af695952c2bac8be2f45082c9b8",
"status": "affected",
"version": "5f7b0569460b7d8d01ca776430a00505a68b7584",
"versionType": "git"
},
{
"lessThan": "900a4e0910e98b8caef117d5df00471fa438dcf9",
"status": "affected",
"version": "5f7b0569460b7d8d01ca776430a00505a68b7584",
"versionType": "git"
},
{
"lessThan": "bdf206e740bf2919d818f132c8c9cc7ed91d11c0",
"status": "affected",
"version": "5f7b0569460b7d8d01ca776430a00505a68b7584",
"versionType": "git"
},
{
"lessThan": "39897df386376912d561d4946499379effa1e7ef",
"status": "affected",
"version": "5f7b0569460b7d8d01ca776430a00505a68b7584",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/unix/diag.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: read UNIX_DIAG_VFS data under unix_state_lock\n\nExact UNIX diag lookups hold a reference to the socket, but not to\nu-\u003epath. Meanwhile, unix_release_sock() clears u-\u003epath under\nunix_state_lock() and drops the path reference after unlocking.\n\nRead the inode and device numbers for UNIX_DIAG_VFS while holding\nunix_state_lock(), then emit the netlink attribute after dropping the\nlock.\n\nThis keeps the VFS data stable while the reply is being built."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through local NETLINK_SOCK_DIAG SOCK_DIAG_BY_FAMILY requests for AF_UNIX diagnostics. It is not reachable from remote network packets; an attacker needs local code execution to create sockets and send netlink requests.\nAC:L - The race is attacker-controlled because one thread can repeatedly issue exact UNIX_DIAG requests with UDIAG_SHOW_VFS while another closes attacker-created pathname AF_UNIX sockets. No rare external condition is required beyond timing that can be retried.\nPR:L - Unprivileged users can create AF_UNIX sockets and NETLINK_SOCK_DIAG sockets, and the sock_diag netlink socket permits non-root diagnostic requests. No real root or init-namespace CAP_NET_ADMIN is required.\nUI:N - Exploitation does not require any victim action. The attacker can create, bind, query, unlink, and close the involved sockets directly.\nS:U - The bug is in the kernel AF_UNIX diagnostic path and impacts kernel resources within the same security authority. It is a standard local kernel vulnerability, not a VM, IOMMU, or sandbox boundary-crossing issue.\nC:H - The bug is a use-after-free/read-after-free of the AF_UNIX VFS path dentry, allowing stale kernel object pointers to be dereferenced and returned or used during netlink reply construction. Under the required kernel scoring guidance, UAFs are treated as high confidentiality impact.\nI:H - Although the immediate vulnerable operation reads VFS fields, it is a kernel use-after-free in attacker-controllable local object lifetime and race conditions. Following the required guidance and higher-severity rule, UAFs are scored as potentially enabling integrity compromise.\nA:H - The stale dentry or related VFS pointer can be dereferenced after path_put(), plausibly causing a kernel oops or panic. Repeated local triggering makes high availability impact defensible."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:20.351Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e7339db13b9ddb63417b12da55fd6191e59f7442"
},
{
"url": "https://git.kernel.org/stable/c/4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7"
},
{
"url": "https://git.kernel.org/stable/c/c3ec44ab4526bbc4b6c9fc845af86488244f4c9b"
},
{
"url": "https://git.kernel.org/stable/c/b9232421a77a649c9376c99fdfc8cb7f79cad34c"
},
{
"url": "https://git.kernel.org/stable/c/0c739f3785f84af695952c2bac8be2f45082c9b8"
},
{
"url": "https://git.kernel.org/stable/c/900a4e0910e98b8caef117d5df00471fa438dcf9"
},
{
"url": "https://git.kernel.org/stable/c/bdf206e740bf2919d818f132c8c9cc7ed91d11c0"
},
{
"url": "https://git.kernel.org/stable/c/39897df386376912d561d4946499379effa1e7ef"
}
],
"title": "af_unix: read UNIX_DIAG_VFS data under unix_state_lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31673",
"datePublished": "2026-04-25T08:46:49.246Z",
"dateReserved": "2026-03-09T15:48:24.130Z",
"dateUpdated": "2026-08-05T12:24:20.351Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43277 (GCVE-0-2026-43277)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
APEI/GHES: ensure that won't go past CPER allocated record
The logic at ghes_new() prevents allocating too large records, by
checking if they're bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).
Yet, the allocation is done with the actual number of pages from the
CPER bios table location, which can be smaller.
Yet, a bad firmware could send data with a different size, which might
be bigger than the allocated memory, causing an OOPS:
Unable to handle kernel paging request at virtual address fff00000f9b40000
Mem abort info:
ESR = 0x0000000096000007
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x07: level 3 translation fault
Data abort info:
ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000
[fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000
Internal error: Oops: 0000000096000007 [#1] SMP
Modules linked in:
CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT
Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022
Workqueue: kacpi_notify acpi_os_execute_deferred
pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : hex_dump_to_buffer+0x30c/0x4a0
lr : hex_dump_to_buffer+0x328/0x4a0
sp : ffff800080e13880
x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083
x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004
x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083
x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010
x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020
x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008
x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020
x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000
x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008
Call trace:
hex_dump_to_buffer+0x30c/0x4a0 (P)
print_hex_dump+0xac/0x170
cper_estatus_print_section+0x90c/0x968
cper_estatus_print+0xf0/0x158
__ghes_print_estatus+0xa0/0x148
ghes_proc+0x1bc/0x220
ghes_notify_hed+0x5c/0xb8
notifier_call_chain+0x78/0x148
blocking_notifier_call_chain+0x4c/0x80
acpi_hed_notify+0x28/0x40
acpi_ev_notify_dispatch+0x50/0x80
acpi_os_execute_deferred+0x24/0x48
process_one_work+0x15c/0x3b0
worker_thread+0x2d0/0x400
kthread+0x148/0x228
ret_from_fork+0x10/0x20
Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44)
---[ end trace 0000000000000000 ]---
Prevent that by taking the actual allocated are into account when
checking for CPER length.
[ rjw: Subject tweaks ]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d334a49113a4a33109fd24e46073280ecd1bea0d Version: d334a49113a4a33109fd24e46073280ecd1bea0d Version: d334a49113a4a33109fd24e46073280ecd1bea0d Version: d334a49113a4a33109fd24e46073280ecd1bea0d Version: d334a49113a4a33109fd24e46073280ecd1bea0d Version: d334a49113a4a33109fd24e46073280ecd1bea0d Version: d334a49113a4a33109fd24e46073280ecd1bea0d Version: d334a49113a4a33109fd24e46073280ecd1bea0d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/apei/ghes.c",
"include/acpi/ghes.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "92ba79074c58e65a6e32713758c5a9aecd33c2ea",
"status": "affected",
"version": "d334a49113a4a33109fd24e46073280ecd1bea0d",
"versionType": "git"
},
{
"lessThan": "616c120dcdf1ce96edcd818e38bce49667f80689",
"status": "affected",
"version": "d334a49113a4a33109fd24e46073280ecd1bea0d",
"versionType": "git"
},
{
"lessThan": "f3740a1562445f36f08afab8af59e37117b3acdc",
"status": "affected",
"version": "d334a49113a4a33109fd24e46073280ecd1bea0d",
"versionType": "git"
},
{
"lessThan": "e0ec99115e135dbb58e11a0df007c7d4771d4a17",
"status": "affected",
"version": "d334a49113a4a33109fd24e46073280ecd1bea0d",
"versionType": "git"
},
{
"lessThan": "b6be51a12441136fdf8c49b2525689fbea1856e1",
"status": "affected",
"version": "d334a49113a4a33109fd24e46073280ecd1bea0d",
"versionType": "git"
},
{
"lessThan": "6f5d41984ad896736c23e2fff7c80e15c1319132",
"status": "affected",
"version": "d334a49113a4a33109fd24e46073280ecd1bea0d",
"versionType": "git"
},
{
"lessThan": "98bd9b28d4d11e6739ad86524b4be4ada9025e60",
"status": "affected",
"version": "d334a49113a4a33109fd24e46073280ecd1bea0d",
"versionType": "git"
},
{
"lessThan": "fa2408a24f8f0db14d9cfc613ef162dc267d7ad4",
"status": "affected",
"version": "d334a49113a4a33109fd24e46073280ecd1bea0d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/acpi/apei/ghes.c",
"include/acpi/ghes.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nAPEI/GHES: ensure that won\u0027t go past CPER allocated record\n\nThe logic at ghes_new() prevents allocating too large records, by\nchecking if they\u0027re bigger than GHES_ESTATUS_MAX_SIZE (currently, 64KB).\nYet, the allocation is done with the actual number of pages from the\nCPER bios table location, which can be smaller.\n\nYet, a bad firmware could send data with a different size, which might\nbe bigger than the allocated memory, causing an OOPS:\n\n Unable to handle kernel paging request at virtual address fff00000f9b40000\n Mem abort info:\n ESR = 0x0000000096000007\n EC = 0x25: DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n FSC = 0x07: level 3 translation fault\n Data abort info:\n ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000\n CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000008ba16000\n [fff00000f9b40000] pgd=180000013ffff403, p4d=180000013fffe403, pud=180000013f85b403, pmd=180000013f68d403, pte=0000000000000000\n Internal error: Oops: 0000000096000007 [#1] SMP\n Modules linked in:\n CPU: 0 UID: 0 PID: 303 Comm: kworker/0:1 Not tainted 6.19.0-rc1-00002-gda407d200220 #34 PREEMPT\n Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022\n Workqueue: kacpi_notify acpi_os_execute_deferred\n pstate: 214020c5 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)\n pc : hex_dump_to_buffer+0x30c/0x4a0\n lr : hex_dump_to_buffer+0x328/0x4a0\n sp : ffff800080e13880\n x29: ffff800080e13880 x28: ffffac9aba86f6a8 x27: 0000000000000083\n x26: fff00000f9b3fffc x25: 0000000000000004 x24: 0000000000000004\n x23: ffff800080e13905 x22: 0000000000000010 x21: 0000000000000083\n x20: 0000000000000001 x19: 0000000000000008 x18: 0000000000000010\n x17: 0000000000000001 x16: 00000007c7f20fec x15: 0000000000000020\n x14: 0000000000000008 x13: 0000000000081020 x12: 0000000000000008\n x11: ffff800080e13905 x10: ffff800080e13988 x9 : 0000000000000000\n x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000020\n x5 : 0000000000000030 x4 : 00000000fffffffe x3 : 0000000000000000\n x2 : ffffac9aba78c1c8 x1 : ffffac9aba76d0a8 x0 : 0000000000000008\n Call trace:\n hex_dump_to_buffer+0x30c/0x4a0 (P)\n print_hex_dump+0xac/0x170\n cper_estatus_print_section+0x90c/0x968\n cper_estatus_print+0xf0/0x158\n __ghes_print_estatus+0xa0/0x148\n ghes_proc+0x1bc/0x220\n ghes_notify_hed+0x5c/0xb8\n notifier_call_chain+0x78/0x148\n blocking_notifier_call_chain+0x4c/0x80\n acpi_hed_notify+0x28/0x40\n acpi_ev_notify_dispatch+0x50/0x80\n acpi_os_execute_deferred+0x24/0x48\n process_one_work+0x15c/0x3b0\n worker_thread+0x2d0/0x400\n kthread+0x148/0x228\n ret_from_fork+0x10/0x20\n Code: 6b14033f 540001ad a94707e2 f100029f (b8747b44)\n ---[ end trace 0000000000000000 ]---\n\nPrevent that by taking the actual allocated are into account when\nchecking for CPER length.\n\n[ rjw: Subject tweaks ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:21:26.865Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/92ba79074c58e65a6e32713758c5a9aecd33c2ea"
},
{
"url": "https://git.kernel.org/stable/c/616c120dcdf1ce96edcd818e38bce49667f80689"
},
{
"url": "https://git.kernel.org/stable/c/f3740a1562445f36f08afab8af59e37117b3acdc"
},
{
"url": "https://git.kernel.org/stable/c/e0ec99115e135dbb58e11a0df007c7d4771d4a17"
},
{
"url": "https://git.kernel.org/stable/c/b6be51a12441136fdf8c49b2525689fbea1856e1"
},
{
"url": "https://git.kernel.org/stable/c/6f5d41984ad896736c23e2fff7c80e15c1319132"
},
{
"url": "https://git.kernel.org/stable/c/98bd9b28d4d11e6739ad86524b4be4ada9025e60"
},
{
"url": "https://git.kernel.org/stable/c/fa2408a24f8f0db14d9cfc613ef162dc267d7ad4"
}
],
"title": "APEI/GHES: ensure that won\u0027t go past CPER allocated record",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43277",
"datePublished": "2026-05-06T11:28:59.486Z",
"dateReserved": "2026-05-01T14:12:55.998Z",
"dateUpdated": "2026-05-11T22:21:26.865Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43080 (GCVE-0-2026-43080)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-06-01 16:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
l2tp: Drop large packets with UDP encap
syzbot reported a WARN on my patch series [1]. The actual issue is an
overflow of 16-bit UDP length field, and it exists in the upstream code.
My series added a debug WARN with an overflow check that exposed the
issue, that's why syzbot tripped on my patches, rather than on upstream
code.
syzbot's repro:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0xfffffffc}, 0x1c)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0xffff, @ipv4={'\x00', '\xff\xff', @empty}}}}, 0x32)
writev(r0, &(0x7f0000000080)=[{&(0x7f0000000000)="ee", 0x34000}], 0x1)
It basically sends an oversized (0x34000 bytes) PPPoL2TP packet with UDP
encapsulation, and l2tp_xmit_core doesn't check for overflows when it
assigns the UDP length field. The value gets trimmed to 16 bites.
Add an overflow check that drops oversized packets and avoids sending
packets with trimmed UDP length to the wire.
syzbot's stack trace (with my patch applied):
len >= 65536u
WARNING: ./include/linux/udp.h:38 at udp_set_len_short include/linux/udp.h:38 [inline], CPU#1: syz.0.17/5957
WARNING: ./include/linux/udp.h:38 at l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline], CPU#1: syz.0.17/5957
WARNING: ./include/linux/udp.h:38 at l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327, CPU#1: syz.0.17/5957
Modules linked in:
CPU: 1 UID: 0 PID: 5957 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:udp_set_len_short include/linux/udp.h:38 [inline]
RIP: 0010:l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline]
RIP: 0010:l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327
Code: 0f 0b 90 e9 21 f9 ff ff e8 e9 05 ec f6 90 0f 0b 90 e9 8d f9 ff ff e8 db 05 ec f6 90 0f 0b 90 e9 cc f9 ff ff e8 cd 05 ec f6 90 <0f> 0b 90 e9 de fa ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 4f
RSP: 0018:ffffc90003d67878 EFLAGS: 00010293
RAX: ffffffff8ad985e3 RBX: ffff8881a6400090 RCX: ffff8881697f0000
RDX: 0000000000000000 RSI: 0000000000034010 RDI: 000000000000ffff
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff520007acf00 R12: ffff8881baf20900
R13: 0000000000034010 R14: ffff8881a640008e R15: ffff8881760f7000
FS: 000055557e81f500(0000) GS:ffff8882a9467000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000033000 CR3: 00000001612f4000 CR4: 00000000000006f0
Call Trace:
<TASK>
pppol2tp_sendmsg+0x40a/0x5f0 net/l2tp/l2tp_ppp.c:302
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
sock_write_iter+0x503/0x550 net/socket.c:1195
do_iter_readv_writev+0x619/0x8c0 fs/read_write.c:-1
vfs_writev+0x33c/0x990 fs/read_write.c:1059
do_writev+0x154/0x2e0 fs/read_write.c:1105
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f636479c629
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffffd4241c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00007f6364a15fa0 RCX: 00007f636479c629
RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000003
RBP: 00007f6364832b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6364a15fac R14: 00007f6364a15fa0 R15: 00007f6364a15fa0
</TASK>
[1]: https://lore.kernel.org/all/20260226201600.222044-1-alice.kernel@fastmail.im/
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3557baabf28088f49bdf72a048fd33ab62e205b1 Version: 3557baabf28088f49bdf72a048fd33ab62e205b1 Version: 3557baabf28088f49bdf72a048fd33ab62e205b1 Version: 3557baabf28088f49bdf72a048fd33ab62e205b1 Version: 3557baabf28088f49bdf72a048fd33ab62e205b1 Version: 3557baabf28088f49bdf72a048fd33ab62e205b1 Version: 3557baabf28088f49bdf72a048fd33ab62e205b1 Version: 3557baabf28088f49bdf72a048fd33ab62e205b1 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/l2tp/l2tp_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "02d787fd0922c71c0264449fe82d35983613e4e5",
"status": "affected",
"version": "3557baabf28088f49bdf72a048fd33ab62e205b1",
"versionType": "git"
},
{
"lessThan": "c2994fd24997ed63d713c03313f863645adb4d6c",
"status": "affected",
"version": "3557baabf28088f49bdf72a048fd33ab62e205b1",
"versionType": "git"
},
{
"lessThan": "a42452db035577e150ffd9adf98c56fef9fb9408",
"status": "affected",
"version": "3557baabf28088f49bdf72a048fd33ab62e205b1",
"versionType": "git"
},
{
"lessThan": "9ccce02d501335f59a02f26c878c5e095b16302f",
"status": "affected",
"version": "3557baabf28088f49bdf72a048fd33ab62e205b1",
"versionType": "git"
},
{
"lessThan": "77c1489398c85a844f90205f5e76fd6bc8bb4089",
"status": "affected",
"version": "3557baabf28088f49bdf72a048fd33ab62e205b1",
"versionType": "git"
},
{
"lessThan": "86534c97abd6365a9a021fd767a2023e63c44469",
"status": "affected",
"version": "3557baabf28088f49bdf72a048fd33ab62e205b1",
"versionType": "git"
},
{
"lessThan": "f295fe86e22ff0a2ecebf05e30a387e5cf6f6ddc",
"status": "affected",
"version": "3557baabf28088f49bdf72a048fd33ab62e205b1",
"versionType": "git"
},
{
"lessThan": "ebe560ea5f54134279356703e73b7f867c89db13",
"status": "affected",
"version": "3557baabf28088f49bdf72a048fd33ab62e205b1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/l2tp/l2tp_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.23"
},
{
"lessThan": "2.6.23",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: Drop large packets with UDP encap\n\nsyzbot reported a WARN on my patch series [1]. The actual issue is an\noverflow of 16-bit UDP length field, and it exists in the upstream code.\nMy series added a debug WARN with an overflow check that exposed the\nissue, that\u0027s why syzbot tripped on my patches, rather than on upstream\ncode.\n\nsyzbot\u0027s repro:\n\nr0 = socket$pppl2tp(0x18, 0x1, 0x1)\nr1 = socket$inet6_udp(0xa, 0x2, 0x0)\nconnect$inet6(r1, \u0026(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0xfffffffc}, 0x1c)\nconnect$pppl2tp(r0, \u0026(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0xffff, @ipv4={\u0027\\x00\u0027, \u0027\\xff\\xff\u0027, @empty}}}}, 0x32)\nwritev(r0, \u0026(0x7f0000000080)=[{\u0026(0x7f0000000000)=\"ee\", 0x34000}], 0x1)\n\nIt basically sends an oversized (0x34000 bytes) PPPoL2TP packet with UDP\nencapsulation, and l2tp_xmit_core doesn\u0027t check for overflows when it\nassigns the UDP length field. The value gets trimmed to 16 bites.\n\nAdd an overflow check that drops oversized packets and avoids sending\npackets with trimmed UDP length to the wire.\n\nsyzbot\u0027s stack trace (with my patch applied):\n\nlen \u003e= 65536u\nWARNING: ./include/linux/udp.h:38 at udp_set_len_short include/linux/udp.h:38 [inline], CPU#1: syz.0.17/5957\nWARNING: ./include/linux/udp.h:38 at l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline], CPU#1: syz.0.17/5957\nWARNING: ./include/linux/udp.h:38 at l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327, CPU#1: syz.0.17/5957\nModules linked in:\nCPU: 1 UID: 0 PID: 5957 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\nRIP: 0010:udp_set_len_short include/linux/udp.h:38 [inline]\nRIP: 0010:l2tp_xmit_core net/l2tp/l2tp_core.c:1293 [inline]\nRIP: 0010:l2tp_xmit_skb+0x1204/0x18d0 net/l2tp/l2tp_core.c:1327\nCode: 0f 0b 90 e9 21 f9 ff ff e8 e9 05 ec f6 90 0f 0b 90 e9 8d f9 ff ff e8 db 05 ec f6 90 0f 0b 90 e9 cc f9 ff ff e8 cd 05 ec f6 90 \u003c0f\u003e 0b 90 e9 de fa ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c 4f\nRSP: 0018:ffffc90003d67878 EFLAGS: 00010293\nRAX: ffffffff8ad985e3 RBX: ffff8881a6400090 RCX: ffff8881697f0000\nRDX: 0000000000000000 RSI: 0000000000034010 RDI: 000000000000ffff\nRBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004\nR10: dffffc0000000000 R11: fffff520007acf00 R12: ffff8881baf20900\nR13: 0000000000034010 R14: ffff8881a640008e R15: ffff8881760f7000\nFS: 000055557e81f500(0000) GS:ffff8882a9467000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000033000 CR3: 00000001612f4000 CR4: 00000000000006f0\nCall Trace:\n \u003cTASK\u003e\n pppol2tp_sendmsg+0x40a/0x5f0 net/l2tp/l2tp_ppp.c:302\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n sock_write_iter+0x503/0x550 net/socket.c:1195\n do_iter_readv_writev+0x619/0x8c0 fs/read_write.c:-1\n vfs_writev+0x33c/0x990 fs/read_write.c:1059\n do_writev+0x154/0x2e0 fs/read_write.c:1105\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f636479c629\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffffd4241c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014\nRAX: ffffffffffffffda RBX: 00007f6364a15fa0 RCX: 00007f636479c629\nRDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000003\nRBP: 00007f6364832b39 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f6364a15fac R14: 00007f6364a15fa0 R15: 00007f6364a15fa0\n \u003c/TASK\u003e\n\n[1]: https://lore.kernel.org/all/20260226201600.222044-1-alice.kernel@fastmail.im/"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T16:14:23.815Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/02d787fd0922c71c0264449fe82d35983613e4e5"
},
{
"url": "https://git.kernel.org/stable/c/c2994fd24997ed63d713c03313f863645adb4d6c"
},
{
"url": "https://git.kernel.org/stable/c/a42452db035577e150ffd9adf98c56fef9fb9408"
},
{
"url": "https://git.kernel.org/stable/c/9ccce02d501335f59a02f26c878c5e095b16302f"
},
{
"url": "https://git.kernel.org/stable/c/77c1489398c85a844f90205f5e76fd6bc8bb4089"
},
{
"url": "https://git.kernel.org/stable/c/86534c97abd6365a9a021fd767a2023e63c44469"
},
{
"url": "https://git.kernel.org/stable/c/f295fe86e22ff0a2ecebf05e30a387e5cf6f6ddc"
},
{
"url": "https://git.kernel.org/stable/c/ebe560ea5f54134279356703e73b7f867c89db13"
}
],
"title": "l2tp: Drop large packets with UDP encap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43080",
"datePublished": "2026-05-06T07:40:16.491Z",
"dateReserved": "2026-05-01T14:12:55.983Z",
"dateUpdated": "2026-06-01T16:14:23.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43251 (GCVE-0-2026-43251)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: prodikeys: Check presence of pm->input_ep82
Fake USB devices can send their own report descriptors for which the
input_mapping() hook does not get called. In this case, pm->input_ep82 stays
NULL, which leads to a crash later.
This does not happen with the real device, but can be provoked by imposing as
one.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3a370ca1dcf8c80aff7a0a21d6b0f50ca2a151e9 Version: 3a370ca1dcf8c80aff7a0a21d6b0f50ca2a151e9 Version: 3a370ca1dcf8c80aff7a0a21d6b0f50ca2a151e9 Version: 3a370ca1dcf8c80aff7a0a21d6b0f50ca2a151e9 Version: 3a370ca1dcf8c80aff7a0a21d6b0f50ca2a151e9 Version: 3a370ca1dcf8c80aff7a0a21d6b0f50ca2a151e9 Version: 3a370ca1dcf8c80aff7a0a21d6b0f50ca2a151e9 Version: 3a370ca1dcf8c80aff7a0a21d6b0f50ca2a151e9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-prodikeys.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f580c79683356632f12f2c2029f2fe936d953aa1",
"status": "affected",
"version": "3a370ca1dcf8c80aff7a0a21d6b0f50ca2a151e9",
"versionType": "git"
},
{
"lessThan": "ee572578f09f0e743e9383393a75c3a7a0f9b4c2",
"status": "affected",
"version": "3a370ca1dcf8c80aff7a0a21d6b0f50ca2a151e9",
"versionType": "git"
},
{
"lessThan": "edccbf7d6dc05d692bde3a89de5a4001f72a0fa4",
"status": "affected",
"version": "3a370ca1dcf8c80aff7a0a21d6b0f50ca2a151e9",
"versionType": "git"
},
{
"lessThan": "3f1b21cc67a15d7d081378a9b8747dd000a017b8",
"status": "affected",
"version": "3a370ca1dcf8c80aff7a0a21d6b0f50ca2a151e9",
"versionType": "git"
},
{
"lessThan": "e7ac1cd823cd2e9fcbd5cb0b261d6d35dbb79341",
"status": "affected",
"version": "3a370ca1dcf8c80aff7a0a21d6b0f50ca2a151e9",
"versionType": "git"
},
{
"lessThan": "d5512ce892f774d37c53082adadfcad04f21b50e",
"status": "affected",
"version": "3a370ca1dcf8c80aff7a0a21d6b0f50ca2a151e9",
"versionType": "git"
},
{
"lessThan": "d08f35f843881ec504d7537a9bb728a073db3366",
"status": "affected",
"version": "3a370ca1dcf8c80aff7a0a21d6b0f50ca2a151e9",
"versionType": "git"
},
{
"lessThan": "cee8337e1bad168136aecfe6416ecd7d3aa7529a",
"status": "affected",
"version": "3a370ca1dcf8c80aff7a0a21d6b0f50ca2a151e9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-prodikeys.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: prodikeys: Check presence of pm-\u003einput_ep82\n\nFake USB devices can send their own report descriptors for which the\ninput_mapping() hook does not get called. In this case, pm-\u003einput_ep82 stays\nNULL, which leads to a crash later.\n\nThis does not happen with the real device, but can be provoked by imposing as\none."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:20:55.964Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f580c79683356632f12f2c2029f2fe936d953aa1"
},
{
"url": "https://git.kernel.org/stable/c/ee572578f09f0e743e9383393a75c3a7a0f9b4c2"
},
{
"url": "https://git.kernel.org/stable/c/edccbf7d6dc05d692bde3a89de5a4001f72a0fa4"
},
{
"url": "https://git.kernel.org/stable/c/3f1b21cc67a15d7d081378a9b8747dd000a017b8"
},
{
"url": "https://git.kernel.org/stable/c/e7ac1cd823cd2e9fcbd5cb0b261d6d35dbb79341"
},
{
"url": "https://git.kernel.org/stable/c/d5512ce892f774d37c53082adadfcad04f21b50e"
},
{
"url": "https://git.kernel.org/stable/c/d08f35f843881ec504d7537a9bb728a073db3366"
},
{
"url": "https://git.kernel.org/stable/c/cee8337e1bad168136aecfe6416ecd7d3aa7529a"
}
],
"title": "HID: prodikeys: Check presence of pm-\u003einput_ep82",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43251",
"datePublished": "2026-05-06T11:28:41.835Z",
"dateReserved": "2026-05-01T14:12:55.996Z",
"dateUpdated": "2026-05-11T22:20:55.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31646 (GCVE-0-2026-31646)
Vulnerability from cvelistv5
Published
2026-04-24 14:44
Modified
2026-05-11 22:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()
page_pool_create() can return an ERR_PTR on failure. The return value
is used unconditionally in the loop that follows, passing the error
pointer through xdp_rxq_info_reg_mem_model() into page_pool_use_xdp_mem(),
which dereferences it, causing a kernel oops.
Add an IS_ERR check after page_pool_create() to return early on failure.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e63265f188ea39dcf5f546770650027528f3bd0f",
"status": "affected",
"version": "11871aba19748b3387e83a2db6360aa7119e9a1a",
"versionType": "git"
},
{
"lessThan": "305832c53551cfbe6e5b81ca7ee765e60f4fe8e9",
"status": "affected",
"version": "11871aba19748b3387e83a2db6360aa7119e9a1a",
"versionType": "git"
},
{
"lessThan": "b5dcb41ba891b55157006cac79825c78a32b409e",
"status": "affected",
"version": "11871aba19748b3387e83a2db6360aa7119e9a1a",
"versionType": "git"
},
{
"lessThan": "7caf90d9ab97951a58d1de85ab7e7d7cca7a4513",
"status": "affected",
"version": "11871aba19748b3387e83a2db6360aa7119e9a1a",
"versionType": "git"
},
{
"lessThan": "3fd0da4fd8851a7e62d009b7db6c4a05b092bc19",
"status": "affected",
"version": "11871aba19748b3387e83a2db6360aa7119e9a1a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/microchip/lan966x/lan966x_fdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.135",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.135",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.82",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()\n\npage_pool_create() can return an ERR_PTR on failure. The return value\nis used unconditionally in the loop that follows, passing the error\npointer through xdp_rxq_info_reg_mem_model() into page_pool_use_xdp_mem(),\nwhich dereferences it, causing a kernel oops.\n\nAdd an IS_ERR check after page_pool_create() to return early on failure."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:12:50.586Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e63265f188ea39dcf5f546770650027528f3bd0f"
},
{
"url": "https://git.kernel.org/stable/c/305832c53551cfbe6e5b81ca7ee765e60f4fe8e9"
},
{
"url": "https://git.kernel.org/stable/c/b5dcb41ba891b55157006cac79825c78a32b409e"
},
{
"url": "https://git.kernel.org/stable/c/7caf90d9ab97951a58d1de85ab7e7d7cca7a4513"
},
{
"url": "https://git.kernel.org/stable/c/3fd0da4fd8851a7e62d009b7db6c4a05b092bc19"
}
],
"title": "net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31646",
"datePublished": "2026-04-24T14:44:59.874Z",
"dateReserved": "2026-03-09T15:48:24.127Z",
"dateUpdated": "2026-05-11T22:12:50.586Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31555 (GCVE-0-2026-31555)
Vulnerability from cvelistv5
Published
2026-04-24 14:35
Modified
2026-07-14 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
futex: Clear stale exiting pointer in futex_lock_pi() retry path
Fuzzying/stressing futexes triggered:
WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524
When futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY
and stores a refcounted task pointer in 'exiting'.
After wait_for_owner_exiting() consumes that reference, the local pointer
is never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a
different error, the bogus pointer is passed to wait_for_owner_exiting().
CPU0 CPU1 CPU2
futex_lock_pi(uaddr)
// acquires the PI futex
exit()
futex_cleanup_begin()
futex_state = EXITING;
futex_lock_pi(uaddr)
futex_lock_pi_atomic()
attach_to_pi_owner()
// observes EXITING
*exiting = owner; // takes ref
return -EBUSY
wait_for_owner_exiting(-EBUSY, owner)
put_task_struct(); // drops ref
// exiting still points to owner
goto retry;
futex_lock_pi_atomic()
lock_pi_update_atomic()
cmpxchg(uaddr)
*uaddr ^= WAITERS // whatever
// value changed
return -EAGAIN;
wait_for_owner_exiting(-EAGAIN, exiting) // stale
WARN_ON_ONCE(exiting)
Fix this by resetting upon retry, essentially aligning it with requeue_pi.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3ef240eaff36b8119ac9e2ea17cbf41179c930ba Version: 3ef240eaff36b8119ac9e2ea17cbf41179c930ba Version: 3ef240eaff36b8119ac9e2ea17cbf41179c930ba Version: 3ef240eaff36b8119ac9e2ea17cbf41179c930ba Version: 3ef240eaff36b8119ac9e2ea17cbf41179c930ba Version: 3ef240eaff36b8119ac9e2ea17cbf41179c930ba Version: 3ef240eaff36b8119ac9e2ea17cbf41179c930ba Version: 3ef240eaff36b8119ac9e2ea17cbf41179c930ba Version: f2a9957e5c08b1b1caacd18a3dc4c0a1bdb7b463 Version: cf16e42709aa86aa3e37f3acc3d13d5715d90096 Version: 61fa9f167caaa73d0a7c88f498eceeb12c6fa3db Version: 7874eee0130adf9bee28e8720bb5dd051089def3 Version: fc3b55ef2c840bb2746b2d8121a0788de84f7fac Version: 4.4.255 ≤ Version: 4.9.255 ≤ Version: 4.14.158 ≤ Version: 4.19.172 ≤ Version: 5.4.1 ≤ |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:20.561Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/futex/pi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "33095ae3bdde5e5c264d7e88a2f3e7703a26c7aa",
"status": "affected",
"version": "3ef240eaff36b8119ac9e2ea17cbf41179c930ba",
"versionType": "git"
},
{
"lessThan": "e7824ec168d2ac883a213cd1f4d6cc0816002a85",
"status": "affected",
"version": "3ef240eaff36b8119ac9e2ea17cbf41179c930ba",
"versionType": "git"
},
{
"lessThan": "5e8e06bf8909e79b4acd950cf578cfc2f10bbefa",
"status": "affected",
"version": "3ef240eaff36b8119ac9e2ea17cbf41179c930ba",
"versionType": "git"
},
{
"lessThan": "de7c0c04ad868f2cee6671b11c0a6d20421af1da",
"status": "affected",
"version": "3ef240eaff36b8119ac9e2ea17cbf41179c930ba",
"versionType": "git"
},
{
"lessThan": "7475dfad10a05a5bfadebf5f2499bd61b19ed293",
"status": "affected",
"version": "3ef240eaff36b8119ac9e2ea17cbf41179c930ba",
"versionType": "git"
},
{
"lessThan": "92e47ad03e03dbb5515bdf06444bf6b1e147310d",
"status": "affected",
"version": "3ef240eaff36b8119ac9e2ea17cbf41179c930ba",
"versionType": "git"
},
{
"lessThan": "71112e62807d1925dc3ae6188b11f8cfc85aec23",
"status": "affected",
"version": "3ef240eaff36b8119ac9e2ea17cbf41179c930ba",
"versionType": "git"
},
{
"lessThan": "210d36d892de5195e6766c45519dfb1e65f3eb83",
"status": "affected",
"version": "3ef240eaff36b8119ac9e2ea17cbf41179c930ba",
"versionType": "git"
},
{
"status": "affected",
"version": "f2a9957e5c08b1b1caacd18a3dc4c0a1bdb7b463",
"versionType": "git"
},
{
"status": "affected",
"version": "cf16e42709aa86aa3e37f3acc3d13d5715d90096",
"versionType": "git"
},
{
"status": "affected",
"version": "61fa9f167caaa73d0a7c88f498eceeb12c6fa3db",
"versionType": "git"
},
{
"status": "affected",
"version": "7874eee0130adf9bee28e8720bb5dd051089def3",
"versionType": "git"
},
{
"status": "affected",
"version": "fc3b55ef2c840bb2746b2d8121a0788de84f7fac",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.255",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.255",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.158",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.172",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/futex/pi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.255",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.255",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.158",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.172",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Clear stale exiting pointer in futex_lock_pi() retry path\n\nFuzzying/stressing futexes triggered:\n\n WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524\n\nWhen futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY\nand stores a refcounted task pointer in \u0027exiting\u0027.\n\nAfter wait_for_owner_exiting() consumes that reference, the local pointer\nis never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a\ndifferent error, the bogus pointer is passed to wait_for_owner_exiting().\n\n CPU0\t\t\t CPU1\t\t CPU2\n futex_lock_pi(uaddr)\n // acquires the PI futex\n exit()\n futex_cleanup_begin()\n futex_state = EXITING;\n\t\t\t futex_lock_pi(uaddr)\n\t\t\t futex_lock_pi_atomic()\n\t\t\t\t attach_to_pi_owner()\n\t\t\t\t // observes EXITING\n\t\t\t\t *exiting = owner; // takes ref\n\t\t\t\t return -EBUSY\n\t\t\t wait_for_owner_exiting(-EBUSY, owner)\n\t\t\t\t put_task_struct(); // drops ref\n\t\t\t // exiting still points to owner\n\t\t\t goto retry;\n\t\t\t futex_lock_pi_atomic()\n\t\t\t\t lock_pi_update_atomic()\n\t\t\t\t cmpxchg(uaddr)\n\t\t\t\t\t*uaddr ^= WAITERS // whatever\n\t\t\t\t // value changed\n\t\t\t\t return -EAGAIN;\n\t\t\t wait_for_owner_exiting(-EAGAIN, exiting) // stale\n\t\t\t\t WARN_ON_ONCE(exiting)\n\nFix this by resetting upon retry, essentially aligning it with requeue_pi."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:05:19.706Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/33095ae3bdde5e5c264d7e88a2f3e7703a26c7aa"
},
{
"url": "https://git.kernel.org/stable/c/e7824ec168d2ac883a213cd1f4d6cc0816002a85"
},
{
"url": "https://git.kernel.org/stable/c/5e8e06bf8909e79b4acd950cf578cfc2f10bbefa"
},
{
"url": "https://git.kernel.org/stable/c/de7c0c04ad868f2cee6671b11c0a6d20421af1da"
},
{
"url": "https://git.kernel.org/stable/c/7475dfad10a05a5bfadebf5f2499bd61b19ed293"
},
{
"url": "https://git.kernel.org/stable/c/92e47ad03e03dbb5515bdf06444bf6b1e147310d"
},
{
"url": "https://git.kernel.org/stable/c/71112e62807d1925dc3ae6188b11f8cfc85aec23"
},
{
"url": "https://git.kernel.org/stable/c/210d36d892de5195e6766c45519dfb1e65f3eb83"
}
],
"title": "futex: Clear stale exiting pointer in futex_lock_pi() retry path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31555",
"datePublished": "2026-04-24T14:35:39.211Z",
"dateReserved": "2026-03-09T15:48:24.115Z",
"dateUpdated": "2026-07-14T12:48:20.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31509 (GCVE-0-2026-31509)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-05-11 22:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: fix circular locking dependency in nci_close_device
nci_close_device() flushes rx_wq and tx_wq while holding req_lock.
This causes a circular locking dependency because nci_rx_work()
running on rx_wq can end up taking req_lock too:
nci_rx_work -> nci_rx_data_packet -> nci_data_exchange_complete
-> __sk_destruct -> rawsock_destruct -> nfc_deactivate_target
-> nci_deactivate_target -> nci_request -> mutex_lock(&ndev->req_lock)
Move the flush of rx_wq after req_lock has been released.
This should safe (I think) because NCI_UP has already been cleared
and the transport is closed, so the work will see it and return
-ENETDOWN.
NIPA has been hitting this running the nci selftest with a debug
kernel on roughly 4% of the runs.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6a2968aaf50c7a22fced77a5e24aa636281efca8 Version: 6a2968aaf50c7a22fced77a5e24aa636281efca8 Version: 6a2968aaf50c7a22fced77a5e24aa636281efca8 Version: 6a2968aaf50c7a22fced77a5e24aa636281efca8 Version: 6a2968aaf50c7a22fced77a5e24aa636281efca8 Version: 6a2968aaf50c7a22fced77a5e24aa636281efca8 Version: 6a2968aaf50c7a22fced77a5e24aa636281efca8 Version: 6a2968aaf50c7a22fced77a5e24aa636281efca8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/nfc/nci/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7ed00a3edc8597fe2333f524401e2889aa1b5edf",
"status": "affected",
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"versionType": "git"
},
{
"lessThan": "5eef9ebec7f5738f12cadede3545c05b34bf5ac3",
"status": "affected",
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"versionType": "git"
},
{
"lessThan": "ca54e904a071aa65ef3ad46ba42d51aaac6b73b4",
"status": "affected",
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"versionType": "git"
},
{
"lessThan": "eb435d150ca74b4d40f77f1a2266f3636ed64a79",
"status": "affected",
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"versionType": "git"
},
{
"lessThan": "1edc12d2bbcb7a8d0f1088e6fccb9d8c01bb1289",
"status": "affected",
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"versionType": "git"
},
{
"lessThan": "d89b74bf08f067b55c03d7f999ba0a0e73177eb3",
"status": "affected",
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"versionType": "git"
},
{
"lessThan": "09143c0e8f3b03517e6233aad42f45c794d8df8e",
"status": "affected",
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"versionType": "git"
},
{
"lessThan": "4527025d440ce84bf56e75ce1df2e84cb8178616",
"status": "affected",
"version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/nfc/nci/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: fix circular locking dependency in nci_close_device\n\nnci_close_device() flushes rx_wq and tx_wq while holding req_lock.\nThis causes a circular locking dependency because nci_rx_work()\nrunning on rx_wq can end up taking req_lock too:\n\n nci_rx_work -\u003e nci_rx_data_packet -\u003e nci_data_exchange_complete\n -\u003e __sk_destruct -\u003e rawsock_destruct -\u003e nfc_deactivate_target\n -\u003e nci_deactivate_target -\u003e nci_request -\u003e mutex_lock(\u0026ndev-\u003ereq_lock)\n\nMove the flush of rx_wq after req_lock has been released.\nThis should safe (I think) because NCI_UP has already been cleared\nand the transport is closed, so the work will see it and return\n-ENETDOWN.\n\nNIPA has been hitting this running the nci selftest with a debug\nkernel on roughly 4% of the runs."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:10:10.109Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7ed00a3edc8597fe2333f524401e2889aa1b5edf"
},
{
"url": "https://git.kernel.org/stable/c/5eef9ebec7f5738f12cadede3545c05b34bf5ac3"
},
{
"url": "https://git.kernel.org/stable/c/ca54e904a071aa65ef3ad46ba42d51aaac6b73b4"
},
{
"url": "https://git.kernel.org/stable/c/eb435d150ca74b4d40f77f1a2266f3636ed64a79"
},
{
"url": "https://git.kernel.org/stable/c/1edc12d2bbcb7a8d0f1088e6fccb9d8c01bb1289"
},
{
"url": "https://git.kernel.org/stable/c/d89b74bf08f067b55c03d7f999ba0a0e73177eb3"
},
{
"url": "https://git.kernel.org/stable/c/09143c0e8f3b03517e6233aad42f45c794d8df8e"
},
{
"url": "https://git.kernel.org/stable/c/4527025d440ce84bf56e75ce1df2e84cb8178616"
}
],
"title": "nfc: nci: fix circular locking dependency in nci_close_device",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31509",
"datePublished": "2026-04-22T13:54:27.436Z",
"dateReserved": "2026-03-09T15:48:24.106Z",
"dateUpdated": "2026-05-11T22:10:10.109Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31701 (GCVE-0-2026-31701)
Vulnerability from cvelistv5
Published
2026-05-01 13:56
Modified
2026-06-14 17:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: caiaq: take a reference on the USB device in create_card()
The caiaq driver stores a pointer to the parent USB device in
cdev->chip.dev but never takes a reference on it. The card's
private_free callback, snd_usb_caiaq_card_free(), can run
asynchronously via snd_card_free_when_closed() after the USB
device has already been disconnected and freed, so any access to
cdev->chip.dev in that path dereferences a freed usb_device.
On top of the refcounting issue, the current card_free implementation
calls usb_reset_device(cdev->chip.dev). A reset in a free callback
is inappropriate: the device is going away, the call takes the
device lock in a teardown context, and the reset races with the
disconnect path that the callback is already cleaning up after.
Take a reference on the USB device in create_card() with
usb_get_dev(), drop it with usb_put_dev() in the free callback,
and remove the usb_reset_device() call.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4dd821dcbfcecf7af6a08370b0b217cde2818acf Version: cadf1d8e9ddcd74584ec961aeac14ac549b261d8 Version: 237f3faf0177bdde728fa3106d730d806436aa4d Version: 4507a8b9b30344c5ddd8219945f446d47e966a6d Version: a3f9314752dbb6f6aa1f0f2b4c58243bda800738 Version: b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c Version: b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c Version: b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c Version: 3993edf44d3df7b6e8c753eac6ac8783473fcbab Version: ebad462eec93b0f701dfe4de98990e7355283801 Version: dd0de8cb708951cebf727aa045e8242ba651bb52 Version: 5.10.231 ≤ Version: 5.15.174 ≤ Version: 6.1.120 ≤ Version: 6.6.64 ≤ Version: 6.12.2 ≤ Version: 4.19.325 ≤ Version: 5.4.287 ≤ Version: 6.11.11 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/caiaq/device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "493b3a682ededc804555755f5d2193201339612d",
"status": "affected",
"version": "4dd821dcbfcecf7af6a08370b0b217cde2818acf",
"versionType": "git"
},
{
"lessThan": "dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e",
"status": "affected",
"version": "cadf1d8e9ddcd74584ec961aeac14ac549b261d8",
"versionType": "git"
},
{
"lessThan": "ac7345f68cda6989016d85d63f7b244c064aa8f6",
"status": "affected",
"version": "237f3faf0177bdde728fa3106d730d806436aa4d",
"versionType": "git"
},
{
"lessThan": "f6634af5de728a46792f674a66d7843570cb68f7",
"status": "affected",
"version": "4507a8b9b30344c5ddd8219945f446d47e966a6d",
"versionType": "git"
},
{
"lessThan": "1d9be95aee6c6246a21752e60c9519902649f482",
"status": "affected",
"version": "a3f9314752dbb6f6aa1f0f2b4c58243bda800738",
"versionType": "git"
},
{
"lessThan": "6473ed16df1fe88051140611b3eb9a49be7f429e",
"status": "affected",
"version": "b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c",
"versionType": "git"
},
{
"lessThan": "59b622a043cffc58b7638cd85ae6c30a0904f8e6",
"status": "affected",
"version": "b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c",
"versionType": "git"
},
{
"lessThan": "80bb50e2d459213cccff3111d5ef98ed4238c0d5",
"status": "affected",
"version": "b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c",
"versionType": "git"
},
{
"status": "affected",
"version": "3993edf44d3df7b6e8c753eac6ac8783473fcbab",
"versionType": "git"
},
{
"status": "affected",
"version": "ebad462eec93b0f701dfe4de98990e7355283801",
"versionType": "git"
},
{
"status": "affected",
"version": "dd0de8cb708951cebf727aa045e8242ba651bb52",
"versionType": "git"
},
{
"lessThan": "5.10.258",
"status": "affected",
"version": "5.10.231",
"versionType": "semver"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.174",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.120",
"versionType": "semver"
},
{
"lessThan": "6.6.136",
"status": "affected",
"version": "6.6.64",
"versionType": "semver"
},
{
"lessThan": "6.12.84",
"status": "affected",
"version": "6.12.2",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.325",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.287",
"versionType": "semver"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/caiaq/device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.84",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.25",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10.231",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.174",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "6.6.64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.84",
"versionStartIncluding": "6.12.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.25",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.2",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.325",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.287",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: caiaq: take a reference on the USB device in create_card()\n\nThe caiaq driver stores a pointer to the parent USB device in\ncdev-\u003echip.dev but never takes a reference on it. The card\u0027s\nprivate_free callback, snd_usb_caiaq_card_free(), can run\nasynchronously via snd_card_free_when_closed() after the USB\ndevice has already been disconnected and freed, so any access to\ncdev-\u003echip.dev in that path dereferences a freed usb_device.\n\nOn top of the refcounting issue, the current card_free implementation\ncalls usb_reset_device(cdev-\u003echip.dev). A reset in a free callback\nis inappropriate: the device is going away, the call takes the\ndevice lock in a teardown context, and the reset races with the\ndisconnect path that the callback is already cleaning up after.\n\nTake a reference on the USB device in create_card() with\nusb_get_dev(), drop it with usb_put_dev() in the free callback,\nand remove the usb_reset_device() call."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:43:40.642Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/493b3a682ededc804555755f5d2193201339612d"
},
{
"url": "https://git.kernel.org/stable/c/dbcf7588e8dea017ddb3f18ec2766f7d2e5f2a0e"
},
{
"url": "https://git.kernel.org/stable/c/ac7345f68cda6989016d85d63f7b244c064aa8f6"
},
{
"url": "https://git.kernel.org/stable/c/f6634af5de728a46792f674a66d7843570cb68f7"
},
{
"url": "https://git.kernel.org/stable/c/1d9be95aee6c6246a21752e60c9519902649f482"
},
{
"url": "https://git.kernel.org/stable/c/6473ed16df1fe88051140611b3eb9a49be7f429e"
},
{
"url": "https://git.kernel.org/stable/c/59b622a043cffc58b7638cd85ae6c30a0904f8e6"
},
{
"url": "https://git.kernel.org/stable/c/80bb50e2d459213cccff3111d5ef98ed4238c0d5"
}
],
"title": "ALSA: caiaq: take a reference on the USB device in create_card()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31701",
"datePublished": "2026-05-01T13:56:00.869Z",
"dateReserved": "2026-03-09T15:48:24.132Z",
"dateUpdated": "2026-06-14T17:43:40.642Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46019 (GCVE-0-2026-46019)
Vulnerability from cvelistv5
Published
2026-05-27 12:56
Modified
2026-06-14 17:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup
atmel_aes_buff_init() allocates 4 pages using __get_free_pages() with
ATMEL_AES_BUFFER_ORDER, but atmel_aes_buff_cleanup() frees only the
first page using free_page(), leaking the remaining 3 pages. Use
free_pages() with ATMEL_AES_BUFFER_ORDER to fix the memory leak.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bbe628ed897d728d38c4035381d12b2f308fac6f Version: bbe628ed897d728d38c4035381d12b2f308fac6f Version: bbe628ed897d728d38c4035381d12b2f308fac6f Version: bbe628ed897d728d38c4035381d12b2f308fac6f Version: bbe628ed897d728d38c4035381d12b2f308fac6f Version: bbe628ed897d728d38c4035381d12b2f308fac6f Version: bbe628ed897d728d38c4035381d12b2f308fac6f Version: bbe628ed897d728d38c4035381d12b2f308fac6f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/atmel-aes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "de6952e0af2acbada900d742437e848285c01d11",
"status": "affected",
"version": "bbe628ed897d728d38c4035381d12b2f308fac6f",
"versionType": "git"
},
{
"lessThan": "5ad40cde96d603a88d68f8ed59f6d36407ab1f3c",
"status": "affected",
"version": "bbe628ed897d728d38c4035381d12b2f308fac6f",
"versionType": "git"
},
{
"lessThan": "03e00aafa5f747d07811589e8d5fee638245431b",
"status": "affected",
"version": "bbe628ed897d728d38c4035381d12b2f308fac6f",
"versionType": "git"
},
{
"lessThan": "b63f1e2f0e319ad3fe4a58eb3db4fd50cc98baca",
"status": "affected",
"version": "bbe628ed897d728d38c4035381d12b2f308fac6f",
"versionType": "git"
},
{
"lessThan": "65b3589d39d05699c3850202f8333e5361033ea3",
"status": "affected",
"version": "bbe628ed897d728d38c4035381d12b2f308fac6f",
"versionType": "git"
},
{
"lessThan": "61516b4a5b2647dc3f8f67b5dffaf038be997511",
"status": "affected",
"version": "bbe628ed897d728d38c4035381d12b2f308fac6f",
"versionType": "git"
},
{
"lessThan": "230ad8a78fe67266b1ba4685da1abdd61471c5b8",
"status": "affected",
"version": "bbe628ed897d728d38c4035381d12b2f308fac6f",
"versionType": "git"
},
{
"lessThan": "3fcfff4ed35f963380a68741bcd52742baff7f76",
"status": "affected",
"version": "bbe628ed897d728d38c4035381d12b2f308fac6f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/atmel-aes.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup\n\natmel_aes_buff_init() allocates 4 pages using __get_free_pages() with\nATMEL_AES_BUFFER_ORDER, but atmel_aes_buff_cleanup() frees only the\nfirst page using free_page(), leaking the remaining 3 pages. Use\nfree_pages() with ATMEL_AES_BUFFER_ORDER to fix the memory leak."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:48:21.711Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/de6952e0af2acbada900d742437e848285c01d11"
},
{
"url": "https://git.kernel.org/stable/c/5ad40cde96d603a88d68f8ed59f6d36407ab1f3c"
},
{
"url": "https://git.kernel.org/stable/c/03e00aafa5f747d07811589e8d5fee638245431b"
},
{
"url": "https://git.kernel.org/stable/c/b63f1e2f0e319ad3fe4a58eb3db4fd50cc98baca"
},
{
"url": "https://git.kernel.org/stable/c/65b3589d39d05699c3850202f8333e5361033ea3"
},
{
"url": "https://git.kernel.org/stable/c/61516b4a5b2647dc3f8f67b5dffaf038be997511"
},
{
"url": "https://git.kernel.org/stable/c/230ad8a78fe67266b1ba4685da1abdd61471c5b8"
},
{
"url": "https://git.kernel.org/stable/c/3fcfff4ed35f963380a68741bcd52742baff7f76"
}
],
"title": "crypto: atmel-aes - Fix 3-page memory leak in atmel_aes_buff_cleanup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46019",
"datePublished": "2026-05-27T12:56:21.100Z",
"dateReserved": "2026-05-13T15:03:33.092Z",
"dateUpdated": "2026-06-14T17:48:21.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53137 (GCVE-0-2026-53137)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-06-25 08:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
[Why & How]
During HDCP 2.x repeater authentication over HDMI, the driver reads the
sink's RxStatus register and extracts a 10-bit message size field (max
value 1023). This value is used as the read length for the ReceiverID
list without being clamped to the size of the destination buffer
rx_id_list[177]. A malicious HDMI repeater could advertise a message
size larger than the buffer, causing an out-of-bounds write during the
I2C read.
Clamp the read length in mod_hdcp_read_rx_id_list() to the size of the
rx_id_list buffer, matching the approach already used in the DP branch.
(cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: eff682f83c9c2030761e7536c5d97e1b20f71c15 Version: eff682f83c9c2030761e7536c5d97e1b20f71c15 Version: eff682f83c9c2030761e7536c5d97e1b20f71c15 Version: eff682f83c9c2030761e7536c5d97e1b20f71c15 Version: eff682f83c9c2030761e7536c5d97e1b20f71c15 Version: eff682f83c9c2030761e7536c5d97e1b20f71c15 Version: eff682f83c9c2030761e7536c5d97e1b20f71c15 Version: eff682f83c9c2030761e7536c5d97e1b20f71c15 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3c4444aec06c74fbc05661f370954ac814963c38",
"status": "affected",
"version": "eff682f83c9c2030761e7536c5d97e1b20f71c15",
"versionType": "git"
},
{
"lessThan": "91fb41218c413989d8b6c837748751454b452d68",
"status": "affected",
"version": "eff682f83c9c2030761e7536c5d97e1b20f71c15",
"versionType": "git"
},
{
"lessThan": "964e50ef7b8f09815a7d05b8326af700f8d5bc96",
"status": "affected",
"version": "eff682f83c9c2030761e7536c5d97e1b20f71c15",
"versionType": "git"
},
{
"lessThan": "79e0273272a05fb26f9b1e55bf1a52eefc3b7b35",
"status": "affected",
"version": "eff682f83c9c2030761e7536c5d97e1b20f71c15",
"versionType": "git"
},
{
"lessThan": "bfba882cfcd08f6540f72f48e786b6404f5d2c5b",
"status": "affected",
"version": "eff682f83c9c2030761e7536c5d97e1b20f71c15",
"versionType": "git"
},
{
"lessThan": "1906064d50d194a145486e5caf3db3e708b6f6ef",
"status": "affected",
"version": "eff682f83c9c2030761e7536c5d97e1b20f71c15",
"versionType": "git"
},
{
"lessThan": "98cfb7530ea91d8e5e928285cdce58e1131f6e83",
"status": "affected",
"version": "eff682f83c9c2030761e7536c5d97e1b20f71c15",
"versionType": "git"
},
{
"lessThan": "f0f3981c43b32cadfe373d636d9e9ca522bb3702",
"status": "affected",
"version": "eff682f83c9c2030761e7536c5d97e1b20f71c15",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size\n\n[Why \u0026 How]\nDuring HDCP 2.x repeater authentication over HDMI, the driver reads the\nsink\u0027s RxStatus register and extracts a 10-bit message size field (max\nvalue 1023). This value is used as the read length for the ReceiverID\nlist without being clamped to the size of the destination buffer\nrx_id_list[177]. A malicious HDMI repeater could advertise a message\nsize larger than the buffer, causing an out-of-bounds write during the\nI2C read.\n\nClamp the read length in mod_hdcp_read_rx_id_list() to the size of the\nrx_id_list buffer, matching the approach already used in the DP branch.\n\n(cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:38:25.977Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3c4444aec06c74fbc05661f370954ac814963c38"
},
{
"url": "https://git.kernel.org/stable/c/91fb41218c413989d8b6c837748751454b452d68"
},
{
"url": "https://git.kernel.org/stable/c/964e50ef7b8f09815a7d05b8326af700f8d5bc96"
},
{
"url": "https://git.kernel.org/stable/c/79e0273272a05fb26f9b1e55bf1a52eefc3b7b35"
},
{
"url": "https://git.kernel.org/stable/c/bfba882cfcd08f6540f72f48e786b6404f5d2c5b"
},
{
"url": "https://git.kernel.org/stable/c/1906064d50d194a145486e5caf3db3e708b6f6ef"
},
{
"url": "https://git.kernel.org/stable/c/98cfb7530ea91d8e5e928285cdce58e1131f6e83"
},
{
"url": "https://git.kernel.org/stable/c/f0f3981c43b32cadfe373d636d9e9ca522bb3702"
}
],
"title": "drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53137",
"datePublished": "2026-06-25T08:38:25.977Z",
"dateReserved": "2026-06-09T07:44:35.387Z",
"dateUpdated": "2026-06-25T08:38:25.977Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45880 (GCVE-0-2026-45880)
Vulnerability from cvelistv5
Published
2026-05-27 12:16
Modified
2026-05-27 12:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails
When vm_insert_page() fails in p2pmem_alloc_mmap(), p2pmem_alloc_mmap()
doesn't invoke percpu_ref_put() to free the per-CPU ref of pgmap acquired
after gen_pool_alloc_owner(), and memunmap_pages() will hang forever when
trying to remove the PCI device.
Fix it by adding the missed percpu_ref_put().
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/p2pdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "baa42b756d183a59572f3890981a3d32b8d05d40",
"status": "affected",
"version": "7e9c7ef83d785236f5a8c3761dd053fae9b92fb8",
"versionType": "git"
},
{
"lessThan": "51b7181cfbedf289ce794b6d97a1c596c309ec38",
"status": "affected",
"version": "7e9c7ef83d785236f5a8c3761dd053fae9b92fb8",
"versionType": "git"
},
{
"lessThan": "e19cce88ec4c4877f4ff2469099b9cf23cc3e93e",
"status": "affected",
"version": "7e9c7ef83d785236f5a8c3761dd053fae9b92fb8",
"versionType": "git"
},
{
"lessThan": "a1f4dc72efc3204db95d052058d785cad7ce755f",
"status": "affected",
"version": "7e9c7ef83d785236f5a8c3761dd053fae9b92fb8",
"versionType": "git"
},
{
"lessThan": "6220694c52a5a04102b48109e4f24e958b559bd3",
"status": "affected",
"version": "7e9c7ef83d785236f5a8c3761dd053fae9b92fb8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/p2pdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails\n\nWhen vm_insert_page() fails in p2pmem_alloc_mmap(), p2pmem_alloc_mmap()\ndoesn\u0027t invoke percpu_ref_put() to free the per-CPU ref of pgmap acquired\nafter gen_pool_alloc_owner(), and memunmap_pages() will hang forever when\ntrying to remove the PCI device.\n\nFix it by adding the missed percpu_ref_put()."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:16:52.117Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/baa42b756d183a59572f3890981a3d32b8d05d40"
},
{
"url": "https://git.kernel.org/stable/c/51b7181cfbedf289ce794b6d97a1c596c309ec38"
},
{
"url": "https://git.kernel.org/stable/c/e19cce88ec4c4877f4ff2469099b9cf23cc3e93e"
},
{
"url": "https://git.kernel.org/stable/c/a1f4dc72efc3204db95d052058d785cad7ce755f"
},
{
"url": "https://git.kernel.org/stable/c/6220694c52a5a04102b48109e4f24e958b559bd3"
}
],
"title": "PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45880",
"datePublished": "2026-05-27T12:16:52.117Z",
"dateReserved": "2026-05-13T15:03:33.082Z",
"dateUpdated": "2026-05-27T12:16:52.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31566 (GCVE-0-2026-31566)
Vulnerability from cvelistv5
Published
2026-04-24 14:35
Modified
2026-08-05 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib
amdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence
from amdgpu_ib_schedule(). This fence is used to wait for job
completion.
Currently, the code drops the fence reference using dma_fence_put()
before calling dma_fence_wait().
If dma_fence_put() releases the last reference, the fence may be
freed before dma_fence_wait() is called. This can lead to a
use-after-free.
Fix this by waiting on the fence first and releasing the reference
only after dma_fence_wait() completes.
Fixes the below:
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory 'f' (line 696)
(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9ae55f030dc523fc4dc6069557e4a887ea815453 Version: 9ae55f030dc523fc4dc6069557e4a887ea815453 Version: 9ae55f030dc523fc4dc6069557e4a887ea815453 Version: 9ae55f030dc523fc4dc6069557e4a887ea815453 Version: 9ae55f030dc523fc4dc6069557e4a887ea815453 Version: 9ae55f030dc523fc4dc6069557e4a887ea815453 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bc7760c107dc08ef3e231d72c492e67b0a86848b",
"status": "affected",
"version": "9ae55f030dc523fc4dc6069557e4a887ea815453",
"versionType": "git"
},
{
"lessThan": "e23602eb0779760544314ed3905fa6a89a4e4070",
"status": "affected",
"version": "9ae55f030dc523fc4dc6069557e4a887ea815453",
"versionType": "git"
},
{
"lessThan": "138e42be35ff2ce6572ae744de851ea286cf3c69",
"status": "affected",
"version": "9ae55f030dc523fc4dc6069557e4a887ea815453",
"versionType": "git"
},
{
"lessThan": "39820864eacd886f1a6f817414fb8f9ea3e9a2b4",
"status": "affected",
"version": "9ae55f030dc523fc4dc6069557e4a887ea815453",
"versionType": "git"
},
{
"lessThan": "42d248726a0837640452b71c5a202ca3d35239ec",
"status": "affected",
"version": "9ae55f030dc523fc4dc6069557e4a887ea815453",
"versionType": "git"
},
{
"lessThan": "7150850146ebfa4ca998f653f264b8df6f7f85be",
"status": "affected",
"version": "9ae55f030dc523fc4dc6069557e4a887ea815453",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib\n\namdgpu_amdkfd_submit_ib() submits a GPU job and gets a fence\nfrom amdgpu_ib_schedule(). This fence is used to wait for job\ncompletion.\n\nCurrently, the code drops the fence reference using dma_fence_put()\nbefore calling dma_fence_wait().\n\nIf dma_fence_put() releases the last reference, the fence may be\nfreed before dma_fence_wait() is called. This can lead to a\nuse-after-free.\n\nFix this by waiting on the fence first and releasing the reference\nonly after dma_fence_wait() completes.\n\nFixes the below:\ndrivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c:697 amdgpu_amdkfd_submit_ib() warn: passing freed memory \u0027f\u0027 (line 696)\n\n(cherry picked from commit 8b9e5259adc385b61a6590a13b82ae0ac2bd3482)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable `amdgpu_amdkfd_submit_ib()` path is reached from local userspace through `/dev/kfd` and AMDGPU/KFD queue ioctls, not through network, adjacent, or physical input.\nAC:L - On an affected AMDGPU KFD/NO_HWS Hawaii deployment, an attacker can drive the queue create/destroy path and repeatedly trigger the fence lifetime bug without relying on victim-controlled timing. When uncertain, the lower-complexity option is appropriate.\nPR:L - The path requires local access to the KFD/AMDGPU device interfaces and a render/DRM VM FD, but no kernel administrative capability is checked by the relevant KFD queue ioctls. This is ordinary low-privileged local GPU access rather than real root.\nUI:N - After obtaining local device access, the attacker can issue the ioctl sequence themselves. No separate victim action is required.\nS:U - The impact is within the same kernel security authority: corrupting or crashing kernel/driver state from a local kernel attack surface. It does not cross a VM, IOMMU, or comparable security boundary.\nC:H - The bug is a use-after-free of a `dma_fence`/AMDGPU fence object used by `dma_fence_wait()`. Per kernel scoring guidance, UAF memory corruption can be leveraged for high confidentiality impact.\nI:H - The same UAF exposes kernel object lifetime corruption in a wait path using function pointers, locks, callbacks, and list state. Per guidance, UAF memory corruption is scored as high integrity impact.\nA:H - Even without full exploitation, using a freed fence in `dma_fence_wait()` can cause kernel warnings, crashes, hangs, or panics. A kernel UAF therefore has high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:23:32.865Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bc7760c107dc08ef3e231d72c492e67b0a86848b"
},
{
"url": "https://git.kernel.org/stable/c/e23602eb0779760544314ed3905fa6a89a4e4070"
},
{
"url": "https://git.kernel.org/stable/c/138e42be35ff2ce6572ae744de851ea286cf3c69"
},
{
"url": "https://git.kernel.org/stable/c/39820864eacd886f1a6f817414fb8f9ea3e9a2b4"
},
{
"url": "https://git.kernel.org/stable/c/42d248726a0837640452b71c5a202ca3d35239ec"
},
{
"url": "https://git.kernel.org/stable/c/7150850146ebfa4ca998f653f264b8df6f7f85be"
}
],
"title": "drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31566",
"datePublished": "2026-04-24T14:35:46.740Z",
"dateReserved": "2026-03-09T15:48:24.117Z",
"dateUpdated": "2026-08-05T12:23:32.865Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43047 (GCVE-0-2026-43047)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: multitouch: Check to ensure report responses match the request
It is possible for a malicious (or clumsy) device to respond to a
specific report's feature request using a completely different report
ID. This can cause confusion in the HID core resulting in nasty
side-effects such as OOB writes.
Add a check to ensure that the report ID in the response, matches the
one that was requested. If it doesn't, omit reporting the raw event and
return early.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095 Version: 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095 Version: 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095 Version: 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095 Version: 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095 Version: 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095 Version: 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095 Version: 6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095 Version: fee906f035f0bd18ff12d84d58766c44a2ab0918 Version: 4.3.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-multitouch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "516da3f25cfe18643835af1cf09b0e9ffc36c383",
"status": "affected",
"version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095",
"versionType": "git"
},
{
"lessThan": "a61163daf8a90b4a7ef154d5fc9c525f665734e3",
"status": "affected",
"version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095",
"versionType": "git"
},
{
"lessThan": "74c6015375d8b9bc1b1eb79f20636c8e894bcad7",
"status": "affected",
"version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095",
"versionType": "git"
},
{
"lessThan": "c7a27bb4d0f6573ca0f9c7ef0b63291486239190",
"status": "affected",
"version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095",
"versionType": "git"
},
{
"lessThan": "6a4acd3e86fe5584050c213d95147eba33856033",
"status": "affected",
"version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095",
"versionType": "git"
},
{
"lessThan": "7f66fdbc077faed3b52519228d21d81979e92249",
"status": "affected",
"version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095",
"versionType": "git"
},
{
"lessThan": "2edc92f89eee328b5be5706b5d431bf90669e9c0",
"status": "affected",
"version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095",
"versionType": "git"
},
{
"lessThan": "e716edafedad4952fe3a4a273d2e039a84e8681a",
"status": "affected",
"version": "6d4f5440a3a2bb2e9d0d582bbf98234e9e9bb095",
"versionType": "git"
},
{
"status": "affected",
"version": "fee906f035f0bd18ff12d84d58766c44a2ab0918",
"versionType": "git"
},
{
"lessThan": "4.4",
"status": "affected",
"version": "4.3.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-multitouch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.3.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: Check to ensure report responses match the request\n\nIt is possible for a malicious (or clumsy) device to respond to a\nspecific report\u0027s feature request using a completely different report\nID. This can cause confusion in the HID core resulting in nasty\nside-effects such as OOB writes.\n\nAdd a check to ensure that the report ID in the response, matches the\none that was requested. If it doesn\u0027t, omit reporting the raw event and\nreturn early."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reachable by a local process through /dev/uhid by creating a synthetic HID multitouch device and replying to the kernel\u0027s UHID_GET_REPORT with a mismatched report ID. Malicious physical HID devices can also trigger it, but UHID provides a higher-severity local device-file path.\nAC:L - The attacker controls the HID report descriptor and the feature-report response contents, and the bug is triggered deterministically during probe/open/resume feature fetching. There is no race or condition outside the attacker\u0027s control.\nPR:L - The local UHID path requires only access to the UHID character device as a low-privileged local user or permitted device group member. The kernel UHID create/reply path has no capable() gate requiring real root.\nUI:N - A local UHID attacker can create the virtual device and answer the kernel\u0027s GET_REPORT request directly. No separate victim action is required.\nS:U - The corruption occurs within the kernel HID/HID-core processing context and affects the same kernel security authority. It is not a VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The fix commit states that the mismatched report response can lead to HID-core confusion with out-of-bounds writes. Kernel memory corruption is reasonably capable of producing arbitrary information disclosure primitives.\nI:H - An out-of-bounds write in kernel memory is high-integrity impact because it can corrupt kernel objects and plausibly be developed into control-flow hijack or privilege escalation. When uncertain, the higher severity is appropriate.\nA:H - The same kernel memory corruption can crash or panic the kernel during HID report processing. Even without full exploitation, repeated triggering can cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:32.795Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/516da3f25cfe18643835af1cf09b0e9ffc36c383"
},
{
"url": "https://git.kernel.org/stable/c/a61163daf8a90b4a7ef154d5fc9c525f665734e3"
},
{
"url": "https://git.kernel.org/stable/c/74c6015375d8b9bc1b1eb79f20636c8e894bcad7"
},
{
"url": "https://git.kernel.org/stable/c/c7a27bb4d0f6573ca0f9c7ef0b63291486239190"
},
{
"url": "https://git.kernel.org/stable/c/6a4acd3e86fe5584050c213d95147eba33856033"
},
{
"url": "https://git.kernel.org/stable/c/7f66fdbc077faed3b52519228d21d81979e92249"
},
{
"url": "https://git.kernel.org/stable/c/2edc92f89eee328b5be5706b5d431bf90669e9c0"
},
{
"url": "https://git.kernel.org/stable/c/e716edafedad4952fe3a4a273d2e039a84e8681a"
}
],
"title": "HID: multitouch: Check to ensure report responses match the request",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43047",
"datePublished": "2026-05-01T14:15:42.562Z",
"dateReserved": "2026-05-01T14:12:55.979Z",
"dateUpdated": "2026-08-05T12:25:32.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53081 (GCVE-0-2026-53081)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars
When regsafe() compares two scalar registers that both carry
BPF_ADD_CONST, check_scalar_ids() maps their full compound id
(aka base | BPF_ADD_CONST flag) as one idmap entry. However,
it never verifies that the underlying base ids, that is, with
the flag stripped are consistent with existing idmap mappings.
This allows construction of two verifier states where the old
state has R3 = R2 + 10 (both sharing base id A) while the current
state has R3 = R4 + 10 (base id C, unrelated to R2). The idmap
creates two independent entries: A->B (for R2) and A|flag->C|flag
(for R3), without catching that A->C conflicts with A->B. State
pruning then incorrectly succeeds.
Fix this by additionally verifying base ID mapping consistency
whenever BPF_ADD_CONST is set: after mapping the compound ids,
also invoke check_ids() on the base IDs (flag bits stripped).
This ensures that if A was already mapped to B from comparing
the source register, any ADD_CONST derivative must also derive
from B, not an unrelated C.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Berkeley Packet Filter (BPF) verifier. This vulnerability occurs due to inconsistent base ID mapping when the `regsafe()` function compares scalar registers with `BPF_ADD_CONST` values. This inconsistency allows the BPF verifier to incorrectly succeed in state pruning, which could enable a bypass of its security mechanisms. Such a bypass may lead to unexpected system behavior or potentially allow an attacker to execute unauthorized operations."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-386",
"description": "Symbolic Name not Mapping to Correct Object",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:45:06.204Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53081"
},
{
"name": "RHBZ#2492322",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492322"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53081.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "13c02881e49aac4c82b261faa26db9edf2567231",
"status": "affected",
"version": "98d7ca374ba4b39e7535613d40e159f09ca14da2",
"versionType": "git"
},
{
"lessThan": "691adf738817275368ed56311b7d798d617823a3",
"status": "affected",
"version": "98d7ca374ba4b39e7535613d40e159f09ca14da2",
"versionType": "git"
},
{
"lessThan": "7d73c72cccac651acc891377a5e623e4021c6380",
"status": "affected",
"version": "98d7ca374ba4b39e7535613d40e159f09ca14da2",
"versionType": "git"
},
{
"lessThan": "2f2ec8e7730e21fc9bd49e0de9cdd58213ea24d0",
"status": "affected",
"version": "98d7ca374ba4b39e7535613d40e159f09ca14da2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/verifier.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars\n\nWhen regsafe() compares two scalar registers that both carry\nBPF_ADD_CONST, check_scalar_ids() maps their full compound id\n(aka base | BPF_ADD_CONST flag) as one idmap entry. However,\nit never verifies that the underlying base ids, that is, with\nthe flag stripped are consistent with existing idmap mappings.\n\nThis allows construction of two verifier states where the old\nstate has R3 = R2 + 10 (both sharing base id A) while the current\nstate has R3 = R4 + 10 (base id C, unrelated to R2). The idmap\ncreates two independent entries: A-\u003eB (for R2) and A|flag-\u003eC|flag\n(for R3), without catching that A-\u003eC conflicts with A-\u003eB. State\npruning then incorrectly succeeds.\n\nFix this by additionally verifying base ID mapping consistency\nwhenever BPF_ADD_CONST is set: after mapping the compound ids,\nalso invoke check_ids() on the base IDs (flag bits stripped).\nThis ensures that if A was already mapped to B from comparing\nthe source register, any ADD_CONST derivative must also derive\nfrom B, not an unrelated C."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable verifier path is reached by a local attacker through the bpf() syscall with BPF_PROG_LOAD, not by remote packets or adjacent/physical input. The crafted program then drives verifier state pruning into regsafe()/check_scalar_ids().\nAC:L - Exploitation depends on constructing specific BPF instructions and verifier states, but there is no race or external condition outside the attacker\u0027s control. The verifier behavior is deterministic once the crafted program is submitted.\nPR:L - The affected BPF_ADD_CONST tracking is gated on privileged BPF loading through CAP_BPF or an equivalent BPF token, but BPF tokens can delegate this capability into user namespaces in realistic containerized deployments. Under the required highest-severity reasonable scenario, this is low privilege rather than init-namespace root only.\nUI:N - No victim action is required; the attacker submits and executes the crafted BPF program directly through local kernel interfaces. Loading and triggering the program are attacker-controlled.\nS:U - The vulnerability is a kernel BPF verifier flaw that affects the same kernel security authority. It does not cross a separate scope such as guest-to-host or IOMMU isolation.\nC:H - An unsound verifier state-pruning decision can allow an unsafe BPF program to pass validation, enabling kernel memory reads through invalid bounds or scalar relationship assumptions. BPF verifier bypasses are generally exploitable for high-impact information disclosure.\nI:H - By accepting an unsafe BPF program, the verifier can permit memory accesses or control effects that should have been rejected, supporting arbitrary kernel memory modification or code execution. This is a high-integrity kernel compromise scenario.\nA:H - Even if not fully weaponized for read/write primitives, an unsafe accepted BPF program can crash or panic the kernel through invalid memory access. Kernel crash availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:12.279Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/13c02881e49aac4c82b261faa26db9edf2567231"
},
{
"url": "https://git.kernel.org/stable/c/691adf738817275368ed56311b7d798d617823a3"
},
{
"url": "https://git.kernel.org/stable/c/7d73c72cccac651acc891377a5e623e4021c6380"
},
{
"url": "https://git.kernel.org/stable/c/2f2ec8e7730e21fc9bd49e0de9cdd58213ea24d0"
}
],
"title": "bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53081",
"datePublished": "2026-06-24T16:30:21.959Z",
"dateReserved": "2026-06-09T07:44:35.383Z",
"dateUpdated": "2026-08-05T12:33:12.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53135 (GCVE-0-2026-53135)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-06-25 08:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
[Why & How]
dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc
without checking for NULL. A connector can be connected but not bound to
any CRTC (e.g. after hot-plug before the next atomic commit), causing a
kernel crash when writing to the sdp_message debugfs node.
The function also ignores the user-provided size argument and always
passes 36 bytes to copy_from_user(), reading past the user buffer when
size < 36.
Fix both issues by:
- Returning -ENODEV when connector->base.state or state->crtc is NULL
- Clamping write_size to min(size, sizeof(data))
(cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c7ba3653e9773256b2b08508a2ed2ca28ea7566b Version: c7ba3653e9773256b2b08508a2ed2ca28ea7566b Version: c7ba3653e9773256b2b08508a2ed2ca28ea7566b Version: c7ba3653e9773256b2b08508a2ed2ca28ea7566b Version: c7ba3653e9773256b2b08508a2ed2ca28ea7566b Version: c7ba3653e9773256b2b08508a2ed2ca28ea7566b Version: c7ba3653e9773256b2b08508a2ed2ca28ea7566b Version: c7ba3653e9773256b2b08508a2ed2ca28ea7566b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ee9cfcf77a8e8af637396dc00966df5f701e661c",
"status": "affected",
"version": "c7ba3653e9773256b2b08508a2ed2ca28ea7566b",
"versionType": "git"
},
{
"lessThan": "b781f90a9528555c709e59789550893581ef0be4",
"status": "affected",
"version": "c7ba3653e9773256b2b08508a2ed2ca28ea7566b",
"versionType": "git"
},
{
"lessThan": "a2de1d71891a038a9346b2c1a72b88c8350f2479",
"status": "affected",
"version": "c7ba3653e9773256b2b08508a2ed2ca28ea7566b",
"versionType": "git"
},
{
"lessThan": "7fc4fab4acc307ad2903312c195872b2953d32c3",
"status": "affected",
"version": "c7ba3653e9773256b2b08508a2ed2ca28ea7566b",
"versionType": "git"
},
{
"lessThan": "7ae95c0275c330b5dbae806f8e431720edad776f",
"status": "affected",
"version": "c7ba3653e9773256b2b08508a2ed2ca28ea7566b",
"versionType": "git"
},
{
"lessThan": "bb6f705b73b5f191f14ad004e2c8c4b615806187",
"status": "affected",
"version": "c7ba3653e9773256b2b08508a2ed2ca28ea7566b",
"versionType": "git"
},
{
"lessThan": "c90954cdea4d6998ec345de0d840d030c145b89e",
"status": "affected",
"version": "c7ba3653e9773256b2b08508a2ed2ca28ea7566b",
"versionType": "git"
},
{
"lessThan": "adf67034b1f61f7119295208085bfd43f85f56af",
"status": "affected",
"version": "c7ba3653e9773256b2b08508a2ed2ca28ea7566b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs\n\n[Why \u0026 How]\ndp_sdp_message_debugfs_write() dereferences connector-\u003ebase.state-\u003ecrtc\nwithout checking for NULL. A connector can be connected but not bound to\nany CRTC (e.g. after hot-plug before the next atomic commit), causing a\nkernel crash when writing to the sdp_message debugfs node.\n\nThe function also ignores the user-provided size argument and always\npasses 36 bytes to copy_from_user(), reading past the user buffer when\nsize \u003c 36.\n\nFix both issues by:\n- Returning -ENODEV when connector-\u003ebase.state or state-\u003ecrtc is NULL\n- Clamping write_size to min(size, sizeof(data))\n\n(cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:38:24.216Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ee9cfcf77a8e8af637396dc00966df5f701e661c"
},
{
"url": "https://git.kernel.org/stable/c/b781f90a9528555c709e59789550893581ef0be4"
},
{
"url": "https://git.kernel.org/stable/c/a2de1d71891a038a9346b2c1a72b88c8350f2479"
},
{
"url": "https://git.kernel.org/stable/c/7fc4fab4acc307ad2903312c195872b2953d32c3"
},
{
"url": "https://git.kernel.org/stable/c/7ae95c0275c330b5dbae806f8e431720edad776f"
},
{
"url": "https://git.kernel.org/stable/c/bb6f705b73b5f191f14ad004e2c8c4b615806187"
},
{
"url": "https://git.kernel.org/stable/c/c90954cdea4d6998ec345de0d840d030c145b89e"
},
{
"url": "https://git.kernel.org/stable/c/adf67034b1f61f7119295208085bfd43f85f56af"
}
],
"title": "drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53135",
"datePublished": "2026-06-25T08:38:24.216Z",
"dateReserved": "2026-06-09T07:44:35.387Z",
"dateUpdated": "2026-06-25T08:38:24.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31665 (GCVE-0-2026-31665)
Vulnerability from cvelistv5
Published
2026-04-24 14:45
Modified
2026-08-05 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_ct: fix use-after-free in timeout object destroy
nft_ct_timeout_obj_destroy() frees the timeout object with kfree()
immediately after nf_ct_untimeout(), without waiting for an RCU grace
period. Concurrent packet processing on other CPUs may still hold
RCU-protected references to the timeout object obtained via
rcu_dereference() in nf_ct_timeout_data().
Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer
freeing until after an RCU grace period, matching the approach already
used in nfnetlink_cttimeout.c.
KASAN report:
BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0
Read of size 4 at addr ffff8881035fe19c by task exploit/80
Call Trace:
nf_conntrack_tcp_packet+0x1381/0x29d0
nf_conntrack_in+0x612/0x8b0
nf_hook_slow+0x70/0x100
__ip_local_out+0x1b2/0x210
tcp_sendmsg_locked+0x722/0x1580
__sys_sendto+0x2d8/0x320
Allocated by task 75:
nft_ct_timeout_obj_init+0xf6/0x290
nft_obj_init+0x107/0x1b0
nf_tables_newobj+0x680/0x9c0
nfnetlink_rcv_batch+0xc29/0xe00
Freed by task 26:
nft_obj_destroy+0x3f/0xa0
nf_tables_trans_destroy_work+0x51c/0x5c0
process_one_work+0x2c4/0x5a0
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7e0b2b57f01d183e1c84114f1f2287737358d748 Version: 7e0b2b57f01d183e1c84114f1f2287737358d748 Version: 7e0b2b57f01d183e1c84114f1f2287737358d748 Version: 7e0b2b57f01d183e1c84114f1f2287737358d748 Version: 7e0b2b57f01d183e1c84114f1f2287737358d748 Version: 7e0b2b57f01d183e1c84114f1f2287737358d748 Version: 7e0b2b57f01d183e1c84114f1f2287737358d748 Version: 7e0b2b57f01d183e1c84114f1f2287737358d748 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:33.734Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_conntrack_timeout.h",
"net/netfilter/nft_ct.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c458fc1c278a65ad5381083121d39a479973ebed",
"status": "affected",
"version": "7e0b2b57f01d183e1c84114f1f2287737358d748",
"versionType": "git"
},
{
"lessThan": "c581e5c8f2b59158f62efe61c1a3dc36189081ff",
"status": "affected",
"version": "7e0b2b57f01d183e1c84114f1f2287737358d748",
"versionType": "git"
},
{
"lessThan": "f16fe84879a5280f05ebbcea593a189ba0f3e79a",
"status": "affected",
"version": "7e0b2b57f01d183e1c84114f1f2287737358d748",
"versionType": "git"
},
{
"lessThan": "070abdf1b04325b21a20a2a0c39a2208af107275",
"status": "affected",
"version": "7e0b2b57f01d183e1c84114f1f2287737358d748",
"versionType": "git"
},
{
"lessThan": "aa7cfa16f98f8ec3e6d47c34e1a8c1ae4b9b8b77",
"status": "affected",
"version": "7e0b2b57f01d183e1c84114f1f2287737358d748",
"versionType": "git"
},
{
"lessThan": "b42aca3660dc2627a29a38131597ca610dc451f9",
"status": "affected",
"version": "7e0b2b57f01d183e1c84114f1f2287737358d748",
"versionType": "git"
},
{
"lessThan": "d0983b48c10d1509fd795c155f8b1e832e1369ff",
"status": "affected",
"version": "7e0b2b57f01d183e1c84114f1f2287737358d748",
"versionType": "git"
},
{
"lessThan": "f8dca15a1b190787bbd03285304b569631160eda",
"status": "affected",
"version": "7e0b2b57f01d183e1c84114f1f2287737358d748",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/netfilter/nf_conntrack_timeout.h",
"net/netfilter/nft_ct.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.169",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.135",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.169",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.135",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.82",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: fix use-after-free in timeout object destroy\n\nnft_ct_timeout_obj_destroy() frees the timeout object with kfree()\nimmediately after nf_ct_untimeout(), without waiting for an RCU grace\nperiod. Concurrent packet processing on other CPUs may still hold\nRCU-protected references to the timeout object obtained via\nrcu_dereference() in nf_ct_timeout_data().\n\nAdd an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer\nfreeing until after an RCU grace period, matching the approach already\nused in nfnetlink_cttimeout.c.\n\nKASAN report:\n BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0\n Read of size 4 at addr ffff8881035fe19c by task exploit/80\n\n Call Trace:\n nf_conntrack_tcp_packet+0x1381/0x29d0\n nf_conntrack_in+0x612/0x8b0\n nf_hook_slow+0x70/0x100\n __ip_local_out+0x1b2/0x210\n tcp_sendmsg_locked+0x722/0x1580\n __sys_sendto+0x2d8/0x320\n\n Allocated by task 75:\n nft_ct_timeout_obj_init+0xf6/0x290\n nft_obj_init+0x107/0x1b0\n nf_tables_newobj+0x680/0x9c0\n nfnetlink_rcv_batch+0xc29/0xe00\n\n Freed by task 26:\n nft_obj_destroy+0x3f/0xa0\n nf_tables_trans_destroy_work+0x51c/0x5c0\n process_one_work+0x2c4/0x5a0"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable timeout object is created and destroyed through nftables netlink operations, and the stale pointer is exercised by local packet/syscall activity such as sendto through conntrack. Netfilter/nftables control-plane access is a local attack surface, not a remotely unauthenticated one.\nAC:L - The attacker can create the timeout object, attach it to conntrack state, delete it, and generate concurrent packet processing themselves. The UAF race is between attacker-controlled netlink teardown and attacker-controlled traffic, with no external condition required.\nPR:L - nfnetlink requires CAP_NET_ADMIN, but this is checked against the network namespace user_ns, so an unprivileged user can reach it via user and network namespaces on common configurations. This is therefore low privileges rather than real init-namespace root.\nUI:N - No victim interaction is required once the attacker has local execution. The attacker can perform the nftables operations and packet generation directly.\nS:U - The vulnerability is in the kernel netfilter/conntrack subsystem and impacts the same kernel security authority. It does not cross a VM, hypervisor, or separate authorization boundary.\nC:H - This is a use-after-free of an RCU-protected conntrack timeout object during packet processing. A kernel UAF can be shaped through heap reuse and is defensibly treated as enabling high confidentiality impact.\nI:H - Use-after-free in kernel heap memory can be leveraged through heap spraying and object replacement toward memory corruption or control-flow manipulation. Under the required overestimation rule, integrity impact is high.\nA:H - The fix commit includes a KASAN slab-use-after-free report in nf_conntrack_tcp_packet, and such UAFs can crash or destabilize the kernel. Repeated local triggering makes high availability impact appropriate."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:15.035Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c458fc1c278a65ad5381083121d39a479973ebed"
},
{
"url": "https://git.kernel.org/stable/c/c581e5c8f2b59158f62efe61c1a3dc36189081ff"
},
{
"url": "https://git.kernel.org/stable/c/f16fe84879a5280f05ebbcea593a189ba0f3e79a"
},
{
"url": "https://git.kernel.org/stable/c/070abdf1b04325b21a20a2a0c39a2208af107275"
},
{
"url": "https://git.kernel.org/stable/c/aa7cfa16f98f8ec3e6d47c34e1a8c1ae4b9b8b77"
},
{
"url": "https://git.kernel.org/stable/c/b42aca3660dc2627a29a38131597ca610dc451f9"
},
{
"url": "https://git.kernel.org/stable/c/d0983b48c10d1509fd795c155f8b1e832e1369ff"
},
{
"url": "https://git.kernel.org/stable/c/f8dca15a1b190787bbd03285304b569631160eda"
}
],
"title": "netfilter: nft_ct: fix use-after-free in timeout object destroy",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31665",
"datePublished": "2026-04-24T14:45:14.613Z",
"dateReserved": "2026-03-09T15:48:24.129Z",
"dateUpdated": "2026-08-05T12:24:15.035Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43098 (GCVE-0-2026-43098)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-06-01 16:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfc: s3fwrn5: allocate rx skb before consuming bytes
s3fwrn82_uart_read() reports the number of accepted bytes to the serdev
core. The current code consumes bytes into recv_skb and may already
deliver a complete frame before allocating a fresh receive buffer.
If that alloc_skb() fails, the callback returns 0 even though it has
already consumed bytes, and it leaves recv_skb as NULL for the next
receive callback. That breaks the receive_buf() accounting contract and
can also lead to a NULL dereference on the next skb_put_u8().
Allocate the receive skb lazily before consuming the next byte instead.
If allocation fails, return the number of bytes already accepted.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3f52c2cb7e3ada37513dabb69a22cf917dba754f Version: 3f52c2cb7e3ada37513dabb69a22cf917dba754f Version: 3f52c2cb7e3ada37513dabb69a22cf917dba754f Version: 3f52c2cb7e3ada37513dabb69a22cf917dba754f Version: 3f52c2cb7e3ada37513dabb69a22cf917dba754f Version: 3f52c2cb7e3ada37513dabb69a22cf917dba754f Version: 3f52c2cb7e3ada37513dabb69a22cf917dba754f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nfc/s3fwrn5/uart.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "20a57de2e79b797ed75382659d52bf4c7d9cb446",
"status": "affected",
"version": "3f52c2cb7e3ada37513dabb69a22cf917dba754f",
"versionType": "git"
},
{
"lessThan": "e4ab0fd1c91882f2a7846b1817781c8741f7f315",
"status": "affected",
"version": "3f52c2cb7e3ada37513dabb69a22cf917dba754f",
"versionType": "git"
},
{
"lessThan": "d8c2aa3c4a1ec530a485e46a1c4f1a118bb00156",
"status": "affected",
"version": "3f52c2cb7e3ada37513dabb69a22cf917dba754f",
"versionType": "git"
},
{
"lessThan": "7c31f7a599cf00fad3c204092a91a924126c67e4",
"status": "affected",
"version": "3f52c2cb7e3ada37513dabb69a22cf917dba754f",
"versionType": "git"
},
{
"lessThan": "6d931680a9851481c3243689488eafed08eeff71",
"status": "affected",
"version": "3f52c2cb7e3ada37513dabb69a22cf917dba754f",
"versionType": "git"
},
{
"lessThan": "09822d3d6f68a0cdc4626e0c507324a4927f55a9",
"status": "affected",
"version": "3f52c2cb7e3ada37513dabb69a22cf917dba754f",
"versionType": "git"
},
{
"lessThan": "5c14a19d5b1645cce1cb1252833d70b23635b632",
"status": "affected",
"version": "3f52c2cb7e3ada37513dabb69a22cf917dba754f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nfc/s3fwrn5/uart.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: s3fwrn5: allocate rx skb before consuming bytes\n\ns3fwrn82_uart_read() reports the number of accepted bytes to the serdev\ncore. The current code consumes bytes into recv_skb and may already\ndeliver a complete frame before allocating a fresh receive buffer.\n\nIf that alloc_skb() fails, the callback returns 0 even though it has\nalready consumed bytes, and it leaves recv_skb as NULL for the next\nreceive callback. That breaks the receive_buf() accounting contract and\ncan also lead to a NULL dereference on the next skb_put_u8().\n\nAllocate the receive skb lazily before consuming the next byte instead.\nIf allocation fails, return the number of bytes already accepted."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T16:14:42.508Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/20a57de2e79b797ed75382659d52bf4c7d9cb446"
},
{
"url": "https://git.kernel.org/stable/c/e4ab0fd1c91882f2a7846b1817781c8741f7f315"
},
{
"url": "https://git.kernel.org/stable/c/d8c2aa3c4a1ec530a485e46a1c4f1a118bb00156"
},
{
"url": "https://git.kernel.org/stable/c/7c31f7a599cf00fad3c204092a91a924126c67e4"
},
{
"url": "https://git.kernel.org/stable/c/6d931680a9851481c3243689488eafed08eeff71"
},
{
"url": "https://git.kernel.org/stable/c/09822d3d6f68a0cdc4626e0c507324a4927f55a9"
},
{
"url": "https://git.kernel.org/stable/c/5c14a19d5b1645cce1cb1252833d70b23635b632"
}
],
"title": "nfc: s3fwrn5: allocate rx skb before consuming bytes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43098",
"datePublished": "2026-05-06T07:40:28.845Z",
"dateReserved": "2026-05-01T14:12:55.984Z",
"dateUpdated": "2026-06-01T16:14:42.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43194 (GCVE-0-2026-43194)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: consume xmit errors of GSO frames
udpgro_frglist.sh and udpgro_bench.sh are the flakiest tests
currently in NIPA. They fail in the same exact way, TCP GRO
test stalls occasionally and the test gets killed after 10min.
These tests use veth to simulate GRO. They attach a trivial
("return XDP_PASS;") XDP program to the veth to force TSO off
and NAPI on.
Digging into the failure mode we can see that the connection
is completely stuck after a burst of drops. The sender's snd_nxt
is at sequence number N [1], but the receiver claims to have
received (rcv_nxt) up to N + 3 * MSS [2]. Last piece of the puzzle
is that senders rtx queue is not empty (let's say the block in
the rtx queue is at sequence number N - 4 * MSS [3]).
In this state, sender sends a retransmission from the rtx queue
with a single segment, and sequence numbers N-4*MSS:N-3*MSS [3].
Receiver sees it and responds with an ACK all the way up to
N + 3 * MSS [2]. But sender will reject this ack as TCP_ACK_UNSENT_DATA
because it has no recollection of ever sending data that far out [1].
And we are stuck.
The root cause is the mess of the xmit return codes. veth returns
an error when it can't xmit a frame. We end up with a loss event
like this:
-------------------------------------------------
| GSO super frame 1 | GSO super frame 2 |
|-----------------------------------------------|
| seg | seg | seg | seg | seg | seg | seg | seg |
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 |
-------------------------------------------------
x ok ok <ok>| ok ok ok <x>
\\
snd_nxt
"x" means packet lost by veth, and "ok" means it went thru.
Since veth has TSO disabled in this test it sees individual segments.
Segment 1 is on the retransmit queue and will be resent.
So why did the sender not advance snd_nxt even tho it clearly did
send up to seg 8? tcp_write_xmit() interprets the return code
from the core to mean that data has not been sent at all. Since
TCP deals with GSO super frames, not individual segment the crux
of the problem is that loss of a single segment can be interpreted
as loss of all. TCP only sees the last return code for the last
segment of the GSO frame (in <> brackets in the diagram above).
Of course for the problem to occur we need a setup or a device
without a Qdisc. Otherwise Qdisc layer disconnects the protocol
layer from the device errors completely.
We have multiple ways to fix this.
1) make veth not return an error when it lost a packet.
While this is what I think we did in the past, the issue keeps
reappearing and it's annoying to debug. The game of whack
a mole is not great.
2) fix the damn return codes
We only talk about NETDEV_TX_OK and NETDEV_TX_BUSY in the
documentation, so maybe we should make the return code from
ndo_start_xmit() a boolean. I like that the most, but perhaps
some ancient, not-really-networking protocol would suffer.
3) make TCP ignore the errors
It is not entirely clear to me what benefit TCP gets from
interpreting the result of ip_queue_xmit()? Specifically once
the connection is established and we're pushing data - packet
loss is just packet loss?
4) this fix
Ignore the rc in the Qdisc-less+GSO case, since it's unreliable.
We already always return OK in the TCQ_F_CAN_BYPASS case.
In the Qdisc-less case let's be a bit more conservative and only
mask the GSO errors. This path is taken by non-IP-"networks"
like CAN, MCTP etc, so we could regress some ancient thing.
This is the simplest, but also maybe the hackiest fix?
Similar fix has been proposed by Eric in the past but never committed
because original reporter was working with an OOT driver and wasn't
providing feedback (see Link).
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1f59533f9ca5634e7b8914252e48aee9d9cbe501 Version: 1f59533f9ca5634e7b8914252e48aee9d9cbe501 Version: 1f59533f9ca5634e7b8914252e48aee9d9cbe501 Version: 1f59533f9ca5634e7b8914252e48aee9d9cbe501 Version: 1f59533f9ca5634e7b8914252e48aee9d9cbe501 Version: 1f59533f9ca5634e7b8914252e48aee9d9cbe501 Version: 1f59533f9ca5634e7b8914252e48aee9d9cbe501 Version: 1f59533f9ca5634e7b8914252e48aee9d9cbe501 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae3f627b45fbc3c776a4e484696f3cad7cbb4eca",
"status": "affected",
"version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501",
"versionType": "git"
},
{
"lessThan": "0c9de092ef8c50a7ee9612811566f0aa81d8d7b6",
"status": "affected",
"version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501",
"versionType": "git"
},
{
"lessThan": "56bd32c0edca34041a5c215887fcf562fae2e2db",
"status": "affected",
"version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501",
"versionType": "git"
},
{
"lessThan": "9ac6aebef4b4bfc5ed408b0b65645981574bc780",
"status": "affected",
"version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501",
"versionType": "git"
},
{
"lessThan": "ea5d7787635e26ec1194ec7eec0e8e5ae3bd10a5",
"status": "affected",
"version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501",
"versionType": "git"
},
{
"lessThan": "4cb163e9efcac4cd35c3043e097f25081a5c015c",
"status": "affected",
"version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501",
"versionType": "git"
},
{
"lessThan": "c86901d22c89a6bf4e2f013e948aaabc60869893",
"status": "affected",
"version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501",
"versionType": "git"
},
{
"lessThan": "7aa767d0d3d04e50ae94e770db7db8197f666970",
"status": "affected",
"version": "1f59533f9ca5634e7b8914252e48aee9d9cbe501",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"lessThan": "3.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: consume xmit errors of GSO frames\n\nudpgro_frglist.sh and udpgro_bench.sh are the flakiest tests\ncurrently in NIPA. They fail in the same exact way, TCP GRO\ntest stalls occasionally and the test gets killed after 10min.\n\nThese tests use veth to simulate GRO. They attach a trivial\n(\"return XDP_PASS;\") XDP program to the veth to force TSO off\nand NAPI on.\n\nDigging into the failure mode we can see that the connection\nis completely stuck after a burst of drops. The sender\u0027s snd_nxt\nis at sequence number N [1], but the receiver claims to have\nreceived (rcv_nxt) up to N + 3 * MSS [2]. Last piece of the puzzle\nis that senders rtx queue is not empty (let\u0027s say the block in\nthe rtx queue is at sequence number N - 4 * MSS [3]).\n\nIn this state, sender sends a retransmission from the rtx queue\nwith a single segment, and sequence numbers N-4*MSS:N-3*MSS [3].\nReceiver sees it and responds with an ACK all the way up to\nN + 3 * MSS [2]. But sender will reject this ack as TCP_ACK_UNSENT_DATA\nbecause it has no recollection of ever sending data that far out [1].\nAnd we are stuck.\n\nThe root cause is the mess of the xmit return codes. veth returns\nan error when it can\u0027t xmit a frame. We end up with a loss event\nlike this:\n\n -------------------------------------------------\n | GSO super frame 1 | GSO super frame 2 |\n |-----------------------------------------------|\n | seg | seg | seg | seg | seg | seg | seg | seg |\n | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 |\n -------------------------------------------------\n x ok ok \u003cok\u003e| ok ok ok \u003cx\u003e\n \\\\\n\t\t\t snd_nxt\n\n\"x\" means packet lost by veth, and \"ok\" means it went thru.\nSince veth has TSO disabled in this test it sees individual segments.\nSegment 1 is on the retransmit queue and will be resent.\n\nSo why did the sender not advance snd_nxt even tho it clearly did\nsend up to seg 8? tcp_write_xmit() interprets the return code\nfrom the core to mean that data has not been sent at all. Since\nTCP deals with GSO super frames, not individual segment the crux\nof the problem is that loss of a single segment can be interpreted\nas loss of all. TCP only sees the last return code for the last\nsegment of the GSO frame (in \u003c\u003e brackets in the diagram above).\n\nOf course for the problem to occur we need a setup or a device\nwithout a Qdisc. Otherwise Qdisc layer disconnects the protocol\nlayer from the device errors completely.\n\nWe have multiple ways to fix this.\n\n 1) make veth not return an error when it lost a packet.\n While this is what I think we did in the past, the issue keeps\n reappearing and it\u0027s annoying to debug. The game of whack\n a mole is not great.\n\n 2) fix the damn return codes\n We only talk about NETDEV_TX_OK and NETDEV_TX_BUSY in the\n documentation, so maybe we should make the return code from\n ndo_start_xmit() a boolean. I like that the most, but perhaps\n some ancient, not-really-networking protocol would suffer.\n\n 3) make TCP ignore the errors\n It is not entirely clear to me what benefit TCP gets from\n interpreting the result of ip_queue_xmit()? Specifically once\n the connection is established and we\u0027re pushing data - packet\n loss is just packet loss?\n\n 4) this fix\n Ignore the rc in the Qdisc-less+GSO case, since it\u0027s unreliable.\n We already always return OK in the TCQ_F_CAN_BYPASS case.\n In the Qdisc-less case let\u0027s be a bit more conservative and only\n mask the GSO errors. This path is taken by non-IP-\"networks\"\n like CAN, MCTP etc, so we could regress some ancient thing.\n This is the simplest, but also maybe the hackiest fix?\n\nSimilar fix has been proposed by Eric in the past but never committed\nbecause original reporter was working with an OOT driver and wasn\u0027t\nproviding feedback (see Link)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable path is the generic TCP/IP transmit path and is reachable when a remote peer causes a network-facing service or container to send GSO-sized TCP data over a noqueue virtual device such as veth. A plausible internet-facing container deployment can hit this through ordinary network traffic.\nAC:L - Triggering requires GSO transmission plus lower-device drops in the noqueue path, which can be induced with repeated large transfers or queue pressure in veth/XDP/GRO-style deployments. There is no attacker-uncontrolled race or memory-layout dependency.\nPR:N - A remote attacker only needs network access to the service and can elicit outbound TCP data without kernel privileges or a local account. No capability check gates the vulnerable transmit path once the service sends data.\nUI:N - No victim user action is required beyond the already-running network service processing traffic. The attacker can repeatedly initiate the relevant network exchanges.\nS:U - The impact remains within the same kernel/networking security authority. This is not a VM escape, IOMMU bypass, or cross-scope isolation break.\nC:N - The bug is incorrect transmit error propagation/accounting after GSO segmentation, not a memory disclosure or memory corruption flaw. I found no read primitive or exposure of sensitive data.\nI:N - The failure leaves TCP send state inconsistent but does not corrupt kernel memory or allow attacker-controlled data modification. I found no write primitive, type confusion, or control-flow impact.\nA:H - Partial GSO transmission errors can leave TCP connections permanently stuck because ACKs for actually delivered data are rejected as TCP_ACK_UNSENT_DATA after snd_nxt was not advanced. Repeated unauthenticated triggering can stall or exhaust service connections, causing a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:27.573Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae3f627b45fbc3c776a4e484696f3cad7cbb4eca"
},
{
"url": "https://git.kernel.org/stable/c/0c9de092ef8c50a7ee9612811566f0aa81d8d7b6"
},
{
"url": "https://git.kernel.org/stable/c/56bd32c0edca34041a5c215887fcf562fae2e2db"
},
{
"url": "https://git.kernel.org/stable/c/9ac6aebef4b4bfc5ed408b0b65645981574bc780"
},
{
"url": "https://git.kernel.org/stable/c/ea5d7787635e26ec1194ec7eec0e8e5ae3bd10a5"
},
{
"url": "https://git.kernel.org/stable/c/4cb163e9efcac4cd35c3043e097f25081a5c015c"
},
{
"url": "https://git.kernel.org/stable/c/c86901d22c89a6bf4e2f013e948aaabc60869893"
},
{
"url": "https://git.kernel.org/stable/c/7aa767d0d3d04e50ae94e770db7db8197f666970"
}
],
"title": "net: consume xmit errors of GSO frames",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43194",
"datePublished": "2026-05-06T11:28:02.794Z",
"dateReserved": "2026-05-01T14:12:55.992Z",
"dateUpdated": "2026-08-05T12:26:27.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53160 (GCVE-0-2026-53160)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: fix use-after-free race in fastrpc_map_create
fastrpc_map_lookup returns a raw pointer after releasing fl->lock. The
caller fastrpc_map_create then calls fastrpc_map_get (kref_get_unless_zero)
on this unprotected pointer. A concurrent MEM_UNMAP can free the map
between the lock release and the kref operation, resulting in a
use-after-free on the freed slab object.
Restore the take_ref parameter to fastrpc_map_lookup so the reference
is acquired atomically under fl->lock before the pointer is exposed to
the caller.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0b70ec82b309a4093106ff399da1911ad23b52d3 Version: d7513b47082c08105e837b06cebeb3f07a5fa56f Version: 802359a52676176b18713e33caa17572ad009057 Version: 10df039834f84a297c72ec962c0f9b7c8c5ca31a Version: 10df039834f84a297c72ec962c0f9b7c8c5ca31a Version: 10df039834f84a297c72ec962c0f9b7c8c5ca31a Version: f3f59bab68e9bc714f757ab22f3fb36153014043 Version: 6.1.156 ≤ Version: 6.6.112 ≤ Version: 6.12.53 ≤ Version: 6.17.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/misc/fastrpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0a3b87293fbd34fda651e6aead9964f84b893962",
"status": "affected",
"version": "0b70ec82b309a4093106ff399da1911ad23b52d3",
"versionType": "git"
},
{
"lessThan": "8b080c89183196fd3e49212f2a1a1c4a29335b9c",
"status": "affected",
"version": "d7513b47082c08105e837b06cebeb3f07a5fa56f",
"versionType": "git"
},
{
"lessThan": "5b0166112019d1dce30b976ab28fd67f7f0be532",
"status": "affected",
"version": "802359a52676176b18713e33caa17572ad009057",
"versionType": "git"
},
{
"lessThan": "992f121796b7ca83a5a8b93da24e971363206218",
"status": "affected",
"version": "10df039834f84a297c72ec962c0f9b7c8c5ca31a",
"versionType": "git"
},
{
"lessThan": "f20f6512ecb75c816e0debf4551a138f098615c4",
"status": "affected",
"version": "10df039834f84a297c72ec962c0f9b7c8c5ca31a",
"versionType": "git"
},
{
"lessThan": "07ebe87915d8accdaba20c4f88c5ae430fe62fbb",
"status": "affected",
"version": "10df039834f84a297c72ec962c0f9b7c8c5ca31a",
"versionType": "git"
},
{
"status": "affected",
"version": "f3f59bab68e9bc714f757ab22f3fb36153014043",
"versionType": "git"
},
{
"lessThan": "6.1.176",
"status": "affected",
"version": "6.1.156",
"versionType": "semver"
},
{
"lessThan": "6.6.143",
"status": "affected",
"version": "6.6.112",
"versionType": "semver"
},
{
"lessThan": "6.12.94",
"status": "affected",
"version": "6.12.53",
"versionType": "semver"
},
{
"lessThan": "6.18",
"status": "affected",
"version": "6.17.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/misc/fastrpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "6.1.156",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.6.112",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.12.53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: fix use-after-free race in fastrpc_map_create\n\nfastrpc_map_lookup returns a raw pointer after releasing fl-\u003elock. The\ncaller fastrpc_map_create then calls fastrpc_map_get (kref_get_unless_zero)\non this unprotected pointer. A concurrent MEM_UNMAP can free the map\nbetween the lock release and the kref operation, resulting in a\nuse-after-free on the freed slab object.\n\nRestore the take_ref parameter to fastrpc_map_lookup so the reference\nis acquired atomically under fl-\u003elock before the pointer is exposed to\nthe caller."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through local FastRPC misc-device ioctls such as FASTRPC_IOCTL_MEM_MAP, FASTRPC_IOCTL_INVOKE, and FASTRPC_IOCTL_INIT_CREATE. There is no network or adjacent-path entry point.\nAC:L - The attacker can drive both sides of the race by issuing concurrent map-creating and MEM_UNMAP ioctls against the same FastRPC file context and DMA-buf fd. No condition outside attacker control is required beyond scheduling the race.\nPR:L - The ioctl path has no in-driver capable(), namespace capability, or credential check once the FastRPC device node is open. Exploitation requires local access to the device node as a basic user or device-authorized app, not real root.\nUI:N - No victim action is required after the attacker has local access. The attacker directly opens the FastRPC device and submits ioctls.\nS:U - This is a kernel memory safety bug in a local kernel driver and exploitation would affect the same kernel security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation by itself.\nC:H - The bug is a use-after-free on struct fastrpc_map, a slab object containing pointers and DMA mapping state. Under the required high-severity rule, this memory corruption is treated as capable of enabling kernel information disclosure.\nI:H - The use-after-free can be raced with allocator reuse and involves refcount/list/DMA mapping state, making control of freed object contents plausibly exploitable for kernel memory corruption. Under the kernel guidance, UAFs receive high integrity impact.\nA:H - Even without full exploitation, racing kref_get_unless_zero() and later map-field use on a freed object can trigger kernel warnings, oopses, or crashes. Repeated local ioctls can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:35.015Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0a3b87293fbd34fda651e6aead9964f84b893962"
},
{
"url": "https://git.kernel.org/stable/c/8b080c89183196fd3e49212f2a1a1c4a29335b9c"
},
{
"url": "https://git.kernel.org/stable/c/5b0166112019d1dce30b976ab28fd67f7f0be532"
},
{
"url": "https://git.kernel.org/stable/c/992f121796b7ca83a5a8b93da24e971363206218"
},
{
"url": "https://git.kernel.org/stable/c/f20f6512ecb75c816e0debf4551a138f098615c4"
},
{
"url": "https://git.kernel.org/stable/c/07ebe87915d8accdaba20c4f88c5ae430fe62fbb"
}
],
"title": "misc: fastrpc: fix use-after-free race in fastrpc_map_create",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53160",
"datePublished": "2026-06-25T08:38:42.138Z",
"dateReserved": "2026-06-09T07:44:35.388Z",
"dateUpdated": "2026-08-05T12:33:35.015Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52958 (GCVE-0-2026-52958)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential out-of-bounds access in osdmap_decode()
When decoding osd_state and osd_weight from an incoming osdmap in
osdmap_decode(), both are decoded for each osd, i.e., map->max_osd
times. The ceph_decode_need() check only accounts for
sizeof(*map->osd_weight) once. This can potentially result in an
out-of-bounds memory access if the incoming message is corrupted such
that the max_osd value exceeds the actual content of the osdmap message.
This patch fixes the issue by changing the corresponding part in the
ceph_decode_need() check to account for
map->max_osd*sizeof(*map->osd_weight).
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: dcbc919a5dc8c2629684a113a90c0b6fe10c3462 Version: dcbc919a5dc8c2629684a113a90c0b6fe10c3462 Version: dcbc919a5dc8c2629684a113a90c0b6fe10c3462 Version: dcbc919a5dc8c2629684a113a90c0b6fe10c3462 Version: dcbc919a5dc8c2629684a113a90c0b6fe10c3462 Version: dcbc919a5dc8c2629684a113a90c0b6fe10c3462 Version: dcbc919a5dc8c2629684a113a90c0b6fe10c3462 Version: dcbc919a5dc8c2629684a113a90c0b6fe10c3462 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "36a79759a288961b1ff28a68ec2d1f56f6848098",
"status": "affected",
"version": "dcbc919a5dc8c2629684a113a90c0b6fe10c3462",
"versionType": "git"
},
{
"lessThan": "3f2575bb7f955d42569d96c3e04fa958a0dcf4b4",
"status": "affected",
"version": "dcbc919a5dc8c2629684a113a90c0b6fe10c3462",
"versionType": "git"
},
{
"lessThan": "8713bbc4b2b9ad78f803978e54b7e49dd21bd9be",
"status": "affected",
"version": "dcbc919a5dc8c2629684a113a90c0b6fe10c3462",
"versionType": "git"
},
{
"lessThan": "0d2dd7e6bb74fd7712aa73457a4a821906c6863a",
"status": "affected",
"version": "dcbc919a5dc8c2629684a113a90c0b6fe10c3462",
"versionType": "git"
},
{
"lessThan": "e7187f33c02488697ec0d01d82bf7a3f8deaba8f",
"status": "affected",
"version": "dcbc919a5dc8c2629684a113a90c0b6fe10c3462",
"versionType": "git"
},
{
"lessThan": "48df98d12b15360cd56af5c1f460307b340c1197",
"status": "affected",
"version": "dcbc919a5dc8c2629684a113a90c0b6fe10c3462",
"versionType": "git"
},
{
"lessThan": "ee933694645dac062d65fc2743f92bc06fa0db6b",
"status": "affected",
"version": "dcbc919a5dc8c2629684a113a90c0b6fe10c3462",
"versionType": "git"
},
{
"lessThan": "35d0ed82d03e5ee77ea4f31f20e29562a7721649",
"status": "affected",
"version": "dcbc919a5dc8c2629684a113a90c0b6fe10c3462",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential out-of-bounds access in osdmap_decode()\n\nWhen decoding osd_state and osd_weight from an incoming osdmap in\nosdmap_decode(), both are decoded for each osd, i.e., map-\u003emax_osd\ntimes. The ceph_decode_need() check only accounts for\nsizeof(*map-\u003eosd_weight) once. This can potentially result in an\nout-of-bounds memory access if the incoming message is corrupted such\nthat the max_osd value exceeds the actual content of the osdmap message.\n\nThis patch fixes the issue by changing the corresponding part in the\nceph_decode_need() check to account for\nmap-\u003emax_osd*sizeof(*map-\u003eosd_weight)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable decoder processes Ceph OSD map messages received over Ceph messenger connections from monitors or OSDs. A malicious or compromised network Ceph peer can deliver the crafted map to a connected kernel client.\nAC:L - The trigger is a deterministic malformed OSD map with `max_osd` larger than the supplied `osd_weight` content. No race or condition outside the attacker\u0027s control is required.\nPR:N - The attacker does not need privileges on the vulnerable Linux system; the crafted data is supplied by a remote Ceph peer. Ceph also supports auth-none deployments, so the highest defensible scenario does not require authenticated attacker privileges.\nUI:N - Once the kernel Ceph client is connected, OSD map updates are processed asynchronously without a user action. The attacker can trigger parsing by sending the crafted map over the established network connection.\nS:U - The impact is within the kernel/client system that parses the malicious Ceph message. This is not a VM escape, IOMMU bypass, or other cross-scope boundary change.\nC:H - The bug is an out-of-bounds read from the received message buffer, and the read can extend beyond a small bounded area based on attacker-controlled `max_osd`. Following the higher-severity rule for OOB reads, this supports high confidentiality impact.\nI:N - The faulty loop reads past the input buffer into the allocated `osd_weight` array but does not write out of bounds or provide a clear kernel memory write primitive. The malformed full map is rejected after decoding fails.\nA:H - The out-of-bounds kernel read can fault or otherwise crash the kernel when it crosses invalid memory, and malformed OSD maps can be sent repeatedly by the network peer. Kernel crash or oops is high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:08.518Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/36a79759a288961b1ff28a68ec2d1f56f6848098"
},
{
"url": "https://git.kernel.org/stable/c/3f2575bb7f955d42569d96c3e04fa958a0dcf4b4"
},
{
"url": "https://git.kernel.org/stable/c/8713bbc4b2b9ad78f803978e54b7e49dd21bd9be"
},
{
"url": "https://git.kernel.org/stable/c/0d2dd7e6bb74fd7712aa73457a4a821906c6863a"
},
{
"url": "https://git.kernel.org/stable/c/e7187f33c02488697ec0d01d82bf7a3f8deaba8f"
},
{
"url": "https://git.kernel.org/stable/c/48df98d12b15360cd56af5c1f460307b340c1197"
},
{
"url": "https://git.kernel.org/stable/c/ee933694645dac062d65fc2743f92bc06fa0db6b"
},
{
"url": "https://git.kernel.org/stable/c/35d0ed82d03e5ee77ea4f31f20e29562a7721649"
}
],
"title": "libceph: Fix potential out-of-bounds access in osdmap_decode()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52958",
"datePublished": "2026-06-24T16:28:39.723Z",
"dateReserved": "2026-06-09T07:44:35.373Z",
"dateUpdated": "2026-08-05T12:32:08.518Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52955 (GCVE-0-2026-52955)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential out-of-bounds access in crush_decode()
A message of type CEPH_MSG_OSD_MAP containing a crush map with at least
one bucket has two fields holding the bucket algorithm. If the values
in these two fields differ, an out-of-bounds access can occur. This is
the case because the first algorithm field (alg) is used to allocate
the correct amount of memory for a bucket of this type, while the second
algorithm field inside the bucket (b->alg) is used in the subsequent
processing.
This patch fixes the issue by adding a check that compares alg and
b->alg and aborts the processing in case they differ. Furthermore,
b->alg is set to 0 in this case, because the destruction of the crush
map also uses this field to determine the bucket type, which can again
result in an out-of-bounds access when trying to free the memory pointed
to by the fields of the bucket. To correctly free the memory allocated
for the bucket in such a case, the corresponding call to kfree is moved
from the algorithm-specific crush_destroy_bucket functions to the
generic crush_destroy_bucket().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f24e9980eb860d8600cbe5ef3d2fd9295320d229 Version: f24e9980eb860d8600cbe5ef3d2fd9295320d229 Version: f24e9980eb860d8600cbe5ef3d2fd9295320d229 Version: f24e9980eb860d8600cbe5ef3d2fd9295320d229 Version: f24e9980eb860d8600cbe5ef3d2fd9295320d229 Version: f24e9980eb860d8600cbe5ef3d2fd9295320d229 Version: f24e9980eb860d8600cbe5ef3d2fd9295320d229 Version: f24e9980eb860d8600cbe5ef3d2fd9295320d229 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the `libceph` component of the Linux kernel. A remote attacker could send a specially crafted `CEPH_MSG_OSD_MAP` message where two internal fields, `alg` and `b-\u003ealg`, contain differing bucket algorithm values. This discrepancy can lead to an out-of-bounds memory access during processing or memory deallocation, potentially causing a system crash and resulting in a Denial of Service (DoS)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-131",
"description": "Incorrect Calculation of Buffer Size",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:45:47.779Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52955"
},
{
"name": "RHBZ#2492328",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492328"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52955.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: libceph: Fix potential out-of-bounds access in crush_decode()",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/crush/crush.c",
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6e70ef53e818c53eab28d7b0026b7fd03dddaba5",
"status": "affected",
"version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
"versionType": "git"
},
{
"lessThan": "ebe76d58a48a48031b98543d86c4cd30a825b622",
"status": "affected",
"version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
"versionType": "git"
},
{
"lessThan": "3f42508191e129ee6b5ea96578d5cab14f2a013a",
"status": "affected",
"version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
"versionType": "git"
},
{
"lessThan": "ea0d42137f0c06da71e37ffc647aab4c5309599a",
"status": "affected",
"version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
"versionType": "git"
},
{
"lessThan": "cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5",
"status": "affected",
"version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
"versionType": "git"
},
{
"lessThan": "0f3604cbe4df14c5e58288ac9f57511e726a222d",
"status": "affected",
"version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
"versionType": "git"
},
{
"lessThan": "fb176a99e4c1a5a8448a83d83d3606203ba81faa",
"status": "affected",
"version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
"versionType": "git"
},
{
"lessThan": "4c79fc2d598694bda845b46229c9d48b65042970",
"status": "affected",
"version": "f24e9980eb860d8600cbe5ef3d2fd9295320d229",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/crush/crush.c",
"net/ceph/osdmap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential out-of-bounds access in crush_decode()\n\nA message of type CEPH_MSG_OSD_MAP containing a crush map with at least\none bucket has two fields holding the bucket algorithm. If the values\nin these two fields differ, an out-of-bounds access can occur. This is\nthe case because the first algorithm field (alg) is used to allocate\nthe correct amount of memory for a bucket of this type, while the second\nalgorithm field inside the bucket (b-\u003ealg) is used in the subsequent\nprocessing.\n\nThis patch fixes the issue by adding a check that compares alg and\nb-\u003ealg and aborts the processing in case they differ. Furthermore,\nb-\u003ealg is set to 0 in this case, because the destruction of the crush\nmap also uses this field to determine the bucket type, which can again\nresult in an out-of-bounds access when trying to free the memory pointed\nto by the fields of the bucket. To correctly free the memory allocated\nfor the bucket in such a case, the corresponding call to kfree is moved\nfrom the algorithm-specific crush_destroy_bucket functions to the\ngeneric crush_destroy_bucket()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable CRUSH map is parsed from CEPH_MSG_OSD_MAP messages delivered over Ceph messenger network sessions from monitor or OSD peers.\nAC:L - An attacker controlling a malicious or compromised Ceph peer can choose the two bucket algorithm fields and map contents directly; no race or external timing condition is required.\nPR:N - The attacker needs no privileges on the vulnerable kernel client; the higher-severity reasonable scenario is a malicious or compromised remote Ceph monitor/OSD sending the map.\nUI:N - Once the Ceph client is mounted or an RBD client is connected, OSD map updates are processed automatically without per-attack user action.\nS:U - The corruption occurs in the client kernel and impacts that same kernel security authority, with no VM, IOMMU, or other scope boundary crossed.\nC:H - The mismatch can make the parser/destructor interpret a smaller allocation as a larger bucket type, causing kernel heap out-of-bounds pointer accesses; such memory corruption is reasonably exploitable for information disclosure.\nI:H - The bug can write pointer fields beyond the allocated bucket object and later free through the wrong layout, creating kernel heap corruption with potential control-flow or data integrity compromise.\nA:H - Malformed OSD maps can corrupt kernel memory or trigger invalid frees/oopses, making a kernel crash or denial of service a high-probability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:05.254Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6e70ef53e818c53eab28d7b0026b7fd03dddaba5"
},
{
"url": "https://git.kernel.org/stable/c/ebe76d58a48a48031b98543d86c4cd30a825b622"
},
{
"url": "https://git.kernel.org/stable/c/3f42508191e129ee6b5ea96578d5cab14f2a013a"
},
{
"url": "https://git.kernel.org/stable/c/ea0d42137f0c06da71e37ffc647aab4c5309599a"
},
{
"url": "https://git.kernel.org/stable/c/cceb10023e76bc89f3fe9238ebd0ccab0fc7c7c5"
},
{
"url": "https://git.kernel.org/stable/c/0f3604cbe4df14c5e58288ac9f57511e726a222d"
},
{
"url": "https://git.kernel.org/stable/c/fb176a99e4c1a5a8448a83d83d3606203ba81faa"
},
{
"url": "https://git.kernel.org/stable/c/4c79fc2d598694bda845b46229c9d48b65042970"
}
],
"title": "libceph: Fix potential out-of-bounds access in crush_decode()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52955",
"datePublished": "2026-06-24T16:28:37.748Z",
"dateReserved": "2026-06-09T07:44:35.373Z",
"dateUpdated": "2026-08-05T12:32:05.254Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52919 (GCVE-0-2026-52919)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: fix tp_meter counter underflow during shutdown
batadv_tp_sender_shutdown() unconditionally decrements the "sending"
atomic counter. If multiple paths (e.g. timeout, user cancel, and
normal finish) call this function, the counter can underflow to -1.
Since the sender logic treats any non-zero value as "still sending",
a negative value causes the sender kthread to loop indefinitely.
This leads to a use-after-free when the interface is removed while
the zombie thread is still active.
Fix this by using atomic_xchg() to ensure the counter only transitions
from 1 to 0 once.
[sven: added missing change in batadv_tp_send]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e Version: 33a3bb4a3345bb511f9c69c913da95d4693e2a4e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/tp_meter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e75e2ab463b5b34df6b98f94d740aff327ce9f6b",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "abae88fa254f2981d39ac003a7b302528a22af64",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "c66d20a3ff095e3f000551d208ec2606616db15c",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "c1bac194733aabd731aafa6a01350c229e187dba",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "01cefc5923889e29dbb5f281c3d457714ceb9c00",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "90ae3eae06b7b8ab9f6250b9497c860915b4c17b",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "aeae11c5dad9cd0d50723890bdd866f8e6db2e7d",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
},
{
"lessThan": "94f3b133168d1c49895e7cc6afbcf1cc0b354602",
"status": "affected",
"version": "33a3bb4a3345bb511f9c69c913da95d4693e2a4e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/tp_meter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: fix tp_meter counter underflow during shutdown\n\nbatadv_tp_sender_shutdown() unconditionally decrements the \"sending\"\natomic counter. If multiple paths (e.g. timeout, user cancel, and\nnormal finish) call this function, the counter can underflow to -1.\n\nSince the sender logic treats any non-zero value as \"still sending\",\na negative value causes the sender kthread to loop indefinitely.\nThis leads to a use-after-free when the interface is removed while\nthe zombie thread is still active.\n\nFix this by using atomic_xchg() to ensure the counter only transitions\nfrom 1 to 0 once.\n\n[sven: added missing change in batadv_tp_send]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable sender shutdown path is reached through the batman-adv generic netlink tp_meter start/cancel operations and mesh-interface teardown, which are local kernel control interfaces rather than packets alone. Adjacent mesh packets can influence timing, but an attacker must be able to initiate or cancel the tp_meter session locally to reliably hit the underflow.\nAC:L - The underflow occurs when multiple attacker-controllable stop paths act on the same session, such as a short test/timeout plus cancel or teardown. Although timing is involved, the attacker controls the session lifetime and can repeat the race, so this is low complexity.\nPR:L - The tp_meter genl commands use GENL_UNS_ADMIN_PERM, requiring CAP_NET_ADMIN in the caller\u0027s user namespace. Because batman-adv is netns-aware and can be driven from user namespaces when available, this is low rather than high privilege.\nUI:N - A local attacker with the required namespace capability can create/start/cancel/tear down the tp_meter session without any separate victim action. No user needs to open a file, mount anything, or interact with attacker-controlled data.\nS:U - The bug corrupts/uses kernel networking subsystem state within the same kernel security authority. It is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The fix commit states the negative sender counter leaves a zombie kthread active and leads to a use-after-free during interface removal. Per kernel scoring guidance, a kernel UAF is treated as potentially enabling high confidentiality impact.\nI:H - The resulting use-after-free is kernel memory corruption and can plausibly be shaped into write/control-flow primitives in the most severe reasonable scenario. Per guidance, kernel UAFs are scored as high integrity impact.\nA:H - At minimum, the negative counter can keep the sender kthread looping indefinitely and hang teardown; the documented UAF can also crash the kernel. This is high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:41.245Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e75e2ab463b5b34df6b98f94d740aff327ce9f6b"
},
{
"url": "https://git.kernel.org/stable/c/abae88fa254f2981d39ac003a7b302528a22af64"
},
{
"url": "https://git.kernel.org/stable/c/c66d20a3ff095e3f000551d208ec2606616db15c"
},
{
"url": "https://git.kernel.org/stable/c/c1bac194733aabd731aafa6a01350c229e187dba"
},
{
"url": "https://git.kernel.org/stable/c/01cefc5923889e29dbb5f281c3d457714ceb9c00"
},
{
"url": "https://git.kernel.org/stable/c/90ae3eae06b7b8ab9f6250b9497c860915b4c17b"
},
{
"url": "https://git.kernel.org/stable/c/aeae11c5dad9cd0d50723890bdd866f8e6db2e7d"
},
{
"url": "https://git.kernel.org/stable/c/94f3b133168d1c49895e7cc6afbcf1cc0b354602"
}
],
"title": "batman-adv: fix tp_meter counter underflow during shutdown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52919",
"datePublished": "2026-06-24T07:14:15.201Z",
"dateReserved": "2026-06-09T07:44:35.367Z",
"dateUpdated": "2026-08-05T12:31:41.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46263 (GCVE-0-2026-46263)
Vulnerability from cvelistv5
Published
2026-06-03 15:50
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix out-of-bounds stream encoder index v3
eng_id can be negative and that stream_enc_regs[]
can be indexed out of bounds.
eng_id is used directly as an index into stream_enc_regs[], which has
only 5 entries. When eng_id is 5 (ENGINE_ID_DIGF) or negative, this can
access memory past the end of the array.
Add a bounds check using ARRAY_SIZE() before using eng_id as an index.
The unsigned cast also rejects negative values.
This avoids out-of-bounds access.
Fixes the below smatch error:
dcn*_resource.c: stream_encoder_create() may index
stream_enc_regs[eng_id] out of bounds (size 5).
drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn351/dcn351_resource.c
1246 static struct stream_encoder *dcn35_stream_encoder_create(
1247 enum engine_id eng_id,
1248 struct dc_context *ctx)
1249 {
...
1255
1256 /* Mapping of VPG, AFMT, DME register blocks to DIO block instance */
1257 if (eng_id <= ENGINE_ID_DIGF) {
ENGINE_ID_DIGF is 5. should <= be <?
Unrelated but, ugh, why is Smatch saying that "eng_id" can be negative?
end_id is type signed long, but there are checks in the caller which prevent it from being negative.
1258 vpg_inst = eng_id;
1259 afmt_inst = eng_id;
1260 } else
1261 return NULL;
1262
...
1281
1282 dcn35_dio_stream_encoder_construct(enc1, ctx, ctx->dc_bios,
1283 eng_id, vpg, afmt,
--> 1284 &stream_enc_regs[eng_id],
^^^^^^^^^^^^^^^^^^^^^^^ This stream_enc_regs[] array has 5 elements so we are one element beyond the end of the array.
...
1287 return &enc1->base;
1288 }
v2: use explicit bounds check as suggested by Roman/Dan; avoid unsigned int cast
v3: The compiler already knows how to compare the two values, so the
cast (int) is not needed. (Roman)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c",
"drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c",
"drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c",
"drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c",
"drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c",
"drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "29f3824b08a98d41ecbbfd33580630d7607f962e",
"status": "affected",
"version": "2728e9c7c84235d2d7bc1403174d071ffc82d6d2",
"versionType": "git"
},
{
"lessThan": "263e28add4f4472cfa95150d218955d1945aa413",
"status": "affected",
"version": "2728e9c7c84235d2d7bc1403174d071ffc82d6d2",
"versionType": "git"
},
{
"lessThan": "ca3808d560ad946ab6d089fd1f5bee04b952ead4",
"status": "affected",
"version": "2728e9c7c84235d2d7bc1403174d071ffc82d6d2",
"versionType": "git"
},
{
"lessThan": "abde491143e4e12eecc41337910aace4e8d59603",
"status": "affected",
"version": "2728e9c7c84235d2d7bc1403174d071ffc82d6d2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/resource/dcn315/dcn315_resource.c",
"drivers/gpu/drm/amd/display/dc/resource/dcn316/dcn316_resource.c",
"drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c",
"drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c",
"drivers/gpu/drm/amd/display/dc/resource/dcn35/dcn35_resource.c",
"drivers/gpu/drm/amd/display/dc/resource/dcn351/dcn351_resource.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix out-of-bounds stream encoder index v3\n\neng_id can be negative and that stream_enc_regs[]\ncan be indexed out of bounds.\n\neng_id is used directly as an index into stream_enc_regs[], which has\nonly 5 entries. When eng_id is 5 (ENGINE_ID_DIGF) or negative, this can\naccess memory past the end of the array.\n\nAdd a bounds check using ARRAY_SIZE() before using eng_id as an index.\nThe unsigned cast also rejects negative values.\n\nThis avoids out-of-bounds access.\n\nFixes the below smatch error:\ndcn*_resource.c: stream_encoder_create() may index\nstream_enc_regs[eng_id] out of bounds (size 5).\n\ndrivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn351/dcn351_resource.c\n 1246 static struct stream_encoder *dcn35_stream_encoder_create(\n 1247 enum engine_id eng_id,\n 1248 struct dc_context *ctx)\n 1249 {\n\n ...\n\n 1255\n 1256 /* Mapping of VPG, AFMT, DME register blocks to DIO block instance */\n 1257 if (eng_id \u003c= ENGINE_ID_DIGF) {\n\nENGINE_ID_DIGF is 5. should \u003c= be \u003c?\n\nUnrelated but, ugh, why is Smatch saying that \"eng_id\" can be negative?\nend_id is type signed long, but there are checks in the caller which prevent it from being negative.\n\n 1258 vpg_inst = eng_id;\n 1259 afmt_inst = eng_id;\n 1260 } else\n 1261 return NULL;\n 1262\n\n ...\n\n 1281\n 1282 dcn35_dio_stream_encoder_construct(enc1, ctx, ctx-\u003edc_bios,\n 1283 eng_id, vpg, afmt,\n--\u003e 1284 \u0026stream_enc_regs[eng_id],\n ^^^^^^^^^^^^^^^^^^^^^^^ This stream_enc_regs[] array has 5 elements so we are one element beyond the end of the array.\n\n ...\n\n 1287 return \u0026enc1-\u003ebase;\n 1288 }\n\nv2: use explicit bounds check as suggested by Roman/Dan; avoid unsigned int cast\n\nv3: The compiler already knows how to compare the two values, so the\n cast (int) is not needed. (Roman)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is in AMDGPU display core initialization (dc_create/resource_construct during GPU probe), reachable only from the local kernel context, not from the network or physical buses.\nAC:L - When an out-of-range eng_id is passed, the out-of-bounds index is deterministic with no race; the off-by-one check reliably allows ENGINE_ID_DIGF (5) past validation.\nPR:L - Exploitation requires local access on a system with a vulnerable AMD DCN3.x GPU driver loaded; typical desktop/cloud-GPU tenants have local DRM access without real root, though module reload generally needs elevated privileges.\nUI:N - No victim interaction is required; the bug fires during driver/display-core initialization, not from opening a file or approving a prompt.\nS:U - Impact stays within kernel/GPU driver context (wrong MMIO register maps, memory corruption); it does not cross a VM/hypervisor or IOMMU security boundary by itself.\nC:H - Out-of-bounds indexing of stream_enc_regs[] reads adjacent kernel memory into encoder register descriptors, which is an unbounded kernel memory disclosure primitive per kernel CVSS guidance.\nI:H - The corrupted register block pointer is used for subsequent GPU MMIO writes through stream-encoder helpers, enabling misdirected hardware register modification and potential control of display hardware state.\nA:H - Invalid register mappings and out-of-bounds kernel reads can cause kernel oops/panic or GPU hang when display paths are exercised, matching kernel guidance for crash-class availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:50.295Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/29f3824b08a98d41ecbbfd33580630d7607f962e"
},
{
"url": "https://git.kernel.org/stable/c/263e28add4f4472cfa95150d218955d1945aa413"
},
{
"url": "https://git.kernel.org/stable/c/ca3808d560ad946ab6d089fd1f5bee04b952ead4"
},
{
"url": "https://git.kernel.org/stable/c/abde491143e4e12eecc41337910aace4e8d59603"
}
],
"title": "drm/amd/display: Fix out-of-bounds stream encoder index v3",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46263",
"datePublished": "2026-06-03T15:50:02.572Z",
"dateReserved": "2026-05-13T15:03:33.108Z",
"dateUpdated": "2026-08-05T12:30:50.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31605 (GCVE-0-2026-31605)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
Much like commit 19f953e74356 ("fbdev: fb_pm2fb: Avoid potential divide
by zero error"), we also need to prevent that same crash from happening
in the udlfb driver as it uses pixclock directly when dividing, which
will crash.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 59277b679f8b5ce594e367759256668eba652d0d Version: 59277b679f8b5ce594e367759256668eba652d0d Version: 59277b679f8b5ce594e367759256668eba652d0d Version: 59277b679f8b5ce594e367759256668eba652d0d Version: 59277b679f8b5ce594e367759256668eba652d0d Version: 59277b679f8b5ce594e367759256668eba652d0d Version: 59277b679f8b5ce594e367759256668eba652d0d Version: 59277b679f8b5ce594e367759256668eba652d0d Version: 59277b679f8b5ce594e367759256668eba652d0d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/udlfb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9981de9fb5ae0d3d6bc5ff5ca63350c2a3cdc564",
"status": "affected",
"version": "59277b679f8b5ce594e367759256668eba652d0d",
"versionType": "git"
},
{
"lessThan": "fd50ab7dd4ee5bbb4aebffa76ae18484b03a8ea5",
"status": "affected",
"version": "59277b679f8b5ce594e367759256668eba652d0d",
"versionType": "git"
},
{
"lessThan": "828ce54b27de93bd9c67991bca5a2c76c76742de",
"status": "affected",
"version": "59277b679f8b5ce594e367759256668eba652d0d",
"versionType": "git"
},
{
"lessThan": "cce24f70090e0decb597b88bc52e8ef8efed6105",
"status": "affected",
"version": "59277b679f8b5ce594e367759256668eba652d0d",
"versionType": "git"
},
{
"lessThan": "03797cdee38ef19c87785622d423aabaafb71c5f",
"status": "affected",
"version": "59277b679f8b5ce594e367759256668eba652d0d",
"versionType": "git"
},
{
"lessThan": "6de048d78f3029744778b7a2891745f3ca7c209a",
"status": "affected",
"version": "59277b679f8b5ce594e367759256668eba652d0d",
"versionType": "git"
},
{
"lessThan": "cccbf9b7fdab48ce4feb69c24f7f928aa8e4e8b8",
"status": "affected",
"version": "59277b679f8b5ce594e367759256668eba652d0d",
"versionType": "git"
},
{
"lessThan": "afaaaa38579f1252bb42b145f6e88a955c4f73f3",
"status": "affected",
"version": "59277b679f8b5ce594e367759256668eba652d0d",
"versionType": "git"
},
{
"lessThan": "a31e4518bec70333a0a98f2946a12b53b45fe5b9",
"status": "affected",
"version": "59277b679f8b5ce594e367759256668eba652d0d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/udlfb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO\n\nMuch like commit 19f953e74356 (\"fbdev: fb_pm2fb: Avoid potential divide\nby zero error\"), we also need to prevent that same crash from happening\nin the udlfb driver as it uses pixclock directly when dividing, which\nwill crash."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:42:46.052Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9981de9fb5ae0d3d6bc5ff5ca63350c2a3cdc564"
},
{
"url": "https://git.kernel.org/stable/c/fd50ab7dd4ee5bbb4aebffa76ae18484b03a8ea5"
},
{
"url": "https://git.kernel.org/stable/c/828ce54b27de93bd9c67991bca5a2c76c76742de"
},
{
"url": "https://git.kernel.org/stable/c/cce24f70090e0decb597b88bc52e8ef8efed6105"
},
{
"url": "https://git.kernel.org/stable/c/03797cdee38ef19c87785622d423aabaafb71c5f"
},
{
"url": "https://git.kernel.org/stable/c/6de048d78f3029744778b7a2891745f3ca7c209a"
},
{
"url": "https://git.kernel.org/stable/c/cccbf9b7fdab48ce4feb69c24f7f928aa8e4e8b8"
},
{
"url": "https://git.kernel.org/stable/c/afaaaa38579f1252bb42b145f6e88a955c4f73f3"
},
{
"url": "https://git.kernel.org/stable/c/a31e4518bec70333a0a98f2946a12b53b45fe5b9"
}
],
"title": "fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31605",
"datePublished": "2026-04-24T14:42:28.120Z",
"dateReserved": "2026-03-09T15:48:24.122Z",
"dateUpdated": "2026-06-14T17:42:46.052Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31773 (GCVE-0-2026-31773)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: SMP: derive legacy responder STK authentication from MITM state
The legacy responder path in smp_random() currently labels the stored
STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.
That reflects what the local service requested, not what the pairing
flow actually achieved.
For Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear
and the resulting STK should remain unauthenticated even if the local
side requested HIGH security. Use the established MITM state when
storing the responder STK so the key metadata matches the pairing result.
This also keeps the legacy path aligned with the Secure Connections code,
which already treats JUST_WORKS/JUST_CFM as unauthenticated.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fff3490f47810e2d34b91fb9e31103e923b11c2f Version: fff3490f47810e2d34b91fb9e31103e923b11c2f Version: fff3490f47810e2d34b91fb9e31103e923b11c2f Version: fff3490f47810e2d34b91fb9e31103e923b11c2f Version: fff3490f47810e2d34b91fb9e31103e923b11c2f Version: fff3490f47810e2d34b91fb9e31103e923b11c2f Version: fff3490f47810e2d34b91fb9e31103e923b11c2f Version: fff3490f47810e2d34b91fb9e31103e923b11c2f Version: 14ec593d6bb050cf40a4ade2f9ac9ca050e0412c Version: 3.15.5 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/smp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9a38659a3d06080715691bd3139f9c4b61f688e3",
"status": "affected",
"version": "fff3490f47810e2d34b91fb9e31103e923b11c2f",
"versionType": "git"
},
{
"lessThan": "667f44f1392df6482483756458c48670e579e9ff",
"status": "affected",
"version": "fff3490f47810e2d34b91fb9e31103e923b11c2f",
"versionType": "git"
},
{
"lessThan": "929db734d12db41ca5f95424db4612397f1bd4a7",
"status": "affected",
"version": "fff3490f47810e2d34b91fb9e31103e923b11c2f",
"versionType": "git"
},
{
"lessThan": "b1c6a8e554a39b222c0879a288ea98e338fc4d77",
"status": "affected",
"version": "fff3490f47810e2d34b91fb9e31103e923b11c2f",
"versionType": "git"
},
{
"lessThan": "0afc846bd80073ffcd2b8040f2b2fafaea3d9f72",
"status": "affected",
"version": "fff3490f47810e2d34b91fb9e31103e923b11c2f",
"versionType": "git"
},
{
"lessThan": "061ee71ac6b03c9f8432fe49538c3682bfcf4cf3",
"status": "affected",
"version": "fff3490f47810e2d34b91fb9e31103e923b11c2f",
"versionType": "git"
},
{
"lessThan": "9a6d0db176f082685e0b6149700c0baf3ce2aa8b",
"status": "affected",
"version": "fff3490f47810e2d34b91fb9e31103e923b11c2f",
"versionType": "git"
},
{
"lessThan": "20756fec2f0108cb88e815941f1ffff88dc286fe",
"status": "affected",
"version": "fff3490f47810e2d34b91fb9e31103e923b11c2f",
"versionType": "git"
},
{
"status": "affected",
"version": "14ec593d6bb050cf40a4ade2f9ac9ca050e0412c",
"versionType": "git"
},
{
"lessThan": "3.16",
"status": "affected",
"version": "3.15.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/smp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.15.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SMP: derive legacy responder STK authentication from MITM state\n\nThe legacy responder path in smp_random() currently labels the stored\nSTK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.\nThat reflects what the local service requested, not what the pairing\nflow actually achieved.\n\nFor Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear\nand the resulting STK should remain unauthenticated even if the local\nside requested HIGH security. Use the established MITM state when\nstoring the responder STK so the key metadata matches the pairing result.\n\nThis also keeps the legacy path aligned with the Secure Connections code,\nwhich already treats JUST_WORKS/JUST_CFM as unauthenticated."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable SMP legacy pairing path is reached by Bluetooth LE Security Manager PDUs over the L2CAP SMP fixed channel, so the attacker must be within Bluetooth radio range.\nAC:L - A nearby attacker can drive the Pairing Request/Confirm/Random exchange and trigger the responder STK metadata error without winning a race or relying on memory layout.\nPR:N - The affected code runs during Bluetooth pairing before the remote peer has authenticated or obtained any prior privileges on the target.\nUI:N - Although some deployments may ask a user-space agent to confirm pairing, headless or auto-confirming BLE deployments can complete Just Works/Confirm pairing without human action, so the higher-severity reasonable case is no user interaction.\nS:U - The bug misclassifies Bluetooth link/key authentication inside the same host Bluetooth security authority and does not cross a VM, sandbox, or hardware isolation boundary.\nC:H - An unauthenticated adjacent peer can cause unauthenticated legacy pairing material to be treated as authenticated, allowing access to data exposed only to BT_SECURITY_HIGH peers in high-value BLE deployments.\nI:H - The same authentication bypass can let the peer perform writes or control operations guarded by authenticated Bluetooth security, including persistent trusted-key use after pairing.\nA:H - In severe but reasonable embedded or controller BLE deployments, unauthorized authenticated-level control access can disable, reset, or otherwise disrupt protected device functionality."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:05.705Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9a38659a3d06080715691bd3139f9c4b61f688e3"
},
{
"url": "https://git.kernel.org/stable/c/667f44f1392df6482483756458c48670e579e9ff"
},
{
"url": "https://git.kernel.org/stable/c/929db734d12db41ca5f95424db4612397f1bd4a7"
},
{
"url": "https://git.kernel.org/stable/c/b1c6a8e554a39b222c0879a288ea98e338fc4d77"
},
{
"url": "https://git.kernel.org/stable/c/0afc846bd80073ffcd2b8040f2b2fafaea3d9f72"
},
{
"url": "https://git.kernel.org/stable/c/061ee71ac6b03c9f8432fe49538c3682bfcf4cf3"
},
{
"url": "https://git.kernel.org/stable/c/9a6d0db176f082685e0b6149700c0baf3ce2aa8b"
},
{
"url": "https://git.kernel.org/stable/c/20756fec2f0108cb88e815941f1ffff88dc286fe"
}
],
"title": "Bluetooth: SMP: derive legacy responder STK authentication from MITM state",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31773",
"datePublished": "2026-05-01T14:15:01.277Z",
"dateReserved": "2026-03-09T15:48:24.140Z",
"dateUpdated": "2026-08-05T12:25:05.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52961 (GCVE-0-2026-52961)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-06-24 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
The generic/642 test-case can reproduce the kernel crash:
[40243.605254] ------------[ cut here ]------------
[40243.605956] kernel BUG at fs/ceph/xattr.c:918!
[40243.607142] Oops: invalid opcode: 0000 [#1] SMP PTI
[40243.608067] CPU: 7 UID: 0 PID: 498762 Comm: kworker/7:1 Not tainted 7.0.0-rc7+ #3 PREEMPT(full)
[40243.609700] Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[40243.611820] Workqueue: ceph-msgr ceph_con_workfn
[40243.612715] RIP: 0010:__ceph_build_xattrs_blob+0x1b8/0x1e0
[40243.613731] Code: 0f 84 82 fe ff ff e9 cf 8e 56 ff 48 8d 65 e8 31 c0 5b 41 5c 41 5d 5d 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 c3 cc cc cc cc <0f> 0b 4c 8b 62 08 41 8b 85 24 07 00 00 49 83 c4 04 41 89 44 24 fc
[40243.616888] RSP: 0018:ffffcc80c4d4b688 EFLAGS: 00010287
[40243.617773] RAX: 0000000000010026 RBX: 0000000000000001 RCX: 0000000000000000
[40243.618928] RDX: ffff8a773798dee0 RSI: 0000000000000000 RDI: 0000000000000000
[40243.620158] RBP: ffffcc80c4d4b6a0 R08: 0000000000000000 R09: 0000000000000000
[40243.621573] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a75f3b58000
[40243.622907] R13: ffff8a75f3b58000 R14: 0000000000000080 R15: 000000000000bffd
[40243.624054] FS: 0000000000000000(0000) GS:ffff8a787d1b4000(0000) knlGS:0000000000000000
[40243.625331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[40243.626269] CR2: 000072f390b623c0 CR3: 000000011c02a003 CR4: 0000000000372ef0
[40243.627408] Call Trace:
[40243.627839] <TASK>
[40243.628188] __prep_cap+0x3fd/0x4a0
[40243.628789] ? do_raw_spin_unlock+0x4e/0xe0
[40243.629474] ceph_check_caps+0x46a/0xc80
[40243.630094] ? __lock_acquire+0x4a2/0x2650
[40243.630773] ? find_held_lock+0x31/0x90
[40243.631347] ? handle_cap_grant+0x79f/0x1060
[40243.632068] ? lock_release+0xd9/0x300
[40243.632696] ? __mutex_unlock_slowpath+0x3e/0x340
[40243.633429] ? lock_release+0xd9/0x300
[40243.634052] handle_cap_grant+0xcf6/0x1060
[40243.634745] ceph_handle_caps+0x122b/0x2110
[40243.635415] mds_dispatch+0x5bd/0x2160
[40243.636034] ? ceph_con_process_message+0x65/0x190
[40243.636828] ? lock_release+0xd9/0x300
[40243.637431] ceph_con_process_message+0x7a/0x190
[40243.638184] ? kfree+0x311/0x4f0
[40243.638749] ? kfree+0x311/0x4f0
[40243.639268] process_message+0x16/0x1a0
[40243.639915] ? sg_free_table+0x39/0x90
[40243.640572] ceph_con_v2_try_read+0xf58/0x2120
[40243.641255] ? lock_acquire+0xc8/0x300
[40243.641863] ceph_con_workfn+0x151/0x820
[40243.642493] process_one_work+0x22f/0x630
[40243.643093] ? process_one_work+0x254/0x630
[40243.643770] worker_thread+0x1e2/0x400
[40243.644332] ? __pfx_worker_thread+0x10/0x10
[40243.645020] kthread+0x109/0x140
[40243.645560] ? __pfx_kthread+0x10/0x10
[40243.646125] ret_from_fork+0x3f8/0x480
[40243.646752] ? __pfx_kthread+0x10/0x10
[40243.647316] ? __pfx_kthread+0x10/0x10
[40243.647919] ret_from_fork_asm+0x1a/0x30
[40243.648556] </TASK>
[40243.648902] Modules linked in: overlay hctr2 libpolyval chacha libchacha adiantum libnh libpoly1305 essiv intel_rapl_msr intel_rapl_common intel_uncore_frequency_common skx_edac_common nfit kvm_intel kvm irqbypass joydev ghash_clmulni_intel aesni_intel rapl input_leds mac_hid psmouse vga16fb serio_raw vgastate floppy i2c_piix4 pata_acpi bochs qemu_fw_cfg i2c_smbus sch_fq_codel rbd dm_crypt msr parport_pc ppdev lp parport efi_pstore
[40243.654766] ---[ end trace 0000000000000000 ]---
Commit d93231a6bc8a ("ceph: prevent a client from exceeding the MDS
maximum xattr size") moved the required_blob_size computation to before
the __build_xattrs() call, introducing a race.
__build_xattrs() releases and reacquires i_ceph_lock during execution.
In that window, handle_cap_grant() may update i_xattrs.blob with a
newer MDS-provided blob and bump i_xattrs.version. When
__bui
---truncated---
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ceph/xattr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7eb72425c4e3234926502eb262f9d6193ccd572c",
"status": "affected",
"version": "d93231a6bc8a452323d5fef16cca7107ce483a27",
"versionType": "git"
},
{
"lessThan": "d5bd8b4e39cfa8b087448adcd48088065cd629d5",
"status": "affected",
"version": "d93231a6bc8a452323d5fef16cca7107ce483a27",
"versionType": "git"
},
{
"lessThan": "368d21ae9081c93497b1c8163bed3eddcb2443ff",
"status": "affected",
"version": "d93231a6bc8a452323d5fef16cca7107ce483a27",
"versionType": "git"
},
{
"lessThan": "0c22d9511cbde746622f8e4c11aaa63fe76d45f9",
"status": "affected",
"version": "d93231a6bc8a452323d5fef16cca7107ce483a27",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ceph/xattr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size\n\nThe generic/642 test-case can reproduce the kernel crash:\n\n[40243.605254] ------------[ cut here ]------------\n[40243.605956] kernel BUG at fs/ceph/xattr.c:918!\n[40243.607142] Oops: invalid opcode: 0000 [#1] SMP PTI\n[40243.608067] CPU: 7 UID: 0 PID: 498762 Comm: kworker/7:1 Not tainted 7.0.0-rc7+ #3 PREEMPT(full)\n[40243.609700] Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[40243.611820] Workqueue: ceph-msgr ceph_con_workfn\n[40243.612715] RIP: 0010:__ceph_build_xattrs_blob+0x1b8/0x1e0\n[40243.613731] Code: 0f 84 82 fe ff ff e9 cf 8e 56 ff 48 8d 65 e8 31 c0 5b 41 5c 41 5d 5d 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 c3 cc cc cc cc \u003c0f\u003e 0b 4c 8b 62 08 41 8b 85 24 07 00 00 49 83 c4 04 41 89 44 24 fc\n[40243.616888] RSP: 0018:ffffcc80c4d4b688 EFLAGS: 00010287\n[40243.617773] RAX: 0000000000010026 RBX: 0000000000000001 RCX: 0000000000000000\n[40243.618928] RDX: ffff8a773798dee0 RSI: 0000000000000000 RDI: 0000000000000000\n[40243.620158] RBP: ffffcc80c4d4b6a0 R08: 0000000000000000 R09: 0000000000000000\n[40243.621573] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a75f3b58000\n[40243.622907] R13: ffff8a75f3b58000 R14: 0000000000000080 R15: 000000000000bffd\n[40243.624054] FS: 0000000000000000(0000) GS:ffff8a787d1b4000(0000) knlGS:0000000000000000\n[40243.625331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[40243.626269] CR2: 000072f390b623c0 CR3: 000000011c02a003 CR4: 0000000000372ef0\n[40243.627408] Call Trace:\n[40243.627839] \u003cTASK\u003e\n[40243.628188] __prep_cap+0x3fd/0x4a0\n[40243.628789] ? do_raw_spin_unlock+0x4e/0xe0\n[40243.629474] ceph_check_caps+0x46a/0xc80\n[40243.630094] ? __lock_acquire+0x4a2/0x2650\n[40243.630773] ? find_held_lock+0x31/0x90\n[40243.631347] ? handle_cap_grant+0x79f/0x1060\n[40243.632068] ? lock_release+0xd9/0x300\n[40243.632696] ? __mutex_unlock_slowpath+0x3e/0x340\n[40243.633429] ? lock_release+0xd9/0x300\n[40243.634052] handle_cap_grant+0xcf6/0x1060\n[40243.634745] ceph_handle_caps+0x122b/0x2110\n[40243.635415] mds_dispatch+0x5bd/0x2160\n[40243.636034] ? ceph_con_process_message+0x65/0x190\n[40243.636828] ? lock_release+0xd9/0x300\n[40243.637431] ceph_con_process_message+0x7a/0x190\n[40243.638184] ? kfree+0x311/0x4f0\n[40243.638749] ? kfree+0x311/0x4f0\n[40243.639268] process_message+0x16/0x1a0\n[40243.639915] ? sg_free_table+0x39/0x90\n[40243.640572] ceph_con_v2_try_read+0xf58/0x2120\n[40243.641255] ? lock_acquire+0xc8/0x300\n[40243.641863] ceph_con_workfn+0x151/0x820\n[40243.642493] process_one_work+0x22f/0x630\n[40243.643093] ? process_one_work+0x254/0x630\n[40243.643770] worker_thread+0x1e2/0x400\n[40243.644332] ? __pfx_worker_thread+0x10/0x10\n[40243.645020] kthread+0x109/0x140\n[40243.645560] ? __pfx_kthread+0x10/0x10\n[40243.646125] ret_from_fork+0x3f8/0x480\n[40243.646752] ? __pfx_kthread+0x10/0x10\n[40243.647316] ? __pfx_kthread+0x10/0x10\n[40243.647919] ret_from_fork_asm+0x1a/0x30\n[40243.648556] \u003c/TASK\u003e\n[40243.648902] Modules linked in: overlay hctr2 libpolyval chacha libchacha adiantum libnh libpoly1305 essiv intel_rapl_msr intel_rapl_common intel_uncore_frequency_common skx_edac_common nfit kvm_intel kvm irqbypass joydev ghash_clmulni_intel aesni_intel rapl input_leds mac_hid psmouse vga16fb serio_raw vgastate floppy i2c_piix4 pata_acpi bochs qemu_fw_cfg i2c_smbus sch_fq_codel rbd dm_crypt msr parport_pc ppdev lp parport efi_pstore\n[40243.654766] ---[ end trace 0000000000000000 ]---\n\nCommit d93231a6bc8a (\"ceph: prevent a client from exceeding the MDS\nmaximum xattr size\") moved the required_blob_size computation to before\nthe __build_xattrs() call, introducing a race.\n\n__build_xattrs() releases and reacquires i_ceph_lock during execution.\nIn that window, handle_cap_grant() may update i_xattrs.blob with a\nnewer MDS-provided blob and bump i_xattrs.version. When\n__bui\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:28:41.836Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7eb72425c4e3234926502eb262f9d6193ccd572c"
},
{
"url": "https://git.kernel.org/stable/c/d5bd8b4e39cfa8b087448adcd48088065cd629d5"
},
{
"url": "https://git.kernel.org/stable/c/368d21ae9081c93497b1c8163bed3eddcb2443ff"
},
{
"url": "https://git.kernel.org/stable/c/0c22d9511cbde746622f8e4c11aaa63fe76d45f9"
}
],
"title": "ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52961",
"datePublished": "2026-06-24T16:28:41.836Z",
"dateReserved": "2026-06-09T07:44:35.374Z",
"dateUpdated": "2026-06-24T16:28:41.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31570 (GCVE-0-2026-31570)
Vulnerability from cvelistv5
Published
2026-04-24 14:35
Modified
2026-08-05 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: gw: fix OOB heap access in cgw_csum_crc8_rel()
cgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():
int from = calc_idx(crc8->from_idx, cf->len);
int to = calc_idx(crc8->to_idx, cf->len);
int res = calc_idx(crc8->result_idx, cf->len);
if (from < 0 || to < 0 || res < 0)
return;
However, the loop and the result write then use the raw s8 fields directly
instead of the computed variables:
for (i = crc8->from_idx; ...) /* BUG: raw negative index */
cf->data[crc8->result_idx] = ...; /* BUG: raw negative index */
With from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame,
calc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with
i = -64, reading cf->data[-64], and the write goes to cf->data[-64].
This write might end up to 56 (7.0-rc) or 40 (<= 6.19) bytes before the
start of the canfd_frame on the heap.
The companion function cgw_csum_xor_rel() uses `from`/`to`/`res`
correctly throughout; fix cgw_csum_crc8_rel() to match.
Confirmed with KASAN on linux-7.0-rc2:
BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0
Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62
To configure the can-gw crc8 checksums CAP_NET_ADMIN is needed.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 456a8a646b2563438c16a9b27decf9aa717f1ebb Version: 456a8a646b2563438c16a9b27decf9aa717f1ebb Version: 456a8a646b2563438c16a9b27decf9aa717f1ebb Version: 456a8a646b2563438c16a9b27decf9aa717f1ebb Version: 456a8a646b2563438c16a9b27decf9aa717f1ebb Version: 456a8a646b2563438c16a9b27decf9aa717f1ebb Version: 456a8a646b2563438c16a9b27decf9aa717f1ebb Version: 456a8a646b2563438c16a9b27decf9aa717f1ebb |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/gw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e7c99348b0612b2bc02d5ce6ff9873261cc7605f",
"status": "affected",
"version": "456a8a646b2563438c16a9b27decf9aa717f1ebb",
"versionType": "git"
},
{
"lessThan": "999ca48d55a8a46da21519db7e834e5867200379",
"status": "affected",
"version": "456a8a646b2563438c16a9b27decf9aa717f1ebb",
"versionType": "git"
},
{
"lessThan": "a025283d7f7404c739225e457fb99db2368bb544",
"status": "affected",
"version": "456a8a646b2563438c16a9b27decf9aa717f1ebb",
"versionType": "git"
},
{
"lessThan": "54ecdf76a55e75c1f5085e440f8ab671a3283ef5",
"status": "affected",
"version": "456a8a646b2563438c16a9b27decf9aa717f1ebb",
"versionType": "git"
},
{
"lessThan": "c4e8eaa75fa0b6bcbfa5356d6195c4ad0e05e57a",
"status": "affected",
"version": "456a8a646b2563438c16a9b27decf9aa717f1ebb",
"versionType": "git"
},
{
"lessThan": "84f8b76d24273175a22713e83e90874e1880d801",
"status": "affected",
"version": "456a8a646b2563438c16a9b27decf9aa717f1ebb",
"versionType": "git"
},
{
"lessThan": "66b689efd08227da2c5ca49b58b30a95d23c695a",
"status": "affected",
"version": "456a8a646b2563438c16a9b27decf9aa717f1ebb",
"versionType": "git"
},
{
"lessThan": "b9c310d72783cc2f30d103eed83920a5a29c671a",
"status": "affected",
"version": "456a8a646b2563438c16a9b27decf9aa717f1ebb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/gw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: gw: fix OOB heap access in cgw_csum_crc8_rel()\n\ncgw_csum_crc8_rel() correctly computes bounds-safe indices via calc_idx():\n\n int from = calc_idx(crc8-\u003efrom_idx, cf-\u003elen);\n int to = calc_idx(crc8-\u003eto_idx, cf-\u003elen);\n int res = calc_idx(crc8-\u003eresult_idx, cf-\u003elen);\n\n if (from \u003c 0 || to \u003c 0 || res \u003c 0)\n return;\n\nHowever, the loop and the result write then use the raw s8 fields directly\ninstead of the computed variables:\n\n for (i = crc8-\u003efrom_idx; ...) /* BUG: raw negative index */\n cf-\u003edata[crc8-\u003eresult_idx] = ...; /* BUG: raw negative index */\n\nWith from_idx = to_idx = result_idx = -64 on a 64-byte CAN FD frame,\ncalc_idx(-64, 64) = 0 so the guard passes, but the loop iterates with\ni = -64, reading cf-\u003edata[-64], and the write goes to cf-\u003edata[-64].\nThis write might end up to 56 (7.0-rc) or 40 (\u003c= 6.19) bytes before the\nstart of the canfd_frame on the heap.\n\nThe companion function cgw_csum_xor_rel() uses `from`/`to`/`res`\ncorrectly throughout; fix cgw_csum_crc8_rel() to match.\n\nConfirmed with KASAN on linux-7.0-rc2:\n BUG: KASAN: slab-out-of-bounds in cgw_csum_crc8_rel+0x515/0x5b0\n Read of size 1 at addr ffff8880076619c8 by task poc_cgw_oob/62\n\nTo configure the can-gw crc8 checksums CAP_NET_ADMIN is needed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable function runs in the CAN gateway receive path for CAN/CAN FD frames, after a matching gateway rule processes traffic. In a reasonable automotive or industrial CAN gateway deployment, an attacker on the same CAN segment can send matching CAN FD frames, so this is Adjacent.\nAC:L - There is no race or probabilistic condition; once an affected CRC8 relative-index gateway rule exists, the attacker can choose CAN ID, payload length, and frame contents to trigger the bad negative index path reliably. A 64-byte CAN FD frame reaches the demonstrated OOB case directly.\nPR:N - No host privileges are required to inject trigger CAN FD traffic into an already configured gateway route on the CAN segment. Creating or changing the rule requires CAP_NET_ADMIN in init_user_ns, but the highest reasonable deployed gateway scenario only requires attacker-controlled bus traffic.\nUI:N - No victim user action is required after the affected gateway configuration is present. The vulnerable code runs automatically while processing matching CAN FD frames.\nS:U - The impact is within the same kernel security authority as the vulnerable CAN gateway code. This is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The bug performs out-of-bounds heap reads before the CAN FD frame while computing CRC8. Because this is kernel heap memory exposure potential from memory corruption, confidentiality impact is High.\nI:H - The bug performs an out-of-bounds heap write through cf-\u003edata[result_idx] using a raw negative index. Kernel heap corruption is defensibly exploitable for integrity compromise, so integrity impact is High.\nA:H - KASAN confirms a slab-out-of-bounds access in the receive path, and repeated crafted frames can trigger kernel memory corruption. This can crash or destabilize the kernel, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:23:34.970Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e7c99348b0612b2bc02d5ce6ff9873261cc7605f"
},
{
"url": "https://git.kernel.org/stable/c/999ca48d55a8a46da21519db7e834e5867200379"
},
{
"url": "https://git.kernel.org/stable/c/a025283d7f7404c739225e457fb99db2368bb544"
},
{
"url": "https://git.kernel.org/stable/c/54ecdf76a55e75c1f5085e440f8ab671a3283ef5"
},
{
"url": "https://git.kernel.org/stable/c/c4e8eaa75fa0b6bcbfa5356d6195c4ad0e05e57a"
},
{
"url": "https://git.kernel.org/stable/c/84f8b76d24273175a22713e83e90874e1880d801"
},
{
"url": "https://git.kernel.org/stable/c/66b689efd08227da2c5ca49b58b30a95d23c695a"
},
{
"url": "https://git.kernel.org/stable/c/b9c310d72783cc2f30d103eed83920a5a29c671a"
}
],
"title": "can: gw: fix OOB heap access in cgw_csum_crc8_rel()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31570",
"datePublished": "2026-04-24T14:35:49.435Z",
"dateReserved": "2026-03-09T15:48:24.117Z",
"dateUpdated": "2026-08-05T12:23:34.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46018 (GCVE-0-2026-46018)
Vulnerability from cvelistv5
Published
2026-05-27 12:56
Modified
2026-06-14 17:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES
parse_uac2_sample_rate_range() caps the number of enumerated
rates at MAX_NR_RATES, but it only breaks out of the current
rate loop. A malformed UAC2 RANGE response with additional
triplets continues parsing the remaining triplets and repeatedly
prints "invalid uac2 rates" while probe still holds
register_mutex.
Stop the whole parse once the cap is reached and return the
number of rates collected so far.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4fa0e81b83503900be277e6273a79651b375e288 Version: 4fa0e81b83503900be277e6273a79651b375e288 Version: 4fa0e81b83503900be277e6273a79651b375e288 Version: 4fa0e81b83503900be277e6273a79651b375e288 Version: 4fa0e81b83503900be277e6273a79651b375e288 Version: 4fa0e81b83503900be277e6273a79651b375e288 Version: 4fa0e81b83503900be277e6273a79651b375e288 Version: 4fa0e81b83503900be277e6273a79651b375e288 Version: 44f059fb742aac78cffdab5e0d8fe0c9910c1ded Version: c25a53781f61c78bf2a2fa308bbd35b42ba346f6 Version: 3.0.81 ≤ Version: 3.2.47 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/format.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5436bc1b07d4656f99412dc72871d250d7d55205",
"status": "affected",
"version": "4fa0e81b83503900be277e6273a79651b375e288",
"versionType": "git"
},
{
"lessThan": "0da05fedf5e1966b7e7d389866cb86fcf09f4b32",
"status": "affected",
"version": "4fa0e81b83503900be277e6273a79651b375e288",
"versionType": "git"
},
{
"lessThan": "f14bd323eec4b4f0ef662520ec852e593ece1d4c",
"status": "affected",
"version": "4fa0e81b83503900be277e6273a79651b375e288",
"versionType": "git"
},
{
"lessThan": "ab5ba9fd138758ddc50222264ff246b31e397abf",
"status": "affected",
"version": "4fa0e81b83503900be277e6273a79651b375e288",
"versionType": "git"
},
{
"lessThan": "ba036305323814ec1f8655313b2fa6a0f7048716",
"status": "affected",
"version": "4fa0e81b83503900be277e6273a79651b375e288",
"versionType": "git"
},
{
"lessThan": "4d7893a137eadb6163ea4298bf67d74b811d76ef",
"status": "affected",
"version": "4fa0e81b83503900be277e6273a79651b375e288",
"versionType": "git"
},
{
"lessThan": "a0b78639ef09b2e77974a3de3b1c07f6de3c5e56",
"status": "affected",
"version": "4fa0e81b83503900be277e6273a79651b375e288",
"versionType": "git"
},
{
"lessThan": "3c318f97dcc50b2e0556a1813bd6958678e881fd",
"status": "affected",
"version": "4fa0e81b83503900be277e6273a79651b375e288",
"versionType": "git"
},
{
"status": "affected",
"version": "44f059fb742aac78cffdab5e0d8fe0c9910c1ded",
"versionType": "git"
},
{
"status": "affected",
"version": "c25a53781f61c78bf2a2fa308bbd35b42ba346f6",
"versionType": "git"
},
{
"lessThan": "3.1",
"status": "affected",
"version": "3.0.81",
"versionType": "semver"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.47",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/format.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.3"
},
{
"lessThan": "3.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.0.81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.47",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES\n\nparse_uac2_sample_rate_range() caps the number of enumerated\nrates at MAX_NR_RATES, but it only breaks out of the current\nrate loop. A malformed UAC2 RANGE response with additional\ntriplets continues parsing the remaining triplets and repeatedly\nprints \"invalid uac2 rates\" while probe still holds\nregister_mutex.\n\nStop the whole parse once the cap is reached and return the\nnumber of rates collected so far."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:48:18.248Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5436bc1b07d4656f99412dc72871d250d7d55205"
},
{
"url": "https://git.kernel.org/stable/c/0da05fedf5e1966b7e7d389866cb86fcf09f4b32"
},
{
"url": "https://git.kernel.org/stable/c/f14bd323eec4b4f0ef662520ec852e593ece1d4c"
},
{
"url": "https://git.kernel.org/stable/c/ab5ba9fd138758ddc50222264ff246b31e397abf"
},
{
"url": "https://git.kernel.org/stable/c/ba036305323814ec1f8655313b2fa6a0f7048716"
},
{
"url": "https://git.kernel.org/stable/c/4d7893a137eadb6163ea4298bf67d74b811d76ef"
},
{
"url": "https://git.kernel.org/stable/c/a0b78639ef09b2e77974a3de3b1c07f6de3c5e56"
},
{
"url": "https://git.kernel.org/stable/c/3c318f97dcc50b2e0556a1813bd6958678e881fd"
}
],
"title": "ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46018",
"datePublished": "2026-05-27T12:56:19.588Z",
"dateReserved": "2026-05-13T15:03:33.092Z",
"dateUpdated": "2026-06-14T17:48:18.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31780 (GCVE-0-2026-31780)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation
The variable valuesize is declared as u8 but accumulates the total
length of all SSIDs to scan. Each SSID contributes up to 33 bytes
(IEEE80211_MAX_SSID_LEN + 1), and with WILC_MAX_NUM_PROBED_SSID (10)
SSIDs the total can reach 330, which wraps around to 74 when stored
in a u8.
This causes kmalloc to allocate only 75 bytes while the subsequent
memcpy writes up to 331 bytes into the buffer, resulting in a 256-byte
heap buffer overflow.
Widen valuesize from u8 to u32 to accommodate the full range.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c5c77ba18ea66aa05441c71e38473efb787705a4 Version: c5c77ba18ea66aa05441c71e38473efb787705a4 Version: c5c77ba18ea66aa05441c71e38473efb787705a4 Version: c5c77ba18ea66aa05441c71e38473efb787705a4 Version: c5c77ba18ea66aa05441c71e38473efb787705a4 Version: c5c77ba18ea66aa05441c71e38473efb787705a4 Version: c5c77ba18ea66aa05441c71e38473efb787705a4 Version: c5c77ba18ea66aa05441c71e38473efb787705a4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/microchip/wilc1000/hif.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "34a23fd9ddd683a03c7e8cc0ceded3e59e354b99",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "549f02d8ec94d39092ab6d9b103d0d6783a4b024",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "bfbddeadd4779651403035ee177ae2f22f9f5521",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "9907ac9b9a18b92fc34b9e4cb9e10f208dc1d3f7",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "c97b2a00059608592ad0d86fbb813a4f8cf9464b",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "d8388614de613c28eeb659c10115060a83739924",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "0c7f21d8bd2f93998b72b7a7f93152336aeca4dd",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "d049e56b1739101d1c4d81deedb269c52a8dbba0",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/microchip/wilc1000/hif.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation\n\nThe variable valuesize is declared as u8 but accumulates the total\nlength of all SSIDs to scan. Each SSID contributes up to 33 bytes\n(IEEE80211_MAX_SSID_LEN + 1), and with WILC_MAX_NUM_PROBED_SSID (10)\nSSIDs the total can reach 330, which wraps around to 74 when stored\nin a u8.\n\nThis causes kmalloc to allocate only 75 bytes while the subsequent\nmemcpy writes up to 331 bytes into the buffer, resulting in a 256-byte\nheap buffer overflow.\n\nWiden valuesize from u8 to u32 to accommodate the full range."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached by a local nl80211 generic-netlink trigger-scan request that supplies the probe SSID list. Over-the-air WiFi frames do not control this buffer.\nAC:L - The attacker can directly choose up to 10 SSIDs of up to 32 bytes each, reliably causing the u8 size wrap and heap overflow when scan is accepted. No race or hard-to-hit external condition is required.\nPR:L - NL80211_CMD_TRIGGER_SCAN is gated by GENL_UNS_ADMIN_PERM and netlink_ns_capable(..., CAP_NET_ADMIN), so namespace-scoped CAP_NET_ADMIN over the target wireless netns is sufficient. It is not reachable with no privileges.\nUI:N - No victim action is required once the attacker can issue the scan request. The attacker triggers the vulnerable code directly.\nS:U - The corruption occurs in the kernel while servicing a kernel wireless driver operation. It does not cross a VM, IOMMU, or other separate security authority boundary.\nC:H - The bug is a controlled kernel heap buffer overflow of up to 256 bytes, which can corrupt adjacent heap objects and plausibly support information disclosure during exploitation. Under the higher-severity rule, memory corruption is scored high for confidentiality.\nI:H - The attacker controls much of the data written past the undersized allocation into adjacent kernel heap memory. This is a kernel out-of-bounds write and is defensibly exploitable for integrity compromise.\nA:H - At minimum, the heap overflow can crash or oops the kernel, and it can be triggered repeatedly through scan requests. Kernel crash impact is high availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:08.895Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/34a23fd9ddd683a03c7e8cc0ceded3e59e354b99"
},
{
"url": "https://git.kernel.org/stable/c/549f02d8ec94d39092ab6d9b103d0d6783a4b024"
},
{
"url": "https://git.kernel.org/stable/c/bfbddeadd4779651403035ee177ae2f22f9f5521"
},
{
"url": "https://git.kernel.org/stable/c/9907ac9b9a18b92fc34b9e4cb9e10f208dc1d3f7"
},
{
"url": "https://git.kernel.org/stable/c/c97b2a00059608592ad0d86fbb813a4f8cf9464b"
},
{
"url": "https://git.kernel.org/stable/c/d8388614de613c28eeb659c10115060a83739924"
},
{
"url": "https://git.kernel.org/stable/c/0c7f21d8bd2f93998b72b7a7f93152336aeca4dd"
},
{
"url": "https://git.kernel.org/stable/c/d049e56b1739101d1c4d81deedb269c52a8dbba0"
}
],
"title": "wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31780",
"datePublished": "2026-05-01T14:15:07.253Z",
"dateReserved": "2026-03-09T15:48:24.141Z",
"dateUpdated": "2026-08-05T12:25:08.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31479 (GCVE-0-2026-31479)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-08-05 12:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe: always keep track of remap prev/next
During 3D workload, user is reporting hitting:
[ 413.361679] WARNING: drivers/gpu/drm/xe/xe_vm.c:1217 at vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe], CPU#7: vkd3d_queue/9925
[ 413.361944] CPU: 7 UID: 1000 PID: 9925 Comm: vkd3d_queue Kdump: loaded Not tainted 7.0.0-070000rc3-generic #202603090038 PREEMPT(lazy)
[ 413.361949] RIP: 0010:vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe]
[ 413.362074] RSP: 0018:ffffd4c25c3df930 EFLAGS: 00010282
[ 413.362077] RAX: 0000000000000000 RBX: ffff8f3ee817ed10 RCX: 0000000000000000
[ 413.362078] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 413.362079] RBP: ffffd4c25c3df980 R08: 0000000000000000 R09: 0000000000000000
[ 413.362081] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8f41fbf99380
[ 413.362082] R13: ffff8f3ee817e968 R14: 00000000ffffffef R15: ffff8f43d00bd380
[ 413.362083] FS: 00000001040ff6c0(0000) GS:ffff8f4696d89000(0000) knlGS:00000000330b0000
[ 413.362085] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
[ 413.362086] CR2: 00007ddfc4747000 CR3: 00000002e6262005 CR4: 0000000000f72ef0
[ 413.362088] PKRU: 55555554
[ 413.362089] Call Trace:
[ 413.362092] <TASK>
[ 413.362096] xe_vm_bind_ioctl+0xa9a/0xc60 [xe]
Which seems to hint that the vma we are re-inserting for the ops unwind
is either invalid or overlapping with something already inserted in the
vm. It shouldn't be invalid since this is a re-insertion, so must have
worked before. Leaving the likely culprit as something already placed
where we want to insert the vma.
Following from that, for the case where we do something like a rebind in
the middle of a vma, and one or both mapped ends are already compatible,
we skip doing the rebind of those vma and set next/prev to NULL. As well
as then adjust the original unmap va range, to avoid unmapping the ends.
However, if we trigger the unwind path, we end up with three va, with
the two ends never being removed and the original va range in the middle
still being the shrunken size.
If this occurs, one failure mode is when another unwind op needs to
interact with that range, which can happen with a vector of binds. For
example, if we need to re-insert something in place of the original va.
In this case the va is still the shrunken version, so when removing it
and then doing a re-insert it can overlap with the ends, which were
never removed, triggering a warning like above, plus leaving the vm in a
bad state.
With that, we need two things here:
1) Stop nuking the prev/next tracking for the skip cases. Instead
relying on checking for skip prev/next, where needed. That way on the
unwind path, we now correctly remove both ends.
2) Undo the unmap va shrinkage, on the unwind path. With the two ends
now removed the unmap va should expand back to the original size again,
before re-insertion.
v2:
- Update the explanation in the commit message, based on an actual IGT of
triggering this issue, rather than conjecture.
- Also undo the unmap shrinkage, for the skip case. With the two ends
now removed, the original unmap va range should expand back to the
original range.
v3:
- Track the old start/range separately. vma_size/start() uses the va
info directly.
(cherry picked from commit aec6969f75afbf4e01fd5fb5850ed3e9c27043ac)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_pt.c",
"drivers/gpu/drm/xe/xe_vm.c",
"drivers/gpu/drm/xe/xe_vm_types.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ccd41f110c608b3cc347b9be881c3e72cd634b2b",
"status": "affected",
"version": "8f33b4f054fc29a4774d8d10116ef460faeb84a8",
"versionType": "git"
},
{
"lessThan": "5eda8001ebb5269755608d678dd1f3928ab077c9",
"status": "affected",
"version": "8f33b4f054fc29a4774d8d10116ef460faeb84a8",
"versionType": "git"
},
{
"lessThan": "e6ba1749549e87b83c0c4885d84b543687c3740e",
"status": "affected",
"version": "8f33b4f054fc29a4774d8d10116ef460faeb84a8",
"versionType": "git"
},
{
"lessThan": "bfe9e314d7574d1c5c851972e7aee342733819d2",
"status": "affected",
"version": "8f33b4f054fc29a4774d8d10116ef460faeb84a8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_pt.c",
"drivers/gpu/drm/xe/xe_vm.c",
"drivers/gpu/drm/xe/xe_vm_types.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: always keep track of remap prev/next\n\nDuring 3D workload, user is reporting hitting:\n\n[ 413.361679] WARNING: drivers/gpu/drm/xe/xe_vm.c:1217 at vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe], CPU#7: vkd3d_queue/9925\n[ 413.361944] CPU: 7 UID: 1000 PID: 9925 Comm: vkd3d_queue Kdump: loaded Not tainted 7.0.0-070000rc3-generic #202603090038 PREEMPT(lazy)\n[ 413.361949] RIP: 0010:vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe]\n[ 413.362074] RSP: 0018:ffffd4c25c3df930 EFLAGS: 00010282\n[ 413.362077] RAX: 0000000000000000 RBX: ffff8f3ee817ed10 RCX: 0000000000000000\n[ 413.362078] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 413.362079] RBP: ffffd4c25c3df980 R08: 0000000000000000 R09: 0000000000000000\n[ 413.362081] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8f41fbf99380\n[ 413.362082] R13: ffff8f3ee817e968 R14: 00000000ffffffef R15: ffff8f43d00bd380\n[ 413.362083] FS: 00000001040ff6c0(0000) GS:ffff8f4696d89000(0000) knlGS:00000000330b0000\n[ 413.362085] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033\n[ 413.362086] CR2: 00007ddfc4747000 CR3: 00000002e6262005 CR4: 0000000000f72ef0\n[ 413.362088] PKRU: 55555554\n[ 413.362089] Call Trace:\n[ 413.362092] \u003cTASK\u003e\n[ 413.362096] xe_vm_bind_ioctl+0xa9a/0xc60 [xe]\n\nWhich seems to hint that the vma we are re-inserting for the ops unwind\nis either invalid or overlapping with something already inserted in the\nvm. It shouldn\u0027t be invalid since this is a re-insertion, so must have\nworked before. Leaving the likely culprit as something already placed\nwhere we want to insert the vma.\n\nFollowing from that, for the case where we do something like a rebind in\nthe middle of a vma, and one or both mapped ends are already compatible,\nwe skip doing the rebind of those vma and set next/prev to NULL. As well\nas then adjust the original unmap va range, to avoid unmapping the ends.\nHowever, if we trigger the unwind path, we end up with three va, with\nthe two ends never being removed and the original va range in the middle\nstill being the shrunken size.\n\nIf this occurs, one failure mode is when another unwind op needs to\ninteract with that range, which can happen with a vector of binds. For\nexample, if we need to re-insert something in place of the original va.\nIn this case the va is still the shrunken version, so when removing it\nand then doing a re-insert it can overlap with the ends, which were\nnever removed, triggering a warning like above, plus leaving the vm in a\nbad state.\n\nWith that, we need two things here:\n\n 1) Stop nuking the prev/next tracking for the skip cases. Instead\n relying on checking for skip prev/next, where needed. That way on the\n unwind path, we now correctly remove both ends.\n\n 2) Undo the unmap va shrinkage, on the unwind path. With the two ends\n now removed the unmap va should expand back to the original size again,\n before re-insertion.\n\nv2:\n - Update the explanation in the commit message, based on an actual IGT of\n triggering this issue, rather than conjecture.\n - Also undo the unmap shrinkage, for the skip case. With the two ends\n now removed, the original unmap va range should expand back to the\n original range.\nv3:\n - Track the old start/range separately. vma_size/start() uses the va\n info directly.\n\n(cherry picked from commit aec6969f75afbf4e01fd5fb5850ed3e9c27043ac)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through the local DRM_XE_VM_BIND ioctl on the Intel xe render device, not by network or adjacent protocols.\nAC:L - An attacker can craft VM bind vectors that create the remap skip condition and then force the unwind path through later bind failures or resource pressure. The race/trigger conditions are under the local caller\u0027s control.\nPR:L - The ioctl is DRM_RENDER_ALLOW and requires access to the xe DRM render device, which is available to ordinary local render clients without real root or CAP_SYS_ADMIN.\nUI:N - Once the attacker has local device access, exploitation is performed entirely by issuing ioctls and does not require another user to take action.\nS:U - The bug corrupts kernel/driver VM bookkeeping within the same host kernel security authority and does not cross a VM, IOMMU, or sandbox boundary by itself.\nC:H - The unwind bug can leave VMA objects and GPUVA tree/list state inconsistent, creating stale or untracked kernel objects with incorrect lifetime relationships. Given this memory-management corruption, kernel memory disclosure is a plausible high-impact outcome.\nI:H - The same inconsistent VMA bookkeeping can lead to stale mappings, invalid removals, or use-after-free style behavior in later VM/BO operations. This is a kernel memory-safety condition that can plausibly be leveraged for arbitrary corruption or code execution.\nA:H - The observed failure reaches a kernel WARN in xe_vm_insert_vma and leaves the VM in a bad state, which can crash or panic systems configured to panic on warnings and can be repeatedly triggered by a local caller."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:58.251Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ccd41f110c608b3cc347b9be881c3e72cd634b2b"
},
{
"url": "https://git.kernel.org/stable/c/5eda8001ebb5269755608d678dd1f3928ab077c9"
},
{
"url": "https://git.kernel.org/stable/c/e6ba1749549e87b83c0c4885d84b543687c3740e"
},
{
"url": "https://git.kernel.org/stable/c/bfe9e314d7574d1c5c851972e7aee342733819d2"
}
],
"title": "drm/xe: always keep track of remap prev/next",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31479",
"datePublished": "2026-04-22T13:54:06.880Z",
"dateReserved": "2026-03-09T15:48:24.100Z",
"dateUpdated": "2026-08-05T12:22:58.251Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31678 (GCVE-0-2026-31678)
Vulnerability from cvelistv5
Published
2026-04-25 08:46
Modified
2026-08-05 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: defer tunnel netdev_put to RCU release
ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already
detached the device. Dropping the netdev reference in destroy can race
with concurrent readers that still observe vport->dev.
Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let
vport_netdev_free() drop the reference from the RCU callback, matching
the non-tunnel destroy path and avoiding additional synchronization
under RTNL.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a9020fde67a6eb77f8130feff633189f99264db1 Version: a9020fde67a6eb77f8130feff633189f99264db1 Version: a9020fde67a6eb77f8130feff633189f99264db1 Version: a9020fde67a6eb77f8130feff633189f99264db1 Version: a9020fde67a6eb77f8130feff633189f99264db1 Version: a9020fde67a6eb77f8130feff633189f99264db1 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/vport-netdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9d56aced21fb9c104e8a3f3be9b21fbafe448ffc",
"status": "affected",
"version": "a9020fde67a6eb77f8130feff633189f99264db1",
"versionType": "git"
},
{
"lessThan": "42f0d3d81209654c08ffdde5a34b9b92d2645896",
"status": "affected",
"version": "a9020fde67a6eb77f8130feff633189f99264db1",
"versionType": "git"
},
{
"lessThan": "bbe7bd722bfaea36aab3da6cc60fb4a05c644643",
"status": "affected",
"version": "a9020fde67a6eb77f8130feff633189f99264db1",
"versionType": "git"
},
{
"lessThan": "98b726ab5e2a4811e27c28e4d041f75bba147eab",
"status": "affected",
"version": "a9020fde67a6eb77f8130feff633189f99264db1",
"versionType": "git"
},
{
"lessThan": "b8c56a3fc5d879c0928f207a756b0f067f06c6a8",
"status": "affected",
"version": "a9020fde67a6eb77f8130feff633189f99264db1",
"versionType": "git"
},
{
"lessThan": "6931d21f87bc6d657f145798fad0bf077b82486c",
"status": "affected",
"version": "a9020fde67a6eb77f8130feff633189f99264db1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/vport-netdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: defer tunnel netdev_put to RCU release\n\novs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already\ndetached the device. Dropping the netdev reference in destroy can race\nwith concurrent readers that still observe vport-\u003edev.\n\nDo not release vport-\u003edev in ovs_netdev_tunnel_destroy(). Instead, let\nvport_netdev_free() drop the reference from the RCU callback, matching\nthe non-tunnel destroy path and avoiding additional synchronization\nunder RTNL."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable destroy path is reached through local Generic Netlink/rtnetlink control operations that create or delete Open vSwitch tunnel vports. Remote tunnel packets alone do not invoke `ovs_netdev_tunnel_destroy()`.\nAC:L - This is a race/lifetime bug, but the attacker can control both sides by repeatedly deleting tunnel vports while concurrently driving RCU readers such as vport get/dump, packet execute, or datapath traffic. No rare external condition is required.\nPR:L - Creating and deleting OVS datapaths/vports requires `CAP_NET_ADMIN`, but the OVS Generic Netlink families are netns-aware and use `GENL_UNS_ADMIN_PERM`, making this reachable with CAP_NET_ADMIN in an unprivileged user namespace. This is Low privileges rather than High.\nUI:N - No victim user action is needed once the local attacker can issue the relevant netlink operations. The attacker can trigger creation, deletion, and racing reader activity directly.\nS:U - The vulnerability is a kernel memory lifetime error within the same host kernel security authority. It is a standard local kernel privilege-escalation/DoS class issue, not a VM or hardware boundary escape.\nC:H - The early `netdev_put()` can free the `net_device` while RCU readers still dereference `vport-\u003edev`, creating a use-after-free. Per kernel CVSS guidance, UAFs are scored as High confidentiality impact because they can be developed into kernel memory disclosure primitives.\nI:H - The stale `net_device` pointer can be reused after free by kernel readers/writers and may reach function-pointer-bearing netdev paths. Per guidance, a use-after-free is scored as High integrity impact because heap reuse can enable arbitrary write or code execution.\nA:H - The bug can at minimum crash or oops the kernel through NULL/stale `vport-\u003edev` dereferences and has related observed OVS netdev lifetime splats. A kernel UAF also warrants High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:24.631Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9d56aced21fb9c104e8a3f3be9b21fbafe448ffc"
},
{
"url": "https://git.kernel.org/stable/c/42f0d3d81209654c08ffdde5a34b9b92d2645896"
},
{
"url": "https://git.kernel.org/stable/c/bbe7bd722bfaea36aab3da6cc60fb4a05c644643"
},
{
"url": "https://git.kernel.org/stable/c/98b726ab5e2a4811e27c28e4d041f75bba147eab"
},
{
"url": "https://git.kernel.org/stable/c/b8c56a3fc5d879c0928f207a756b0f067f06c6a8"
},
{
"url": "https://git.kernel.org/stable/c/6931d21f87bc6d657f145798fad0bf077b82486c"
}
],
"title": "openvswitch: defer tunnel netdev_put to RCU release",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31678",
"datePublished": "2026-04-25T08:46:54.476Z",
"dateReserved": "2026-03-09T15:48:24.130Z",
"dateUpdated": "2026-08-05T12:24:24.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43427 (GCVE-0-2026-43427)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-11 22:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: class: cdc-wdm: fix reordering issue in read code path
Quoting the bug report:
Due to compiler optimization or CPU out-of-order execution, the
desc->length update can be reordered before the memmove. If this
happens, wdm_read() can see the new length and call copy_to_user() on
uninitialized memory. This also violates LKMM data race rules [1].
Fix it by using WRITE_ONCE and memory barriers.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: afba937e540c902c989cd516fd97ea0c8499bb27 Version: afba937e540c902c989cd516fd97ea0c8499bb27 Version: afba937e540c902c989cd516fd97ea0c8499bb27 Version: afba937e540c902c989cd516fd97ea0c8499bb27 Version: afba937e540c902c989cd516fd97ea0c8499bb27 Version: afba937e540c902c989cd516fd97ea0c8499bb27 Version: afba937e540c902c989cd516fd97ea0c8499bb27 Version: afba937e540c902c989cd516fd97ea0c8499bb27 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/class/cdc-wdm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "638328ca9c17ae6511ad62198c57bae32ffa3c91",
"status": "affected",
"version": "afba937e540c902c989cd516fd97ea0c8499bb27",
"versionType": "git"
},
{
"lessThan": "170e8daca24da6edb4be82ab01abf44e87af387b",
"status": "affected",
"version": "afba937e540c902c989cd516fd97ea0c8499bb27",
"versionType": "git"
},
{
"lessThan": "c8fa96ed021923dae147bcd9f9205b8df7b82360",
"status": "affected",
"version": "afba937e540c902c989cd516fd97ea0c8499bb27",
"versionType": "git"
},
{
"lessThan": "4ee3062bf2c9a722afef429826e8607eaf3fc6a0",
"status": "affected",
"version": "afba937e540c902c989cd516fd97ea0c8499bb27",
"versionType": "git"
},
{
"lessThan": "276aef0fd2b92f41b920ac891c72cadeee957934",
"status": "affected",
"version": "afba937e540c902c989cd516fd97ea0c8499bb27",
"versionType": "git"
},
{
"lessThan": "67ed312124bb1b61858778ac0b985b48961c862a",
"status": "affected",
"version": "afba937e540c902c989cd516fd97ea0c8499bb27",
"versionType": "git"
},
{
"lessThan": "e3c874b05901dc519054b5107d16620e6d2b5fea",
"status": "affected",
"version": "afba937e540c902c989cd516fd97ea0c8499bb27",
"versionType": "git"
},
{
"lessThan": "8df672bfe3ec2268c2636584202755898e547173",
"status": "affected",
"version": "afba937e540c902c989cd516fd97ea0c8499bb27",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/class/cdc-wdm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.26"
},
{
"lessThan": "2.6.26",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "2.6.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: class: cdc-wdm: fix reordering issue in read code path\n\nQuoting the bug report:\n\nDue to compiler optimization or CPU out-of-order execution, the\ndesc-\u003elength update can be reordered before the memmove. If this\nhappens, wdm_read() can see the new length and call copy_to_user() on\nuninitialized memory. This also violates LKMM data race rules [1].\n\nFix it by using WRITE_ONCE and memory barriers."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:22.781Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/638328ca9c17ae6511ad62198c57bae32ffa3c91"
},
{
"url": "https://git.kernel.org/stable/c/170e8daca24da6edb4be82ab01abf44e87af387b"
},
{
"url": "https://git.kernel.org/stable/c/c8fa96ed021923dae147bcd9f9205b8df7b82360"
},
{
"url": "https://git.kernel.org/stable/c/4ee3062bf2c9a722afef429826e8607eaf3fc6a0"
},
{
"url": "https://git.kernel.org/stable/c/276aef0fd2b92f41b920ac891c72cadeee957934"
},
{
"url": "https://git.kernel.org/stable/c/67ed312124bb1b61858778ac0b985b48961c862a"
},
{
"url": "https://git.kernel.org/stable/c/e3c874b05901dc519054b5107d16620e6d2b5fea"
},
{
"url": "https://git.kernel.org/stable/c/8df672bfe3ec2268c2636584202755898e547173"
}
],
"title": "usb: class: cdc-wdm: fix reordering issue in read code path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43427",
"datePublished": "2026-05-08T14:22:00.345Z",
"dateReserved": "2026-05-01T14:12:56.009Z",
"dateUpdated": "2026-05-11T22:24:22.781Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45891 (GCVE-0-2026-45891)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-27 12:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: hns3: fix double free issue for tx spare buffer
In hns3_set_ringparam(), a temporary copy (tmp_rings) of the ring structure
is created for rollback. However, the tx_spare pointer in the original
ring handle is incorrectly left pointing to the old backup memory.
Later, if memory allocation fails in hns3_init_all_ring() during the setup,
the error path attempts to free all newly allocated rings. Since tx_spare
contains a stale (non-NULL) pointer from the backup, it is mistaken for
a newly allocated buffer and is erroneously freed, leading to a double-free
of the backup memory.
The root cause is that the tx_spare field was not cleared after its value
was saved in tmp_rings, leaving a dangling pointer.
Fix this by setting tx_spare to NULL in the original ring structure
when the creation of the new `tx_spare` fails. This ensures the
error cleanup path only frees genuinely newly allocated buffers.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 907676b130711fd1f627824559e92259db2061d1 Version: 907676b130711fd1f627824559e92259db2061d1 Version: 907676b130711fd1f627824559e92259db2061d1 Version: 907676b130711fd1f627824559e92259db2061d1 Version: 907676b130711fd1f627824559e92259db2061d1 Version: 907676b130711fd1f627824559e92259db2061d1 Version: 907676b130711fd1f627824559e92259db2061d1 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/hisilicon/hns3/hns3_enet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fb6a4c376d454b425555b1b0bda36e99f56ec307",
"status": "affected",
"version": "907676b130711fd1f627824559e92259db2061d1",
"versionType": "git"
},
{
"lessThan": "43015461662d41dcfb3bb95fadd8a2a42ad8eacf",
"status": "affected",
"version": "907676b130711fd1f627824559e92259db2061d1",
"versionType": "git"
},
{
"lessThan": "6dc10494cfe27b6f1e9adb7e293293ae39c50b7c",
"status": "affected",
"version": "907676b130711fd1f627824559e92259db2061d1",
"versionType": "git"
},
{
"lessThan": "d2c785733dfb853ea0b53984c75662a1af230a94",
"status": "affected",
"version": "907676b130711fd1f627824559e92259db2061d1",
"versionType": "git"
},
{
"lessThan": "fdbccddb7e7822016601829f95de4008e193f7bc",
"status": "affected",
"version": "907676b130711fd1f627824559e92259db2061d1",
"versionType": "git"
},
{
"lessThan": "c3659273860bed0c8e573b865e3769abc51225a8",
"status": "affected",
"version": "907676b130711fd1f627824559e92259db2061d1",
"versionType": "git"
},
{
"lessThan": "6d2f142b1e4b203387a92519d9d2e34752a79dbb",
"status": "affected",
"version": "907676b130711fd1f627824559e92259db2061d1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/hisilicon/hns3/hns3_enet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fix double free issue for tx spare buffer\n\nIn hns3_set_ringparam(), a temporary copy (tmp_rings) of the ring structure\nis created for rollback. However, the tx_spare pointer in the original\nring handle is incorrectly left pointing to the old backup memory.\n\nLater, if memory allocation fails in hns3_init_all_ring() during the setup,\nthe error path attempts to free all newly allocated rings. Since tx_spare\ncontains a stale (non-NULL) pointer from the backup, it is mistaken for\na newly allocated buffer and is erroneously freed, leading to a double-free\nof the backup memory.\n\nThe root cause is that the tx_spare field was not cleared after its value\nwas saved in tmp_rings, leaving a dangling pointer.\n\nFix this by setting tx_spare to NULL in the original ring structure\nwhen the creation of the new `tx_spare` fails. This ensures the\nerror cleanup path only frees genuinely newly allocated buffers."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:17:02.306Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fb6a4c376d454b425555b1b0bda36e99f56ec307"
},
{
"url": "https://git.kernel.org/stable/c/43015461662d41dcfb3bb95fadd8a2a42ad8eacf"
},
{
"url": "https://git.kernel.org/stable/c/6dc10494cfe27b6f1e9adb7e293293ae39c50b7c"
},
{
"url": "https://git.kernel.org/stable/c/d2c785733dfb853ea0b53984c75662a1af230a94"
},
{
"url": "https://git.kernel.org/stable/c/fdbccddb7e7822016601829f95de4008e193f7bc"
},
{
"url": "https://git.kernel.org/stable/c/c3659273860bed0c8e573b865e3769abc51225a8"
},
{
"url": "https://git.kernel.org/stable/c/6d2f142b1e4b203387a92519d9d2e34752a79dbb"
}
],
"title": "net: hns3: fix double free issue for tx spare buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45891",
"datePublished": "2026-05-27T12:17:02.306Z",
"dateReserved": "2026-05-13T15:03:33.083Z",
"dateUpdated": "2026-05-27T12:17:02.306Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53359 (GCVE-0-2026-53359)
Vulnerability from cvelistv5
Published
2026-07-04 11:51
Modified
2026-08-17 04:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Fix shadow paging use-after-free due to unexpected role
Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due
to unexpected GFN") fixed a shadow paging mismatch between stored and
computed GFNs; the bug could be triggered by changing a PDE mapping from
outside the guest, and then deleting a memslot. The rmap_remove()
call would miss entries created after the PDE change because the GFN
of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.
A similar hole however remains if the modified PDE points to a non-leaf
page. In this case the gfn can be made to match, but the role does not
match: the original large 2MB page creates a kvm_mmu_page with direct=1,
while the new 4KB needs a kvm_mmu_page with direct=0. However,
kvm_mmu_get_child_sp() does not compare the role, and therefore reuses
the page.
The next step is installing a leaf (4KB) SPTE on the new path which
records an rmap entry under the gfn resolved by the walk. But when
that child is zapped its parent kvm_mmu_page has direct=1 and
kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as
sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[]
in older kernels). It therefore fails to remove the recorded entry.
When the memslot is dropped the shadow page is freed but the rmap
entry survives, as in the scenario that was already fixed. Code that
later walks that gfn (dirty logging, MMU notifier invalidation, and
so on) dereferences an sptep that lies in the freed page, causing the
use-after-free.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2032a93d66fa282ba0f2ea9152eeff9511fa9a96 Version: 2032a93d66fa282ba0f2ea9152eeff9511fa9a96 Version: 2032a93d66fa282ba0f2ea9152eeff9511fa9a96 Version: 2032a93d66fa282ba0f2ea9152eeff9511fa9a96 Version: 2032a93d66fa282ba0f2ea9152eeff9511fa9a96 Version: 2032a93d66fa282ba0f2ea9152eeff9511fa9a96 |
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-06T18:38:14.568Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/06/7"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53359",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-08T03:56:43.137575Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T18:22:55.066Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/V4bel/Januscape/blob/main/assets/write-up.md"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/mmu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b1337aae5e194324e4810d561764e7793f8b3864",
"status": "affected",
"version": "2032a93d66fa282ba0f2ea9152eeff9511fa9a96",
"versionType": "git"
},
{
"lessThan": "9291654d69e08542de37755cebe4d5b02c3170d1",
"status": "affected",
"version": "2032a93d66fa282ba0f2ea9152eeff9511fa9a96",
"versionType": "git"
},
{
"lessThan": "2ad3afa40ac6aa340dada122f9abfa46c0a6eb35",
"status": "affected",
"version": "2032a93d66fa282ba0f2ea9152eeff9511fa9a96",
"versionType": "git"
},
{
"lessThan": "5e470998a23e4c3d89ed24e8172cb22747e61efa",
"status": "affected",
"version": "2032a93d66fa282ba0f2ea9152eeff9511fa9a96",
"versionType": "git"
},
{
"lessThan": "1ae7d5a6db6c190ce183e3098ca0e0846e14d462",
"status": "affected",
"version": "2032a93d66fa282ba0f2ea9152eeff9511fa9a96",
"versionType": "git"
},
{
"lessThan": "81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb",
"status": "affected",
"version": "2032a93d66fa282ba0f2ea9152eeff9511fa9a96",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/mmu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"lessThan": "2.6.36",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Fix shadow paging use-after-free due to unexpected role\n\nCommit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due\nto unexpected GFN\") fixed a shadow paging mismatch between stored and\ncomputed GFNs; the bug could be triggered by changing a PDE mapping from\noutside the guest, and then deleting a memslot. The rmap_remove()\ncall would miss entries created after the PDE change because the GFN\nof the leaf SPTE does not match the GFN of the struct kvm_mmu_page.\n\nA similar hole however remains if the modified PDE points to a non-leaf\npage. In this case the gfn can be made to match, but the role does not\nmatch: the original large 2MB page creates a kvm_mmu_page with direct=1,\nwhile the new 4KB needs a kvm_mmu_page with direct=0. However,\nkvm_mmu_get_child_sp() does not compare the role, and therefore reuses\nthe page.\n\nThe next step is installing a leaf (4KB) SPTE on the new path which\nrecords an rmap entry under the gfn resolved by the walk. But when\nthat child is zapped its parent kvm_mmu_page has direct=1 and\nkvm_mmu_page_get_gfn() computes the gfn for the 4KB page as\nsp-\u003egfn + index instead of using sp-\u003eshadowed_translation[] (or sp-\u003egfns[]\nin older kernels). It therefore fails to remove the recorded entry.\n\nWhen the memslot is dropped the shadow page is freed but the rmap\nentry survives, as in the scenario that was already fixed. Code that\nlater walks that gfn (dirty logging, MMU notifier invalidation, and\nso on) dereferences an sptep that lies in the freed page, causing the\nuse-after-free."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through local KVM guest execution/KVM ioctls and shadow-MMU page fault handling, not by network packets or adjacent/physical input. In the highest reasonable scenario, an attacker runs code in a guest on an x86 KVM host with shadow paging/nested virtualization exposed.\nAC:L - The bug is a deterministic role-confusion/use-after-free in shadow page reuse, and the attacker can drive the guest mapping changes and later rmap walks needed to hit it. No condition outside attacker influence is required once the vulnerable KVM configuration is present.\nPR:L - The attacker needs the ability to run code in a KVM guest or otherwise access KVM VM execution interfaces, but does not need host root or administrative privileges. This is low privilege relative to the host security boundary.\nUI:N - No victim user action is required after the attacker-controlled guest or KVM workload is running. The trigger is caused by guest execution and KVM memory-management operations.\nS:C - This is a KVM guest-to-host escape class vulnerability, crossing from the guest security authority into the host kernel/hypervisor. Compromise can affect resources outside the guest\u2019s own scope.\nC:H - The stale rmap entry dereferences an SPTE pointer in freed shadow-page memory, creating a kernel use-after-free. Such memory corruption can be leveraged for host kernel information disclosure and arbitrary memory access.\nI:H - The use-after-free can corrupt host kernel shadow-MMU/rmap state and provides a plausible path to host kernel code execution or arbitrary modification. Public analysis treats this as a KVM escape class issue, so high integrity impact is defensible.\nA:H - At minimum, walking the stale rmap can dereference freed memory and crash or panic the host kernel. A malicious guest can repeatedly trigger the condition, causing high availability impact to the host and colocated guests."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:28.262Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b1337aae5e194324e4810d561764e7793f8b3864"
},
{
"url": "https://git.kernel.org/stable/c/9291654d69e08542de37755cebe4d5b02c3170d1"
},
{
"url": "https://git.kernel.org/stable/c/2ad3afa40ac6aa340dada122f9abfa46c0a6eb35"
},
{
"url": "https://git.kernel.org/stable/c/5e470998a23e4c3d89ed24e8172cb22747e61efa"
},
{
"url": "https://git.kernel.org/stable/c/1ae7d5a6db6c190ce183e3098ca0e0846e14d462"
},
{
"url": "https://git.kernel.org/stable/c/81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb"
}
],
"title": "KVM: x86: Fix shadow paging use-after-free due to unexpected role",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53359",
"datePublished": "2026-07-04T11:51:49.052Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-08-17T04:50:28.262Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53279 (GCVE-0-2026-53279)
Vulnerability from cvelistv5
Published
2026-06-26 19:40
Modified
2026-06-26 19:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/gma500/oaktrail_lvds: fix hang on init failure
The LVDS init code looks up an I2C adapter using i2c_get_adapter() and
tries to read the EDID before falling back to allocating and registering
its own adapter.
The error handling does not separate these cases so on a late init
failure it will try to deregister and free also an adapter that had
previously been registered. Since i2c_get_adapter() takes another
reference to the adapter, deregistration hangs indefinitely while
waiting for the reference to be released.
Fix this by only destroying adapters allocated during LVDS init on
errors.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a57ebfc0b4da16a3f36bfebb158198aab3e340f8 Version: a57ebfc0b4da16a3f36bfebb158198aab3e340f8 Version: a57ebfc0b4da16a3f36bfebb158198aab3e340f8 Version: a57ebfc0b4da16a3f36bfebb158198aab3e340f8 Version: a57ebfc0b4da16a3f36bfebb158198aab3e340f8 Version: a57ebfc0b4da16a3f36bfebb158198aab3e340f8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/gma500/oaktrail_lvds.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5fe9f505d8578852c30668567bc3ce52e776e8c7",
"status": "affected",
"version": "a57ebfc0b4da16a3f36bfebb158198aab3e340f8",
"versionType": "git"
},
{
"lessThan": "4e04b564c005c9900643c56656d751ad677889be",
"status": "affected",
"version": "a57ebfc0b4da16a3f36bfebb158198aab3e340f8",
"versionType": "git"
},
{
"lessThan": "7877f7e231a8bd5c817af1491276550a5e195cd7",
"status": "affected",
"version": "a57ebfc0b4da16a3f36bfebb158198aab3e340f8",
"versionType": "git"
},
{
"lessThan": "ab9256936b58eb178caddcf5b5b1638f079909d2",
"status": "affected",
"version": "a57ebfc0b4da16a3f36bfebb158198aab3e340f8",
"versionType": "git"
},
{
"lessThan": "f6fc44af3bbd5ab0fb6bdec6f47decca11b38425",
"status": "affected",
"version": "a57ebfc0b4da16a3f36bfebb158198aab3e340f8",
"versionType": "git"
},
{
"lessThan": "657a091ab6d01d0091b77660c75cfed573c9a53e",
"status": "affected",
"version": "a57ebfc0b4da16a3f36bfebb158198aab3e340f8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/gma500/oaktrail_lvds.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gma500/oaktrail_lvds: fix hang on init failure\n\nThe LVDS init code looks up an I2C adapter using i2c_get_adapter() and\ntries to read the EDID before falling back to allocating and registering\nits own adapter.\n\nThe error handling does not separate these cases so on a late init\nfailure it will try to deregister and free also an adapter that had\npreviously been registered. Since i2c_get_adapter() takes another\nreference to the adapter, deregistration hangs indefinitely while\nwaiting for the reference to be released.\n\nFix this by only destroying adapters allocated during LVDS init on\nerrors."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T19:40:41.489Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5fe9f505d8578852c30668567bc3ce52e776e8c7"
},
{
"url": "https://git.kernel.org/stable/c/4e04b564c005c9900643c56656d751ad677889be"
},
{
"url": "https://git.kernel.org/stable/c/7877f7e231a8bd5c817af1491276550a5e195cd7"
},
{
"url": "https://git.kernel.org/stable/c/ab9256936b58eb178caddcf5b5b1638f079909d2"
},
{
"url": "https://git.kernel.org/stable/c/f6fc44af3bbd5ab0fb6bdec6f47decca11b38425"
},
{
"url": "https://git.kernel.org/stable/c/657a091ab6d01d0091b77660c75cfed573c9a53e"
}
],
"title": "drm/gma500/oaktrail_lvds: fix hang on init failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53279",
"datePublished": "2026-06-26T19:40:41.489Z",
"dateReserved": "2026-06-09T07:44:35.395Z",
"dateUpdated": "2026-06-26T19:40:41.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43133 (GCVE-0-2026-43133)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-08-26 12:04
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation
Commit cc3ed80ae69f ("KVM: nSVM: always use vmcb01 to for vmsave/vmload
of guest state") made KVM always use vmcb01 for the fields controlled by
VMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code
to always use vmcb01.
As a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not
intercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01
instead of the current VMCB.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cc3ed80ae69f454c3d904af9f65394a540099723 Version: cc3ed80ae69f454c3d904af9f65394a540099723 Version: cc3ed80ae69f454c3d904af9f65394a540099723 Version: cc3ed80ae69f454c3d904af9f65394a540099723 Version: cc3ed80ae69f454c3d904af9f65394a540099723 Version: cc3ed80ae69f454c3d904af9f65394a540099723 Version: cc3ed80ae69f454c3d904af9f65394a540099723 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "libkrun",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift/ose-rhel-coreos-9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Kernel-based Virtual Machine (KVM) nSVM module. When a nested virtual machine (L2 guest) executes VMSAVE/VMLOAD instructions, and these are not intercepted by the first-level hypervisor (L1), KVM incorrectly uses `vmcb02` instead of `vmcb01` for managing guest state. This incorrect Virtual Machine Control Block (VMCB) handling could lead to unexpected behavior or state corruption within the virtualized environment."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.9,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-628",
"description": "Function Call with Incorrectly Specified Arguments",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:04:46.777Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-43133"
},
{
"name": "RHBZ#2467065",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467065"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43133.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-06T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-06T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/svm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "10063e1251c1485034a018236080792ad083dcc5",
"status": "affected",
"version": "cc3ed80ae69f454c3d904af9f65394a540099723",
"versionType": "git"
},
{
"lessThan": "c3b7015000988ba35ecd5648f4b2283960f00543",
"status": "affected",
"version": "cc3ed80ae69f454c3d904af9f65394a540099723",
"versionType": "git"
},
{
"lessThan": "3880e331b0b31d0d5d3702b124f6c93539cd478a",
"status": "affected",
"version": "cc3ed80ae69f454c3d904af9f65394a540099723",
"versionType": "git"
},
{
"lessThan": "fce2fd4a2ca05670a91015aacccf96a1c26268fd",
"status": "affected",
"version": "cc3ed80ae69f454c3d904af9f65394a540099723",
"versionType": "git"
},
{
"lessThan": "d464cf1ed900d47c85393d40b00017b6adfc2e6c",
"status": "affected",
"version": "cc3ed80ae69f454c3d904af9f65394a540099723",
"versionType": "git"
},
{
"lessThan": "0004ecb798b30e90d7ebfe74efae2d9423315a64",
"status": "affected",
"version": "cc3ed80ae69f454c3d904af9f65394a540099723",
"versionType": "git"
},
{
"lessThan": "127ccae2c185f62e6ecb4bf24f9cb307e9b9c619",
"status": "affected",
"version": "cc3ed80ae69f454c3d904af9f65394a540099723",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/svm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation\n\nCommit cc3ed80ae69f (\"KVM: nSVM: always use vmcb01 to for vmsave/vmload\nof guest state\") made KVM always use vmcb01 for the fields controlled by\nVMSAVE/VMLOAD, but it missed updating the VMLOAD/VMSAVE emulation code\nto always use vmcb01.\n\nAs a result, if VMSAVE/VMLOAD is executed by an L2 guest and is not\nintercepted by L1, KVM will mistakenly use vmcb02. Always use vmcb01\ninstead of the current VMCB."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached by locally running a KVM vCPU through /dev/kvm and executing nested SVM VMLOAD/VMSAVE from an L2 guest; it is not reachable via network packets.\nAC:L - The trigger is deterministic once nested SVM is available: configure L1 not to intercept VMLOAD/VMSAVE and execute the instruction in L2. No race or attacker-uncontrolled timing condition is required.\nPR:L - The attacker needs the ability to create/run a KVM VM or execute code in a nested guest, which is local low privilege where /dev/kvm is delegated. No real init-namespace root capability is required by the vulnerable emulation path itself.\nUI:N - After the VM/nested guest is running, exploitation is triggered solely by guest instruction execution. No additional victim user action is required.\nS:C - The bug is in KVM\u2019s enforcement of the nested virtualization boundary, where L2 execution causes KVM to operate on the wrong L0-maintained VMCB state. That can affect resources outside the L2 guest\u2019s own security authority.\nC:L - VMSAVE can copy bounded VMLOAD/VMSAVE save-state fields from the wrong internal VMCB into guest-accessible memory. I did not identify an arbitrary host-memory read primitive, so the defensible confidentiality impact is limited.\nI:L - VMLOAD can corrupt a bounded set of VMLOAD/VMSAVE state fields in the wrong KVM VMCB, causing incorrect nested guest/L1 state handling. I did not find a direct arbitrary host write or host code execution primitive.\nA:H - The wrong VMCB state can make nested VM execution fail or crash/hang the affected virtual machine/vCPU, and the attacker can trigger it repeatedly. This is a complete availability impact for the affected nested virtualization workload, even though I did not find a host kernel panic path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:09.214Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/10063e1251c1485034a018236080792ad083dcc5"
},
{
"url": "https://git.kernel.org/stable/c/c3b7015000988ba35ecd5648f4b2283960f00543"
},
{
"url": "https://git.kernel.org/stable/c/3880e331b0b31d0d5d3702b124f6c93539cd478a"
},
{
"url": "https://git.kernel.org/stable/c/fce2fd4a2ca05670a91015aacccf96a1c26268fd"
},
{
"url": "https://git.kernel.org/stable/c/d464cf1ed900d47c85393d40b00017b6adfc2e6c"
},
{
"url": "https://git.kernel.org/stable/c/0004ecb798b30e90d7ebfe74efae2d9423315a64"
},
{
"url": "https://git.kernel.org/stable/c/127ccae2c185f62e6ecb4bf24f9cb307e9b9c619"
}
],
"title": "KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43133",
"datePublished": "2026-05-06T11:27:20.882Z",
"dateReserved": "2026-05-01T14:12:55.988Z",
"dateUpdated": "2026-08-26T12:04:46.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45868 (GCVE-0-2026-45868)
Vulnerability from cvelistv5
Published
2026-05-27 12:15
Modified
2026-05-27 12:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
pinctrl: single: fix refcount leak in pcs_add_gpio_func()
of_parse_phandle_with_args() returns a device_node pointer with refcount
incremented in gpiospec.np. The loop iterates through all phandles but
never releases the reference, causing a refcount leak on each iteration.
Add of_node_put() calls to release the reference after extracting the
needed arguments and on the error path when devm_kzalloc() fails.
This bug was detected by our static analysis tool and verified by my
code review.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a1a277eb76b3507df7c41774048a644aa4dfd096 Version: a1a277eb76b3507df7c41774048a644aa4dfd096 Version: a1a277eb76b3507df7c41774048a644aa4dfd096 Version: a1a277eb76b3507df7c41774048a644aa4dfd096 Version: a1a277eb76b3507df7c41774048a644aa4dfd096 Version: a1a277eb76b3507df7c41774048a644aa4dfd096 Version: a1a277eb76b3507df7c41774048a644aa4dfd096 Version: a1a277eb76b3507df7c41774048a644aa4dfd096 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pinctrl/pinctrl-single.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "191bfd5710d6a7f48ba4315d8d3e908dcc15243c",
"status": "affected",
"version": "a1a277eb76b3507df7c41774048a644aa4dfd096",
"versionType": "git"
},
{
"lessThan": "3e3b28bb0b6ddc521a4fdd1c1ba0d35017a0796b",
"status": "affected",
"version": "a1a277eb76b3507df7c41774048a644aa4dfd096",
"versionType": "git"
},
{
"lessThan": "456a60d06c09a92680dc35fabca68024badcc28e",
"status": "affected",
"version": "a1a277eb76b3507df7c41774048a644aa4dfd096",
"versionType": "git"
},
{
"lessThan": "99cc7352156c65201c675f750e0e77c4c73d93f5",
"status": "affected",
"version": "a1a277eb76b3507df7c41774048a644aa4dfd096",
"versionType": "git"
},
{
"lessThan": "7814b1431848854b56717086e2b61bea3c59753d",
"status": "affected",
"version": "a1a277eb76b3507df7c41774048a644aa4dfd096",
"versionType": "git"
},
{
"lessThan": "e2e367e56bacb93ce5ac73f0b3297d5c83d38dd4",
"status": "affected",
"version": "a1a277eb76b3507df7c41774048a644aa4dfd096",
"versionType": "git"
},
{
"lessThan": "5b9e84d27e310f22c4ba45fedbc4f5baf43dd823",
"status": "affected",
"version": "a1a277eb76b3507df7c41774048a644aa4dfd096",
"versionType": "git"
},
{
"lessThan": "353353309b0f7afa407df29e455f9d15b5acc296",
"status": "affected",
"version": "a1a277eb76b3507df7c41774048a644aa4dfd096",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pinctrl/pinctrl-single.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: single: fix refcount leak in pcs_add_gpio_func()\n\nof_parse_phandle_with_args() returns a device_node pointer with refcount\nincremented in gpiospec.np. The loop iterates through all phandles but\nnever releases the reference, causing a refcount leak on each iteration.\n\nAdd of_node_put() calls to release the reference after extracting the\nneeded arguments and on the error path when devm_kzalloc() fails.\n\nThis bug was detected by our static analysis tool and verified by my\ncode review."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:15:48.311Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/191bfd5710d6a7f48ba4315d8d3e908dcc15243c"
},
{
"url": "https://git.kernel.org/stable/c/3e3b28bb0b6ddc521a4fdd1c1ba0d35017a0796b"
},
{
"url": "https://git.kernel.org/stable/c/456a60d06c09a92680dc35fabca68024badcc28e"
},
{
"url": "https://git.kernel.org/stable/c/99cc7352156c65201c675f750e0e77c4c73d93f5"
},
{
"url": "https://git.kernel.org/stable/c/7814b1431848854b56717086e2b61bea3c59753d"
},
{
"url": "https://git.kernel.org/stable/c/e2e367e56bacb93ce5ac73f0b3297d5c83d38dd4"
},
{
"url": "https://git.kernel.org/stable/c/5b9e84d27e310f22c4ba45fedbc4f5baf43dd823"
},
{
"url": "https://git.kernel.org/stable/c/353353309b0f7afa407df29e455f9d15b5acc296"
}
],
"title": "pinctrl: single: fix refcount leak in pcs_add_gpio_func()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45868",
"datePublished": "2026-05-27T12:15:48.311Z",
"dateReserved": "2026-05-13T15:03:33.080Z",
"dateUpdated": "2026-05-27T12:15:48.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45861 (GCVE-0-2026-45861)
Vulnerability from cvelistv5
Published
2026-05-27 12:15
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
gfs2: Fix slab-use-after-free in qd_put
Commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously")
started freeing quota data objects during filesystem shutdown instead of
putting them back onto the LRU list, but it failed to remove these
objects from the LRU list, causing LRU list corruption. This caused
use-after-free when the shrinker (gfs2_qd_shrink_scan) tried to access
already-freed objects on the LRU list.
Fix this by removing qd objects from the LRU list before freeing them in
qd_put().
Initial fix from Deepanshu Kartikey <kartikey406@gmail.com>.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/gfs2/quota.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ca7c67bdd293089b3483f18886d6b2d0037d2ad9",
"status": "affected",
"version": "a475c5dd16e57c570113eccba51955b5df8bb052",
"versionType": "git"
},
{
"lessThan": "1d47922b98046b8070a77347fb883a6523792803",
"status": "affected",
"version": "a475c5dd16e57c570113eccba51955b5df8bb052",
"versionType": "git"
},
{
"lessThan": "80fff26d7a0c3926b511661c27eecc811a420eef",
"status": "affected",
"version": "a475c5dd16e57c570113eccba51955b5df8bb052",
"versionType": "git"
},
{
"lessThan": "22150a7d401d9e9169b9b68e05bed95f7f49bf69",
"status": "affected",
"version": "a475c5dd16e57c570113eccba51955b5df8bb052",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/gfs2/quota.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix slab-use-after-free in qd_put\n\nCommit a475c5dd16e5 (\"gfs2: Free quota data objects synchronously\")\nstarted freeing quota data objects during filesystem shutdown instead of\nputting them back onto the LRU list, but it failed to remove these\nobjects from the LRU list, causing LRU list corruption. This caused\nuse-after-free when the shrinker (gfs2_qd_shrink_scan) tried to access\nalready-freed objects on the LRU list.\n\nFix this by removing qd objects from the LRU list before freeing them in\nqd_put().\n\nInitial fix from Deepanshu Kartikey \u003ckartikey406@gmail.com\u003e."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - GFS2 is a local disk filesystem with no network-facing handler; the vulnerable qd lifecycle is reached only via local filesystem operations (mount, quota-incurring I/O, unmount/withdrawal, and the memory shrinker). No remote peer data path exists.\nAC:L - The bug leaves a freed object permanently linked on the global gfs2_qd_lru, so it is persistent rather than a tight race; the attacker can reliably drive the shrinker into the freed object by inducing memory pressure, with no condition outside the attacker\u0027s control.\nPR:L - Triggering requires local access to a GFS2 filesystem and the poisoned LRU is then dereferenced by an unprivileged memory-pressure-driven shrinker walk; consistent with clustered-filesystem UAF scoring (ocfs2 CVE-2026-31597/43075).\nUI:N - Once the LRU is corrupted, the use-after-free is reached through ordinary kernel memory reclaim without requiring any separate victim action.\nS:U - The corruption and its impact are confined to the kernel\u0027s own memory/security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The shrinker reads fields of the freed gfs2_quota_data object, and the freed slab can be reallocated with attacker-controlled data, enabling kernel memory disclosure typical of a use-after-free.\nI:H - gfs2_qd_isolate writes to the freed object (lockref_mark_dead and list_lru_isolate_move), giving a write primitive over freed/reallocated memory that can be leveraged for heap manipulation and control-flow corruption.\nA:H - The slab-use-after-free reliably corrupts the LRU list and freed memory, causing kernel oops/panic as observed by KASAN/syzbot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:33.187Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ca7c67bdd293089b3483f18886d6b2d0037d2ad9"
},
{
"url": "https://git.kernel.org/stable/c/1d47922b98046b8070a77347fb883a6523792803"
},
{
"url": "https://git.kernel.org/stable/c/80fff26d7a0c3926b511661c27eecc811a420eef"
},
{
"url": "https://git.kernel.org/stable/c/22150a7d401d9e9169b9b68e05bed95f7f49bf69"
}
],
"title": "gfs2: Fix slab-use-after-free in qd_put",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45861",
"datePublished": "2026-05-27T12:15:41.057Z",
"dateReserved": "2026-05-13T15:03:33.080Z",
"dateUpdated": "2026-08-05T12:28:33.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53070 (GCVE-0-2026-53070)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: disable BH before calling udp_tunnel_xmit_skb()
udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with
BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit to
tunnel xmit functions"), on the path:
udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit()
dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU.
Without local_bh_disable(), the context may move between CPUs, which can
break the inc/dec pairing. This may lead to incorrect recursion level
detection and cause packets to be dropped in ip(6)_tunnel_xmit() or
__dev_queue_xmit().
Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths.
In my testing, after enabling the SCTP over UDP:
# ip net exec ha sysctl -w net.sctp.udp_port=9899
# ip net exec ha sysctl -w net.sctp.encap_port=9899
# ip net exec hb sysctl -w net.sctp.udp_port=9899
# ip net exec hb sysctl -w net.sctp.encap_port=9899
# ip net exec ha iperf3 -s
- without this patch:
# ip net exec hb iperf3 -c 192.168.0.1 --sctp
[ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender
[ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver
- with this patch:
# ip net exec hb iperf3 -c 192.168.0.1 --sctp
[ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender
[ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/ipv6.c",
"net/sctp/protocol.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "be3bfcb34bda04f6a350710db471d4133f950f2c",
"status": "affected",
"version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
"versionType": "git"
},
{
"lessThan": "0de7db2eb27e82b983157016fa604b1ba664ae5f",
"status": "affected",
"version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
"versionType": "git"
},
{
"lessThan": "790093245e35040c2adb15f48970020425aa3f47",
"status": "affected",
"version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
"versionType": "git"
},
{
"lessThan": "2cd7e6971fc2787408ceef17906ea152791448cf",
"status": "affected",
"version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/ipv6.c",
"net/sctp/protocol.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: disable BH before calling udp_tunnel_xmit_skb()\n\nudp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with\nBH disabled. After commit 6f1a9140ecda (\"add xmit recursion limit to\ntunnel xmit functions\"), on the path:\n\n udp(6)_tunnel_xmit_skb() -\u003e ip(6)tunnel_xmit()\n\ndev_xmit_recursion_inc()/dec() must stay balanced on the same CPU.\n\nWithout local_bh_disable(), the context may move between CPUs, which can\nbreak the inc/dec pairing. This may lead to incorrect recursion level\ndetection and cause packets to be dropped in ip(6)_tunnel_xmit() or\n__dev_queue_xmit().\n\nFix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths.\n\nIn my testing, after enabling the SCTP over UDP:\n\n # ip net exec ha sysctl -w net.sctp.udp_port=9899\n # ip net exec ha sysctl -w net.sctp.encap_port=9899\n # ip net exec hb sysctl -w net.sctp.udp_port=9899\n # ip net exec hb sysctl -w net.sctp.encap_port=9899\n\n # ip net exec ha iperf3 -s\n\n- without this patch:\n\n # ip net exec hb iperf3 -c 192.168.0.1 --sctp\n [ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender\n [ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver\n\n- with this patch:\n\n # ip net exec hb iperf3 -c 192.168.0.1 --sctp\n [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender\n [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - SCTP-over-UDP transmit is reachable from network-facing SCTP endpoints when received packets or application-level requests cause replies through the SCTP output path. A remote peer can trigger the affected UDP-encapsulated transmit path in a reasonable SCTP service deployment.\nAC:L - The bug is triggered by repeatedly causing SCTP-over-UDP transmission in process/backlog context where BH is not disabled. Although CPU migration/preemption timing is involved, the attacker can drive repeated transmissions and the higher-severity choice is AC:L.\nPR:N - A remote SCTP peer does not need local credentials or kernel privileges to send packets to an SCTP-over-UDP service and induce responses. Local setup of SCTP-over-UDP may require configuration, but exploitation of an exposed configured service is unauthenticated.\nUI:N - No victim user action is required once an SCTP-over-UDP endpoint is exposed. The attacker only sends network traffic.\nS:U - The impact remains within the kernel networking stack and host network availability. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:N - The bug corrupts transmit recursion accounting, not packet contents or attacker-readable memory. I found no evidence of an information disclosure primitive.\nI:N - The issue causes incorrect recursion detection and packet drops, not arbitrary writes, control-flow hijack, or attacker-controlled data modification. The only modified state is internal transmit recursion accounting.\nA:H - Unbalanced per-CPU transmit recursion counters can become stale or underflowed, causing false recursion-limit detection and persistent packet drops in tunnel or device transmit paths. Repeated triggering can deny network availability for affected SCTP-over-UDP traffic and potentially broader transmit paths on affected CPUs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:04.761Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/be3bfcb34bda04f6a350710db471d4133f950f2c"
},
{
"url": "https://git.kernel.org/stable/c/0de7db2eb27e82b983157016fa604b1ba664ae5f"
},
{
"url": "https://git.kernel.org/stable/c/790093245e35040c2adb15f48970020425aa3f47"
},
{
"url": "https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf"
}
],
"title": "sctp: disable BH before calling udp_tunnel_xmit_skb()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53070",
"datePublished": "2026-06-24T16:30:11.816Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-08-05T12:33:04.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23394 (GCVE-0-2026-23394)
Vulnerability from cvelistv5
Published
2026-03-25 10:33
Modified
2026-08-19 16:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Give up GC if MSG_PEEK intervened.
Igor Ushakov reported that GC purged the receive queue of
an alive socket due to a race with MSG_PEEK with a nice repro.
This is the exact same issue previously fixed by commit
cbcf01128d0a ("af_unix: fix garbage collect vs MSG_PEEK").
After GC was replaced with the current algorithm, the cited
commit removed the locking dance in unix_peek_fds() and
reintroduced the same issue.
The problem is that MSG_PEEK bumps a file refcount without
interacting with GC.
Consider an SCC containing sk-A and sk-B, where sk-A is
close()d but can be recv()ed via sk-B.
The bad thing happens if sk-A is recv()ed with MSG_PEEK from
sk-B and sk-B is close()d while GC is checking unix_vertex_dead()
for sk-A and sk-B.
GC thread User thread
--------- -----------
unix_vertex_dead(sk-A)
-> true <------.
\
`------ recv(sk-B, MSG_PEEK)
invalidate !! -> sk-A's file refcount : 1 -> 2
close(sk-B)
-> sk-B's file refcount : 2 -> 1
unix_vertex_dead(sk-B)
-> true
Initially, sk-A's file refcount is 1 by the inflight fd in sk-B
recvq. GC thinks sk-A is dead because the file refcount is the
same as the number of its inflight fds.
However, sk-A's file refcount is bumped silently by MSG_PEEK,
which invalidates the previous evaluation.
At this moment, sk-B's file refcount is 2; one by the open fd,
and one by the inflight fd in sk-A. The subsequent close()
releases one refcount by the former.
Finally, GC incorrectly concludes that both sk-A and sk-B are dead.
One option is to restore the locking dance in unix_peek_fds(),
but we can resolve this more elegantly thanks to the new algorithm.
The point is that the issue does not occur without the subsequent
close() and we actually do not need to synchronise MSG_PEEK with
the dead SCC detection.
When the issue occurs, close() and GC touch the same file refcount.
If GC sees the refcount being decremented by close(), it can just
give up garbage-collecting the SCC.
Therefore, we only need to signal the race during MSG_PEEK with
a proper memory barrier to make it visible to the GC.
Let's use seqcount_t to notify GC when MSG_PEEK occurs and let
it defer the SCC to the next run.
This way no locking is needed on the MSG_PEEK side, and we can
avoid imposing a penalty on every MSG_PEEK unnecessarily.
Note that we can retry within unix_scc_dead() if MSG_PEEK is
detected, but we do not do so to avoid hung task splat from
abusive MSG_PEEK calls.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 61a75360dca93c945ef6bd757f8b8a96f39b77cb Version: 7b1ffbd3b22e755d481d49647dcb7c5cfbde5844 Version: 118f457da9ed58a79e24b73c2ef0aa1987241f0e Version: 118f457da9ed58a79e24b73c2ef0aa1987241f0e Version: 118f457da9ed58a79e24b73c2ef0aa1987241f0e Version: 118f457da9ed58a79e24b73c2ef0aa1987241f0e Version: 6.1.141 ≤ Version: 6.6.93 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/unix/af_unix.c",
"net/unix/af_unix.h",
"net/unix/garbage.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "980999a96e1ad043f1197606e5d637219cb102b9",
"status": "affected",
"version": "61a75360dca93c945ef6bd757f8b8a96f39b77cb",
"versionType": "git"
},
{
"lessThan": "3106f326f67c03dd9da4ca64663d11e40138cf40",
"status": "affected",
"version": "7b1ffbd3b22e755d481d49647dcb7c5cfbde5844",
"versionType": "git"
},
{
"lessThan": "e3dd56fb5683ba80bf8d7a2f9aa21cfa53f05202",
"status": "affected",
"version": "118f457da9ed58a79e24b73c2ef0aa1987241f0e",
"versionType": "git"
},
{
"lessThan": "72cf49ad50c16270b52bc512d9c2df5743922968",
"status": "affected",
"version": "118f457da9ed58a79e24b73c2ef0aa1987241f0e",
"versionType": "git"
},
{
"lessThan": "37dd7ab332396eb8dd80b2dc7ea4b61abf767436",
"status": "affected",
"version": "118f457da9ed58a79e24b73c2ef0aa1987241f0e",
"versionType": "git"
},
{
"lessThan": "e5b31d988a41549037b8d8721a3c3cae893d8670",
"status": "affected",
"version": "118f457da9ed58a79e24b73c2ef0aa1987241f0e",
"versionType": "git"
},
{
"lessThan": "6.1.183",
"status": "affected",
"version": "6.1.141",
"versionType": "semver"
},
{
"lessThan": "6.6.142",
"status": "affected",
"version": "6.6.93",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/unix/af_unix.c",
"net/unix/af_unix.h",
"net/unix/garbage.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "6.1.141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "6.6.93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Give up GC if MSG_PEEK intervened.\n\nIgor Ushakov reported that GC purged the receive queue of\nan alive socket due to a race with MSG_PEEK with a nice repro.\n\nThis is the exact same issue previously fixed by commit\ncbcf01128d0a (\"af_unix: fix garbage collect vs MSG_PEEK\").\n\nAfter GC was replaced with the current algorithm, the cited\ncommit removed the locking dance in unix_peek_fds() and\nreintroduced the same issue.\n\nThe problem is that MSG_PEEK bumps a file refcount without\ninteracting with GC.\n\nConsider an SCC containing sk-A and sk-B, where sk-A is\nclose()d but can be recv()ed via sk-B.\n\nThe bad thing happens if sk-A is recv()ed with MSG_PEEK from\nsk-B and sk-B is close()d while GC is checking unix_vertex_dead()\nfor sk-A and sk-B.\n\n GC thread User thread\n --------- -----------\n unix_vertex_dead(sk-A)\n -\u003e true \u003c------.\n \\\n `------ recv(sk-B, MSG_PEEK)\n invalidate !! -\u003e sk-A\u0027s file refcount : 1 -\u003e 2\n\n close(sk-B)\n -\u003e sk-B\u0027s file refcount : 2 -\u003e 1\n unix_vertex_dead(sk-B)\n -\u003e true\n\nInitially, sk-A\u0027s file refcount is 1 by the inflight fd in sk-B\nrecvq. GC thinks sk-A is dead because the file refcount is the\nsame as the number of its inflight fds.\n\nHowever, sk-A\u0027s file refcount is bumped silently by MSG_PEEK,\nwhich invalidates the previous evaluation.\n\nAt this moment, sk-B\u0027s file refcount is 2; one by the open fd,\nand one by the inflight fd in sk-A. The subsequent close()\nreleases one refcount by the former.\n\nFinally, GC incorrectly concludes that both sk-A and sk-B are dead.\n\nOne option is to restore the locking dance in unix_peek_fds(),\nbut we can resolve this more elegantly thanks to the new algorithm.\n\nThe point is that the issue does not occur without the subsequent\nclose() and we actually do not need to synchronise MSG_PEEK with\nthe dead SCC detection.\n\nWhen the issue occurs, close() and GC touch the same file refcount.\nIf GC sees the refcount being decremented by close(), it can just\ngive up garbage-collecting the SCC.\n\nTherefore, we only need to signal the race during MSG_PEEK with\na proper memory barrier to make it visible to the GC.\n\nLet\u0027s use seqcount_t to notify GC when MSG_PEEK occurs and let\nit defer the SCC to the next run.\n\nThis way no locking is needed on the MSG_PEEK side, and we can\navoid imposing a penalty on every MSG_PEEK unnecessarily.\n\nNote that we can retry within unix_scc_dead() if MSG_PEEK is\ndetected, but we do not do so to avoid hung task splat from\nabusive MSG_PEEK calls."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:27:54.571Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/980999a96e1ad043f1197606e5d637219cb102b9"
},
{
"url": "https://git.kernel.org/stable/c/3106f326f67c03dd9da4ca64663d11e40138cf40"
},
{
"url": "https://git.kernel.org/stable/c/e3dd56fb5683ba80bf8d7a2f9aa21cfa53f05202"
},
{
"url": "https://git.kernel.org/stable/c/72cf49ad50c16270b52bc512d9c2df5743922968"
},
{
"url": "https://git.kernel.org/stable/c/37dd7ab332396eb8dd80b2dc7ea4b61abf767436"
},
{
"url": "https://git.kernel.org/stable/c/e5b31d988a41549037b8d8721a3c3cae893d8670"
}
],
"title": "af_unix: Give up GC if MSG_PEEK intervened.",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23394",
"datePublished": "2026-03-25T10:33:18.180Z",
"dateReserved": "2026-01-13T15:37:46.011Z",
"dateUpdated": "2026-08-19T16:27:54.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53139 (GCVE-0-2026-53139)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-07-04 11:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Skip CSD when it has zeroed workgroups
A compute shader dispatch encodes its workgroup counts in the CFG0..CFG2
registers. Kicking off a dispatch with a zero count in any of the three
dimensions is invalid. First, the hardware will process 0 as 65536,
while the user-space driver exposes a maximum of 65535. Over that, a
submission with a zeroed workgroup dimension should be a no-op.
These zeroed counts can reach the dispatch path through an indirect CSD
job, whose workgroup counts are only known once the indirect buffer is
read and may legitimately be zero, but such scenario should only result in
a no-op.
Overwrite the indirect CSD job workgroup counts with the indirect BO
ones, even if they are zeroed, and don't submit the job to the hardware
when any of the workgroup counts is zero, so the job completes immediately
instead of running the shader.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d223f98f02099b002903b9b22b56febae16ef80d Version: d223f98f02099b002903b9b22b56febae16ef80d Version: d223f98f02099b002903b9b22b56febae16ef80d Version: d223f98f02099b002903b9b22b56febae16ef80d Version: d223f98f02099b002903b9b22b56febae16ef80d Version: d223f98f02099b002903b9b22b56febae16ef80d Version: d223f98f02099b002903b9b22b56febae16ef80d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/v3d/v3d_sched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b3a8dd72b0d008ff142880b4dbe5ca37dcf962b4",
"status": "affected",
"version": "d223f98f02099b002903b9b22b56febae16ef80d",
"versionType": "git"
},
{
"lessThan": "8b51c5406ad748c3d5575b66b6009b5dbbc08b80",
"status": "affected",
"version": "d223f98f02099b002903b9b22b56febae16ef80d",
"versionType": "git"
},
{
"lessThan": "abb069fdf51a9ddabcc1ed125dafe54e2089900b",
"status": "affected",
"version": "d223f98f02099b002903b9b22b56febae16ef80d",
"versionType": "git"
},
{
"lessThan": "ad166139d123dc162e8636f0c7962516d04074e1",
"status": "affected",
"version": "d223f98f02099b002903b9b22b56febae16ef80d",
"versionType": "git"
},
{
"lessThan": "9655b56b6de918e1c22b92f3880ae41b052cbd00",
"status": "affected",
"version": "d223f98f02099b002903b9b22b56febae16ef80d",
"versionType": "git"
},
{
"lessThan": "11e6432836394e00d39e468cd514f9ddb66f1e49",
"status": "affected",
"version": "d223f98f02099b002903b9b22b56febae16ef80d",
"versionType": "git"
},
{
"lessThan": "7f93fad5ea0affc9e1505dd0f7596c0fdb496213",
"status": "affected",
"version": "d223f98f02099b002903b9b22b56febae16ef80d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/v3d/v3d_sched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Skip CSD when it has zeroed workgroups\n\nA compute shader dispatch encodes its workgroup counts in the CFG0..CFG2\nregisters. Kicking off a dispatch with a zero count in any of the three\ndimensions is invalid. First, the hardware will process 0 as 65536,\nwhile the user-space driver exposes a maximum of 65535. Over that, a\nsubmission with a zeroed workgroup dimension should be a no-op.\n\nThese zeroed counts can reach the dispatch path through an indirect CSD\njob, whose workgroup counts are only known once the indirect buffer is\nread and may legitimately be zero, but such scenario should only result in\na no-op.\n\nOverwrite the indirect CSD job workgroup counts with the indirect BO\nones, even if they are zeroed, and don\u0027t submit the job to the hardware\nwhen any of the workgroup counts is zero, so the job completes immediately\ninstead of running the shader."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:50:52.146Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b3a8dd72b0d008ff142880b4dbe5ca37dcf962b4"
},
{
"url": "https://git.kernel.org/stable/c/8b51c5406ad748c3d5575b66b6009b5dbbc08b80"
},
{
"url": "https://git.kernel.org/stable/c/abb069fdf51a9ddabcc1ed125dafe54e2089900b"
},
{
"url": "https://git.kernel.org/stable/c/ad166139d123dc162e8636f0c7962516d04074e1"
},
{
"url": "https://git.kernel.org/stable/c/9655b56b6de918e1c22b92f3880ae41b052cbd00"
},
{
"url": "https://git.kernel.org/stable/c/11e6432836394e00d39e468cd514f9ddb66f1e49"
},
{
"url": "https://git.kernel.org/stable/c/7f93fad5ea0affc9e1505dd0f7596c0fdb496213"
}
],
"title": "drm/v3d: Skip CSD when it has zeroed workgroups",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53139",
"datePublished": "2026-06-25T08:38:27.738Z",
"dateReserved": "2026-06-09T07:44:35.387Z",
"dateUpdated": "2026-07-04T11:50:52.146Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53217 (GCVE-0-2026-53217)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: mvpp2: sync RX data at the hardware packet offset
mvpp2 programs the RX queue packet offset, so hardware writes received
data at dma_addr + MVPP2_SKB_HEADROOM. The current CPU sync starts at
dma_addr and only covers rx_bytes + MVPP2_MH_SIZE bytes, which syncs the
unused headroom and misses the same number of bytes at the packet tail.
On non-coherent DMA systems this can leave the CPU reading stale cache
contents for the end of the received frame.
Use dma_sync_single_range_for_cpu() with MVPP2_SKB_HEADROOM as the range
offset so the sync covers the Marvell header and packet data actually
written by hardware.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e1921168bbd4810de4197446e52f652cd0dd9541 Version: e1921168bbd4810de4197446e52f652cd0dd9541 Version: e1921168bbd4810de4197446e52f652cd0dd9541 Version: e1921168bbd4810de4197446e52f652cd0dd9541 Version: e1921168bbd4810de4197446e52f652cd0dd9541 Version: e1921168bbd4810de4197446e52f652cd0dd9541 Version: e1921168bbd4810de4197446e52f652cd0dd9541 Version: e1921168bbd4810de4197446e52f652cd0dd9541 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "60412bdd1b2576659eac23a23d2d9ff96228a643",
"status": "affected",
"version": "e1921168bbd4810de4197446e52f652cd0dd9541",
"versionType": "git"
},
{
"lessThan": "19f8bc139e9b149d1e5bf75ae761d1bb8dd3e7d8",
"status": "affected",
"version": "e1921168bbd4810de4197446e52f652cd0dd9541",
"versionType": "git"
},
{
"lessThan": "a3ad9b5767c89531fc7dae951b51b0933dcf7051",
"status": "affected",
"version": "e1921168bbd4810de4197446e52f652cd0dd9541",
"versionType": "git"
},
{
"lessThan": "bede0f481b9137d73d1cf64309cbe4b94818a5d6",
"status": "affected",
"version": "e1921168bbd4810de4197446e52f652cd0dd9541",
"versionType": "git"
},
{
"lessThan": "23548007b3c66d628fc7d6b80d1e23be04ea10d9",
"status": "affected",
"version": "e1921168bbd4810de4197446e52f652cd0dd9541",
"versionType": "git"
},
{
"lessThan": "a13199fa224e9f776f4005d5037df03aa9ea8f37",
"status": "affected",
"version": "e1921168bbd4810de4197446e52f652cd0dd9541",
"versionType": "git"
},
{
"lessThan": "e302206ad84a407a7e5f3f6fe767ff5efaace689",
"status": "affected",
"version": "e1921168bbd4810de4197446e52f652cd0dd9541",
"versionType": "git"
},
{
"lessThan": "180235600934bef6add3be637c296d6cf3272e67",
"status": "affected",
"version": "e1921168bbd4810de4197446e52f652cd0dd9541",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: sync RX data at the hardware packet offset\n\nmvpp2 programs the RX queue packet offset, so hardware writes received\ndata at dma_addr + MVPP2_SKB_HEADROOM. The current CPU sync starts at\ndma_addr and only covers rx_bytes + MVPP2_MH_SIZE bytes, which syncs the\nunused headroom and misses the same number of bytes at the packet tail.\n\nOn non-coherent DMA systems this can leave the CPU reading stale cache\ncontents for the end of the received frame.\n\nUse dma_sync_single_range_for_cpu() with MVPP2_SKB_HEADROOM as the range\noffset so the sync covers the Marvell header and packet data actually\nwritten by hardware."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is in the Ethernet RX path and is reached by packets received on an affected mvpp2 network interface. A remote peer can trigger it by sending network traffic to a system using this driver.\nAC:L - On affected non-coherent DMA deployments, exploitation only requires sending received frames that traverse the normal RX/NAPI path. There is no race or attacker-uncontrolled timing requirement in the vulnerable path.\nPR:N - No local privileges or authentication are required to reach the receive path. The attacker only needs network reachability to the affected interface.\nUI:N - Packet reception and processing happen automatically once the interface is up. No user action is required.\nS:U - The bug affects packet data handled within the same kernel/network-device security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:H - The incorrect DMA sync can leave stale cache contents in the tail of received skbs, potentially exposing previous packet-buffer contents through delivery, forwarding, or reflection. Repeated remote triggering can disclose more than a few bounded bytes of network data over time.\nI:L - The CPU-visible packet tail can differ from the actual frame written by hardware, corrupting data delivered to XDP, the network stack, or applications. This is packet/data integrity loss, but not an arbitrary kernel memory write or control-flow primitive.\nA:L - An attacker can repeatedly cause corrupted received packets, leading to packet drops, protocol failures, or degraded network service. The investigated path does not indicate a kernel panic, hang, or reliable full-system DoS."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:13.595Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/60412bdd1b2576659eac23a23d2d9ff96228a643"
},
{
"url": "https://git.kernel.org/stable/c/19f8bc139e9b149d1e5bf75ae761d1bb8dd3e7d8"
},
{
"url": "https://git.kernel.org/stable/c/a3ad9b5767c89531fc7dae951b51b0933dcf7051"
},
{
"url": "https://git.kernel.org/stable/c/bede0f481b9137d73d1cf64309cbe4b94818a5d6"
},
{
"url": "https://git.kernel.org/stable/c/23548007b3c66d628fc7d6b80d1e23be04ea10d9"
},
{
"url": "https://git.kernel.org/stable/c/a13199fa224e9f776f4005d5037df03aa9ea8f37"
},
{
"url": "https://git.kernel.org/stable/c/e302206ad84a407a7e5f3f6fe767ff5efaace689"
},
{
"url": "https://git.kernel.org/stable/c/180235600934bef6add3be637c296d6cf3272e67"
}
],
"title": "net: mvpp2: sync RX data at the hardware packet offset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53217",
"datePublished": "2026-06-25T08:39:20.186Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-08-05T12:34:13.595Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43294 (GCVE-0-2026-43294)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-05-11 22:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels
Since commit 56de5e305d4b ("clk: renesas: r9a07g044: Add MSTOP for RZ/G2L")
we may get the following kernel panic, for some panels, when rebooting:
systemd-shutdown[1]: Rebooting.
Call trace:
...
do_serror+0x28/0x68
el1h_64_error_handler+0x34/0x50
el1h_64_error+0x6c/0x70
rzg2l_mipi_dsi_host_transfer+0x114/0x458 (P)
mipi_dsi_device_transfer+0x44/0x58
mipi_dsi_dcs_set_display_off_multi+0x9c/0xc4
ili9881c_unprepare+0x38/0x88
drm_panel_unprepare+0xbc/0x108
This happens for panels that need to send MIPI-DSI commands in their
unprepare() callback. Since the MIPI-DSI interface is stopped at that
point, rzg2l_mipi_dsi_host_transfer() triggers the kernel panic.
Fix by moving rzg2l_mipi_dsi_stop() to new callback function
rzg2l_mipi_dsi_atomic_post_disable().
With this change we now have the correct power-down/stop sequence:
systemd-shutdown[1]: Rebooting.
rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_disable(): entry
ili9881c-dsi 10850000.dsi.0: ili9881c_unprepare(): entry
rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_post_disable(): entry
reboot: Restarting system
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "79f42487ed60d0d5ffce97c3bb98f80c3d17735a",
"status": "affected",
"version": "7a043f978ed1433bddb088a732e9bb91501ebd76",
"versionType": "git"
},
{
"lessThan": "41cda667ffc5074c56279c632b0c20024da6ecdd",
"status": "affected",
"version": "7a043f978ed1433bddb088a732e9bb91501ebd76",
"versionType": "git"
},
{
"lessThan": "64aa8b3a60a825134f7d866adf05c024bbe0c24c",
"status": "affected",
"version": "7a043f978ed1433bddb088a732e9bb91501ebd76",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels\n\nSince commit 56de5e305d4b (\"clk: renesas: r9a07g044: Add MSTOP for RZ/G2L\")\nwe may get the following kernel panic, for some panels, when rebooting:\n\n systemd-shutdown[1]: Rebooting.\n Call trace:\n ...\n do_serror+0x28/0x68\n el1h_64_error_handler+0x34/0x50\n el1h_64_error+0x6c/0x70\n rzg2l_mipi_dsi_host_transfer+0x114/0x458 (P)\n mipi_dsi_device_transfer+0x44/0x58\n mipi_dsi_dcs_set_display_off_multi+0x9c/0xc4\n ili9881c_unprepare+0x38/0x88\n drm_panel_unprepare+0xbc/0x108\n\nThis happens for panels that need to send MIPI-DSI commands in their\nunprepare() callback. Since the MIPI-DSI interface is stopped at that\npoint, rzg2l_mipi_dsi_host_transfer() triggers the kernel panic.\n\nFix by moving rzg2l_mipi_dsi_stop() to new callback function\nrzg2l_mipi_dsi_atomic_post_disable().\n\nWith this change we now have the correct power-down/stop sequence:\n\n systemd-shutdown[1]: Rebooting.\n rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_disable(): entry\n ili9881c-dsi 10850000.dsi.0: ili9881c_unprepare(): entry\n rzg2l-mipi-dsi 10850000.dsi: rzg2l_mipi_dsi_atomic_post_disable(): entry\n reboot: Restarting system"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:21:46.462Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/79f42487ed60d0d5ffce97c3bb98f80c3d17735a"
},
{
"url": "https://git.kernel.org/stable/c/41cda667ffc5074c56279c632b0c20024da6ecdd"
},
{
"url": "https://git.kernel.org/stable/c/64aa8b3a60a825134f7d866adf05c024bbe0c24c"
}
],
"title": "drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43294",
"datePublished": "2026-05-08T13:11:17.483Z",
"dateReserved": "2026-05-01T14:12:55.999Z",
"dateUpdated": "2026-05-11T22:21:46.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53065 (GCVE-0-2026-53065)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: sti: use managed regmap_field allocations
The regmap_field objects allocated at player init are never freed and
may leak resources if the driver is removed.
Switch to devm_regmap_field_alloc() to automatically limit the lifetime
of the allocations the lifetime of the device.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 76c2145ded6b83488dec4afc46a29a57cee90552 Version: 76c2145ded6b83488dec4afc46a29a57cee90552 Version: 76c2145ded6b83488dec4afc46a29a57cee90552 Version: 76c2145ded6b83488dec4afc46a29a57cee90552 Version: 76c2145ded6b83488dec4afc46a29a57cee90552 Version: 76c2145ded6b83488dec4afc46a29a57cee90552 Version: 76c2145ded6b83488dec4afc46a29a57cee90552 Version: 76c2145ded6b83488dec4afc46a29a57cee90552 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/sti/uniperif_player.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4b8dba4527727623a97948aff9f0969a14c203a9",
"status": "affected",
"version": "76c2145ded6b83488dec4afc46a29a57cee90552",
"versionType": "git"
},
{
"lessThan": "c3af3bcfc1deb3b230cc266a2ac75bca8f4dfba9",
"status": "affected",
"version": "76c2145ded6b83488dec4afc46a29a57cee90552",
"versionType": "git"
},
{
"lessThan": "43b67761d486d719128e164536e58de5a81dff9b",
"status": "affected",
"version": "76c2145ded6b83488dec4afc46a29a57cee90552",
"versionType": "git"
},
{
"lessThan": "002a5f925d42eca8ad547e55a4ae22714cfe9dec",
"status": "affected",
"version": "76c2145ded6b83488dec4afc46a29a57cee90552",
"versionType": "git"
},
{
"lessThan": "9641071e3a8e0bc664477a0e54db5f9815f0fb79",
"status": "affected",
"version": "76c2145ded6b83488dec4afc46a29a57cee90552",
"versionType": "git"
},
{
"lessThan": "a3f3c332882c98ae7553af372191116d1384ca52",
"status": "affected",
"version": "76c2145ded6b83488dec4afc46a29a57cee90552",
"versionType": "git"
},
{
"lessThan": "7422a11a753daacbc2409513cf65e1de0d17c291",
"status": "affected",
"version": "76c2145ded6b83488dec4afc46a29a57cee90552",
"versionType": "git"
},
{
"lessThan": "1696fad8b259a2d46e51cd6e17e4bcdbe02279fa",
"status": "affected",
"version": "76c2145ded6b83488dec4afc46a29a57cee90552",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/sti/uniperif_player.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: sti: use managed regmap_field allocations\n\nThe regmap_field objects allocated at player init are never freed and\nmay leak resources if the driver is removed.\n\nSwitch to devm_regmap_field_alloc() to automatically limit the lifetime\nof the allocations the lifetime of the device."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:08.161Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4b8dba4527727623a97948aff9f0969a14c203a9"
},
{
"url": "https://git.kernel.org/stable/c/c3af3bcfc1deb3b230cc266a2ac75bca8f4dfba9"
},
{
"url": "https://git.kernel.org/stable/c/43b67761d486d719128e164536e58de5a81dff9b"
},
{
"url": "https://git.kernel.org/stable/c/002a5f925d42eca8ad547e55a4ae22714cfe9dec"
},
{
"url": "https://git.kernel.org/stable/c/9641071e3a8e0bc664477a0e54db5f9815f0fb79"
},
{
"url": "https://git.kernel.org/stable/c/a3f3c332882c98ae7553af372191116d1384ca52"
},
{
"url": "https://git.kernel.org/stable/c/7422a11a753daacbc2409513cf65e1de0d17c291"
},
{
"url": "https://git.kernel.org/stable/c/1696fad8b259a2d46e51cd6e17e4bcdbe02279fa"
}
],
"title": "ASoC: sti: use managed regmap_field allocations",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53065",
"datePublished": "2026-06-24T16:30:08.161Z",
"dateReserved": "2026-06-09T07:44:35.382Z",
"dateUpdated": "2026-06-24T16:30:08.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45987 (GCVE-0-2026-45987)
Vulnerability from cvelistv5
Published
2026-05-27 12:55
Modified
2026-06-14 17:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2
After VMRUN in guest mode, nested_sync_control_from_vmcb02() syncs
fields written by the CPU from vmcb02 to the cached vmcb12. This is
because the cached vmcb12 is used as the authoritative copy of some of
the controls, and is the payload when saving/restoring nested state.
int_state is also written by the CPU, specifically bit 0 (i.e.
SVM_INTERRUPT_SHADOW_MASK) for nested VMs, but it is not sync'd to
cached vmcb12. This does not cause a problem if KVM_SET_NESTED_STATE
preceeds KVM_SET_VCPU_EVENTS in the restore path, as an interrupt shadow
would be correctly restored to vmcb02 (KVM_SET_VCPU_EVENTS overwrites
what KVM_SET_NESTED_STATE restored in int_state).
However, if KVM_SET_VCPU_EVENTS preceeds KVM_SET_NESTED_STATE, an
interrupt shadow would be restored into vmcb01 instead of vmcb02. This
would mostly be benign for L1 (delays an interrupt), but not for L2. For
L2, the vCPU could hang (e.g. if a wakeup interrupt is delivered before
a HLT that should have been in an interrupt shadow).
Sync int_state to the cached vmcb12 in nested_sync_control_from_vmcb02()
to avoid this problem. With that, KVM_SET_NESTED_STATE restores the
correct interrupt shadow state, and if KVM_SET_VCPU_EVENTS follows it
would overwrite it with the same value.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cc440cdad5b7a4c1de12dace725209eb3e0cf663 Version: cc440cdad5b7a4c1de12dace725209eb3e0cf663 Version: cc440cdad5b7a4c1de12dace725209eb3e0cf663 Version: cc440cdad5b7a4c1de12dace725209eb3e0cf663 Version: cc440cdad5b7a4c1de12dace725209eb3e0cf663 Version: cc440cdad5b7a4c1de12dace725209eb3e0cf663 Version: cc440cdad5b7a4c1de12dace725209eb3e0cf663 Version: cc440cdad5b7a4c1de12dace725209eb3e0cf663 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0c1f74d8b74d8a31751fb6ea5417e48e02c93b58",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
},
{
"lessThan": "4b44aa1a134e499c4517597118378b308602a16c",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
},
{
"lessThan": "e39a77a9b1e17d2d831c304eafac4c41a784a0be",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
},
{
"lessThan": "1709418535a8df95532999d61b03d59975280258",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
},
{
"lessThan": "2f950eeb27af6885416232761700b8820cae0a61",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
},
{
"lessThan": "497f6af9679fc9c6ce2f438e11ed5d51b1aa8297",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
},
{
"lessThan": "e0377e52f3c10ee572732d11b04625b7f517a862",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
},
{
"lessThan": "03bee264f8ebfd39e0254c98e112d033a7aa9055",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2\n\nAfter VMRUN in guest mode, nested_sync_control_from_vmcb02() syncs\nfields written by the CPU from vmcb02 to the cached vmcb12. This is\nbecause the cached vmcb12 is used as the authoritative copy of some of\nthe controls, and is the payload when saving/restoring nested state.\n\nint_state is also written by the CPU, specifically bit 0 (i.e.\nSVM_INTERRUPT_SHADOW_MASK) for nested VMs, but it is not sync\u0027d to\ncached vmcb12. This does not cause a problem if KVM_SET_NESTED_STATE\npreceeds KVM_SET_VCPU_EVENTS in the restore path, as an interrupt shadow\nwould be correctly restored to vmcb02 (KVM_SET_VCPU_EVENTS overwrites\nwhat KVM_SET_NESTED_STATE restored in int_state).\n\nHowever, if KVM_SET_VCPU_EVENTS preceeds KVM_SET_NESTED_STATE, an\ninterrupt shadow would be restored into vmcb01 instead of vmcb02. This\nwould mostly be benign for L1 (delays an interrupt), but not for L2. For\nL2, the vCPU could hang (e.g. if a wakeup interrupt is delivered before\na HLT that should have been in an interrupt shadow).\n\nSync int_state to the cached vmcb12 in nested_sync_control_from_vmcb02()\nto avoid this problem. With that, KVM_SET_NESTED_STATE restores the\ncorrect interrupt shadow state, and if KVM_SET_VCPU_EVENTS follows it\nwould overwrite it with the same value."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:46:36.929Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c1f74d8b74d8a31751fb6ea5417e48e02c93b58"
},
{
"url": "https://git.kernel.org/stable/c/4b44aa1a134e499c4517597118378b308602a16c"
},
{
"url": "https://git.kernel.org/stable/c/e39a77a9b1e17d2d831c304eafac4c41a784a0be"
},
{
"url": "https://git.kernel.org/stable/c/1709418535a8df95532999d61b03d59975280258"
},
{
"url": "https://git.kernel.org/stable/c/2f950eeb27af6885416232761700b8820cae0a61"
},
{
"url": "https://git.kernel.org/stable/c/497f6af9679fc9c6ce2f438e11ed5d51b1aa8297"
},
{
"url": "https://git.kernel.org/stable/c/e0377e52f3c10ee572732d11b04625b7f517a862"
},
{
"url": "https://git.kernel.org/stable/c/03bee264f8ebfd39e0254c98e112d033a7aa9055"
}
],
"title": "KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45987",
"datePublished": "2026-05-27T12:55:38.653Z",
"dateReserved": "2026-05-13T15:03:33.090Z",
"dateUpdated": "2026-06-14T17:46:36.929Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43202 (GCVE-0-2026-43202)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: vt8500lcdfb: fix missing dma_free_coherent()
fbi->fb.screen_buffer is allocated with dma_alloc_coherent() but is not
freed if the error path is reached.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e7b995371fe1e29838321fcdc3cfe35bb0d6bfc4 Version: e7b995371fe1e29838321fcdc3cfe35bb0d6bfc4 Version: e7b995371fe1e29838321fcdc3cfe35bb0d6bfc4 Version: e7b995371fe1e29838321fcdc3cfe35bb0d6bfc4 Version: e7b995371fe1e29838321fcdc3cfe35bb0d6bfc4 Version: e7b995371fe1e29838321fcdc3cfe35bb0d6bfc4 Version: e7b995371fe1e29838321fcdc3cfe35bb0d6bfc4 Version: e7b995371fe1e29838321fcdc3cfe35bb0d6bfc4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/vt8500lcdfb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9a9bc60ed372aaae9784ff8ad8e5f496ff15fd31",
"status": "affected",
"version": "e7b995371fe1e29838321fcdc3cfe35bb0d6bfc4",
"versionType": "git"
},
{
"lessThan": "9c3873cccb3fab54cde0605ae7093d332c99073e",
"status": "affected",
"version": "e7b995371fe1e29838321fcdc3cfe35bb0d6bfc4",
"versionType": "git"
},
{
"lessThan": "778f31be5b8c10024db23fdd8a05f68a02311008",
"status": "affected",
"version": "e7b995371fe1e29838321fcdc3cfe35bb0d6bfc4",
"versionType": "git"
},
{
"lessThan": "e8c5d5f6cd66e032f9aefdcc21b0c34761aef78a",
"status": "affected",
"version": "e7b995371fe1e29838321fcdc3cfe35bb0d6bfc4",
"versionType": "git"
},
{
"lessThan": "f47d5b9e8aa6178a0aaf225119ad1ec7d3f49876",
"status": "affected",
"version": "e7b995371fe1e29838321fcdc3cfe35bb0d6bfc4",
"versionType": "git"
},
{
"lessThan": "40c1ff25025150ff6d7ec7ad441fcfd6d070ee76",
"status": "affected",
"version": "e7b995371fe1e29838321fcdc3cfe35bb0d6bfc4",
"versionType": "git"
},
{
"lessThan": "2cd2f988a8bd2da227f5c3cfa0cbf3a9a287ddc3",
"status": "affected",
"version": "e7b995371fe1e29838321fcdc3cfe35bb0d6bfc4",
"versionType": "git"
},
{
"lessThan": "88b3b9924337336a31cefbe99a22ed09401be74a",
"status": "affected",
"version": "e7b995371fe1e29838321fcdc3cfe35bb0d6bfc4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/vt8500lcdfb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: vt8500lcdfb: fix missing dma_free_coherent()\n\nfbi-\u003efb.screen_buffer is allocated with dma_alloc_coherent() but is not\nfreed if the error path is reached."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:19:57.436Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9a9bc60ed372aaae9784ff8ad8e5f496ff15fd31"
},
{
"url": "https://git.kernel.org/stable/c/9c3873cccb3fab54cde0605ae7093d332c99073e"
},
{
"url": "https://git.kernel.org/stable/c/778f31be5b8c10024db23fdd8a05f68a02311008"
},
{
"url": "https://git.kernel.org/stable/c/e8c5d5f6cd66e032f9aefdcc21b0c34761aef78a"
},
{
"url": "https://git.kernel.org/stable/c/f47d5b9e8aa6178a0aaf225119ad1ec7d3f49876"
},
{
"url": "https://git.kernel.org/stable/c/40c1ff25025150ff6d7ec7ad441fcfd6d070ee76"
},
{
"url": "https://git.kernel.org/stable/c/2cd2f988a8bd2da227f5c3cfa0cbf3a9a287ddc3"
},
{
"url": "https://git.kernel.org/stable/c/88b3b9924337336a31cefbe99a22ed09401be74a"
}
],
"title": "fbdev: vt8500lcdfb: fix missing dma_free_coherent()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43202",
"datePublished": "2026-05-06T11:28:08.226Z",
"dateReserved": "2026-05-01T14:12:55.992Z",
"dateUpdated": "2026-05-11T22:19:57.436Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31492 (GCVE-0-2026-31492)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-05-11 22:09
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Initialize free_qp completion before using it
In irdma_create_qp, if ib_copy_to_udata fails, it will call
irdma_destroy_qp to clean up which will attempt to wait on
the free_qp completion, which is not initialized yet. Fix this
by initializing the completion before the ib_copy_to_udata call.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 Version: b48c24c2d710cf34810c555dcef883a3d35a9c08 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/irdma/verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ac1da7bd224d406b6f1b84414f0f652ab43b6bd8",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "af310407f79d5816fc0ab3638e1588b6193316dd",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "cd1534c8f4984432382c240f6784408497f5bb0a",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "3cb88c12461b71c7d9c604aa2e6a9a477ecfa147",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "f72996834f7bdefc2b95e3eec30447ee195df44e",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
},
{
"lessThan": "11a95521fb93c91e2d4ef9d53dc80ef0a755549b",
"status": "affected",
"version": "b48c24c2d710cf34810c555dcef883a3d35a9c08",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/irdma/verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Initialize free_qp completion before using it\n\nIn irdma_create_qp, if ib_copy_to_udata fails, it will call\nirdma_destroy_qp to clean up which will attempt to wait on\nthe free_qp completion, which is not initialized yet. Fix this\nby initializing the completion before the ib_copy_to_udata call."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:09:46.883Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ac1da7bd224d406b6f1b84414f0f652ab43b6bd8"
},
{
"url": "https://git.kernel.org/stable/c/af310407f79d5816fc0ab3638e1588b6193316dd"
},
{
"url": "https://git.kernel.org/stable/c/cd1534c8f4984432382c240f6784408497f5bb0a"
},
{
"url": "https://git.kernel.org/stable/c/3cb88c12461b71c7d9c604aa2e6a9a477ecfa147"
},
{
"url": "https://git.kernel.org/stable/c/f72996834f7bdefc2b95e3eec30447ee195df44e"
},
{
"url": "https://git.kernel.org/stable/c/11a95521fb93c91e2d4ef9d53dc80ef0a755549b"
}
],
"title": "RDMA/irdma: Initialize free_qp completion before using it",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31492",
"datePublished": "2026-04-22T13:54:15.581Z",
"dateReserved": "2026-03-09T15:48:24.102Z",
"dateUpdated": "2026-05-11T22:09:46.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31604 (GCVE-0-2026-31604)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: fix device leak on probe failure
Driver core holds a reference to the USB interface and its parent USB
device while the interface is bound to a driver and there is no need to
take additional references unless the structures are needed after
disconnect.
This driver takes a reference to the USB device during probe but does
not to release it on all probe errors (e.g. when descriptor parsing
fails).
Drop the redundant device reference to fix the leak, reduce cargo
culting, make it easier to spot drivers where an extra reference is
needed, and reduce the risk of further memory leaks.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 Version: a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 Version: a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 Version: a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 Version: a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 Version: a82dfd33d1237f6c0fb8a7077022189d1fc7ec98 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw88/usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f632987306bce9242cdfcf911ee0b2c9455e05a3",
"status": "affected",
"version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
"versionType": "git"
},
{
"lessThan": "a4f4371d194dfa5473cc961f86194084b1b13a69",
"status": "affected",
"version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
"versionType": "git"
},
{
"lessThan": "89a9c1bc7d797120bcc290864e0cb10a440a677f",
"status": "affected",
"version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
"versionType": "git"
},
{
"lessThan": "af7307e96dad00bcc2675dac650d8558a52f2c6f",
"status": "affected",
"version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
"versionType": "git"
},
{
"lessThan": "25a827b7e1d5747a255bdc757f1d3e9e1e8a4e2a",
"status": "affected",
"version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
"versionType": "git"
},
{
"lessThan": "bbb15e71156cd9f5e1869eee7207a06ea8e96c39",
"status": "affected",
"version": "a82dfd33d1237f6c0fb8a7077022189d1fc7ec98",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw88/usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: fix device leak on probe failure\n\nDriver core holds a reference to the USB interface and its parent USB\ndevice while the interface is bound to a driver and there is no need to\ntake additional references unless the structures are needed after\ndisconnect.\n\nThis driver takes a reference to the USB device during probe but does\nnot to release it on all probe errors (e.g. when descriptor parsing\nfails).\n\nDrop the redundant device reference to fix the leak, reduce cargo\nculting, make it easier to spot drivers where an extra reference is\nneeded, and reduce the risk of further memory leaks."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:42:45.063Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f632987306bce9242cdfcf911ee0b2c9455e05a3"
},
{
"url": "https://git.kernel.org/stable/c/a4f4371d194dfa5473cc961f86194084b1b13a69"
},
{
"url": "https://git.kernel.org/stable/c/89a9c1bc7d797120bcc290864e0cb10a440a677f"
},
{
"url": "https://git.kernel.org/stable/c/af7307e96dad00bcc2675dac650d8558a52f2c6f"
},
{
"url": "https://git.kernel.org/stable/c/25a827b7e1d5747a255bdc757f1d3e9e1e8a4e2a"
},
{
"url": "https://git.kernel.org/stable/c/bbb15e71156cd9f5e1869eee7207a06ea8e96c39"
}
],
"title": "wifi: rtw88: fix device leak on probe failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31604",
"datePublished": "2026-04-24T14:42:27.342Z",
"dateReserved": "2026-03-09T15:48:24.122Z",
"dateUpdated": "2026-06-14T17:42:45.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52943 (GCVE-0-2026-52943)
Vulnerability from cvelistv5
Published
2026-06-24 09:00
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: fix missing zerocopy reference in pskb_carve helpers
pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy
the old skb_shared_info header into a new buffer via memcpy(), which
includes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs.
Neither function calls net_zcopy_get() for the new shinfo, creating an
unaccounted holder: every skb_shared_info with destructor_arg set will
call skb_zcopy_clear() once when freed, but the corresponding
net_zcopy_get() was never called for the new copy. Repeated calls
drive uarg->refcnt to zero prematurely, freeing ubuf_info_msgzc while
TX skbs still hold live destructor_arg pointers.
KASAN reports use-after-free on a freed ubuf_info_msgzc:
BUG: KASAN: slab-use-after-free in skb_release_data+0x77b/0x810
Read of size 8 at addr ffff88801574d3e8 by task poc/220
Call Trace:
skb_release_data+0x77b/0x810
kfree_skb_list_reason+0x13e/0x610
skb_release_data+0x4cd/0x810
sk_skb_reason_drop+0xf3/0x340
skb_queue_purge_reason+0x282/0x440
rds_tcp_inc_free+0x1e/0x30
rds_recvmsg+0x354/0x1780
__sys_recvmsg+0xdf/0x180
Allocated by task 219:
msg_zerocopy_realloc+0x157/0x7b0
tcp_sendmsg_locked+0x2892/0x3ba0
Freed by task 219:
ip_recv_error+0x74a/0xb10
tcp_recvmsg+0x475/0x530
The skb consuming the late access still referenced the same uarg via
shinfo->destructor_arg copied by pskb_carve_inside_nonlinear() without
a refcount bump. This has been verified to be reliably exploitable: a
working proof-of-concept achieves full root privilege escalation from
an unprivileged local user on a default kernel configuration.
The fix follows the pattern of pskb_expand_head() which has the same
memcpy/cloned structure. For pskb_carve_inside_header(), net_zcopy_get()
is placed after skb_orphan_frags() succeeds, so the orphan error path
needs no cleanup. For pskb_carve_inside_nonlinear(), net_zcopy_get() is
placed after all failure points and just before skb_release_data(), so
no error path needs cleanup at all -- matching pskb_expand_head() more
closely and avoiding the need for a balancing net_zcopy_put().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6fa01ccd883021105e9f8af7d04b9f156fa3494a Version: 6fa01ccd883021105e9f8af7d04b9f156fa3494a Version: 6fa01ccd883021105e9f8af7d04b9f156fa3494a Version: 6fa01ccd883021105e9f8af7d04b9f156fa3494a Version: 6fa01ccd883021105e9f8af7d04b9f156fa3494a Version: 6fa01ccd883021105e9f8af7d04b9f156fa3494a Version: 6fa01ccd883021105e9f8af7d04b9f156fa3494a Version: 6fa01ccd883021105e9f8af7d04b9f156fa3494a |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel. The `pskb_carve_inside_header()` and `pskb_carve_inside_nonlinear()` helper functions, which handle network packet buffers, do not correctly account for zero-copy references. This oversight can lead to a use-after-free vulnerability, where memory is prematurely released while still in use. A local unprivileged user can exploit this flaw to achieve full root privilege escalation on the system."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-911",
"description": "Improper Update of Reference Count",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:45:57.638Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52943"
},
{
"name": "RHBZ#2492137",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492137"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52943.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: net: skbuff: fix missing zerocopy reference in pskb_carve helpers",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/skbuff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8dbed691e43a50903658130bde0fcb5abc425b37",
"status": "affected",
"version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
"versionType": "git"
},
{
"lessThan": "9b40bdc2a3298225dffab8158208a0d8c6300578",
"status": "affected",
"version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
"versionType": "git"
},
{
"lessThan": "fd470f0a97b8e9a125f520265d2f3b088ffb5b8a",
"status": "affected",
"version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
"versionType": "git"
},
{
"lessThan": "ceafb893b12f23331dcc5ff9587e643c3a40ee9f",
"status": "affected",
"version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
"versionType": "git"
},
{
"lessThan": "2e0e74c59b2761a414d9f48d7bee1e45220b2427",
"status": "affected",
"version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
"versionType": "git"
},
{
"lessThan": "96a4713ae041cc85e712bac682cd2e644004d6c6",
"status": "affected",
"version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
"versionType": "git"
},
{
"lessThan": "474d6c771d798bca84f0a140b611e36743511e18",
"status": "affected",
"version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
"versionType": "git"
},
{
"lessThan": "98d0912e9f841e5529a5b89a972805f34cb1c69d",
"status": "affected",
"version": "6fa01ccd883021105e9f8af7d04b9f156fa3494a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/skbuff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: fix missing zerocopy reference in pskb_carve helpers\n\npskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy\nthe old skb_shared_info header into a new buffer via memcpy(), which\nincludes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs.\nNeither function calls net_zcopy_get() for the new shinfo, creating an\nunaccounted holder: every skb_shared_info with destructor_arg set will\ncall skb_zcopy_clear() once when freed, but the corresponding\nnet_zcopy_get() was never called for the new copy. Repeated calls\ndrive uarg-\u003erefcnt to zero prematurely, freeing ubuf_info_msgzc while\nTX skbs still hold live destructor_arg pointers.\n\nKASAN reports use-after-free on a freed ubuf_info_msgzc:\n\n BUG: KASAN: slab-use-after-free in skb_release_data+0x77b/0x810\n Read of size 8 at addr ffff88801574d3e8 by task poc/220\n\n Call Trace:\n skb_release_data+0x77b/0x810\n kfree_skb_list_reason+0x13e/0x610\n skb_release_data+0x4cd/0x810\n sk_skb_reason_drop+0xf3/0x340\n skb_queue_purge_reason+0x282/0x440\n rds_tcp_inc_free+0x1e/0x30\n rds_recvmsg+0x354/0x1780\n __sys_recvmsg+0xdf/0x180\n\n Allocated by task 219:\n msg_zerocopy_realloc+0x157/0x7b0\n tcp_sendmsg_locked+0x2892/0x3ba0\n\n Freed by task 219:\n ip_recv_error+0x74a/0xb10\n tcp_recvmsg+0x475/0x530\n\nThe skb consuming the late access still referenced the same uarg via\nshinfo-\u003edestructor_arg copied by pskb_carve_inside_nonlinear() without\na refcount bump. This has been verified to be reliably exploitable: a\nworking proof-of-concept achieves full root privilege escalation from\nan unprivileged local user on a default kernel configuration.\n\nThe fix follows the pattern of pskb_expand_head() which has the same\nmemcpy/cloned structure. For pskb_carve_inside_header(), net_zcopy_get()\nis placed after skb_orphan_frags() succeeds, so the orphan error path\nneeds no cleanup. For pskb_carve_inside_nonlinear(), net_zcopy_get() is\nplaced after all failure points and just before skb_release_data(), so\nno error path needs cleanup at all -- matching pskb_expand_head() more\nclosely and avoiding the need for a balancing net_zcopy_put()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable zerocopy state is created by a local process using TCP MSG_ZEROCOPY; remote RDS/TCP packets can reach pskb_extract() but do not carry local ubuf_info destructor_arg state. A local unprivileged attacker can connect to the in-kernel RDS/TCP listener and send crafted zerocopy TCP data.\nAC:L - The fix commit states the issue is reliably exploitable with a working proof-of-concept, and the trigger is a deterministic missing reference count rather than an attacker-uncontrolled race. The attacker controls the local TCP connection, message layout, zerocopy sends, and repeated triggering.\nPR:L - The attack requires the ability to run local unprivileged code and create ordinary TCP sockets with SO_ZEROCOPY/MSG_ZEROCOPY, which has no capability check. No real root or init-namespace administrative privilege is required.\nUI:N - No victim user action is required once the local attacker runs the exploit. The attacker directly drives the socket operations and RDS/TCP receive path.\nS:U - The vulnerability is exploited within the kernel and impacts the same kernel security authority. It is a standard local kernel privilege escalation, not a VM escape or cross-scope boundary violation.\nC:H - This is a use-after-free of ubuf_info_msgzc reachable through skb zerocopy cleanup, and the fix commit confirms a working full root privilege-escalation exploit. Such kernel UAF exploitation can provide access to protected kernel and process memory.\nI:H - The stale ubuf_info pointer is later dereferenced through zerocopy completion handling, giving a memory-corruption primitive suitable for control-flow or credential manipulation. The reported exploit achieves full root privilege escalation.\nA:H - The bug produces a KASAN-confirmed slab use-after-free in skb_release_data() and can crash the kernel during skb cleanup. Even without full exploitation, repeated triggering can cause kernel oops/panic-level denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:55.528Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8dbed691e43a50903658130bde0fcb5abc425b37"
},
{
"url": "https://git.kernel.org/stable/c/9b40bdc2a3298225dffab8158208a0d8c6300578"
},
{
"url": "https://git.kernel.org/stable/c/fd470f0a97b8e9a125f520265d2f3b088ffb5b8a"
},
{
"url": "https://git.kernel.org/stable/c/ceafb893b12f23331dcc5ff9587e643c3a40ee9f"
},
{
"url": "https://git.kernel.org/stable/c/2e0e74c59b2761a414d9f48d7bee1e45220b2427"
},
{
"url": "https://git.kernel.org/stable/c/96a4713ae041cc85e712bac682cd2e644004d6c6"
},
{
"url": "https://git.kernel.org/stable/c/474d6c771d798bca84f0a140b611e36743511e18"
},
{
"url": "https://git.kernel.org/stable/c/98d0912e9f841e5529a5b89a972805f34cb1c69d"
}
],
"title": "net: skbuff: fix missing zerocopy reference in pskb_carve helpers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52943",
"datePublished": "2026-06-24T09:00:12.292Z",
"dateReserved": "2026-06-09T07:44:35.371Z",
"dateUpdated": "2026-08-05T12:31:55.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43318 (GCVE-0-2026-43318)
Vulnerability from cvelistv5
Published
2026-05-08 13:26
Modified
2026-05-11 22:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify
Invalidating a dmabuf will impact other users of the shared BO.
In the scenario where process A moves the BO, it needs to inform
process B about the move and process B will need to update its
page table.
The commit fixes a synchronisation bug caused by the use of the
ticket: it made amdgpu_vm_handle_moved behave as if updating
the page table immediately was correct but in this case it's not.
An example is the following scenario, with 2 GPUs and glxgears
running on GPU0 and Xorg running on GPU1, on a system where P2P
PCI isn't supported:
glxgears:
export linear buffer from GPU0 and import using GPU1
submit frame rendering to GPU0
submit tiled->linear blit
Xorg:
copy of linear buffer
The sequence of jobs would be:
drm_sched_job_run # GPU0, frame rendering
drm_sched_job_queue # GPU0, blit
drm_sched_job_done # GPU0, frame rendering
drm_sched_job_run # GPU0, blit
move linear buffer for GPU1 access #
amdgpu_dma_buf_move_notify -> update pt # GPU0
It this point the blit job on GPU0 is still running and would
likely produce a page fault.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "82a7ea35a1526bef8ae170c33ff80e5db7728961",
"status": "affected",
"version": "a448cb003edcb4b63d0a9c95f3faab724e6150fb",
"versionType": "git"
},
{
"lessThan": "89a9389ad70d3c69538e59d87df67d407aef4c26",
"status": "affected",
"version": "a448cb003edcb4b63d0a9c95f3faab724e6150fb",
"versionType": "git"
},
{
"lessThan": "3307459eb3583115264421e859858d1f90f3694a",
"status": "affected",
"version": "a448cb003edcb4b63d0a9c95f3faab724e6150fb",
"versionType": "git"
},
{
"lessThan": "b18fc0ab837381c1a6ef28386602cd888f2d9edf",
"status": "affected",
"version": "a448cb003edcb4b63d0a9c95f3faab724e6150fb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify\n\nInvalidating a dmabuf will impact other users of the shared BO.\nIn the scenario where process A moves the BO, it needs to inform\nprocess B about the move and process B will need to update its\npage table.\n\nThe commit fixes a synchronisation bug caused by the use of the\nticket: it made amdgpu_vm_handle_moved behave as if updating\nthe page table immediately was correct but in this case it\u0027s not.\n\nAn example is the following scenario, with 2 GPUs and glxgears\nrunning on GPU0 and Xorg running on GPU1, on a system where P2P\nPCI isn\u0027t supported:\n\nglxgears:\n export linear buffer from GPU0 and import using GPU1\n submit frame rendering to GPU0\n submit tiled-\u003elinear blit\nXorg:\n copy of linear buffer\n\nThe sequence of jobs would be:\n drm_sched_job_run # GPU0, frame rendering\n drm_sched_job_queue # GPU0, blit\n drm_sched_job_done # GPU0, frame rendering\n drm_sched_job_run # GPU0, blit\n move linear buffer for GPU1 access #\n amdgpu_dma_buf_move_notify -\u003e update pt # GPU0\n\nIt this point the blit job on GPU0 is still running and would\nlikely produce a page fault."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:22:14.662Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/82a7ea35a1526bef8ae170c33ff80e5db7728961"
},
{
"url": "https://git.kernel.org/stable/c/89a9389ad70d3c69538e59d87df67d407aef4c26"
},
{
"url": "https://git.kernel.org/stable/c/3307459eb3583115264421e859858d1f90f3694a"
},
{
"url": "https://git.kernel.org/stable/c/b18fc0ab837381c1a6ef28386602cd888f2d9edf"
}
],
"title": "drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43318",
"datePublished": "2026-05-08T13:26:13.557Z",
"dateReserved": "2026-05-01T14:12:56.001Z",
"dateUpdated": "2026-05-11T22:22:14.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43118 (GCVE-0-2026-43118)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-05-11 22:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix zero size inode with non-zero size after log replay
When logging that an inode exists, as part of logging a new name or
logging new dir entries for a directory, we always set the generation of
the logged inode item to 0. This is to signal during log replay (in
overwrite_item()), that we should not set the i_size since we only logged
that an inode exists, so the i_size of the inode in the subvolume tree
must be preserved (as when we log new names or that an inode exists, we
don't log extents).
This works fine except when we have already logged an inode in full mode
or it's the first time we are logging an inode created in a past
transaction, that inode has a new i_size of 0 and then we log a new name
for the inode (due to a new hardlink or a rename), in which case we log
an i_size of 0 for the inode and a generation of 0, which causes the log
replay code to not update the inode's i_size to 0 (in overwrite_item()).
An example scenario:
mkdir /mnt/dir
xfs_io -f -c "pwrite 0 64K" /mnt/dir/foo
sync
xfs_io -c "truncate 0" -c "fsync" /mnt/dir/foo
ln /mnt/dir/foo /mnt/dir/bar
xfs_io -c "fsync" /mnt/dir
<power fail>
After log replay the file remains with a size of 64K. This is because when
we first log the inode, when we fsync file foo, we log its current i_size
of 0, and then when we create a hard link we log again the inode in exists
mode (LOG_INODE_EXISTS) but we set a generation of 0 for the inode item we
add to the log tree, so during log replay overwrite_item() sees that the
generation is 0 and i_size is 0 so we skip updating the inode's i_size
from 64K to 0.
Fix this by making sure at fill_inode_item() we always log the real
generation of the inode if it was logged in the current transaction with
the i_size we logged before. Also if an inode created in a previous
transaction is logged in exists mode only, make sure we log the i_size
stored in the inode item located from the commit root, so that if we log
multiple times that the inode exists we get the correct i_size.
A test case for fstests will follow soon.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/tree-log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fddb157536e67a055597f00a8b4922d5f5ed0826",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
},
{
"lessThan": "03e966b63df5b06790310c1faaf3e0cb43adea8b",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
},
{
"lessThan": "5254d4181add9dfaa5e3519edd71cc8f752b2f85",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/tree-log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix zero size inode with non-zero size after log replay\n\nWhen logging that an inode exists, as part of logging a new name or\nlogging new dir entries for a directory, we always set the generation of\nthe logged inode item to 0. This is to signal during log replay (in\noverwrite_item()), that we should not set the i_size since we only logged\nthat an inode exists, so the i_size of the inode in the subvolume tree\nmust be preserved (as when we log new names or that an inode exists, we\ndon\u0027t log extents).\n\nThis works fine except when we have already logged an inode in full mode\nor it\u0027s the first time we are logging an inode created in a past\ntransaction, that inode has a new i_size of 0 and then we log a new name\nfor the inode (due to a new hardlink or a rename), in which case we log\nan i_size of 0 for the inode and a generation of 0, which causes the log\nreplay code to not update the inode\u0027s i_size to 0 (in overwrite_item()).\n\nAn example scenario:\n\n mkdir /mnt/dir\n xfs_io -f -c \"pwrite 0 64K\" /mnt/dir/foo\n\n sync\n\n xfs_io -c \"truncate 0\" -c \"fsync\" /mnt/dir/foo\n\n ln /mnt/dir/foo /mnt/dir/bar\n\n xfs_io -c \"fsync\" /mnt/dir\n\n \u003cpower fail\u003e\n\nAfter log replay the file remains with a size of 64K. This is because when\nwe first log the inode, when we fsync file foo, we log its current i_size\nof 0, and then when we create a hard link we log again the inode in exists\nmode (LOG_INODE_EXISTS) but we set a generation of 0 for the inode item we\nadd to the log tree, so during log replay overwrite_item() sees that the\ngeneration is 0 and i_size is 0 so we skip updating the inode\u0027s i_size\nfrom 64K to 0.\n\nFix this by making sure at fill_inode_item() we always log the real\ngeneration of the inode if it was logged in the current transaction with\nthe i_size we logged before. Also if an inode created in a previous\ntransaction is logged in exists mode only, make sure we log the i_size\nstored in the inode item located from the commit root, so that if we log\nmultiple times that the inode exists we get the correct i_size.\n\nA test case for fstests will follow soon."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:18:06.327Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fddb157536e67a055597f00a8b4922d5f5ed0826"
},
{
"url": "https://git.kernel.org/stable/c/03e966b63df5b06790310c1faaf3e0cb43adea8b"
},
{
"url": "https://git.kernel.org/stable/c/5254d4181add9dfaa5e3519edd71cc8f752b2f85"
}
],
"title": "btrfs: fix zero size inode with non-zero size after log replay",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43118",
"datePublished": "2026-05-06T07:40:42.598Z",
"dateReserved": "2026-05-01T14:12:55.987Z",
"dateUpdated": "2026-05-11T22:18:06.327Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45936 (GCVE-0-2026-45936)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-27 12:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: supply: goldfish: Fix use-after-free in power_supply_changed()
Using the `devm_` variant for requesting IRQ _before_ the `devm_`
variant for allocating/registering the `power_supply` handle, means that
the `power_supply` handle will be deallocated/unregistered _before_ the
interrupt handler (since `devm_` naturally deallocates in reverse
allocation order). This means that during removal, there is a race
condition where an interrupt can fire just _after_ the `power_supply`
handle has been freed, *but* just _before_ the corresponding
unregistration of the IRQ handler has run.
This will lead to the IRQ handler calling `power_supply_changed()` with
a freed `power_supply` handle. Which usually crashes the system or
otherwise silently corrupts the memory...
Note that there is a similar situation which can also happen during
`probe()`; the possibility of an interrupt firing _before_ registering
the `power_supply` handle. This would then lead to the nasty situation
of using the `power_supply` handle *uninitialized* in
`power_supply_changed()`.
Fix this racy use-after-free by making sure the IRQ is requested _after_
the registration of the `power_supply` handle.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 84d7b768748943db2bb658b43931fdab04c224cc Version: 84d7b768748943db2bb658b43931fdab04c224cc Version: 84d7b768748943db2bb658b43931fdab04c224cc Version: 84d7b768748943db2bb658b43931fdab04c224cc Version: 84d7b768748943db2bb658b43931fdab04c224cc Version: 84d7b768748943db2bb658b43931fdab04c224cc Version: 84d7b768748943db2bb658b43931fdab04c224cc Version: 84d7b768748943db2bb658b43931fdab04c224cc |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/goldfish_battery.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "589d4fe56713c6344cd9f8939f9c7621c85f0966",
"status": "affected",
"version": "84d7b768748943db2bb658b43931fdab04c224cc",
"versionType": "git"
},
{
"lessThan": "bad8b61eb5059acd88349680e47839342dc89e94",
"status": "affected",
"version": "84d7b768748943db2bb658b43931fdab04c224cc",
"versionType": "git"
},
{
"lessThan": "33751e28842bf5aee5ef7b2b8d5e456a069095cb",
"status": "affected",
"version": "84d7b768748943db2bb658b43931fdab04c224cc",
"versionType": "git"
},
{
"lessThan": "77ea437faa4c06362e3ecfd2d7264eaa7ac1e82c",
"status": "affected",
"version": "84d7b768748943db2bb658b43931fdab04c224cc",
"versionType": "git"
},
{
"lessThan": "4350505e82b4f972ddb788e1c712c557c38859d0",
"status": "affected",
"version": "84d7b768748943db2bb658b43931fdab04c224cc",
"versionType": "git"
},
{
"lessThan": "8c89aade8335e26a6a7dcda18992d15f51943927",
"status": "affected",
"version": "84d7b768748943db2bb658b43931fdab04c224cc",
"versionType": "git"
},
{
"lessThan": "0b29ffe4090a3fc7a7649de20e1eb1e53adddac7",
"status": "affected",
"version": "84d7b768748943db2bb658b43931fdab04c224cc",
"versionType": "git"
},
{
"lessThan": "b2ce982e2e0c888dc55c888ad0e20ea04daf2e6b",
"status": "affected",
"version": "84d7b768748943db2bb658b43931fdab04c224cc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/goldfish_battery.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: goldfish: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:17:53.451Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/589d4fe56713c6344cd9f8939f9c7621c85f0966"
},
{
"url": "https://git.kernel.org/stable/c/bad8b61eb5059acd88349680e47839342dc89e94"
},
{
"url": "https://git.kernel.org/stable/c/33751e28842bf5aee5ef7b2b8d5e456a069095cb"
},
{
"url": "https://git.kernel.org/stable/c/77ea437faa4c06362e3ecfd2d7264eaa7ac1e82c"
},
{
"url": "https://git.kernel.org/stable/c/4350505e82b4f972ddb788e1c712c557c38859d0"
},
{
"url": "https://git.kernel.org/stable/c/8c89aade8335e26a6a7dcda18992d15f51943927"
},
{
"url": "https://git.kernel.org/stable/c/0b29ffe4090a3fc7a7649de20e1eb1e53adddac7"
},
{
"url": "https://git.kernel.org/stable/c/b2ce982e2e0c888dc55c888ad0e20ea04daf2e6b"
}
],
"title": "power: supply: goldfish: Fix use-after-free in power_supply_changed()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45936",
"datePublished": "2026-05-27T12:17:53.451Z",
"dateReserved": "2026-05-13T15:03:33.086Z",
"dateUpdated": "2026-05-27T12:17:53.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43313 (GCVE-0-2026-43313)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-05-11 22:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()
In acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE
device and then reassigned an ISA device:
dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);
dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);
If the first lookup succeeds but the second fails, dev becomes NULL. This
leads to a potential null-pointer dereference when dev_dbg() is called:
if (errata.piix4.bmisx)
dev_dbg(&dev->dev, ...);
To prevent this, use two temporary pointers and retrieve each device
independently, avoiding overwriting dev with a possible NULL value.
[ rjw: Subject adjustment, added an empty code line ]
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/acpi_processor.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "06724a60cfa9767ea90b0f5d3dfb5cdd251b64f5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ad86ac604f8391c0212a91412d4f764c7a85f254",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "01e8751b37a366b1ca561add0042f2ceb18c03bf",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b803811485ac0b2f774b6bf3abc8b999ba3b7033",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "29f60d3d06818d40118a30d663231f027ae87a05",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0398b641be2b66c2fc7e0163c606ef19372e7ad5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f132e089fe89cadc2098991f0a3cb05c3f824ac6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/acpi/acpi_processor.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()\n\nIn acpi_processor_errata_piix4(), the pointer dev is first assigned an IDE\ndevice and then reassigned an ISA device:\n\n dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB, ...);\n dev = pci_get_subsys(..., PCI_DEVICE_ID_INTEL_82371AB_0, ...);\n\nIf the first lookup succeeds but the second fails, dev becomes NULL. This\nleads to a potential null-pointer dereference when dev_dbg() is called:\n\n if (errata.piix4.bmisx)\n dev_dbg(\u0026dev-\u003edev, ...);\n\nTo prevent this, use two temporary pointers and retrieve each device\nindependently, avoiding overwriting dev with a possible NULL value.\n\n[ rjw: Subject adjustment, added an empty code line ]"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:22:08.644Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/06724a60cfa9767ea90b0f5d3dfb5cdd251b64f5"
},
{
"url": "https://git.kernel.org/stable/c/ad86ac604f8391c0212a91412d4f764c7a85f254"
},
{
"url": "https://git.kernel.org/stable/c/01e8751b37a366b1ca561add0042f2ceb18c03bf"
},
{
"url": "https://git.kernel.org/stable/c/b803811485ac0b2f774b6bf3abc8b999ba3b7033"
},
{
"url": "https://git.kernel.org/stable/c/29f60d3d06818d40118a30d663231f027ae87a05"
},
{
"url": "https://git.kernel.org/stable/c/0398b641be2b66c2fc7e0163c606ef19372e7ad5"
},
{
"url": "https://git.kernel.org/stable/c/f132e089fe89cadc2098991f0a3cb05c3f824ac6"
}
],
"title": "ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43313",
"datePublished": "2026-05-08T13:11:30.386Z",
"dateReserved": "2026-05-01T14:12:56.001Z",
"dateUpdated": "2026-05-11T22:22:08.644Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53281 (GCVE-0-2026-53281)
Vulnerability from cvelistv5
Published
2026-06-26 19:40
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Avoid NULL pointer dereference or refcount corruption
Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE")
fixed a NULL pointer dereference in an unlikely situation partly.
If dev_pasid is not found in the dev_pasids list, it remains NULL.
However, the teardown operations are executed unconditionally, this lead
to a NULL pointer dereference or refcount corruption.
If the domain was never attached to this IOMMU, info will be NULL, which
would cause an immediate dereference when checking --info->refcnt.
Even if info is not NULL, decrementing the refcount without having removed
a valid PASID might unbalance the count. This could lead to premature
dropping of the refcount to 0, potentially causing a use-after-free for the
remaining active devices sharing the domain.
Fix it by returning early if dev_pasid is NULL, before executing the
teardown operations.
Issue found by AI review and suggested by Kevin Tian.
https://sashiko.dev/#/patchset/20260421031347.1408890-1-zhenzhong.duan%40intel.com
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 60f030f7418d3f1d94f2fb207fe3080e1844630b Version: 60f030f7418d3f1d94f2fb207fe3080e1844630b Version: 60f030f7418d3f1d94f2fb207fe3080e1844630b Version: 68ec78beb4a3fb0877cbaaf49758c85410c05977 Version: df96876be3b064aefc493f760e0639765d13ed0d Version: 6.12.57 ≤ Version: 6.13.3 ≤ |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.40.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.31.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Input-Output Memory Management Unit (IOMMU) virtualized direct memory access (VT-d) component. This vulnerability occurs when the system attempts to perform cleanup operations without a valid device identifier, leading to a null pointer dereference or incorrect management of resource references. An attacker with local access could exploit this to cause a system crash, resulting in a denial of service (DoS)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T12:04:49.598Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53281"
},
{
"name": "RHBZ#2493728",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493728"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53281.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47017"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47040"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:47017: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:47040: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-26T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-26T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9022cb9ac0c2a72a57fa8ebf92ac74f953ca0153",
"status": "affected",
"version": "60f030f7418d3f1d94f2fb207fe3080e1844630b",
"versionType": "git"
},
{
"lessThan": "cdfe3c9f2c9e28a8651ee463c88ad191ced2f840",
"status": "affected",
"version": "60f030f7418d3f1d94f2fb207fe3080e1844630b",
"versionType": "git"
},
{
"lessThan": "79ea2feb917b05366b49d85573c9c5331f043b2c",
"status": "affected",
"version": "60f030f7418d3f1d94f2fb207fe3080e1844630b",
"versionType": "git"
},
{
"status": "affected",
"version": "68ec78beb4a3fb0877cbaaf49758c85410c05977",
"versionType": "git"
},
{
"status": "affected",
"version": "df96876be3b064aefc493f760e0639765d13ed0d",
"versionType": "git"
},
{
"lessThan": "6.13",
"status": "affected",
"version": "6.12.57",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12.57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Avoid NULL pointer dereference or refcount corruption\n\nCommit 60f030f7418d (\"iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE\")\nfixed a NULL pointer dereference in an unlikely situation partly.\n\nIf dev_pasid is not found in the dev_pasids list, it remains NULL.\nHowever, the teardown operations are executed unconditionally, this lead\nto a NULL pointer dereference or refcount corruption.\n\nIf the domain was never attached to this IOMMU, info will be NULL, which\nwould cause an immediate dereference when checking --info-\u003erefcnt.\n\nEven if info is not NULL, decrementing the refcount without having removed\na valid PASID might unbalance the count. This could lead to premature\ndropping of the refcount to 0, potentially causing a use-after-free for the\nremaining active devices sharing the domain.\n\nFix it by returning early if dev_pasid is NULL, before executing the\nteardown operations.\n\nIssue found by AI review and suggested by Kevin Tian.\nhttps://sashiko.dev/#/patchset/20260421031347.1408890-1-zhenzhong.duan%40intel.com"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable VT-d PASID teardown path is reached through local IOMMU/VFIO/SVA device-management operations such as iommufd/VFIO PASID attach, detach, replace, or device reset recovery. It is not reachable by network packets or adjacent radio protocols.\nAC:L - The relevant paths are normal serialized attach/detach/reset flows and do not require winning an attacker-uncontrolled race. A PASID-capable Intel IOMMU device and suitable VFIO/SVA setup are prerequisites for the affected subsystem, but triggering the vulnerable teardown is otherwise straightforward in that environment.\nPR:L - The attacker needs local access to a PASID-capable VFIO/iommufd or SVA-capable accelerator device node, which can be delegated to an unprivileged userspace process such as QEMU or accelerator clients. It does not inherently require real root in the initial namespace once device access is granted.\nUI:N - No separate victim action is required after the attacker controls the local device-management file descriptors. The attacker can initiate the attach/detach/close/reset-triggering sequence directly.\nS:C - The corruption is in IOMMU/PASID domain bookkeeping that enforces DMA isolation for devices. Premature domain refcount teardown can affect resources outside the intended device/DMA translation boundary.\nC:H - Although one failure mode is a NULL dereference, the fix explicitly identifies refcount corruption that can prematurely free domain metadata and create a use-after-free for remaining active devices. Under the required conservative scoring rule, that memory corruption is treated as capable of enabling high-impact information disclosure.\nI:H - The same refcount corruption/use-after-free in IOMMU domain metadata can plausibly be exploited for kernel memory corruption or DMA isolation manipulation. Under the required conservative scoring rule, this supports high integrity impact.\nA:H - If the domain was never attached to the IOMMU, `domain_detach_iommu()` can immediately dereference NULL and crash the kernel. The refcount corruption path can also lead to use-after-free crashes, so availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:54.806Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9022cb9ac0c2a72a57fa8ebf92ac74f953ca0153"
},
{
"url": "https://git.kernel.org/stable/c/cdfe3c9f2c9e28a8651ee463c88ad191ced2f840"
},
{
"url": "https://git.kernel.org/stable/c/79ea2feb917b05366b49d85573c9c5331f043b2c"
}
],
"title": "iommu/vt-d: Avoid NULL pointer dereference or refcount corruption",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53281",
"datePublished": "2026-06-26T19:40:43.040Z",
"dateReserved": "2026-06-09T07:44:35.396Z",
"dateUpdated": "2026-08-05T12:34:54.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45875 (GCVE-0-2026-45875)
Vulnerability from cvelistv5
Published
2026-05-27 12:15
Modified
2026-05-27 12:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure
The wm5102_clear_write_sequencer() helper may return an error
and just return, bypassing the cleanup sequence and causing
regulators to remain enabled, leading to a resource leak.
Change the direct return to jump to the err_reset label to
properly free the resources.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1c1c6bba57f51331f64f32d0ce9a0f9883041205 Version: 1c1c6bba57f51331f64f32d0ce9a0f9883041205 Version: 1c1c6bba57f51331f64f32d0ce9a0f9883041205 Version: 1c1c6bba57f51331f64f32d0ce9a0f9883041205 Version: 1c1c6bba57f51331f64f32d0ce9a0f9883041205 Version: 1c1c6bba57f51331f64f32d0ce9a0f9883041205 Version: 1c1c6bba57f51331f64f32d0ce9a0f9883041205 Version: 1c1c6bba57f51331f64f32d0ce9a0f9883041205 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mfd/arizona-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "54eafc1b0dbcf79c5f8b6dc8d9e92e56b9384c0a",
"status": "affected",
"version": "1c1c6bba57f51331f64f32d0ce9a0f9883041205",
"versionType": "git"
},
{
"lessThan": "933c5463873582baaecf5c38401ec4095b1c6269",
"status": "affected",
"version": "1c1c6bba57f51331f64f32d0ce9a0f9883041205",
"versionType": "git"
},
{
"lessThan": "445cec7b4fbb1546836ae8e332d158e8d37d0fb6",
"status": "affected",
"version": "1c1c6bba57f51331f64f32d0ce9a0f9883041205",
"versionType": "git"
},
{
"lessThan": "3ea01691738b0decb63ea2705d2cdf27f6f26fc0",
"status": "affected",
"version": "1c1c6bba57f51331f64f32d0ce9a0f9883041205",
"versionType": "git"
},
{
"lessThan": "e0527c09bcf1e6beeb685a7f4177683866b8609c",
"status": "affected",
"version": "1c1c6bba57f51331f64f32d0ce9a0f9883041205",
"versionType": "git"
},
{
"lessThan": "5a4923726a165593d7601834a6fb2a10ab47b85d",
"status": "affected",
"version": "1c1c6bba57f51331f64f32d0ce9a0f9883041205",
"versionType": "git"
},
{
"lessThan": "2049820d1e635e467d795237fd40287213d92349",
"status": "affected",
"version": "1c1c6bba57f51331f64f32d0ce9a0f9883041205",
"versionType": "git"
},
{
"lessThan": "4feb753ba6e5e5bbaba868b841a2db41c21e56fa",
"status": "affected",
"version": "1c1c6bba57f51331f64f32d0ce9a0f9883041205",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mfd/arizona-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure\n\nThe wm5102_clear_write_sequencer() helper may return an error\nand just return, bypassing the cleanup sequence and causing\nregulators to remain enabled, leading to a resource leak.\n\nChange the direct return to jump to the err_reset label to\nproperly free the resources."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:15:56.675Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/54eafc1b0dbcf79c5f8b6dc8d9e92e56b9384c0a"
},
{
"url": "https://git.kernel.org/stable/c/933c5463873582baaecf5c38401ec4095b1c6269"
},
{
"url": "https://git.kernel.org/stable/c/445cec7b4fbb1546836ae8e332d158e8d37d0fb6"
},
{
"url": "https://git.kernel.org/stable/c/3ea01691738b0decb63ea2705d2cdf27f6f26fc0"
},
{
"url": "https://git.kernel.org/stable/c/e0527c09bcf1e6beeb685a7f4177683866b8609c"
},
{
"url": "https://git.kernel.org/stable/c/5a4923726a165593d7601834a6fb2a10ab47b85d"
},
{
"url": "https://git.kernel.org/stable/c/2049820d1e635e467d795237fd40287213d92349"
},
{
"url": "https://git.kernel.org/stable/c/4feb753ba6e5e5bbaba868b841a2db41c21e56fa"
}
],
"title": "mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45875",
"datePublished": "2026-05-27T12:15:56.675Z",
"dateReserved": "2026-05-13T15:03:33.081Z",
"dateUpdated": "2026-05-27T12:15:56.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45841 (GCVE-0-2026-45841)
Vulnerability from cvelistv5
Published
2026-05-27 09:24
Modified
2026-06-14 17:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
nf_osf_match_one() computes ctx->window % f->wss.val in the
OSF_WSS_MODULO branch with no guard for f->wss.val == 0. A
CAP_NET_ADMIN user can add such a fingerprint via nfnetlink; a
subsequent matching TCP SYN divides by zero and panics the kernel.
Reject the bogus fingerprint in nfnl_osf_add_callback() above the
per-option for-loop. f->wss is per-fingerprint, not per-option, so
the check must run regardless of f->opt_num (including 0). Also
reject wss.wc >= OSF_WSS_MAX; nf_osf_match_one() already treats that
as "should not happen".
Crash:
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)
Call Trace:
<IRQ>
nf_osf_match (net/netfilter/nfnetlink_osf.c:220)
xt_osf_match_packet (net/netfilter/xt_osf.c:32)
ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)
nf_hook_slow (net/netfilter/core.c:622)
ip_local_deliver (net/ipv4/ip_input.c:265)
ip_rcv (include/linux/skbuff.h:1162)
__netif_receive_skb_one_core (net/core/dev.c:6181)
process_backlog (net/core/dev.c:6642)
__napi_poll (net/core/dev.c:7710)
net_rx_action (net/core/dev.c:7945)
handle_softirqs (kernel/softirq.c:622)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 Version: 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 Version: 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 Version: 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 Version: 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 Version: 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 Version: 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 Version: 11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nfnetlink_osf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cb833bbc1b3c51e08652d3c86298307c07d3f2db",
"status": "affected",
"version": "11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384",
"versionType": "git"
},
{
"lessThan": "26900306a5a2c3e4f75c643a064525526bb6e5f3",
"status": "affected",
"version": "11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384",
"versionType": "git"
},
{
"lessThan": "0694618cf3e9b120666e31f5f383a6e466d95a0d",
"status": "affected",
"version": "11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384",
"versionType": "git"
},
{
"lessThan": "8def8fbd23f40e945febe913d04b731012ce0082",
"status": "affected",
"version": "11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384",
"versionType": "git"
},
{
"lessThan": "c55940895245d8ef658ab381248a28755218d625",
"status": "affected",
"version": "11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384",
"versionType": "git"
},
{
"lessThan": "fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2f",
"status": "affected",
"version": "11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384",
"versionType": "git"
},
{
"lessThan": "9a05e195618a6d474f2bcd5b6376d0ffc2f00366",
"status": "affected",
"version": "11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384",
"versionType": "git"
},
{
"lessThan": "2195574dc6d9017d32ac346987e12659f931d932",
"status": "affected",
"version": "11eeef41d5f63c7d2f7fdfcc733eb7fb137cc384",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nfnetlink_osf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO\n\nnf_osf_match_one() computes ctx-\u003ewindow % f-\u003ewss.val in the\nOSF_WSS_MODULO branch with no guard for f-\u003ewss.val == 0. A\nCAP_NET_ADMIN user can add such a fingerprint via nfnetlink; a\nsubsequent matching TCP SYN divides by zero and panics the kernel.\n\nReject the bogus fingerprint in nfnl_osf_add_callback() above the\nper-option for-loop. f-\u003ewss is per-fingerprint, not per-option, so\nthe check must run regardless of f-\u003eopt_num (including 0). Also\nreject wss.wc \u003e= OSF_WSS_MAX; nf_osf_match_one() already treats that\nas \"should not happen\".\n\nCrash:\n Oops: divide error: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:nf_osf_match_one (net/netfilter/nfnetlink_osf.c:98)\n Call Trace:\n \u003cIRQ\u003e\n nf_osf_match (net/netfilter/nfnetlink_osf.c:220)\n xt_osf_match_packet (net/netfilter/xt_osf.c:32)\n ipt_do_table (net/ipv4/netfilter/ip_tables.c:348)\n nf_hook_slow (net/netfilter/core.c:622)\n ip_local_deliver (net/ipv4/ip_input.c:265)\n ip_rcv (include/linux/skbuff.h:1162)\n __netif_receive_skb_one_core (net/core/dev.c:6181)\n process_backlog (net/core/dev.c:6642)\n __napi_poll (net/core/dev.c:7710)\n net_rx_action (net/core/dev.c:7945)\n handle_softirqs (kernel/softirq.c:622)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:46:14.099Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cb833bbc1b3c51e08652d3c86298307c07d3f2db"
},
{
"url": "https://git.kernel.org/stable/c/26900306a5a2c3e4f75c643a064525526bb6e5f3"
},
{
"url": "https://git.kernel.org/stable/c/0694618cf3e9b120666e31f5f383a6e466d95a0d"
},
{
"url": "https://git.kernel.org/stable/c/8def8fbd23f40e945febe913d04b731012ce0082"
},
{
"url": "https://git.kernel.org/stable/c/c55940895245d8ef658ab381248a28755218d625"
},
{
"url": "https://git.kernel.org/stable/c/fb965b1cfe92b28d28b5ebe3116b81dbef9f2d2f"
},
{
"url": "https://git.kernel.org/stable/c/9a05e195618a6d474f2bcd5b6376d0ffc2f00366"
},
{
"url": "https://git.kernel.org/stable/c/2195574dc6d9017d32ac346987e12659f931d932"
}
],
"title": "netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45841",
"datePublished": "2026-05-27T09:24:40.805Z",
"dateReserved": "2026-05-13T15:03:33.078Z",
"dateUpdated": "2026-06-14T17:46:14.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43010 (GCVE-0-2026-43010)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-07-04 11:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject sleepable kprobe_multi programs at attach time
kprobe.multi programs run in atomic/RCU context and cannot sleep.
However, bpf_kprobe_multi_link_attach() did not validate whether the
program being attached had the sleepable flag set, allowing sleepable
helpers such as bpf_copy_from_user() to be invoked from a non-sleepable
context.
This causes a "sleeping function called from invalid context" splat:
BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:169
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1787, name: sudo
preempt_count: 1, expected: 0
RCU nest depth: 2, expected: 0
Fix this by rejecting sleepable programs early in
bpf_kprobe_multi_link_attach(), before any further processing.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/bpf_trace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "89327ed787746a7aa4db3c97f91d2e294228932b",
"status": "affected",
"version": "0dcac272540613d41c05e89679e4ddb978b612f1",
"versionType": "git"
},
{
"lessThan": "d97b19fe5265f7901b2c862f88a4eb1b129a0b61",
"status": "affected",
"version": "0dcac272540613d41c05e89679e4ddb978b612f1",
"versionType": "git"
},
{
"lessThan": "dc9a060d76c12b23c5f378ee115d5e5d03d8bbf3",
"status": "affected",
"version": "0dcac272540613d41c05e89679e4ddb978b612f1",
"versionType": "git"
},
{
"lessThan": "f952157e695fd434bdc05af63a703bb082a78717",
"status": "affected",
"version": "0dcac272540613d41c05e89679e4ddb978b612f1",
"versionType": "git"
},
{
"lessThan": "eb7024bfcc5f68ed11ed9dd4891a3073c15f04a8",
"status": "affected",
"version": "0dcac272540613d41c05e89679e4ddb978b612f1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/bpf_trace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject sleepable kprobe_multi programs at attach time\n\nkprobe.multi programs run in atomic/RCU context and cannot sleep.\nHowever, bpf_kprobe_multi_link_attach() did not validate whether the\nprogram being attached had the sleepable flag set, allowing sleepable\nhelpers such as bpf_copy_from_user() to be invoked from a non-sleepable\ncontext.\n\nThis causes a \"sleeping function called from invalid context\" splat:\n\n BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:169\n in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1787, name: sudo\n preempt_count: 1, expected: 0\n RCU nest depth: 2, expected: 0\n\nFix this by rejecting sleepable programs early in\nbpf_kprobe_multi_link_attach(), before any further processing."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:50:34.675Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/89327ed787746a7aa4db3c97f91d2e294228932b"
},
{
"url": "https://git.kernel.org/stable/c/d97b19fe5265f7901b2c862f88a4eb1b129a0b61"
},
{
"url": "https://git.kernel.org/stable/c/dc9a060d76c12b23c5f378ee115d5e5d03d8bbf3"
},
{
"url": "https://git.kernel.org/stable/c/f952157e695fd434bdc05af63a703bb082a78717"
},
{
"url": "https://git.kernel.org/stable/c/eb7024bfcc5f68ed11ed9dd4891a3073c15f04a8"
}
],
"title": "bpf: Reject sleepable kprobe_multi programs at attach time",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43010",
"datePublished": "2026-05-01T14:15:16.947Z",
"dateReserved": "2026-05-01T14:12:55.974Z",
"dateUpdated": "2026-07-04T11:50:34.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43117 (GCVE-0-2026-43117)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()
If overlay is used on top of btrfs, dentry->d_sb translates to overlay's
super block and fsid assignment will lead to a crash.
Use file_inode(file)->i_sb to always get btrfs_sb.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bc074524e123ded281cde25ebc5661910f9679e3 Version: bc074524e123ded281cde25ebc5661910f9679e3 Version: bc074524e123ded281cde25ebc5661910f9679e3 Version: bc074524e123ded281cde25ebc5661910f9679e3 Version: bc074524e123ded281cde25ebc5661910f9679e3 Version: bc074524e123ded281cde25ebc5661910f9679e3 Version: bc074524e123ded281cde25ebc5661910f9679e3 Version: bc074524e123ded281cde25ebc5661910f9679e3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/trace/events/btrfs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4a7bab35fad5251c8cb738161152578cd83b6b9c",
"status": "affected",
"version": "bc074524e123ded281cde25ebc5661910f9679e3",
"versionType": "git"
},
{
"lessThan": "520e8b4bcf872a534a7bf61ccf880047642df296",
"status": "affected",
"version": "bc074524e123ded281cde25ebc5661910f9679e3",
"versionType": "git"
},
{
"lessThan": "e252db8ca2a01f82d472091f35d549b313278636",
"status": "affected",
"version": "bc074524e123ded281cde25ebc5661910f9679e3",
"versionType": "git"
},
{
"lessThan": "c09a7446aab5773f38d6abb25fce99b8e1dfbc97",
"status": "affected",
"version": "bc074524e123ded281cde25ebc5661910f9679e3",
"versionType": "git"
},
{
"lessThan": "32372781d664a9b03c40343e96c29d0a6139f97d",
"status": "affected",
"version": "bc074524e123ded281cde25ebc5661910f9679e3",
"versionType": "git"
},
{
"lessThan": "2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a",
"status": "affected",
"version": "bc074524e123ded281cde25ebc5661910f9679e3",
"versionType": "git"
},
{
"lessThan": "d110d7cdb045715c0b45b0dfd974525bb38f653d",
"status": "affected",
"version": "bc074524e123ded281cde25ebc5661910f9679e3",
"versionType": "git"
},
{
"lessThan": "a85b46db143fda5869e7d8df8f258ccef5fa1719",
"status": "affected",
"version": "bc074524e123ded281cde25ebc5661910f9679e3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/trace/events/btrfs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()\n\nIf overlay is used on top of btrfs, dentry-\u003ed_sb translates to overlay\u0027s\nsuper block and fsid assignment will lead to a crash.\n\nUse file_inode(file)-\u003ei_sb to always get btrfs_sb."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable tracepoint is reachable through fsync/flush paths, and a severe reasonable deployment is an NFS/ksmbd-exported overlay filesystem backed by btrfs where a remote client can issue COMMIT/FLUSH into btrfs_sync_file(). Local fsync paths also reach it, but the network file-server path is the highest reasonable vector.\nAC:L - Once the btrfs_sync_file tracepoint/perf event is active, triggering the bug is a deterministic fsync/flush on an overlay-backed btrfs file with no race or timing requirement. Overlay-on-btrfs is a normal supported configuration.\nPR:N - A remote client can plausibly reach the fsync path through a guest or writable NFS/SMB export without privileges on the vulnerable host. When uncertain, the higher severity no-privilege scenario is defensible.\nUI:N - No victim action is needed after the filesystem/export/tracing environment exists; the attacker only sends or performs the fsync/flush operation. Mounting or tracing setup is environmental, not per-exploit user interaction.\nS:U - The impact is within the same kernel security authority and does not cross a hypervisor, IOMMU, or sandbox boundary. Standard kernel crash or kernel-memory exposure remains scope unchanged.\nC:H - The bug type-confuses an overlay superblock as btrfs_fs_info and copies through the bogus fs_devices pointer into trace/perf data. If the pointer resolves to valid kernel memory, this can expose kernel memory, so the higher severity confidentiality impact is selected.\nI:N - The vulnerable operations are invalid reads and writes only to the trace record buffer, not attacker-controlled writes to kernel objects. No direct integrity modification or control-flow overwrite was found.\nA:H - The fix commit explicitly states the bad fsid assignment can crash, and the invalid superblock/fs_devices dereference can oops or panic the kernel. This is high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:03.902Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4a7bab35fad5251c8cb738161152578cd83b6b9c"
},
{
"url": "https://git.kernel.org/stable/c/520e8b4bcf872a534a7bf61ccf880047642df296"
},
{
"url": "https://git.kernel.org/stable/c/e252db8ca2a01f82d472091f35d549b313278636"
},
{
"url": "https://git.kernel.org/stable/c/c09a7446aab5773f38d6abb25fce99b8e1dfbc97"
},
{
"url": "https://git.kernel.org/stable/c/32372781d664a9b03c40343e96c29d0a6139f97d"
},
{
"url": "https://git.kernel.org/stable/c/2e4adfaec97ee053ad1bdfb5036845e66f7e0d8a"
},
{
"url": "https://git.kernel.org/stable/c/d110d7cdb045715c0b45b0dfd974525bb38f653d"
},
{
"url": "https://git.kernel.org/stable/c/a85b46db143fda5869e7d8df8f258ccef5fa1719"
}
],
"title": "btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43117",
"datePublished": "2026-05-06T07:40:41.862Z",
"dateReserved": "2026-05-01T14:12:55.987Z",
"dateUpdated": "2026-08-05T12:26:03.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45867 (GCVE-0-2026-45867)
Vulnerability from cvelistv5
Published
2026-05-27 12:15
Modified
2026-05-27 12:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: supply: act8945a: Fix use-after-free in power_supply_changed()
Using the `devm_` variant for requesting IRQ _before_ the `devm_`
variant for allocating/registering the `power_supply` handle, means that
the `power_supply` handle will be deallocated/unregistered _before_ the
interrupt handler (since `devm_` naturally deallocates in reverse
allocation order). This means that during removal, there is a race
condition where an interrupt can fire just _after_ the `power_supply`
handle has been freed, *but* just _before_ the corresponding
unregistration of the IRQ handler has run.
This will lead to the IRQ handler calling `power_supply_changed()` with
a freed `power_supply` handle. Which usually crashes the system or
otherwise silently corrupts the memory...
Note that there is a similar situation which can also happen during
`probe()`; the possibility of an interrupt firing _before_ registering
the `power_supply` handle. This would then lead to the nasty situation
of using the `power_supply` handle *uninitialized* in
`power_supply_changed()`.
Fix this racy use-after-free by making sure the IRQ is requested _after_
the registration of the `power_supply` handle.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a09209acd6a808794bdd7866af3678d1fd1d90e7 Version: a09209acd6a808794bdd7866af3678d1fd1d90e7 Version: a09209acd6a808794bdd7866af3678d1fd1d90e7 Version: a09209acd6a808794bdd7866af3678d1fd1d90e7 Version: a09209acd6a808794bdd7866af3678d1fd1d90e7 Version: a09209acd6a808794bdd7866af3678d1fd1d90e7 Version: a09209acd6a808794bdd7866af3678d1fd1d90e7 Version: a09209acd6a808794bdd7866af3678d1fd1d90e7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/act8945a_charger.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f2a0777b1e5a3cee1712c4d3e9095c0df8fc8cb3",
"status": "affected",
"version": "a09209acd6a808794bdd7866af3678d1fd1d90e7",
"versionType": "git"
},
{
"lessThan": "0768e8525a46df103647ca5059b32320d7fd17e4",
"status": "affected",
"version": "a09209acd6a808794bdd7866af3678d1fd1d90e7",
"versionType": "git"
},
{
"lessThan": "d023ef9f748b2090f7a9dbdd5c622b6ad99088ea",
"status": "affected",
"version": "a09209acd6a808794bdd7866af3678d1fd1d90e7",
"versionType": "git"
},
{
"lessThan": "697bb5dc0cb4791e244f3970b067bc1ef33be9d9",
"status": "affected",
"version": "a09209acd6a808794bdd7866af3678d1fd1d90e7",
"versionType": "git"
},
{
"lessThan": "76a42ba547a9b2e2337894f67a4d9247445007d5",
"status": "affected",
"version": "a09209acd6a808794bdd7866af3678d1fd1d90e7",
"versionType": "git"
},
{
"lessThan": "f27eb76def5c07e4d7cc468b40741f19dafc83ce",
"status": "affected",
"version": "a09209acd6a808794bdd7866af3678d1fd1d90e7",
"versionType": "git"
},
{
"lessThan": "83c1bd466c514cb24ca6ef347c5aac76a13c4e1e",
"status": "affected",
"version": "a09209acd6a808794bdd7866af3678d1fd1d90e7",
"versionType": "git"
},
{
"lessThan": "3291c51d4684d048dd2eb91b5b65fcfdaf72141f",
"status": "affected",
"version": "a09209acd6a808794bdd7866af3678d1fd1d90e7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/act8945a_charger.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: act8945a: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:15:47.222Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f2a0777b1e5a3cee1712c4d3e9095c0df8fc8cb3"
},
{
"url": "https://git.kernel.org/stable/c/0768e8525a46df103647ca5059b32320d7fd17e4"
},
{
"url": "https://git.kernel.org/stable/c/d023ef9f748b2090f7a9dbdd5c622b6ad99088ea"
},
{
"url": "https://git.kernel.org/stable/c/697bb5dc0cb4791e244f3970b067bc1ef33be9d9"
},
{
"url": "https://git.kernel.org/stable/c/76a42ba547a9b2e2337894f67a4d9247445007d5"
},
{
"url": "https://git.kernel.org/stable/c/f27eb76def5c07e4d7cc468b40741f19dafc83ce"
},
{
"url": "https://git.kernel.org/stable/c/83c1bd466c514cb24ca6ef347c5aac76a13c4e1e"
},
{
"url": "https://git.kernel.org/stable/c/3291c51d4684d048dd2eb91b5b65fcfdaf72141f"
}
],
"title": "power: supply: act8945a: Fix use-after-free in power_supply_changed()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45867",
"datePublished": "2026-05-27T12:15:47.222Z",
"dateReserved": "2026-05-13T15:03:33.080Z",
"dateUpdated": "2026-05-27T12:15:47.222Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43123 (GCVE-0-2026-43123)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbcon: check return value of con2fb_acquire_newinfo()
If fbcon_open() fails when called from con2fb_acquire_newinfo() then
info->fbcon_par pointer remains NULL which is later dereferenced.
Add check for return value of the function con2fb_acquire_newinfo() to
avoid it.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e Version: d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e Version: d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e Version: d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e Version: d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e Version: d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e Version: d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbcon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d3e535533767c85788529e626478718b7e95a59f",
"status": "affected",
"version": "d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e",
"versionType": "git"
},
{
"lessThan": "3b5a754ec86bc6064af9aca76eb191c2405e6b0c",
"status": "affected",
"version": "d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e",
"versionType": "git"
},
{
"lessThan": "a785c4e2a999c2d51dfcf40d317cfb30cc735d2c",
"status": "affected",
"version": "d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e",
"versionType": "git"
},
{
"lessThan": "0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cc",
"status": "affected",
"version": "d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e",
"versionType": "git"
},
{
"lessThan": "11a93180a70bb3095a9bd80d113d9277e30d9959",
"status": "affected",
"version": "d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e",
"versionType": "git"
},
{
"lessThan": "f57b61624c86ef8f87f6e6b7dd0755de03d90e89",
"status": "affected",
"version": "d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e",
"versionType": "git"
},
{
"lessThan": "011a0502801c8536f64141a2b61362c14f456544",
"status": "affected",
"version": "d1baa4ffa677bf6986c460fcfd4cdaf8bfe66f0e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbcon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.23"
},
{
"lessThan": "2.6.23",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbcon: check return value of con2fb_acquire_newinfo()\n\nIf fbcon_open() fails when called from con2fb_acquire_newinfo() then\ninfo-\u003efbcon_par pointer remains NULL which is later dereferenced.\n\nAdd check for return value of the function con2fb_acquire_newinfo() to\navoid it.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:18:12.071Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d3e535533767c85788529e626478718b7e95a59f"
},
{
"url": "https://git.kernel.org/stable/c/3b5a754ec86bc6064af9aca76eb191c2405e6b0c"
},
{
"url": "https://git.kernel.org/stable/c/a785c4e2a999c2d51dfcf40d317cfb30cc735d2c"
},
{
"url": "https://git.kernel.org/stable/c/0b038c0be6827dd2dbb1ce4f8d92d97c80cbe9cc"
},
{
"url": "https://git.kernel.org/stable/c/11a93180a70bb3095a9bd80d113d9277e30d9959"
},
{
"url": "https://git.kernel.org/stable/c/f57b61624c86ef8f87f6e6b7dd0755de03d90e89"
},
{
"url": "https://git.kernel.org/stable/c/011a0502801c8536f64141a2b61362c14f456544"
}
],
"title": "fbcon: check return value of con2fb_acquire_newinfo()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43123",
"datePublished": "2026-05-06T11:27:09.553Z",
"dateReserved": "2026-05-01T14:12:55.987Z",
"dateUpdated": "2026-05-11T22:18:12.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52969 (GCVE-0-2026-52969)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-07-15 02:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: Reject wrapped offset in kvm_reset_dirty_gfn()
kvm_reset_dirty_gfn() guards the gfn range with
if (!memslot || (offset + __fls(mask)) >= memslot->npages)
return;
but offset is u64 and the addition is unchecked. The check can be
silently bypassed by a u64 wrap.
The dirty ring backing those entries is MAP_SHARED at
KVM_DIRTY_LOG_PAGE_OFFSET of the vcpu fd, so the VMM can rewrite the
slot and offset fields of any entry between when the kernel pushes
them and when KVM_RESET_DIRTY_RINGS consumes them. On reset,
kvm_dirty_ring_reset() re-reads the values via READ_ONCE() and feeds
them straight back into this check; only the flags handshake is
treated as the handover, the slot/offset payload is taken on trust.
Crafting two entries
entry[i].offset = 0xffffffffffffffc1
entry[i+1].offset = 0
makes the coalescing loop in kvm_dirty_ring_reset() compute
delta = (s64)(0 - 0xffffffffffffffc1) = 63
which falls in [0, BITS_PER_LONG), so it folds entry[i+1] into the
existing mask by setting bit 63. The trailing kvm_reset_dirty_gfn()
call then sees offset = 0xffffffffffffffc1 and __fls(mask) = 63;
the sum is 0 in u64 and the bounds check passes.
That offset propagates into kvm_arch_mmu_enable_log_dirty_pt_masked()
unchanged. On the legacy MMU path -- kvm_memslots_have_rmaps() ==
true, i.e. shadow paging, any VM that has allocated shadow roots, or
a write-tracked slot -- it reaches gfn_to_rmap(), which indexes
slot->arch.rmap[0][] with a near-U64_MAX gfn. That is an
out-of-bounds load of a kvm_rmap_head, followed by a conditional
clear of PT_WRITABLE_MASK in whatever the loaded pointer points at.
The path is reachable from any process holding /dev/kvm.
Range-check offset on its own first, so the addition cannot wrap.
memslot->npages is bounded well below U64_MAX, so once offset <
npages holds, offset + __fls(mask) (with __fls(mask) < BITS_PER_LONG)
stays in range.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fb04a1eddb1a65b6588a021bdc132270d5ae48bb Version: fb04a1eddb1a65b6588a021bdc132270d5ae48bb Version: fb04a1eddb1a65b6588a021bdc132270d5ae48bb Version: fb04a1eddb1a65b6588a021bdc132270d5ae48bb Version: fb04a1eddb1a65b6588a021bdc132270d5ae48bb Version: fb04a1eddb1a65b6588a021bdc132270d5ae48bb Version: fb04a1eddb1a65b6588a021bdc132270d5ae48bb |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Kernel-based Virtual Machine (KVM) component. A local attacker with access to /dev/kvm could exploit an integer overflow vulnerability in the kvm_reset_dirty_gfn() function. By manipulating dirty ring entries, the attacker can bypass a bounds check, leading to an out-of-bounds memory access. This could result in information disclosure or potentially cause a denial of service."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T02:48:28.368Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52969"
},
{
"name": "RHBZ#2492434",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492434"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52969.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: KVM: Reject wrapped offset in kvm_reset_dirty_gfn()",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"virt/kvm/dirty_ring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "74f1a22f7a80f03d28ad8551a2d25d563433addf",
"status": "affected",
"version": "fb04a1eddb1a65b6588a021bdc132270d5ae48bb",
"versionType": "git"
},
{
"lessThan": "0eb281eb95b2d4eea4db1da5fe91023aecc97095",
"status": "affected",
"version": "fb04a1eddb1a65b6588a021bdc132270d5ae48bb",
"versionType": "git"
},
{
"lessThan": "01b71b930f15728aa8599478a7ce90c19dcd9fc2",
"status": "affected",
"version": "fb04a1eddb1a65b6588a021bdc132270d5ae48bb",
"versionType": "git"
},
{
"lessThan": "b315b033a877b1ee6d827810b5d7bb4392ffcf8d",
"status": "affected",
"version": "fb04a1eddb1a65b6588a021bdc132270d5ae48bb",
"versionType": "git"
},
{
"lessThan": "0d419c23bb11b5c9664de777c47c1f04a235882d",
"status": "affected",
"version": "fb04a1eddb1a65b6588a021bdc132270d5ae48bb",
"versionType": "git"
},
{
"lessThan": "ecf9b3ea7847fe14f34b8c41f00de1eb95c747da",
"status": "affected",
"version": "fb04a1eddb1a65b6588a021bdc132270d5ae48bb",
"versionType": "git"
},
{
"lessThan": "577a8d3bae0531f0e5ccfac919cd8192f920a804",
"status": "affected",
"version": "fb04a1eddb1a65b6588a021bdc132270d5ae48bb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"virt/kvm/dirty_ring.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Reject wrapped offset in kvm_reset_dirty_gfn()\n\nkvm_reset_dirty_gfn() guards the gfn range with\n\n\tif (!memslot || (offset + __fls(mask)) \u003e= memslot-\u003enpages)\n\t\treturn;\n\nbut offset is u64 and the addition is unchecked. The check can be\nsilently bypassed by a u64 wrap.\n\nThe dirty ring backing those entries is MAP_SHARED at\nKVM_DIRTY_LOG_PAGE_OFFSET of the vcpu fd, so the VMM can rewrite the\nslot and offset fields of any entry between when the kernel pushes\nthem and when KVM_RESET_DIRTY_RINGS consumes them. On reset,\nkvm_dirty_ring_reset() re-reads the values via READ_ONCE() and feeds\nthem straight back into this check; only the flags handshake is\ntreated as the handover, the slot/offset payload is taken on trust.\n\nCrafting two entries\n\n\tentry[i].offset = 0xffffffffffffffc1\n\tentry[i+1].offset = 0\n\nmakes the coalescing loop in kvm_dirty_ring_reset() compute\n\n\tdelta = (s64)(0 - 0xffffffffffffffc1) = 63\n\nwhich falls in [0, BITS_PER_LONG), so it folds entry[i+1] into the\nexisting mask by setting bit 63. The trailing kvm_reset_dirty_gfn()\ncall then sees offset = 0xffffffffffffffc1 and __fls(mask) = 63;\nthe sum is 0 in u64 and the bounds check passes.\n\nThat offset propagates into kvm_arch_mmu_enable_log_dirty_pt_masked()\nunchanged. On the legacy MMU path -- kvm_memslots_have_rmaps() ==\ntrue, i.e. shadow paging, any VM that has allocated shadow roots, or\na write-tracked slot -- it reaches gfn_to_rmap(), which indexes\nslot-\u003earch.rmap[0][] with a near-U64_MAX gfn. That is an\nout-of-bounds load of a kvm_rmap_head, followed by a conditional\nclear of PT_WRITABLE_MASK in whatever the loaded pointer points at.\nThe path is reachable from any process holding /dev/kvm.\n\nRange-check offset on its own first, so the addition cannot wrap.\nmemslot-\u003enpages is bounded well below U64_MAX, so once offset \u003c\nnpages holds, offset + __fls(mask) (with __fls(mask) \u003c BITS_PER_LONG)\nstays in range."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:28:48.085Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/74f1a22f7a80f03d28ad8551a2d25d563433addf"
},
{
"url": "https://git.kernel.org/stable/c/0eb281eb95b2d4eea4db1da5fe91023aecc97095"
},
{
"url": "https://git.kernel.org/stable/c/01b71b930f15728aa8599478a7ce90c19dcd9fc2"
},
{
"url": "https://git.kernel.org/stable/c/b315b033a877b1ee6d827810b5d7bb4392ffcf8d"
},
{
"url": "https://git.kernel.org/stable/c/0d419c23bb11b5c9664de777c47c1f04a235882d"
},
{
"url": "https://git.kernel.org/stable/c/ecf9b3ea7847fe14f34b8c41f00de1eb95c747da"
},
{
"url": "https://git.kernel.org/stable/c/577a8d3bae0531f0e5ccfac919cd8192f920a804"
}
],
"title": "KVM: Reject wrapped offset in kvm_reset_dirty_gfn()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52969",
"datePublished": "2026-06-24T16:28:48.085Z",
"dateReserved": "2026-06-09T07:44:35.375Z",
"dateUpdated": "2026-07-15T02:48:28.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53208 (GCVE-0-2026-53208)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-29 04:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig
net/bluetooth/l2cap_core.c:l2cap_sig_channel() accepts BR/EDR
signaling packets up to the channel MTU and dispatches each command
without enforcing the signaling MTU (MTUsig). A Bluetooth BR/EDR peer
within radio range can send a fixed-channel CID 0x0001 packet that is
larger than MTUsig and contains many L2CAP_ECHO_REQ commands before
pairing. In a real-radio stock-kernel run, one 681-byte signaling
packet containing 168 zero-length ECHO_REQ commands made the target
transmit 168 ECHO_RSP frames over about 220 ms.
Impact: a Bluetooth BR/EDR peer within radio range, before pairing, can
force 168 ECHO_RSP frames from one 681-byte fixed-channel signaling
packet containing packed ECHO_REQ commands.
Define Linux's BR/EDR signaling MTU as the spec minimum of 48 bytes and
reject any larger signaling packet with one L2CAP_COMMAND_REJECT_RSP
carrying L2CAP_REJ_MTU_EXCEEDED before any command is dispatched.
The Bluetooth Core spec wording for MTUExceeded says the reject
identifier shall match the first request command in the packet, and
that packets containing only responses shall be silently discarded.
Linux intentionally deviates from that prescription: silently
discarding desynchronizes the peer because the remote stack never
learns its responses were dropped, and locating the first request
command requires walking command headers past MTUsig, i.e. processing
bytes from a packet we have already decided is too large to process.
We therefore always emit one reject and use the identifier from the
first command header, a single fixed-offset byte read.
The unrestricted BR/EDR signaling parser and ECHO_REQ response path both
trace to the initial git import; no later introducing commit is
available for a Fixes tag.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/l2cap.h",
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e05c4ac575b457978a7ef441053394169084869c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "fa5823126239b3e453fac1a2fe50726c7f4a55e1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b20e8a98dd29b121f58fcdf51e8576119aba536a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "214a2042b16b3c8d798a8b9ef9f36094f13a9859",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a8335f3db15bd1e0e82e0db5d488fabc7d10d1ab",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "dedc92b96dc1d8919a3bdf2495ede68922ef7ebc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e2b8acf9405bd9b1baf1c54dc897b0905db689bf",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "dd214733544427587a95f66dbf3adff072568990",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/l2cap.h",
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig\n\nnet/bluetooth/l2cap_core.c:l2cap_sig_channel() accepts BR/EDR\nsignaling packets up to the channel MTU and dispatches each command\nwithout enforcing the signaling MTU (MTUsig). A Bluetooth BR/EDR peer\nwithin radio range can send a fixed-channel CID 0x0001 packet that is\nlarger than MTUsig and contains many L2CAP_ECHO_REQ commands before\npairing. In a real-radio stock-kernel run, one 681-byte signaling\npacket containing 168 zero-length ECHO_REQ commands made the target\ntransmit 168 ECHO_RSP frames over about 220 ms.\n\nImpact: a Bluetooth BR/EDR peer within radio range, before pairing, can\nforce 168 ECHO_RSP frames from one 681-byte fixed-channel signaling\npacket containing packed ECHO_REQ commands.\n\nDefine Linux\u0027s BR/EDR signaling MTU as the spec minimum of 48 bytes and\nreject any larger signaling packet with one L2CAP_COMMAND_REJECT_RSP\ncarrying L2CAP_REJ_MTU_EXCEEDED before any command is dispatched.\n\nThe Bluetooth Core spec wording for MTUExceeded says the reject\nidentifier shall match the first request command in the packet, and\nthat packets containing only responses shall be silently discarded.\nLinux intentionally deviates from that prescription: silently\ndiscarding desynchronizes the peer because the remote stack never\nlearns its responses were dropped, and locating the first request\ncommand requires walking command headers past MTUsig, i.e. processing\nbytes from a packet we have already decided is too large to process.\nWe therefore always emit one reject and use the identifier from the\nfirst command header, a single fixed-offset byte read.\n\nThe unrestricted BR/EDR signaling parser and ECHO_REQ response path both\ntrace to the initial git import; no later introducing commit is\navailable for a Fixes tag."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T04:18:57.916Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e05c4ac575b457978a7ef441053394169084869c"
},
{
"url": "https://git.kernel.org/stable/c/fa5823126239b3e453fac1a2fe50726c7f4a55e1"
},
{
"url": "https://git.kernel.org/stable/c/b20e8a98dd29b121f58fcdf51e8576119aba536a"
},
{
"url": "https://git.kernel.org/stable/c/214a2042b16b3c8d798a8b9ef9f36094f13a9859"
},
{
"url": "https://git.kernel.org/stable/c/a8335f3db15bd1e0e82e0db5d488fabc7d10d1ab"
},
{
"url": "https://git.kernel.org/stable/c/dedc92b96dc1d8919a3bdf2495ede68922ef7ebc"
},
{
"url": "https://git.kernel.org/stable/c/e2b8acf9405bd9b1baf1c54dc897b0905db689bf"
},
{
"url": "https://git.kernel.org/stable/c/dd214733544427587a95f66dbf3adff072568990"
}
],
"title": "Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53208",
"datePublished": "2026-06-25T08:39:14.257Z",
"dateReserved": "2026-06-09T07:44:35.391Z",
"dateUpdated": "2026-06-29T04:18:57.916Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43303 (GCVE-0-2026-43303)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/page_alloc: clear page->private in free_pages_prepare()
Several subsystems (slub, shmem, ttm, etc.) use page->private but don't
clear it before freeing pages. When these pages are later allocated as
high-order pages and split via split_page(), tail pages retain stale
page->private values.
This causes a use-after-free in the swap subsystem. The swap code uses
page->private to track swap count continuations, assuming freshly
allocated pages have page->private == 0. When stale values are present,
swap_count_continued() incorrectly assumes the continuation list is valid
and iterates over uninitialized page->lru containing LIST_POISON values,
causing a crash:
KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107]
RIP: 0010:__do_sys_swapoff+0x1151/0x1860
Fix this by clearing page->private in free_pages_prepare(), ensuring all
freed pages have clean state regardless of previous use.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3b8000ae185cb068adbda5f966a3835053c85fd4 Version: 3b8000ae185cb068adbda5f966a3835053c85fd4 Version: 3b8000ae185cb068adbda5f966a3835053c85fd4 Version: 3b8000ae185cb068adbda5f966a3835053c85fd4 Version: 3b8000ae185cb068adbda5f966a3835053c85fd4 Version: 3b8000ae185cb068adbda5f966a3835053c85fd4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/page_alloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e7790ab165713b79b1617ce659742ceb3a859d05",
"status": "affected",
"version": "3b8000ae185cb068adbda5f966a3835053c85fd4",
"versionType": "git"
},
{
"lessThan": "3edb8ebbf79b9016040e8f3421d723ae3d542b32",
"status": "affected",
"version": "3b8000ae185cb068adbda5f966a3835053c85fd4",
"versionType": "git"
},
{
"lessThan": "f9719e32a67b4b00b3c9b133e8b5ffa72a26b67b",
"status": "affected",
"version": "3b8000ae185cb068adbda5f966a3835053c85fd4",
"versionType": "git"
},
{
"lessThan": "23b82b7a26182ad840ae67d390d7ec9771e8c00f",
"status": "affected",
"version": "3b8000ae185cb068adbda5f966a3835053c85fd4",
"versionType": "git"
},
{
"lessThan": "d757c793853ec5483eb41ec2942c300b8fa720fb",
"status": "affected",
"version": "3b8000ae185cb068adbda5f966a3835053c85fd4",
"versionType": "git"
},
{
"lessThan": "ac1ea219590c09572ed5992dc233bbf7bb70fef9",
"status": "affected",
"version": "3b8000ae185cb068adbda5f966a3835053c85fd4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/page_alloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_alloc: clear page-\u003eprivate in free_pages_prepare()\n\nSeveral subsystems (slub, shmem, ttm, etc.) use page-\u003eprivate but don\u0027t\nclear it before freeing pages. When these pages are later allocated as\nhigh-order pages and split via split_page(), tail pages retain stale\npage-\u003eprivate values.\n\nThis causes a use-after-free in the swap subsystem. The swap code uses\npage-\u003eprivate to track swap count continuations, assuming freshly\nallocated pages have page-\u003eprivate == 0. When stale values are present,\nswap_count_continued() incorrectly assumes the continuation list is valid\nand iterates over uninitialized page-\u003elru containing LIST_POISON values,\ncausing a crash:\n\n KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107]\n RIP: 0010:__do_sys_swapoff+0x1151/0x1860\n\nFix this by clearing page-\u003eprivate in free_pages_prepare(), ensuring all\nfreed pages have clean state regardless of previous use."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable swap continuation and page allocator paths are reached through local memory-management activity such as fork/swap/reclaim or swap administration, not by remote packets or physical access.\nAC:L - There is no attacker-uncontrolled race; a local attacker can repeatedly create swap pressure and duplicate swapped entries to drive the continuation path, and allocator grooming is under attacker influence.\nPR:L - Although swapon/swapoff require CAP_SYS_ADMIN in init_user_ns, the same vulnerable swap_count_continued() path is reachable by an unprivileged local user through normal swapped PTE duplication paths once swap is active.\nUI:N - No victim action is required after the attacker has local execution; the trigger can be driven by the attacker\u0027s own processes and memory activity.\nS:U - The impact remains within the kernel and the same host security authority; this is not a VM escape or cross-boundary IOMMU/DMA issue.\nC:H - The stale page-\u003eprivate value causes a use-after-free style interpretation of stale struct page list metadata, leading to wild kernel memory accesses that can plausibly be shaped into information disclosure.\nI:H - swap_count_continued() can write through a page derived from stale list pointers, making this kernel memory corruption with plausible arbitrary write/control-flow impact.\nA:H - The reported failure is a KASAN wild-memory-access crash in __do_sys_swapoff, and the same invalid list traversal can oops or panic the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:08.856Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e7790ab165713b79b1617ce659742ceb3a859d05"
},
{
"url": "https://git.kernel.org/stable/c/3edb8ebbf79b9016040e8f3421d723ae3d542b32"
},
{
"url": "https://git.kernel.org/stable/c/f9719e32a67b4b00b3c9b133e8b5ffa72a26b67b"
},
{
"url": "https://git.kernel.org/stable/c/23b82b7a26182ad840ae67d390d7ec9771e8c00f"
},
{
"url": "https://git.kernel.org/stable/c/d757c793853ec5483eb41ec2942c300b8fa720fb"
},
{
"url": "https://git.kernel.org/stable/c/ac1ea219590c09572ed5992dc233bbf7bb70fef9"
}
],
"title": "mm/page_alloc: clear page-\u003eprivate in free_pages_prepare()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43303",
"datePublished": "2026-05-08T13:11:23.561Z",
"dateReserved": "2026-05-01T14:12:56.000Z",
"dateUpdated": "2026-08-05T12:27:08.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31450 (GCVE-0-2026-31450)
Vulnerability from cvelistv5
Published
2026-04-22 13:53
Modified
2026-08-05 12:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: publish jinode after initialization
ext4_inode_attach_jinode() publishes ei->jinode to concurrent users.
It used to set ei->jinode before jbd2_journal_init_jbd_inode(),
allowing a reader to observe a non-NULL jinode with i_vfs_inode
still unset.
The fast commit flush path can then pass this jinode to
jbd2_wait_inode_data(), which dereferences i_vfs_inode->i_mapping and
may crash.
Below is the crash I observe:
```
BUG: unable to handle page fault for address: 000000010beb47f4
PGD 110e51067 P4D 110e51067 PUD 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014
RIP: 0010:xas_find_marked+0x3d/0x2e0
Code: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f <49> 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02
RSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246
RAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003
RDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10
RBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec
R10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000
R13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88
FS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
<TASK>
filemap_get_folios_tag+0x87/0x2a0
__filemap_fdatawait_range+0x5f/0xd0
? srso_alias_return_thunk+0x5/0xfbef5
? __schedule+0x3e7/0x10c0
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
? srso_alias_return_thunk+0x5/0xfbef5
? cap_safe_nice+0x37/0x70
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
? srso_alias_return_thunk+0x5/0xfbef5
filemap_fdatawait_range_keep_errors+0x12/0x40
ext4_fc_commit+0x697/0x8b0
? ext4_file_write_iter+0x64b/0x950
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
? srso_alias_return_thunk+0x5/0xfbef5
? vfs_write+0x356/0x480
? srso_alias_return_thunk+0x5/0xfbef5
? preempt_count_sub+0x5f/0x80
ext4_sync_file+0xf7/0x370
do_fsync+0x3b/0x80
? syscall_trace_enter+0x108/0x1d0
__x64_sys_fdatasync+0x16/0x20
do_syscall_64+0x62/0x2c0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
...
```
Fix this by initializing the jbd2_inode first.
Use smp_wmb() and WRITE_ONCE() to publish ei->jinode after
initialization. Readers use READ_ONCE() to fetch the pointer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a361293f5fedea0016a10599f409631a15d47ee7 Version: a361293f5fedea0016a10599f409631a15d47ee7 Version: a361293f5fedea0016a10599f409631a15d47ee7 Version: a361293f5fedea0016a10599f409631a15d47ee7 Version: a361293f5fedea0016a10599f409631a15d47ee7 Version: a361293f5fedea0016a10599f409631a15d47ee7 Version: a361293f5fedea0016a10599f409631a15d47ee7 Version: a361293f5fedea0016a10599f409631a15d47ee7 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:47:55.794Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/fast_commit.c",
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2d2b648960147d078b000b9a7494017082024366",
"status": "affected",
"version": "a361293f5fedea0016a10599f409631a15d47ee7",
"versionType": "git"
},
{
"lessThan": "e4325e84727e539c8597bd5b8491349f57f7fb17",
"status": "affected",
"version": "a361293f5fedea0016a10599f409631a15d47ee7",
"versionType": "git"
},
{
"lessThan": "be54c0055407a73b60349c093c8ce621cb8fa232",
"status": "affected",
"version": "a361293f5fedea0016a10599f409631a15d47ee7",
"versionType": "git"
},
{
"lessThan": "a070d5a872ffe0e0fe5c46eda6386140ded39adb",
"status": "affected",
"version": "a361293f5fedea0016a10599f409631a15d47ee7",
"versionType": "git"
},
{
"lessThan": "e76bcb727e4874a2f9d0297f8e3f8eced89b0764",
"status": "affected",
"version": "a361293f5fedea0016a10599f409631a15d47ee7",
"versionType": "git"
},
{
"lessThan": "4855a59e21789c79f003a9b5f4135c95a7495c6b",
"status": "affected",
"version": "a361293f5fedea0016a10599f409631a15d47ee7",
"versionType": "git"
},
{
"lessThan": "33f486987af21531a7b18973d11795ede3da9ddd",
"status": "affected",
"version": "a361293f5fedea0016a10599f409631a15d47ee7",
"versionType": "git"
},
{
"lessThan": "1aec30021edd410b986c156f195f3d23959a9d11",
"status": "affected",
"version": "a361293f5fedea0016a10599f409631a15d47ee7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/fast_commit.c",
"fs/ext4/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.11"
},
{
"lessThan": "3.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: publish jinode after initialization\n\next4_inode_attach_jinode() publishes ei-\u003ejinode to concurrent users.\nIt used to set ei-\u003ejinode before jbd2_journal_init_jbd_inode(),\nallowing a reader to observe a non-NULL jinode with i_vfs_inode\nstill unset.\n\nThe fast commit flush path can then pass this jinode to\njbd2_wait_inode_data(), which dereferences i_vfs_inode-\u003ei_mapping and\nmay crash.\n\nBelow is the crash I observe:\n```\nBUG: unable to handle page fault for address: 000000010beb47f4\nPGD 110e51067 P4D 110e51067 PUD 0\nOops: Oops: 0000 [#1] SMP NOPTI\nCPU: 1 UID: 0 PID: 4850 Comm: fc_fsync_bench_ Not tainted 6.18.0-00764-g795a690c06a5 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014\nRIP: 0010:xas_find_marked+0x3d/0x2e0\nCode: e0 03 48 83 f8 02 0f 84 f0 01 00 00 48 8b 47 08 48 89 c3 48 39 c6 0f 82 fd 01 00 00 48 85 c9 74 3d 48 83 f9 03 77 63 4c 8b 0f \u003c49\u003e 8b 71 08 48 c7 47 18 00 00 00 00 48 89 f1 83 e1 03 48 83 f9 02\nRSP: 0018:ffffbbee806e7bf0 EFLAGS: 00010246\nRAX: 000000000010beb4 RBX: 000000000010beb4 RCX: 0000000000000003\nRDX: 0000000000000001 RSI: 0000002000300000 RDI: ffffbbee806e7c10\nRBP: 0000000000000001 R08: 0000002000300000 R09: 000000010beb47ec\nR10: ffff9ea494590090 R11: 0000000000000000 R12: 0000002000300000\nR13: ffffbbee806e7c90 R14: ffff9ea494513788 R15: ffffbbee806e7c88\nFS: 00007fc2f9e3e6c0(0000) GS:ffff9ea6b1444000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000010beb47f4 CR3: 0000000119ac5000 CR4: 0000000000750ef0\nPKRU: 55555554\nCall Trace:\n\u003cTASK\u003e\nfilemap_get_folios_tag+0x87/0x2a0\n__filemap_fdatawait_range+0x5f/0xd0\n? srso_alias_return_thunk+0x5/0xfbef5\n? __schedule+0x3e7/0x10c0\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? cap_safe_nice+0x37/0x70\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\nfilemap_fdatawait_range_keep_errors+0x12/0x40\next4_fc_commit+0x697/0x8b0\n? ext4_file_write_iter+0x64b/0x950\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\n? srso_alias_return_thunk+0x5/0xfbef5\n? vfs_write+0x356/0x480\n? srso_alias_return_thunk+0x5/0xfbef5\n? preempt_count_sub+0x5f/0x80\next4_sync_file+0xf7/0x370\ndo_fsync+0x3b/0x80\n? syscall_trace_enter+0x108/0x1d0\n__x64_sys_fdatasync+0x16/0x20\ndo_syscall_64+0x62/0x2c0\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n...\n```\n\nFix this by initializing the jbd2_inode first.\nUse smp_wmb() and WRITE_ONCE() to publish ei-\u003ejinode after\ninitialization. Readers use READ_ONCE() to fetch the pointer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - In a reasonable server deployment, an ext4 filesystem with fast commits can be exported through in-kernel NFS or ksmbd, whose remote write/commit/flush paths call VFS fsync into ext4. Remote clients can therefore reach the vulnerable fast-commit flush path over the network.\nAC:L - The bug is a race, but the attacker can drive both sides with concurrent open/write/truncate and fsync/fdatasync or network flush/commit operations. Fast commit being enabled is a deployment condition for the affected ext4 configuration, not an uncontrollable exploitation condition.\nPR:L - The attacker needs permission to write and sync a file on the affected ext4 filesystem or exported share. No kernel capability or administrator privilege is required once such filesystem access is available.\nUI:N - Exploitation is triggered entirely by attacker-controlled file operations. No separate victim action is required.\nS:U - The impact remains within the vulnerable kernel and filesystem security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The race exposes an uninitialized slab-allocated jbd2_inode to consumers, allowing stale kernel pointers and ranges to be interpreted by writeback/wait paths. Under the required higher-severity rule, this UAF-like invalid object use is treated as capable of enabling kernel memory disclosure primitives.\nI:H - The same stale jbd2_inode fields can drive ext4/jbd2 writeback callbacks through an invalid or stale inode pointer. Under the required higher-severity rule, this kernel object misuse is treated as potentially exploitable for memory corruption or arbitrary modification.\nA:H - The demonstrated failure is a kernel oops/page fault in the fast commit fsync path. A local or remote authorized attacker can repeatedly trigger the crash, causing high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:40.995Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2d2b648960147d078b000b9a7494017082024366"
},
{
"url": "https://git.kernel.org/stable/c/e4325e84727e539c8597bd5b8491349f57f7fb17"
},
{
"url": "https://git.kernel.org/stable/c/be54c0055407a73b60349c093c8ce621cb8fa232"
},
{
"url": "https://git.kernel.org/stable/c/a070d5a872ffe0e0fe5c46eda6386140ded39adb"
},
{
"url": "https://git.kernel.org/stable/c/e76bcb727e4874a2f9d0297f8e3f8eced89b0764"
},
{
"url": "https://git.kernel.org/stable/c/4855a59e21789c79f003a9b5f4135c95a7495c6b"
},
{
"url": "https://git.kernel.org/stable/c/33f486987af21531a7b18973d11795ede3da9ddd"
},
{
"url": "https://git.kernel.org/stable/c/1aec30021edd410b986c156f195f3d23959a9d11"
}
],
"title": "ext4: publish jinode after initialization",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31450",
"datePublished": "2026-04-22T13:53:45.532Z",
"dateReserved": "2026-03-09T15:48:24.091Z",
"dateUpdated": "2026-08-05T12:22:40.995Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45862 (GCVE-0-2026-45862)
Vulnerability from cvelistv5
Published
2026-05-27 12:15
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Flush cache for PASID table before using it
When writing the address of a freshly allocated zero-initialized PASID
table to a PASID directory entry, do that after the CPU cache flush for
this PASID table, not before it, to avoid the time window when this
PASID table may be already used by non-coherent IOMMU hardware while
its contents in RAM is still some random old data, not zero-initialized.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7e00b52c8cdd9d3a985d63d72ecae7bde6314883 Version: 5c65f097124770c3e5b9b83ed1a8b68c119bc7b5 Version: 2bed9455db7cc0ab7ece6b3d846472097b52855a Version: 194b3348bdbb7db65375c72f3f774aee4cc6614e Version: 194b3348bdbb7db65375c72f3f774aee4cc6614e Version: 194b3348bdbb7db65375c72f3f774aee4cc6614e Version: 194b3348bdbb7db65375c72f3f774aee4cc6614e Version: 194b3348bdbb7db65375c72f3f774aee4cc6614e Version: 1b48c70feefc499b62670521efa002ab01e05df5 Version: bc348a6cc8f92e9979fbfbb3c6b48fd51b4b1dbf Version: 5.10.175 ≤ Version: 5.15.103 ≤ Version: 6.1.16 ≤ Version: 5.4.237 ≤ Version: 6.2.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/pasid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cd75e77125c8a51754ca4cd60b4ca083ed735d1d",
"status": "affected",
"version": "7e00b52c8cdd9d3a985d63d72ecae7bde6314883",
"versionType": "git"
},
{
"lessThan": "0616137b70e6d9a547d4b60df8e1b64e36d83661",
"status": "affected",
"version": "5c65f097124770c3e5b9b83ed1a8b68c119bc7b5",
"versionType": "git"
},
{
"lessThan": "36990407cdd257473607e33802d00e978af2759e",
"status": "affected",
"version": "2bed9455db7cc0ab7ece6b3d846472097b52855a",
"versionType": "git"
},
{
"lessThan": "c93f23375d8c410954b0df825e814b632fd62b9d",
"status": "affected",
"version": "194b3348bdbb7db65375c72f3f774aee4cc6614e",
"versionType": "git"
},
{
"lessThan": "5962c30a6f05ea1ab73f039e235bb30716243517",
"status": "affected",
"version": "194b3348bdbb7db65375c72f3f774aee4cc6614e",
"versionType": "git"
},
{
"lessThan": "36244dfd3853f7bf89d03b8e90d56b23ce7fbc16",
"status": "affected",
"version": "194b3348bdbb7db65375c72f3f774aee4cc6614e",
"versionType": "git"
},
{
"lessThan": "d15cda135148ea7ba929cfdbcf208182bc29a7aa",
"status": "affected",
"version": "194b3348bdbb7db65375c72f3f774aee4cc6614e",
"versionType": "git"
},
{
"lessThan": "22d169bdd2849fe6bd18c2643742e1c02be6451c",
"status": "affected",
"version": "194b3348bdbb7db65375c72f3f774aee4cc6614e",
"versionType": "git"
},
{
"status": "affected",
"version": "1b48c70feefc499b62670521efa002ab01e05df5",
"versionType": "git"
},
{
"status": "affected",
"version": "bc348a6cc8f92e9979fbfbb3c6b48fd51b4b1dbf",
"versionType": "git"
},
{
"lessThan": "5.10.252",
"status": "affected",
"version": "5.10.175",
"versionType": "semver"
},
{
"lessThan": "5.15.202",
"status": "affected",
"version": "5.15.103",
"versionType": "semver"
},
{
"lessThan": "6.1.165",
"status": "affected",
"version": "6.1.16",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.237",
"versionType": "semver"
},
{
"lessThan": "6.3",
"status": "affected",
"version": "6.2.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/pasid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "5.10.175",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.15.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.1.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.237",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Flush cache for PASID table before using it\n\nWhen writing the address of a freshly allocated zero-initialized PASID\ntable to a PASID directory entry, do that after the CPU cache flush for\nthis PASID table, not before it, to avoid the time window when this\nPASID table may be already used by non-coherent IOMMU hardware while\nits contents in RAM is still some random old data, not zero-initialized."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable PASID-table allocation is reached locally via IOMMU domain attach (SVA bind through an accelerator device, or guest/IOMMUFD device setup) using syscalls/ioctls; there is no network-facing path to this code.\nAC:H - Exploitation requires non-coherent VT-d hardware and winning a nanosecond-scale cache-writeback race in which the IOMMU must read the entry before the CPU flushes the zeroes to RAM, with the stale data happening to form a usable present entry \u2014 conditions governed by microarchitectural timing the attacker cannot control.\nPR:L - An unprivileged local user with access to an SVA-capable accelerator device can drive `iommu_sva_bind_device` to trigger the PASID-table allocation while controlling the device\u0027s DMA; no real root is required.\nUI:N - The allocation and the device DMA are driven entirely by the attacker; no victim interaction is needed.\nS:C - The IOMMU enforces the DMA isolation boundary; using stale garbage PASID entries lets a device\u0027s DMA escape its assigned domain, impacting host physical memory in a different security authority \u2014 an IOMMU/DMA boundary bypass.\nC:H - A misdirected DMA translated through a garbage page table can read arbitrary host physical memory, yielding disclosure beyond the device\u0027s domain.\nI:H - The same misdirected DMA path provides write access to arbitrary host physical memory, allowing corruption of kernel data outside the device\u0027s intended domain.\nA:H - Garbage PASID entries can cause IOMMU faults, DMA failures, and memory corruption leading to oops/panic or device/system hangs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:37.806Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cd75e77125c8a51754ca4cd60b4ca083ed735d1d"
},
{
"url": "https://git.kernel.org/stable/c/0616137b70e6d9a547d4b60df8e1b64e36d83661"
},
{
"url": "https://git.kernel.org/stable/c/36990407cdd257473607e33802d00e978af2759e"
},
{
"url": "https://git.kernel.org/stable/c/c93f23375d8c410954b0df825e814b632fd62b9d"
},
{
"url": "https://git.kernel.org/stable/c/5962c30a6f05ea1ab73f039e235bb30716243517"
},
{
"url": "https://git.kernel.org/stable/c/36244dfd3853f7bf89d03b8e90d56b23ce7fbc16"
},
{
"url": "https://git.kernel.org/stable/c/d15cda135148ea7ba929cfdbcf208182bc29a7aa"
},
{
"url": "https://git.kernel.org/stable/c/22d169bdd2849fe6bd18c2643742e1c02be6451c"
}
],
"title": "iommu/vt-d: Flush cache for PASID table before using it",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45862",
"datePublished": "2026-05-27T12:15:41.903Z",
"dateReserved": "2026-05-13T15:03:33.080Z",
"dateUpdated": "2026-08-05T12:28:37.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45920 (GCVE-0-2026-45920)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-27 12:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix dirtyclusters double decrement on fs shutdown
fstests test generic/388 occasionally reproduces a warning in
ext4_put_super() associated with the dirty clusters count:
WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4]
Tracing the failure shows that the warning fires due to an
s_dirtyclusters_counter value of -1. IOW, this appears to be a
spurious decrement as opposed to some sort of leak. Further tracing
of the dirty cluster count deltas and an LLM scan of the resulting
output identified the cause as a double decrement in the error path
between ext4_mb_mark_diskspace_used() and the caller
ext4_mb_new_blocks().
First, note that generic/388 is a shutdown vs. fsstress test and so
produces a random set of operations and shutdown injections. In the
problematic case, the shutdown triggers an error return from the
ext4_handle_dirty_metadata() call(s) made from
ext4_mb_mark_context(). The changed value is non-zero at this point,
so ext4_mb_mark_diskspace_used() does not exit after the error
bubbles up from ext4_mb_mark_context(). Instead, the former
decrements both cluster counters and returns the error up to
ext4_mb_new_blocks(). The latter falls into the !ar->len out path
which decrements the dirty clusters counter a second time, creating
the inconsistency.
To avoid this problem and simplify ownership of the cluster
reservation in this codepath, lift the counter reduction to a single
place in the caller. This makes it more clear that
ext4_mb_new_blocks() is responsible for acquiring cluster
reservation (via ext4_claim_free_clusters()) in the !delalloc case
as well as releasing it, regardless of whether it ends up consumed
or returned due to failure.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0087d9fb3f29f59e8d42c8b058376d80e5adde4c Version: 0087d9fb3f29f59e8d42c8b058376d80e5adde4c Version: 0087d9fb3f29f59e8d42c8b058376d80e5adde4c Version: 0087d9fb3f29f59e8d42c8b058376d80e5adde4c Version: 0087d9fb3f29f59e8d42c8b058376d80e5adde4c Version: 0087d9fb3f29f59e8d42c8b058376d80e5adde4c Version: 0087d9fb3f29f59e8d42c8b058376d80e5adde4c Version: 0087d9fb3f29f59e8d42c8b058376d80e5adde4c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/mballoc-test.c",
"fs/ext4/mballoc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "523d5a4df3c649fa305c89efb552ec62a1ce9d3d",
"status": "affected",
"version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c",
"versionType": "git"
},
{
"lessThan": "ca408af08544d96769c93a3d81a7f63f61129e95",
"status": "affected",
"version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c",
"versionType": "git"
},
{
"lessThan": "55576fa14771d33994c29a9ae960e07bb3f56c20",
"status": "affected",
"version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c",
"versionType": "git"
},
{
"lessThan": "dbc4e10619ed87a50e637b96f2e574df36a7a769",
"status": "affected",
"version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c",
"versionType": "git"
},
{
"lessThan": "61e372122b6d95aec940fdaea0a16f988f359897",
"status": "affected",
"version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c",
"versionType": "git"
},
{
"lessThan": "3924aea2c33df3864929c1acd178bfc29d8f005f",
"status": "affected",
"version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c",
"versionType": "git"
},
{
"lessThan": "81982a11406c5da6c6e2b188028e7056e16b7128",
"status": "affected",
"version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c",
"versionType": "git"
},
{
"lessThan": "94a8cea54cd935c54fa2fba70354757c0fc245e3",
"status": "affected",
"version": "0087d9fb3f29f59e8d42c8b058376d80e5adde4c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/mballoc-test.c",
"fs/ext4/mballoc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix dirtyclusters double decrement on fs shutdown\n\nfstests test generic/388 occasionally reproduces a warning in\next4_put_super() associated with the dirty clusters count:\n\n WARNING: CPU: 7 PID: 76064 at fs/ext4/super.c:1324 ext4_put_super+0x48c/0x590 [ext4]\n\nTracing the failure shows that the warning fires due to an\ns_dirtyclusters_counter value of -1. IOW, this appears to be a\nspurious decrement as opposed to some sort of leak. Further tracing\nof the dirty cluster count deltas and an LLM scan of the resulting\noutput identified the cause as a double decrement in the error path\nbetween ext4_mb_mark_diskspace_used() and the caller\next4_mb_new_blocks().\n\nFirst, note that generic/388 is a shutdown vs. fsstress test and so\nproduces a random set of operations and shutdown injections. In the\nproblematic case, the shutdown triggers an error return from the\next4_handle_dirty_metadata() call(s) made from\next4_mb_mark_context(). The changed value is non-zero at this point,\nso ext4_mb_mark_diskspace_used() does not exit after the error\nbubbles up from ext4_mb_mark_context(). Instead, the former\ndecrements both cluster counters and returns the error up to\next4_mb_new_blocks(). The latter falls into the !ar-\u003elen out path\nwhich decrements the dirty clusters counter a second time, creating\nthe inconsistency.\n\nTo avoid this problem and simplify ownership of the cluster\nreservation in this codepath, lift the counter reduction to a single\nplace in the caller. This makes it more clear that\next4_mb_new_blocks() is responsible for acquiring cluster\nreservation (via ext4_claim_free_clusters()) in the !delalloc case\nas well as releasing it, regardless of whether it ends up consumed\nor returned due to failure."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:17:38.234Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/523d5a4df3c649fa305c89efb552ec62a1ce9d3d"
},
{
"url": "https://git.kernel.org/stable/c/ca408af08544d96769c93a3d81a7f63f61129e95"
},
{
"url": "https://git.kernel.org/stable/c/55576fa14771d33994c29a9ae960e07bb3f56c20"
},
{
"url": "https://git.kernel.org/stable/c/dbc4e10619ed87a50e637b96f2e574df36a7a769"
},
{
"url": "https://git.kernel.org/stable/c/61e372122b6d95aec940fdaea0a16f988f359897"
},
{
"url": "https://git.kernel.org/stable/c/3924aea2c33df3864929c1acd178bfc29d8f005f"
},
{
"url": "https://git.kernel.org/stable/c/81982a11406c5da6c6e2b188028e7056e16b7128"
},
{
"url": "https://git.kernel.org/stable/c/94a8cea54cd935c54fa2fba70354757c0fc245e3"
}
],
"title": "ext4: fix dirtyclusters double decrement on fs shutdown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45920",
"datePublished": "2026-05-27T12:17:38.234Z",
"dateReserved": "2026-05-13T15:03:33.085Z",
"dateUpdated": "2026-05-27T12:17:38.234Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43343 (GCVE-0-2026-43343)
Vulnerability from cvelistv5
Published
2026-05-08 13:37
Modified
2026-05-11 22:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
geth_alloc() increments the reference count, but geth_free() fails to
decrement it. This prevents the configuration of attributes via configfs
after unlinking the function.
Decrement the reference count in geth_free() to ensure proper cleanup.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 02832e56f88a981474ee4c7c141f46fc1b4454f4 Version: 02832e56f88a981474ee4c7c141f46fc1b4454f4 Version: 02832e56f88a981474ee4c7c141f46fc1b4454f4 Version: 02832e56f88a981474ee4c7c141f46fc1b4454f4 Version: 02832e56f88a981474ee4c7c141f46fc1b4454f4 Version: 02832e56f88a981474ee4c7c141f46fc1b4454f4 Version: 02832e56f88a981474ee4c7c141f46fc1b4454f4 Version: 02832e56f88a981474ee4c7c141f46fc1b4454f4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_subset.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a932b171554714b1bca313b853c7aa9f2930f9aa",
"status": "affected",
"version": "02832e56f88a981474ee4c7c141f46fc1b4454f4",
"versionType": "git"
},
{
"lessThan": "d7d702407b61e96286a15b6e715572f541a8d41c",
"status": "affected",
"version": "02832e56f88a981474ee4c7c141f46fc1b4454f4",
"versionType": "git"
},
{
"lessThan": "3f5bfc550a40d7493b1cf09540ed6b412b3b82be",
"status": "affected",
"version": "02832e56f88a981474ee4c7c141f46fc1b4454f4",
"versionType": "git"
},
{
"lessThan": "75776a055b656873319c3830fed471daef3ceb23",
"status": "affected",
"version": "02832e56f88a981474ee4c7c141f46fc1b4454f4",
"versionType": "git"
},
{
"lessThan": "cc8ec610cd14c093a19371691a7ce1ee5421e829",
"status": "affected",
"version": "02832e56f88a981474ee4c7c141f46fc1b4454f4",
"versionType": "git"
},
{
"lessThan": "3d436670b47415da042452618fb5d8e317ab095f",
"status": "affected",
"version": "02832e56f88a981474ee4c7c141f46fc1b4454f4",
"versionType": "git"
},
{
"lessThan": "23e4851ce348a329d974e84e828155dda9f52122",
"status": "affected",
"version": "02832e56f88a981474ee4c7c141f46fc1b4454f4",
"versionType": "git"
},
{
"lessThan": "caa27923aacd8a5869207842f2ab1657c6c0c7bc",
"status": "affected",
"version": "02832e56f88a981474ee4c7c141f46fc1b4454f4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_subset.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.11"
},
{
"lessThan": "3.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_subset: Fix unbalanced refcnt in geth_free\n\ngeth_alloc() increments the reference count, but geth_free() fails to\ndecrement it. This prevents the configuration of attributes via configfs\nafter unlinking the function.\n\nDecrement the reference count in geth_free() to ensure proper cleanup."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:22:44.192Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a932b171554714b1bca313b853c7aa9f2930f9aa"
},
{
"url": "https://git.kernel.org/stable/c/d7d702407b61e96286a15b6e715572f541a8d41c"
},
{
"url": "https://git.kernel.org/stable/c/3f5bfc550a40d7493b1cf09540ed6b412b3b82be"
},
{
"url": "https://git.kernel.org/stable/c/75776a055b656873319c3830fed471daef3ceb23"
},
{
"url": "https://git.kernel.org/stable/c/cc8ec610cd14c093a19371691a7ce1ee5421e829"
},
{
"url": "https://git.kernel.org/stable/c/3d436670b47415da042452618fb5d8e317ab095f"
},
{
"url": "https://git.kernel.org/stable/c/23e4851ce348a329d974e84e828155dda9f52122"
},
{
"url": "https://git.kernel.org/stable/c/caa27923aacd8a5869207842f2ab1657c6c0c7bc"
}
],
"title": "usb: gadget: f_subset: Fix unbalanced refcnt in geth_free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43343",
"datePublished": "2026-05-08T13:37:20.663Z",
"dateReserved": "2026-05-01T14:12:56.003Z",
"dateUpdated": "2026-05-11T22:22:44.192Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43407 (GCVE-0-2026-43407)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
This patch fixes an out-of-bounds access in ceph_handle_auth_reply()
that can be triggered by a message of type CEPH_MSG_AUTH_REPLY. In
ceph_handle_auth_reply(), the value of the payload_len field of such a
message is stored in a variable of type int. A value greater than
INT_MAX leads to an integer overflow and is interpreted as a negative
value. This leads to decrementing the pointer address by this value and
subsequently accessing it because ceph_decode_need() only checks that
the memory access does not exceed the end address of the allocation.
This patch fixes the issue by changing the data type of payload_len to
u32. Additionally, the data type of result_msg_len is changed to u32,
as it is also a variable holding a non-negative length.
Also, an additional layer of sanity checks is introduced, ensuring that
directly after reading it from the message, payload_len and
result_msg_len are not greater than the overall segment length.
BUG: KASAN: slab-out-of-bounds in ceph_handle_auth_reply+0x642/0x7a0 [libceph]
Read of size 4 at addr ffff88811404df14 by task kworker/20:1/262
CPU: 20 UID: 0 PID: 262 Comm: kworker/20:1 Not tainted 6.19.2 #5 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: ceph-msgr ceph_con_workfn [libceph]
Call Trace:
<TASK>
dump_stack_lvl+0x76/0xa0
print_report+0xd1/0x620
? __pfx__raw_spin_lock_irqsave+0x10/0x10
? kasan_complete_mode_report_info+0x72/0x210
kasan_report+0xe7/0x130
? ceph_handle_auth_reply+0x642/0x7a0 [libceph]
? ceph_handle_auth_reply+0x642/0x7a0 [libceph]
__asan_report_load_n_noabort+0xf/0x20
ceph_handle_auth_reply+0x642/0x7a0 [libceph]
mon_dispatch+0x973/0x23d0 [libceph]
? apparmor_socket_recvmsg+0x6b/0xa0
? __pfx_mon_dispatch+0x10/0x10 [libceph]
? __kasan_check_write+0x14/0x30i
? mutex_unlock+0x7f/0xd0
? __pfx_mutex_unlock+0x10/0x10
? __pfx_do_recvmsg+0x10/0x10 [libceph]
ceph_con_process_message+0x1f1/0x650 [libceph]
process_message+0x1e/0x450 [libceph]
ceph_con_v2_try_read+0x2e48/0x6c80 [libceph]
? __pfx_ceph_con_v2_try_read+0x10/0x10 [libceph]
? save_fpregs_to_fpstate+0xb0/0x230
? raw_spin_rq_unlock+0x17/0xa0
? finish_task_switch.isra.0+0x13b/0x760
? __switch_to+0x385/0xda0
? __kasan_check_write+0x14/0x30
? mutex_lock+0x8d/0xe0
? __pfx_mutex_lock+0x10/0x10
ceph_con_workfn+0x248/0x10c0 [libceph]
process_one_work+0x629/0xf80
? __kasan_check_write+0x14/0x30
worker_thread+0x87f/0x1570
? __pfx__raw_spin_lock_irqsave+0x10/0x10
? __pfx_try_to_wake_up+0x10/0x10
? kasan_print_address_stack_frame+0x1f7/0x280
? __pfx_worker_thread+0x10/0x10
kthread+0x396/0x830
? __pfx__raw_spin_lock_irq+0x10/0x10
? __pfx_kthread+0x10/0x10
? __kasan_check_write+0x14/0x30
? recalc_sigpending+0x180/0x210
? __pfx_kthread+0x10/0x10
ret_from_fork+0x3f7/0x610
? __pfx_ret_from_fork+0x10/0x10
? __switch_to+0x385/0xda0
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
[ idryomov: replace if statements with ceph_decode_need() for
payload_len and result_msg_len ]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ea080b21092590122c3f971cf588932cdbf47847",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "edc678e5cd11730a2834b43071d8923f05bc334d",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "6cee34d6669fe176b4259131adb1a145c939b472",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "8bb87547e92dcf0928ed763c60e0ac8d733c3656",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "ed024d2f4c79c0eb2464df0fb640610ac301f9a0",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "f9da5c1bbac5c8e33259fe00ed7347438fffa969",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "9f9e2297f45fc2d2524eb104c289d69ddef95665",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "b282c43ed156ae15ea76748fc15cd5c39dc9ab72",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()\n\nThis patch fixes an out-of-bounds access in ceph_handle_auth_reply()\nthat can be triggered by a message of type CEPH_MSG_AUTH_REPLY. In\nceph_handle_auth_reply(), the value of the payload_len field of such a\nmessage is stored in a variable of type int. A value greater than\nINT_MAX leads to an integer overflow and is interpreted as a negative\nvalue. This leads to decrementing the pointer address by this value and\nsubsequently accessing it because ceph_decode_need() only checks that\nthe memory access does not exceed the end address of the allocation.\n\nThis patch fixes the issue by changing the data type of payload_len to\nu32. Additionally, the data type of result_msg_len is changed to u32,\nas it is also a variable holding a non-negative length.\n\nAlso, an additional layer of sanity checks is introduced, ensuring that\ndirectly after reading it from the message, payload_len and\nresult_msg_len are not greater than the overall segment length.\n\nBUG: KASAN: slab-out-of-bounds in ceph_handle_auth_reply+0x642/0x7a0 [libceph]\nRead of size 4 at addr ffff88811404df14 by task kworker/20:1/262\n\nCPU: 20 UID: 0 PID: 262 Comm: kworker/20:1 Not tainted 6.19.2 #5 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nWorkqueue: ceph-msgr ceph_con_workfn [libceph]\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x76/0xa0\n print_report+0xd1/0x620\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? kasan_complete_mode_report_info+0x72/0x210\n kasan_report+0xe7/0x130\n ? ceph_handle_auth_reply+0x642/0x7a0 [libceph]\n ? ceph_handle_auth_reply+0x642/0x7a0 [libceph]\n __asan_report_load_n_noabort+0xf/0x20\n ceph_handle_auth_reply+0x642/0x7a0 [libceph]\n mon_dispatch+0x973/0x23d0 [libceph]\n ? apparmor_socket_recvmsg+0x6b/0xa0\n ? __pfx_mon_dispatch+0x10/0x10 [libceph]\n ? __kasan_check_write+0x14/0x30i\n ? mutex_unlock+0x7f/0xd0\n ? __pfx_mutex_unlock+0x10/0x10\n ? __pfx_do_recvmsg+0x10/0x10 [libceph]\n ceph_con_process_message+0x1f1/0x650 [libceph]\n process_message+0x1e/0x450 [libceph]\n ceph_con_v2_try_read+0x2e48/0x6c80 [libceph]\n ? __pfx_ceph_con_v2_try_read+0x10/0x10 [libceph]\n ? save_fpregs_to_fpstate+0xb0/0x230\n ? raw_spin_rq_unlock+0x17/0xa0\n ? finish_task_switch.isra.0+0x13b/0x760\n ? __switch_to+0x385/0xda0\n ? __kasan_check_write+0x14/0x30\n ? mutex_lock+0x8d/0xe0\n ? __pfx_mutex_lock+0x10/0x10\n ceph_con_workfn+0x248/0x10c0 [libceph]\n process_one_work+0x629/0xf80\n ? __kasan_check_write+0x14/0x30\n worker_thread+0x87f/0x1570\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? __pfx_try_to_wake_up+0x10/0x10\n ? kasan_print_address_stack_frame+0x1f7/0x280\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x396/0x830\n ? __pfx__raw_spin_lock_irq+0x10/0x10\n ? __pfx_kthread+0x10/0x10\n ? __kasan_check_write+0x14/0x30\n ? recalc_sigpending+0x180/0x210\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x3f7/0x610\n ? __pfx_ret_from_fork+0x10/0x10\n ? __switch_to+0x385/0xda0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\n[ idryomov: replace if statements with ceph_decode_need() for\n payload_len and result_msg_len ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable `CEPH_MSG_AUTH_REPLY` is parsed from data received over a Ceph messenger TCP connection from a monitor peer. A malicious or compromised monitor, or an attacker in position to impersonate one, can supply the crafted network message remotely.\nAC:L - The trigger is a deterministic malformed length field in a single auth reply, with no race or unusual heap state required to reach the out-of-bounds read. The attacker controls the relevant message contents.\nPR:N - The vulnerable reply is processed by the kernel client from the network peer during monitor/auth session handling, before any attacker-controlled credentials are required on the target. No local account or target privileges are needed.\nUI:N - Once a Ceph client connects or reconnects to the monitor peer, the attacker can send the crafted reply without further victim action. This is server-to-client network input processing.\nS:U - The impact is within the Linux kernel/client security authority. It does not cross a hypervisor, IOMMU, or separate authorization scope boundary.\nC:H - The signed length overflow lets the attacker move the decode pointer before the message buffer and perform an out-of-bounds kernel memory read at an attacker-influenced offset. Although the immediate read is small, it is not confined to a fixed in-object field, so high confidentiality impact is the safer defensible choice.\nI:N - The bug is an out-of-bounds read caused by pointer underflow; the investigated path does not provide an out-of-bounds write or direct memory corruption primitive. The downstream auth handlers reject the inverted buffer range or ignore the payload.\nA:H - The commit includes a KASAN slab-out-of-bounds report in `ceph_handle_auth_reply()`, and attacker-controlled pointer underflow can fault or oops the kernel worker processing the connection. A malicious peer can repeat the malformed reply to disrupt affected clients."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:50.423Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ea080b21092590122c3f971cf588932cdbf47847"
},
{
"url": "https://git.kernel.org/stable/c/edc678e5cd11730a2834b43071d8923f05bc334d"
},
{
"url": "https://git.kernel.org/stable/c/6cee34d6669fe176b4259131adb1a145c939b472"
},
{
"url": "https://git.kernel.org/stable/c/8bb87547e92dcf0928ed763c60e0ac8d733c3656"
},
{
"url": "https://git.kernel.org/stable/c/ed024d2f4c79c0eb2464df0fb640610ac301f9a0"
},
{
"url": "https://git.kernel.org/stable/c/f9da5c1bbac5c8e33259fe00ed7347438fffa969"
},
{
"url": "https://git.kernel.org/stable/c/9f9e2297f45fc2d2524eb104c289d69ddef95665"
},
{
"url": "https://git.kernel.org/stable/c/b282c43ed156ae15ea76748fc15cd5c39dc9ab72"
}
],
"title": "libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43407",
"datePublished": "2026-05-08T14:21:46.927Z",
"dateReserved": "2026-05-01T14:12:56.008Z",
"dateUpdated": "2026-08-05T12:27:50.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46090 (GCVE-0-2026-46090)
Vulnerability from cvelistv5
Published
2026-05-27 12:58
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: aloop: Fix peer runtime UAF during format-change stop
loopback_check_format() may stop the capture side when playback starts
with parameters that no longer match a running capture stream. Commit
826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved
the peer lookup under cable->lock, but the actual snd_pcm_stop() still
runs after dropping that lock.
A concurrent close can clear the capture entry from cable->streams[] and
detach or free its runtime while the playback trigger path still holds a
stale peer substream pointer.
Keep a per-cable count of in-flight peer stops before dropping
cable->lock, and make free_cable() wait for those stops before
detaching the runtime. This preserves the existing behavior while
making the peer runtime lifetime explicit.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 597603d615d2b19a9e451d8cfac24372856a522d Version: 597603d615d2b19a9e451d8cfac24372856a522d Version: 597603d615d2b19a9e451d8cfac24372856a522d Version: 597603d615d2b19a9e451d8cfac24372856a522d Version: 597603d615d2b19a9e451d8cfac24372856a522d Version: 597603d615d2b19a9e451d8cfac24372856a522d |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.29.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.84.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_extras_rt_els:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.10.0-1160.155.1.rt56.1307.el7",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.10.0-1160.154.1.el7",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.136.1.rt7.477.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.136.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.197.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.197.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.198.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.198.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.150.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.150.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.19.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.178.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.178.1.rt14.463.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.135.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.125.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s ALSA (Advanced Linux Sound Architecture) aloop driver. This Use-After-Free (UAF) vulnerability occurs when loopback_check_format() stops the capture side during a format change, while a concurrent close operation detaches or frees the runtime. An attacker could potentially exploit this to cause a system crash or achieve arbitrary code execution."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-364",
"description": "Signal Handler Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-20T12:04:57.641Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-46090"
},
{
"name": "RHBZ#2481980",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481980"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46090.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35844"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41236"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33215"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33685"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34095"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34443"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34094"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30848"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27353"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35896"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33899"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:35863"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27354"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33900"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:35844: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:41236: Red Hat Enterprise Linux for Real Time (v. 7 ELS)"
},
{
"lang": "en",
"value": "RHSA-2026:33215: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:33685: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:34095: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:34443: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:34094: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:30848: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:27353: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:35896: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:33899: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:35863: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:27354: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:33900: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-27T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-27T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/drivers/aloop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "83bd62fa9620ac98d5d694bde14c50f98c8e7189",
"status": "affected",
"version": "597603d615d2b19a9e451d8cfac24372856a522d",
"versionType": "git"
},
{
"lessThan": "345c24b2bcf0923dfae1ab41497351c68214ff76",
"status": "affected",
"version": "597603d615d2b19a9e451d8cfac24372856a522d",
"versionType": "git"
},
{
"lessThan": "03f52a9c170431e8f10e156b9dc0dae80b3e9198",
"status": "affected",
"version": "597603d615d2b19a9e451d8cfac24372856a522d",
"versionType": "git"
},
{
"lessThan": "bdd9503c3d222d2735b56c7a8b4422ccf3de6e5c",
"status": "affected",
"version": "597603d615d2b19a9e451d8cfac24372856a522d",
"versionType": "git"
},
{
"lessThan": "5d45e34bf001344e2966dabca1897561bbc9e913",
"status": "affected",
"version": "597603d615d2b19a9e451d8cfac24372856a522d",
"versionType": "git"
},
{
"lessThan": "e5c33cdc6f402eab8abd36ecf436b22c9d3a8aff",
"status": "affected",
"version": "597603d615d2b19a9e451d8cfac24372856a522d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/drivers/aloop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.37"
},
{
"lessThan": "2.6.37",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: aloop: Fix peer runtime UAF during format-change stop\n\nloopback_check_format() may stop the capture side when playback starts\nwith parameters that no longer match a running capture stream. Commit\n826af7fa62e3 (\"ALSA: aloop: Fix racy access at PCM trigger\") moved\nthe peer lookup under cable-\u003elock, but the actual snd_pcm_stop() still\nruns after dropping that lock.\n\nA concurrent close can clear the capture entry from cable-\u003estreams[] and\ndetach or free its runtime while the playback trigger path still holds a\nstale peer substream pointer.\n\nKeep a per-cable count of in-flight peer stops before dropping\ncable-\u003elock, and make free_cable() wait for those stops before\ndetaching the runtime. This preserves the existing behavior while\nmaking the peer runtime lifetime explicit."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached only through local ALSA PCM device files (/dev/snd/pcmC*D*) via open/ioctl syscalls; there is no remote or network-facing path to the aloop trigger callback.\nAC:L - The attacker controls both sides of the race by opening both loopback substreams and repeatedly triggering playback START while concurrently closing the capture stream; syzbot reproduces it readily, so no condition is outside attacker control.\nPR:L - Exploitation requires only access to /dev/snd PCM nodes, which an unprivileged local user obtains via the audio group or udev session ACLs on systems where snd-aloop is loaded; no real root is needed.\nUI:N - The attacker performs all open/trigger/close operations themselves; no victim action is required.\nS:U - The use-after-free and its impact are confined within the kernel\u0027s own security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The UAF on the freed snd_pcm_runtime heap object lets an attacker reclaim it via heap spraying and read attacker-influenced/adjacent kernel memory, yielding high confidentiality impact.\nI:H - Re-entering snd_pcm_stop()/the trigger op on a freed, attacker-reclaimable object enables a write/control-flow primitive via heap spraying, giving high integrity impact.\nA:H - The use-after-free dereferences freed kernel memory, reliably causing an oops/kernel panic and thus high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:34.260Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/83bd62fa9620ac98d5d694bde14c50f98c8e7189"
},
{
"url": "https://git.kernel.org/stable/c/345c24b2bcf0923dfae1ab41497351c68214ff76"
},
{
"url": "https://git.kernel.org/stable/c/03f52a9c170431e8f10e156b9dc0dae80b3e9198"
},
{
"url": "https://git.kernel.org/stable/c/bdd9503c3d222d2735b56c7a8b4422ccf3de6e5c"
},
{
"url": "https://git.kernel.org/stable/c/5d45e34bf001344e2966dabca1897561bbc9e913"
},
{
"url": "https://git.kernel.org/stable/c/e5c33cdc6f402eab8abd36ecf436b22c9d3a8aff"
}
],
"title": "ALSA: aloop: Fix peer runtime UAF during format-change stop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46090",
"datePublished": "2026-05-27T12:58:34.428Z",
"dateReserved": "2026-05-13T15:03:33.097Z",
"dateUpdated": "2026-08-05T12:29:34.260Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43246 (GCVE-0-2026-43246)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: i2c/tw9906: Fix potential memory leak in tw9906_probe()
In one of the error paths in tw9906_probe(), the memory allocated in
v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not freed. Fix that
by calling v4l2_ctrl_handler_free() on the handler in that error path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a000e9a02b5885b1b69f691c80e346d102f94a88 Version: a000e9a02b5885b1b69f691c80e346d102f94a88 Version: a000e9a02b5885b1b69f691c80e346d102f94a88 Version: a000e9a02b5885b1b69f691c80e346d102f94a88 Version: a000e9a02b5885b1b69f691c80e346d102f94a88 Version: a000e9a02b5885b1b69f691c80e346d102f94a88 Version: a000e9a02b5885b1b69f691c80e346d102f94a88 Version: a000e9a02b5885b1b69f691c80e346d102f94a88 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/i2c/tw9906.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e9a490937942f18205dac7b6b192975ef1369ae1",
"status": "affected",
"version": "a000e9a02b5885b1b69f691c80e346d102f94a88",
"versionType": "git"
},
{
"lessThan": "9548a8bbf511a252a9848f96220c6b95c9a3b918",
"status": "affected",
"version": "a000e9a02b5885b1b69f691c80e346d102f94a88",
"versionType": "git"
},
{
"lessThan": "0c33338514d8246280533a77091e6b6ee548c606",
"status": "affected",
"version": "a000e9a02b5885b1b69f691c80e346d102f94a88",
"versionType": "git"
},
{
"lessThan": "ccb92def042a3636ed47f25a30bd553788e5191e",
"status": "affected",
"version": "a000e9a02b5885b1b69f691c80e346d102f94a88",
"versionType": "git"
},
{
"lessThan": "fb09d8b80046216646f1a344410cfa9cfa6c6c7c",
"status": "affected",
"version": "a000e9a02b5885b1b69f691c80e346d102f94a88",
"versionType": "git"
},
{
"lessThan": "377a7756914364d72550fc86ca0f404ef1d96141",
"status": "affected",
"version": "a000e9a02b5885b1b69f691c80e346d102f94a88",
"versionType": "git"
},
{
"lessThan": "59420d5d9c46b084e21f9ea6ce79fc79ae9e414c",
"status": "affected",
"version": "a000e9a02b5885b1b69f691c80e346d102f94a88",
"versionType": "git"
},
{
"lessThan": "cad237b6c875fbee5d353a2b289e98d240d17ec8",
"status": "affected",
"version": "a000e9a02b5885b1b69f691c80e346d102f94a88",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/i2c/tw9906.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c/tw9906: Fix potential memory leak in tw9906_probe()\n\nIn one of the error paths in tw9906_probe(), the memory allocated in\nv4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not freed. Fix that\nby calling v4l2_ctrl_handler_free() on the handler in that error path."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:20:50.199Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e9a490937942f18205dac7b6b192975ef1369ae1"
},
{
"url": "https://git.kernel.org/stable/c/9548a8bbf511a252a9848f96220c6b95c9a3b918"
},
{
"url": "https://git.kernel.org/stable/c/0c33338514d8246280533a77091e6b6ee548c606"
},
{
"url": "https://git.kernel.org/stable/c/ccb92def042a3636ed47f25a30bd553788e5191e"
},
{
"url": "https://git.kernel.org/stable/c/fb09d8b80046216646f1a344410cfa9cfa6c6c7c"
},
{
"url": "https://git.kernel.org/stable/c/377a7756914364d72550fc86ca0f404ef1d96141"
},
{
"url": "https://git.kernel.org/stable/c/59420d5d9c46b084e21f9ea6ce79fc79ae9e414c"
},
{
"url": "https://git.kernel.org/stable/c/cad237b6c875fbee5d353a2b289e98d240d17ec8"
}
],
"title": "media: i2c/tw9906: Fix potential memory leak in tw9906_probe()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43246",
"datePublished": "2026-05-06T11:28:38.246Z",
"dateReserved": "2026-05-01T14:12:55.996Z",
"dateUpdated": "2026-05-11T22:20:50.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23276 (GCVE-0-2026-23276)
Vulnerability from cvelistv5
Published
2026-03-20 08:08
Modified
2026-05-23 16:04
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: add xmit recursion limit to tunnel xmit functions
Tunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own
recursion limit. When a bond device in broadcast mode has GRE tap
interfaces as slaves, and those GRE tunnels route back through the
bond, multicast/broadcast traffic triggers infinite recursion between
bond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing
kernel stack overflow.
The existing XMIT_RECURSION_LIMIT (8) in the no-qdisc path is not
sufficient because tunnel recursion involves route lookups and full IP
output, consuming much more stack per level. Use a lower limit of 4
(IP_TUNNEL_RECURSION_LIMIT) to prevent overflow.
Add recursion detection using dev_xmit_recursion helpers directly in
iptunnel_xmit() and ip6tunnel_xmit() to cover all IPv4/IPv6 tunnel
paths including UDP encapsulated tunnels (VXLAN, Geneve, etc.).
Move dev_xmit_recursion helpers from net/core/dev.h to public header
include/linux/netdevice.h so they can be used by tunnel code.
BUG: KASAN: stack-out-of-bounds in blake2s.constprop.0+0xe7/0x160
Write of size 32 at addr ffff88810033fed0 by task kworker/0:1/11
Workqueue: mld mld_ifc_work
Call Trace:
<TASK>
__build_flow_key.constprop.0 (net/ipv4/route.c:515)
ip_rt_update_pmtu (net/ipv4/route.c:1073)
iptunnel_xmit (net/ipv4/ip_tunnel_core.c:84)
ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)
gre_tap_xmit (net/ipv4/ip_gre.c:779)
dev_hard_start_xmit (net/core/dev.c:3887)
sch_direct_xmit (net/sched/sch_generic.c:347)
__dev_queue_xmit (net/core/dev.c:4802)
bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)
bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)
bond_start_xmit (drivers/net/bonding/bond_main.c:5530)
dev_hard_start_xmit (net/core/dev.c:3887)
__dev_queue_xmit (net/core/dev.c:4841)
ip_finish_output2 (net/ipv4/ip_output.c:237)
ip_output (net/ipv4/ip_output.c:438)
iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)
gre_tap_xmit (net/ipv4/ip_gre.c:779)
dev_hard_start_xmit (net/core/dev.c:3887)
sch_direct_xmit (net/sched/sch_generic.c:347)
__dev_queue_xmit (net/core/dev.c:4802)
bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)
bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)
bond_start_xmit (drivers/net/bonding/bond_main.c:5530)
dev_hard_start_xmit (net/core/dev.c:3887)
__dev_queue_xmit (net/core/dev.c:4841)
ip_finish_output2 (net/ipv4/ip_output.c:237)
ip_output (net/ipv4/ip_output.c:438)
iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)
ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)
gre_tap_xmit (net/ipv4/ip_gre.c:779)
dev_hard_start_xmit (net/core/dev.c:3887)
sch_direct_xmit (net/sched/sch_generic.c:347)
__dev_queue_xmit (net/core/dev.c:4802)
bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)
bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)
bond_start_xmit (drivers/net/bonding/bond_main.c:5530)
dev_hard_start_xmit (net/core/dev.c:3887)
__dev_queue_xmit (net/core/dev.c:4841)
mld_sendpack
mld_ifc_work
process_one_work
worker_thread
</TASK>
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 745e20f1b626b1be4b100af5d4bf7b3439392f8f Version: 745e20f1b626b1be4b100af5d4bf7b3439392f8f Version: 745e20f1b626b1be4b100af5d4bf7b3439392f8f Version: 745e20f1b626b1be4b100af5d4bf7b3439392f8f Version: 3f266b04185de51d8e6446eb1fccec3b5e7ce575 Version: 2.6.35.9 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/netdevice.h",
"include/net/ip6_tunnel.h",
"include/net/ip_tunnels.h",
"net/core/dev.h",
"net/ipv4/ip_tunnel_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "834c4f645726a25fd71ea50cdfb5c135f8f95d85",
"status": "affected",
"version": "745e20f1b626b1be4b100af5d4bf7b3439392f8f",
"versionType": "git"
},
{
"lessThan": "8a57deeb256069f262957d8012418559ff66c385",
"status": "affected",
"version": "745e20f1b626b1be4b100af5d4bf7b3439392f8f",
"versionType": "git"
},
{
"lessThan": "b56b8d19bd05e2a8338385c770bc2b60590bc81e",
"status": "affected",
"version": "745e20f1b626b1be4b100af5d4bf7b3439392f8f",
"versionType": "git"
},
{
"lessThan": "6f1a9140ecda3baba3d945b9a6155af4268aafc4",
"status": "affected",
"version": "745e20f1b626b1be4b100af5d4bf7b3439392f8f",
"versionType": "git"
},
{
"status": "affected",
"version": "3f266b04185de51d8e6446eb1fccec3b5e7ce575",
"versionType": "git"
},
{
"lessThan": "2.6.36",
"status": "affected",
"version": "2.6.35.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/netdevice.h",
"include/net/ip6_tunnel.h",
"include/net/ip_tunnels.h",
"net/core/dev.h",
"net/ipv4/ip_tunnel_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.37"
},
{
"lessThan": "2.6.37",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.35.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: add xmit recursion limit to tunnel xmit functions\n\nTunnel xmit functions (iptunnel_xmit, ip6tunnel_xmit) lack their own\nrecursion limit. When a bond device in broadcast mode has GRE tap\ninterfaces as slaves, and those GRE tunnels route back through the\nbond, multicast/broadcast traffic triggers infinite recursion between\nbond_xmit_broadcast() and ip_tunnel_xmit()/ip6_tnl_xmit(), causing\nkernel stack overflow.\n\nThe existing XMIT_RECURSION_LIMIT (8) in the no-qdisc path is not\nsufficient because tunnel recursion involves route lookups and full IP\noutput, consuming much more stack per level. Use a lower limit of 4\n(IP_TUNNEL_RECURSION_LIMIT) to prevent overflow.\n\nAdd recursion detection using dev_xmit_recursion helpers directly in\niptunnel_xmit() and ip6tunnel_xmit() to cover all IPv4/IPv6 tunnel\npaths including UDP encapsulated tunnels (VXLAN, Geneve, etc.).\n\nMove dev_xmit_recursion helpers from net/core/dev.h to public header\ninclude/linux/netdevice.h so they can be used by tunnel code.\n\n BUG: KASAN: stack-out-of-bounds in blake2s.constprop.0+0xe7/0x160\n Write of size 32 at addr ffff88810033fed0 by task kworker/0:1/11\n Workqueue: mld mld_ifc_work\n Call Trace:\n \u003cTASK\u003e\n __build_flow_key.constprop.0 (net/ipv4/route.c:515)\n ip_rt_update_pmtu (net/ipv4/route.c:1073)\n iptunnel_xmit (net/ipv4/ip_tunnel_core.c:84)\n ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\n gre_tap_xmit (net/ipv4/ip_gre.c:779)\n dev_hard_start_xmit (net/core/dev.c:3887)\n sch_direct_xmit (net/sched/sch_generic.c:347)\n __dev_queue_xmit (net/core/dev.c:4802)\n bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\n bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\n bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\n dev_hard_start_xmit (net/core/dev.c:3887)\n __dev_queue_xmit (net/core/dev.c:4841)\n ip_finish_output2 (net/ipv4/ip_output.c:237)\n ip_output (net/ipv4/ip_output.c:438)\n iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)\n gre_tap_xmit (net/ipv4/ip_gre.c:779)\n dev_hard_start_xmit (net/core/dev.c:3887)\n sch_direct_xmit (net/sched/sch_generic.c:347)\n __dev_queue_xmit (net/core/dev.c:4802)\n bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\n bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\n bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\n dev_hard_start_xmit (net/core/dev.c:3887)\n __dev_queue_xmit (net/core/dev.c:4841)\n ip_finish_output2 (net/ipv4/ip_output.c:237)\n ip_output (net/ipv4/ip_output.c:438)\n iptunnel_xmit (net/ipv4/ip_tunnel_core.c:86)\n ip_tunnel_xmit (net/ipv4/ip_tunnel.c:847)\n gre_tap_xmit (net/ipv4/ip_gre.c:779)\n dev_hard_start_xmit (net/core/dev.c:3887)\n sch_direct_xmit (net/sched/sch_generic.c:347)\n __dev_queue_xmit (net/core/dev.c:4802)\n bond_dev_queue_xmit (drivers/net/bonding/bond_main.c:312)\n bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5279)\n bond_start_xmit (drivers/net/bonding/bond_main.c:5530)\n dev_hard_start_xmit (net/core/dev.c:3887)\n __dev_queue_xmit (net/core/dev.c:4841)\n mld_sendpack\n mld_ifc_work\n process_one_work\n worker_thread\n \u003c/TASK\u003e"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:04:28.110Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/834c4f645726a25fd71ea50cdfb5c135f8f95d85"
},
{
"url": "https://git.kernel.org/stable/c/8a57deeb256069f262957d8012418559ff66c385"
},
{
"url": "https://git.kernel.org/stable/c/b56b8d19bd05e2a8338385c770bc2b60590bc81e"
},
{
"url": "https://git.kernel.org/stable/c/6f1a9140ecda3baba3d945b9a6155af4268aafc4"
}
],
"title": "net: add xmit recursion limit to tunnel xmit functions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23276",
"datePublished": "2026-03-20T08:08:56.575Z",
"dateReserved": "2026-01-13T15:37:45.991Z",
"dateUpdated": "2026-05-23T16:04:28.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45883 (GCVE-0-2026-45883)
Vulnerability from cvelistv5
Published
2026-05-27 12:16
Modified
2026-05-27 12:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: sca3000: Fix a resource leak in sca3000_probe()
spi->irq from request_threaded_irq() not released when
iio_device_register() fails. Add an return value check and jump to a
common error handler when iio_device_register() fails.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9a4936dc89a34e002946a6c08b330918ec6afab8 Version: 9a4936dc89a34e002946a6c08b330918ec6afab8 Version: 9a4936dc89a34e002946a6c08b330918ec6afab8 Version: 9a4936dc89a34e002946a6c08b330918ec6afab8 Version: 9a4936dc89a34e002946a6c08b330918ec6afab8 Version: 9a4936dc89a34e002946a6c08b330918ec6afab8 Version: 9a4936dc89a34e002946a6c08b330918ec6afab8 Version: 9a4936dc89a34e002946a6c08b330918ec6afab8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/accel/sca3000.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "55e13abf22c27a3b0ab5cf941dd07a2d9786736c",
"status": "affected",
"version": "9a4936dc89a34e002946a6c08b330918ec6afab8",
"versionType": "git"
},
{
"lessThan": "40c860ece22542178cddcf01b08644bcdbc597b3",
"status": "affected",
"version": "9a4936dc89a34e002946a6c08b330918ec6afab8",
"versionType": "git"
},
{
"lessThan": "597d749c5180f3e351837e851a6131b140324e9f",
"status": "affected",
"version": "9a4936dc89a34e002946a6c08b330918ec6afab8",
"versionType": "git"
},
{
"lessThan": "e8e960c3d23fdb4882d70d34ce762368da0f1427",
"status": "affected",
"version": "9a4936dc89a34e002946a6c08b330918ec6afab8",
"versionType": "git"
},
{
"lessThan": "103ac8e3a7f345a0966ef582b8a874ac31a92c7c",
"status": "affected",
"version": "9a4936dc89a34e002946a6c08b330918ec6afab8",
"versionType": "git"
},
{
"lessThan": "517d9f2b963089b3d64c23accf7920d77f5a30c8",
"status": "affected",
"version": "9a4936dc89a34e002946a6c08b330918ec6afab8",
"versionType": "git"
},
{
"lessThan": "84d3c396d8ae73c24dececfcc4e544ea09311e32",
"status": "affected",
"version": "9a4936dc89a34e002946a6c08b330918ec6afab8",
"versionType": "git"
},
{
"lessThan": "62b44ebc1f2c71db3ca2d4737c52e433f6f03038",
"status": "affected",
"version": "9a4936dc89a34e002946a6c08b330918ec6afab8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/accel/sca3000.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: sca3000: Fix a resource leak in sca3000_probe()\n\nspi-\u003eirq from request_threaded_irq() not released when\niio_device_register() fails. Add an return value check and jump to a\ncommon error handler when iio_device_register() fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:16:55.840Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/55e13abf22c27a3b0ab5cf941dd07a2d9786736c"
},
{
"url": "https://git.kernel.org/stable/c/40c860ece22542178cddcf01b08644bcdbc597b3"
},
{
"url": "https://git.kernel.org/stable/c/597d749c5180f3e351837e851a6131b140324e9f"
},
{
"url": "https://git.kernel.org/stable/c/e8e960c3d23fdb4882d70d34ce762368da0f1427"
},
{
"url": "https://git.kernel.org/stable/c/103ac8e3a7f345a0966ef582b8a874ac31a92c7c"
},
{
"url": "https://git.kernel.org/stable/c/517d9f2b963089b3d64c23accf7920d77f5a30c8"
},
{
"url": "https://git.kernel.org/stable/c/84d3c396d8ae73c24dececfcc4e544ea09311e32"
},
{
"url": "https://git.kernel.org/stable/c/62b44ebc1f2c71db3ca2d4737c52e433f6f03038"
}
],
"title": "iio: sca3000: Fix a resource leak in sca3000_probe()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45883",
"datePublished": "2026-05-27T12:16:55.840Z",
"dateReserved": "2026-05-13T15:03:33.082Z",
"dateUpdated": "2026-05-27T12:16:55.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43017 (GCVE-0-2026-43017)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-05-11 22:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: validate mesh send advertising payload length
mesh_send() currently bounds MGMT_OP_MESH_SEND by total command
length, but it never verifies that the bytes supplied for the
flexible adv_data[] array actually match the embedded adv_data_len
field. MGMT_MESH_SEND_SIZE only covers the fixed header, so a
truncated command can still pass the existing 20..50 byte range
check and later drive the async mesh send path past the end of the
queued command buffer.
Keep rejecting zero-length and oversized advertising payloads, but
validate adv_data_len explicitly and require the command length to
exactly match the flexible array size before queueing the request.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b338d91703fae6f6afd67f3f75caa3b8f36ddef3 Version: b338d91703fae6f6afd67f3f75caa3b8f36ddef3 Version: b338d91703fae6f6afd67f3f75caa3b8f36ddef3 Version: b338d91703fae6f6afd67f3f75caa3b8f36ddef3 Version: b338d91703fae6f6afd67f3f75caa3b8f36ddef3 Version: b338d91703fae6f6afd67f3f75caa3b8f36ddef3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "24fa32369cf15d8fc918bdfe94097b12e6acada0",
"status": "affected",
"version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3",
"versionType": "git"
},
{
"lessThan": "244b639e6a3a8e26241e201004a3a9f764476631",
"status": "affected",
"version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3",
"versionType": "git"
},
{
"lessThan": "0b706fb2294aff3adfd54653bda1b5e356ad4566",
"status": "affected",
"version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3",
"versionType": "git"
},
{
"lessThan": "edb5898cfa91afe7e8f83eda18d93034c953d632",
"status": "affected",
"version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3",
"versionType": "git"
},
{
"lessThan": "562ed1954f0c1bff3422b7b752bd3dacf185edbf",
"status": "affected",
"version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3",
"versionType": "git"
},
{
"lessThan": "bda93eec78cdbfe5cda00785cefebd443e56b88b",
"status": "affected",
"version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate mesh send advertising payload length\n\nmesh_send() currently bounds MGMT_OP_MESH_SEND by total command\nlength, but it never verifies that the bytes supplied for the\nflexible adv_data[] array actually match the embedded adv_data_len\nfield. MGMT_MESH_SEND_SIZE only covers the fixed header, so a\ntruncated command can still pass the existing 20..50 byte range\ncheck and later drive the async mesh send path past the end of the\nqueued command buffer.\n\nKeep rejecting zero-length and oversized advertising payloads, but\nvalidate adv_data_len explicitly and require the command length to\nexactly match the flexible array size before queueing the request."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:16:05.863Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/24fa32369cf15d8fc918bdfe94097b12e6acada0"
},
{
"url": "https://git.kernel.org/stable/c/244b639e6a3a8e26241e201004a3a9f764476631"
},
{
"url": "https://git.kernel.org/stable/c/0b706fb2294aff3adfd54653bda1b5e356ad4566"
},
{
"url": "https://git.kernel.org/stable/c/edb5898cfa91afe7e8f83eda18d93034c953d632"
},
{
"url": "https://git.kernel.org/stable/c/562ed1954f0c1bff3422b7b752bd3dacf185edbf"
},
{
"url": "https://git.kernel.org/stable/c/bda93eec78cdbfe5cda00785cefebd443e56b88b"
}
],
"title": "Bluetooth: MGMT: validate mesh send advertising payload length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43017",
"datePublished": "2026-05-01T14:15:21.561Z",
"dateReserved": "2026-05-01T14:12:55.975Z",
"dateUpdated": "2026-05-11T22:16:05.863Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46328 (GCVE-0-2026-46328)
Vulnerability from cvelistv5
Published
2026-06-09 12:25
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
apparmor: fix rlimit for posix cpu timers
Posix cpu timers requires an additional step beyond setting the rlimit.
Refactor the code so its clear when what code is setting the
limit and conditionally update the posix cpu timers when appropriate.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: baa73d9e478ff32d62f3f9422822b59dd9a95a21 Version: baa73d9e478ff32d62f3f9422822b59dd9a95a21 Version: baa73d9e478ff32d62f3f9422822b59dd9a95a21 Version: baa73d9e478ff32d62f3f9422822b59dd9a95a21 Version: baa73d9e478ff32d62f3f9422822b59dd9a95a21 Version: baa73d9e478ff32d62f3f9422822b59dd9a95a21 Version: baa73d9e478ff32d62f3f9422822b59dd9a95a21 Version: baa73d9e478ff32d62f3f9422822b59dd9a95a21 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/apparmor/resource.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e1cc11550b2f66687a374536c9dfdddcefca0efe",
"status": "affected",
"version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21",
"versionType": "git"
},
{
"lessThan": "2232d7cd243833ad750cae656d1817fe43744a09",
"status": "affected",
"version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21",
"versionType": "git"
},
{
"lessThan": "28aa93fcfb33b6d580c5df4ae8b6d13fb0e6fcd3",
"status": "affected",
"version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21",
"versionType": "git"
},
{
"lessThan": "1f736dfe27c857b78f8461cd7c3dd9640be74b37",
"status": "affected",
"version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21",
"versionType": "git"
},
{
"lessThan": "e43818b16815c0c2bf933ef28316f8e704e5e0ef",
"status": "affected",
"version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21",
"versionType": "git"
},
{
"lessThan": "9bf1fa150775b0c6b794e4b6a2c0395e13777999",
"status": "affected",
"version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21",
"versionType": "git"
},
{
"lessThan": "57d51d41b90eface809b72e0e009b50546492f1f",
"status": "affected",
"version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21",
"versionType": "git"
},
{
"lessThan": "6ca56813f4a589f536adceb42882855d91fb1125",
"status": "affected",
"version": "baa73d9e478ff32d62f3f9422822b59dd9a95a21",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/apparmor/resource.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: fix rlimit for posix cpu timers\n\nPosix cpu timers requires an additional step beyond setting the rlimit.\nRefactor the code so its clear when what code is setting the\nlimit and conditionally update the posix cpu timers when appropriate."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is only reached via the execve() credential-commit path (security_bprm_committing_creds \u2192 apparmor_bprm_committing_creds \u2192 __aa_transition_rlimits), requiring a local syscall with no network-facing entry point.\nAC:L - An attacker who can exec between AppArmor profiles with differing RLIMIT_CPU rules controls both the transition timing and CPU consumption beforehand, making the stale posix_cputimers.nextevt condition reliably triggerable whenever policy permits the exec.\nPR:L - Exploitation requires only an unprivileged local process already confined by AppArmor that is permitted to exec into a different profile; no real root or capabilities beyond what the AppArmor policy already grants are needed.\nUI:N - No victim interaction is required; the attacker triggers the bug by executing a binary that causes an AppArmor profile transition on their own process.\nS:C - The bug breaches the AppArmor MAC security boundary by allowing a confined process to exceed administrator-defined RLIMIT_CPU constraints that policy intended to enforce, impacting host resources beyond what the profile permits.\nC:N - The flaw desynchronizes a timer expiration cache from rlimit values; it does not read kernel memory, leak pointers, or provide any information disclosure primitive.\nI:L - While not arbitrary memory write, bypassing AppArmor-enforced CPU hard limits is a limited but real integrity failure of the security policy\u2019s resource enforcement, allowing a confined process to exceed mandated constraints.\nA:H - A stale high nextevt lets confined workloads exceed CPU caps and exhaust CPU on shared Ubuntu/cloud hosts, and a stale low nextevt can deliver premature SIGXCPU that terminates confined services; both constitute high availability impact even without a kernel panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:23.796Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e1cc11550b2f66687a374536c9dfdddcefca0efe"
},
{
"url": "https://git.kernel.org/stable/c/2232d7cd243833ad750cae656d1817fe43744a09"
},
{
"url": "https://git.kernel.org/stable/c/28aa93fcfb33b6d580c5df4ae8b6d13fb0e6fcd3"
},
{
"url": "https://git.kernel.org/stable/c/1f736dfe27c857b78f8461cd7c3dd9640be74b37"
},
{
"url": "https://git.kernel.org/stable/c/e43818b16815c0c2bf933ef28316f8e704e5e0ef"
},
{
"url": "https://git.kernel.org/stable/c/9bf1fa150775b0c6b794e4b6a2c0395e13777999"
},
{
"url": "https://git.kernel.org/stable/c/57d51d41b90eface809b72e0e009b50546492f1f"
},
{
"url": "https://git.kernel.org/stable/c/6ca56813f4a589f536adceb42882855d91fb1125"
}
],
"title": "apparmor: fix rlimit for posix cpu timers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46328",
"datePublished": "2026-06-09T12:25:57.629Z",
"dateReserved": "2026-05-13T15:03:33.112Z",
"dateUpdated": "2026-08-05T12:31:23.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53218 (GCVE-0-2026-53218)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_exthdr: fix register tracking for F_PRESENT flag
nft_exthdr_init() passes user-controlled priv->len to
nft_parse_register_store(), which marks that many bytes in the
register bitmap as initialized. However, when NFT_EXTHDR_F_PRESENT
is set, the eval paths write only 1 byte (nft_reg_store8) or
4 bytes (*dest = 0 on TCP/DCCP error path). When len > 4,
registers beyond the first are never written, retaining
uninitialized stack data from nft_regs.
Bail out if userspace requests too much data when F_PRESENT is set.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 Version: c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 Version: c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 Version: c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 Version: c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 Version: c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 Version: c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 Version: c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_exthdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8738b1b6d0e639ca1fc0f61516afd3557ac4ecc6",
"status": "affected",
"version": "c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783",
"versionType": "git"
},
{
"lessThan": "19748967d59c31d24d21d40b728570788310b237",
"status": "affected",
"version": "c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783",
"versionType": "git"
},
{
"lessThan": "46fc15a044e9938e7ea77786fb37edd2cd74f031",
"status": "affected",
"version": "c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783",
"versionType": "git"
},
{
"lessThan": "cd513e43b4b2bd1de39e2367bc4261c699a8652f",
"status": "affected",
"version": "c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783",
"versionType": "git"
},
{
"lessThan": "67b27434c43b68a97becda98c9f0c8cf6cba2134",
"status": "affected",
"version": "c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783",
"versionType": "git"
},
{
"lessThan": "78069a6d8bc86c9e036eb82c2af4a19cc1871a53",
"status": "affected",
"version": "c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783",
"versionType": "git"
},
{
"lessThan": "f08fb3d42fd3aad0b7a263da3ac3ebaf0845e265",
"status": "affected",
"version": "c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783",
"versionType": "git"
},
{
"lessThan": "772cecf198da732faebb5dcfc46d66a505be8495",
"status": "affected",
"version": "c078ca3b0c5bf82c2b31906c446d6e2ad8ea0783",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_exthdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_exthdr: fix register tracking for F_PRESENT flag\n\nnft_exthdr_init() passes user-controlled priv-\u003elen to\nnft_parse_register_store(), which marks that many bytes in the\nregister bitmap as initialized. However, when NFT_EXTHDR_F_PRESENT\nis set, the eval paths write only 1 byte (nft_reg_store8) or\n4 bytes (*dest = 0 on TCP/DCCP error path). When len \u003e 4,\nregisters beyond the first are never written, retaining\nuninitialized stack data from nft_regs.\n\nBail out if userspace requests too much data when F_PRESENT is set."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:21.069Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8738b1b6d0e639ca1fc0f61516afd3557ac4ecc6"
},
{
"url": "https://git.kernel.org/stable/c/19748967d59c31d24d21d40b728570788310b237"
},
{
"url": "https://git.kernel.org/stable/c/46fc15a044e9938e7ea77786fb37edd2cd74f031"
},
{
"url": "https://git.kernel.org/stable/c/cd513e43b4b2bd1de39e2367bc4261c699a8652f"
},
{
"url": "https://git.kernel.org/stable/c/67b27434c43b68a97becda98c9f0c8cf6cba2134"
},
{
"url": "https://git.kernel.org/stable/c/78069a6d8bc86c9e036eb82c2af4a19cc1871a53"
},
{
"url": "https://git.kernel.org/stable/c/f08fb3d42fd3aad0b7a263da3ac3ebaf0845e265"
},
{
"url": "https://git.kernel.org/stable/c/772cecf198da732faebb5dcfc46d66a505be8495"
}
],
"title": "netfilter: nft_exthdr: fix register tracking for F_PRESENT flag",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53218",
"datePublished": "2026-06-25T08:39:21.069Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-06-25T08:39:21.069Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53225 (GCVE-0-2026-53225)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
__sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF
chunk can hold the ADDIP header and a parameter header, then calls
af->from_addr_param(), which reads the full address (16 bytes for IPv6)
trusting the parameter's declared length.
An unauthenticated peer can send a truncated trailing ASCONF chunk that
declares an IPv6 address parameter but stops after the 4-byte parameter
header; reached from the no-association lookup path, from_addr_param() then
reads uninitialized bytes past the parameter.
Impact: an unauthenticated SCTP peer makes the receive path read up to 16
bytes of uninitialized memory past a truncated ASCONF address parameter.
The sibling __sctp_rcv_init_lookup() bounds parameters with
sctp_walk_params(); this path open-codes the fetch and omits the bound.
Verify the whole address parameter lies within the chunk before
from_addr_param() reads it, the same class of fix as commit 51e5ad549c43
("net: sctp: fix KMSAN uninit-value in sctp_inq_pop").
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: df21857714398acb8b24a8bb5a6d2286dd9c59ef Version: df21857714398acb8b24a8bb5a6d2286dd9c59ef Version: df21857714398acb8b24a8bb5a6d2286dd9c59ef Version: df21857714398acb8b24a8bb5a6d2286dd9c59ef Version: df21857714398acb8b24a8bb5a6d2286dd9c59ef Version: df21857714398acb8b24a8bb5a6d2286dd9c59ef Version: df21857714398acb8b24a8bb5a6d2286dd9c59ef Version: df21857714398acb8b24a8bb5a6d2286dd9c59ef |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "446e0ecd845abc394b24ae2030a883572bec9d16",
"status": "affected",
"version": "df21857714398acb8b24a8bb5a6d2286dd9c59ef",
"versionType": "git"
},
{
"lessThan": "928dd94db23e8ba340f83d68f7f24d831b7a4426",
"status": "affected",
"version": "df21857714398acb8b24a8bb5a6d2286dd9c59ef",
"versionType": "git"
},
{
"lessThan": "d796cfd06074b579d265b28401306cadd30db945",
"status": "affected",
"version": "df21857714398acb8b24a8bb5a6d2286dd9c59ef",
"versionType": "git"
},
{
"lessThan": "8ce96f1182644079249a24ac7e2ffc32e0301a46",
"status": "affected",
"version": "df21857714398acb8b24a8bb5a6d2286dd9c59ef",
"versionType": "git"
},
{
"lessThan": "d6bd0bb7697ea8c0387b0d9d973453f479017b23",
"status": "affected",
"version": "df21857714398acb8b24a8bb5a6d2286dd9c59ef",
"versionType": "git"
},
{
"lessThan": "f76a8b323e28e0951f979dbef20a7496383c47df",
"status": "affected",
"version": "df21857714398acb8b24a8bb5a6d2286dd9c59ef",
"versionType": "git"
},
{
"lessThan": "8e86817b8af4d552f3c6fe04ca52bb0c8c57411d",
"status": "affected",
"version": "df21857714398acb8b24a8bb5a6d2286dd9c59ef",
"versionType": "git"
},
{
"lessThan": "f8373d7090b745728de66308deeecc67e8d319ce",
"status": "affected",
"version": "df21857714398acb8b24a8bb5a6d2286dd9c59ef",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.25"
},
{
"lessThan": "2.6.25",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.25",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: fix uninit-value in __sctp_rcv_asconf_lookup()\n\n__sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF\nchunk can hold the ADDIP header and a parameter header, then calls\naf-\u003efrom_addr_param(), which reads the full address (16 bytes for IPv6)\ntrusting the parameter\u0027s declared length.\n\nAn unauthenticated peer can send a truncated trailing ASCONF chunk that\ndeclares an IPv6 address parameter but stops after the 4-byte parameter\nheader; reached from the no-association lookup path, from_addr_param() then\nreads uninitialized bytes past the parameter.\n\nImpact: an unauthenticated SCTP peer makes the receive path read up to 16\nbytes of uninitialized memory past a truncated ASCONF address parameter.\n\nThe sibling __sctp_rcv_init_lookup() bounds parameters with\nsctp_walk_params(); this path open-codes the fetch and omits the bound.\nVerify the whole address parameter lies within the chunk before\nfrom_addr_param() reads it, the same class of fix as commit 51e5ad549c43\n(\"net: sctp: fix KMSAN uninit-value in sctp_inq_pop\")."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is reached from the SCTP packet receive path via IP/IPv6 or SCTP-over-UDP encapsulation. A remote peer can send the malformed AUTH-bundled ASCONF packet over the network.\nAC:L - Triggering only requires a syntactically valid SCTP packet with an AUTH chunk before a truncated ASCONF chunk declaring an IPv6 address parameter. There is no race or condition outside attacker control.\nPR:N - The association lookup path only checks that an AUTH chunk was seen before ASCONF; it does not validate the AUTH HMAC before the vulnerable read. The commit explicitly describes an unauthenticated peer reaching the bug.\nUI:N - No victim action is required after SCTP is reachable on the target. The attacker sends network packets directly to the kernel receive path.\nS:U - The vulnerability affects the kernel SCTP networking stack within the same operating-system security authority. It does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The bug causes an unauthenticated out-of-bounds/uninitialized read of up to a full IPv6 address worth of bytes past a truncated ASCONF parameter. Under the provided guidance, this is scored High because it is an OOB read not strictly limited to a few harmless bytes.\nI:N - The vulnerable operation reads bytes into a temporary SCTP address used for lookup and does not write attacker data to kernel structures. No direct integrity modification or control-flow overwrite is present.\nA:H - The malformed packet can repeatedly trigger an invalid kernel receive-path read, and such out-of-bounds reads can fault or panic on hardened/sanitized deployments. With uncertainty resolved upward, availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:17.928Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/446e0ecd845abc394b24ae2030a883572bec9d16"
},
{
"url": "https://git.kernel.org/stable/c/928dd94db23e8ba340f83d68f7f24d831b7a4426"
},
{
"url": "https://git.kernel.org/stable/c/d796cfd06074b579d265b28401306cadd30db945"
},
{
"url": "https://git.kernel.org/stable/c/8ce96f1182644079249a24ac7e2ffc32e0301a46"
},
{
"url": "https://git.kernel.org/stable/c/d6bd0bb7697ea8c0387b0d9d973453f479017b23"
},
{
"url": "https://git.kernel.org/stable/c/f76a8b323e28e0951f979dbef20a7496383c47df"
},
{
"url": "https://git.kernel.org/stable/c/8e86817b8af4d552f3c6fe04ca52bb0c8c57411d"
},
{
"url": "https://git.kernel.org/stable/c/f8373d7090b745728de66308deeecc67e8d319ce"
}
],
"title": "sctp: fix uninit-value in __sctp_rcv_asconf_lookup()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53225",
"datePublished": "2026-06-25T08:39:25.911Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-08-05T12:34:17.928Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43139 (GCVE-0-2026-43139)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm6: fix uninitialized saddr in xfrm6_get_saddr()
xfrm6_get_saddr() does not check the return value of
ipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable
source address (returns -EADDRNOTAVAIL), saddr->in6 is left
uninitialized, but xfrm6_get_saddr() still returns 0 (success).
This causes the caller xfrm_tmpl_resolve_one() to use the uninitialized
address in xfrm_state_find(), triggering KMSAN warning:
=====================================================
BUG: KMSAN: uninit-value in xfrm_state_find+0x2424/0xa940
xfrm_state_find+0x2424/0xa940
xfrm_resolve_and_create_bundle+0x906/0x5a20
xfrm_lookup_with_ifid+0xcc0/0x3770
xfrm_lookup_route+0x63/0x2b0
ip_route_output_flow+0x1ce/0x270
udp_sendmsg+0x2ce1/0x3400
inet_sendmsg+0x1ef/0x2a0
__sock_sendmsg+0x278/0x3d0
__sys_sendto+0x593/0x720
__x64_sys_sendto+0x130/0x200
x64_sys_call+0x332b/0x3e70
do_syscall_64+0xd3/0xf80
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Local variable tmp.i.i created at:
xfrm_resolve_and_create_bundle+0x3e3/0x5a20
xfrm_lookup_with_ifid+0xcc0/0x3770
=====================================================
Fix by checking the return value of ipv6_dev_get_saddr() and propagating
the error.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a1e59abf824969554b90facd44a4ab16e265afa4 Version: a1e59abf824969554b90facd44a4ab16e265afa4 Version: a1e59abf824969554b90facd44a4ab16e265afa4 Version: a1e59abf824969554b90facd44a4ab16e265afa4 Version: a1e59abf824969554b90facd44a4ab16e265afa4 Version: a1e59abf824969554b90facd44a4ab16e265afa4 Version: a1e59abf824969554b90facd44a4ab16e265afa4 Version: a1e59abf824969554b90facd44a4ab16e265afa4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/xfrm6_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4f28141786e1fe884ce42a5197ba9beed540f0ea",
"status": "affected",
"version": "a1e59abf824969554b90facd44a4ab16e265afa4",
"versionType": "git"
},
{
"lessThan": "6535867673bf301d52aa00593a4d1d18cc3922fa",
"status": "affected",
"version": "a1e59abf824969554b90facd44a4ab16e265afa4",
"versionType": "git"
},
{
"lessThan": "eb2ee15290af14c60b45cf2b73f5687d1d077d9b",
"status": "affected",
"version": "a1e59abf824969554b90facd44a4ab16e265afa4",
"versionType": "git"
},
{
"lessThan": "719918fc88df6da023dfff370cd965151a5afd7f",
"status": "affected",
"version": "a1e59abf824969554b90facd44a4ab16e265afa4",
"versionType": "git"
},
{
"lessThan": "dc0abce055134cb83b0d981d31ceb20dda419787",
"status": "affected",
"version": "a1e59abf824969554b90facd44a4ab16e265afa4",
"versionType": "git"
},
{
"lessThan": "c7221e7bd8fc2ef38a0b27be580d9d202281306b",
"status": "affected",
"version": "a1e59abf824969554b90facd44a4ab16e265afa4",
"versionType": "git"
},
{
"lessThan": "3dcd1664ac15eee6a690daec7c4ffc59190406f7",
"status": "affected",
"version": "a1e59abf824969554b90facd44a4ab16e265afa4",
"versionType": "git"
},
{
"lessThan": "1799d8abeabc68ec05679292aaf6cba93b343c05",
"status": "affected",
"version": "a1e59abf824969554b90facd44a4ab16e265afa4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/xfrm6_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.19"
},
{
"lessThan": "2.6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm6: fix uninitialized saddr in xfrm6_get_saddr()\n\nxfrm6_get_saddr() does not check the return value of\nipv6_dev_get_saddr(). When ipv6_dev_get_saddr() fails to find a suitable\nsource address (returns -EADDRNOTAVAIL), saddr-\u003ein6 is left\nuninitialized, but xfrm6_get_saddr() still returns 0 (success).\n\nThis causes the caller xfrm_tmpl_resolve_one() to use the uninitialized\naddress in xfrm_state_find(), triggering KMSAN warning:\n\n=====================================================\nBUG: KMSAN: uninit-value in xfrm_state_find+0x2424/0xa940\n xfrm_state_find+0x2424/0xa940\n xfrm_resolve_and_create_bundle+0x906/0x5a20\n xfrm_lookup_with_ifid+0xcc0/0x3770\n xfrm_lookup_route+0x63/0x2b0\n ip_route_output_flow+0x1ce/0x270\n udp_sendmsg+0x2ce1/0x3400\n inet_sendmsg+0x1ef/0x2a0\n __sock_sendmsg+0x278/0x3d0\n __sys_sendto+0x593/0x720\n __x64_sys_sendto+0x130/0x200\n x64_sys_call+0x332b/0x3e70\n do_syscall_64+0xd3/0xf80\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nLocal variable tmp.i.i created at:\n xfrm_resolve_and_create_bundle+0x3e3/0x5a20\n xfrm_lookup_with_ifid+0xcc0/0x3770\n=====================================================\n\nFix by checking the return value of ipv6_dev_get_saddr() and propagating\nthe error."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A network-triggered path exists on an IPv6/IPsec endpoint: received IPv6 traffic that causes kernel-generated output, such as ICMPv6/NDISC replies or service responses, enters xfrm_lookup_route() and reaches xfrm_tmpl_resolve_one()-\u003exfrm6_get_saddr(). The same code is locally reachable with sendmsg(), but a reasonably configured XFRM/IPsec host can be triggered by network traffic.\nAC:L - No race, heap grooming, or timing condition is required; once the affected outbound XFRM template has a wildcard IPv6 tunnel source and source address selection fails, the unchecked error path is deterministic. Matching output traffic can be triggered repeatedly.\nPR:N - The network trigger does not require the attacker to authenticate or hold local privileges. Creating the XFRM policy requires CAP_NET_ADMIN, including via a user/net namespace for local testing, but in the network scenario that policy is preexisting victim configuration.\nUI:N - No victim user action is required after the vulnerable XFRM/IPsec configuration is present. Packets or local sends directly drive the kernel output path.\nS:U - The bug affects kernel XFRM/IPv6 processing within the same host security authority. It does not cross a VM, IOMMU, or separate security scope boundary.\nC:L - The uninitialized value is a bounded 16-byte IPv6 source address from kernel stack, used in hashes/comparisons and potentially copied into XFRM acquire state/messages. This is limited kernel memory disclosure, not an arbitrary read primitive.\nI:L - The uninitialized source address can influence XFRM state lookup/acquire behavior and create or notify state using an unintended local tunnel endpoint. This is limited integrity impact to IPsec/XFRM state handling, not arbitrary modification.\nA:H - Syzbot reported a kernel BUG/KMSAN finding in xfrm_state_find(), and the bad value is consumed in core XFRM state lookup/acquire paths that can be triggered repeatedly. Kernel warning/oops/panic conditions are high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:11.398Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4f28141786e1fe884ce42a5197ba9beed540f0ea"
},
{
"url": "https://git.kernel.org/stable/c/6535867673bf301d52aa00593a4d1d18cc3922fa"
},
{
"url": "https://git.kernel.org/stable/c/eb2ee15290af14c60b45cf2b73f5687d1d077d9b"
},
{
"url": "https://git.kernel.org/stable/c/719918fc88df6da023dfff370cd965151a5afd7f"
},
{
"url": "https://git.kernel.org/stable/c/dc0abce055134cb83b0d981d31ceb20dda419787"
},
{
"url": "https://git.kernel.org/stable/c/c7221e7bd8fc2ef38a0b27be580d9d202281306b"
},
{
"url": "https://git.kernel.org/stable/c/3dcd1664ac15eee6a690daec7c4ffc59190406f7"
},
{
"url": "https://git.kernel.org/stable/c/1799d8abeabc68ec05679292aaf6cba93b343c05"
}
],
"title": "xfrm6: fix uninitialized saddr in xfrm6_get_saddr()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43139",
"datePublished": "2026-05-06T11:27:24.898Z",
"dateReserved": "2026-05-01T14:12:55.988Z",
"dateUpdated": "2026-08-05T12:26:11.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46235 (GCVE-0-2026-46235)
Vulnerability from cvelistv5
Published
2026-05-28 09:41
Modified
2026-06-14 18:04
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: saa7164: add ioremap return checks and cleanups
Add checks for ioremap return values in saa7164_dev_setup(). If
ioremap for BAR0 or BAR2 fails, release the already allocated PCI
memory regions, remove the device from the global list, decrement
the device count, and return -ENODEV.
This prevents potential null pointer dereferences and ensures proper
cleanup on memory mapping failures.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 443c1228d50518f3c550e1fef490a2c9d9246ce7 Version: 443c1228d50518f3c550e1fef490a2c9d9246ce7 Version: 443c1228d50518f3c550e1fef490a2c9d9246ce7 Version: 443c1228d50518f3c550e1fef490a2c9d9246ce7 Version: 443c1228d50518f3c550e1fef490a2c9d9246ce7 Version: 443c1228d50518f3c550e1fef490a2c9d9246ce7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/saa7164/saa7164-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "23dee5990d2c27ed79567fd61ccfe6876768531a",
"status": "affected",
"version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
"versionType": "git"
},
{
"lessThan": "3ce8f3057c51bb0a66aa3fab0862be74e9f88684",
"status": "affected",
"version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
"versionType": "git"
},
{
"lessThan": "a9b83f46e52cf1239d780920d1a7a3e415f7b5d9",
"status": "affected",
"version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
"versionType": "git"
},
{
"lessThan": "6047dc542fa404b5c187cc2c7906aaaaec6d11ed",
"status": "affected",
"version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
"versionType": "git"
},
{
"lessThan": "6c22a6d8e4c1507bba504aeebe80476144a373eb",
"status": "affected",
"version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
"versionType": "git"
},
{
"lessThan": "d51c60a498e83c9a79884c8e420f97e3885c9583",
"status": "affected",
"version": "443c1228d50518f3c550e1fef490a2c9d9246ce7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/saa7164/saa7164-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.32"
},
{
"lessThan": "2.6.32",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: saa7164: add ioremap return checks and cleanups\n\nAdd checks for ioremap return values in saa7164_dev_setup(). If\nioremap for BAR0 or BAR2 fails, release the already allocated PCI\nmemory regions, remove the device from the global list, decrement\nthe device count, and return -ENODEV.\n\nThis prevents potential null pointer dereferences and ensures proper\ncleanup on memory mapping failures."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:04:45.615Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/23dee5990d2c27ed79567fd61ccfe6876768531a"
},
{
"url": "https://git.kernel.org/stable/c/3ce8f3057c51bb0a66aa3fab0862be74e9f88684"
},
{
"url": "https://git.kernel.org/stable/c/a9b83f46e52cf1239d780920d1a7a3e415f7b5d9"
},
{
"url": "https://git.kernel.org/stable/c/6047dc542fa404b5c187cc2c7906aaaaec6d11ed"
},
{
"url": "https://git.kernel.org/stable/c/6c22a6d8e4c1507bba504aeebe80476144a373eb"
},
{
"url": "https://git.kernel.org/stable/c/d51c60a498e83c9a79884c8e420f97e3885c9583"
}
],
"title": "media: saa7164: add ioremap return checks and cleanups",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46235",
"datePublished": "2026-05-28T09:41:04.419Z",
"dateReserved": "2026-05-13T15:03:33.106Z",
"dateUpdated": "2026-06-14T18:04:45.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31667 (GCVE-0-2026-31667)
Vulnerability from cvelistv5
Published
2026-04-24 14:45
Modified
2026-08-05 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: uinput - fix circular locking dependency with ff-core
A lockdep circular locking dependency warning can be triggered
reproducibly when using a force-feedback gamepad with uinput (for
example, playing ELDEN RING under Wine with a Flydigi Vader 5
controller):
ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex
The cycle is caused by four lock acquisition paths:
1. ff upload: input_ff_upload() holds ff->mutex and calls
uinput_dev_upload_effect() -> uinput_request_submit() ->
uinput_request_send(), which acquires udev->mutex.
2. device create: uinput_ioctl_handler() holds udev->mutex and calls
uinput_create_device() -> input_register_device(), which acquires
input_mutex.
3. device register: input_register_device() holds input_mutex and
calls kbd_connect() -> input_register_handle(), which acquires
dev->mutex.
4. evdev release: evdev_release() calls input_flush_device() under
dev->mutex, which calls input_ff_flush() acquiring ff->mutex.
Fix this by introducing a new state_lock spinlock to protect
udev->state and udev->dev access in uinput_request_send() instead of
acquiring udev->mutex. The function only needs to atomically check
device state and queue an input event into the ring buffer via
uinput_dev_event() -- both operations are safe under a spinlock
(ktime_get_ts64() and wake_up_interruptible() do not sleep). This
breaks the ff->mutex -> udev->mutex link since a spinlock is a leaf in
the lock ordering and cannot form cycles with mutexes.
To keep state transitions visible to uinput_request_send(), protect
writes to udev->state in uinput_create_device() and
uinput_destroy_device() with the same state_lock spinlock.
Additionally, move init_completion(&request->done) from
uinput_request_send() to uinput_request_submit() before
uinput_request_reserve_slot(). Once the slot is allocated,
uinput_flush_requests() may call complete() on it at any time from
the destroy path, so the completion must be initialised before the
request becomes visible.
Lock ordering after the fix:
ff->mutex -> state_lock (spinlock, leaf)
udev->mutex -> state_lock (spinlock, leaf)
udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ff462551235d8d7d843a005950bc90924fcedede Version: ff462551235d8d7d843a005950bc90924fcedede Version: ff462551235d8d7d843a005950bc90924fcedede Version: ff462551235d8d7d843a005950bc90924fcedede Version: ff462551235d8d7d843a005950bc90924fcedede Version: ff462551235d8d7d843a005950bc90924fcedede Version: ff462551235d8d7d843a005950bc90924fcedede Version: ff462551235d8d7d843a005950bc90924fcedede |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/misc/uinput.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "71a9729f412e2c692a35c542e14b706fb342927f",
"status": "affected",
"version": "ff462551235d8d7d843a005950bc90924fcedede",
"versionType": "git"
},
{
"lessThan": "271ee71a1917b89f6d73ec82dd091c33d92ee617",
"status": "affected",
"version": "ff462551235d8d7d843a005950bc90924fcedede",
"versionType": "git"
},
{
"lessThan": "974f7b138c3a96dd5cd53d1b33409cd7b2229dc6",
"status": "affected",
"version": "ff462551235d8d7d843a005950bc90924fcedede",
"versionType": "git"
},
{
"lessThan": "546c18a14924eb521fe168d916d7ce28f1e13c1d",
"status": "affected",
"version": "ff462551235d8d7d843a005950bc90924fcedede",
"versionType": "git"
},
{
"lessThan": "a3d6c9c053c9c605651508569230ead633b13f76",
"status": "affected",
"version": "ff462551235d8d7d843a005950bc90924fcedede",
"versionType": "git"
},
{
"lessThan": "1e09dfbb4f5d20ee111f92325a00f85778a5f328",
"status": "affected",
"version": "ff462551235d8d7d843a005950bc90924fcedede",
"versionType": "git"
},
{
"lessThan": "1534661043c434b81cfde26b97a2fb2460329cf0",
"status": "affected",
"version": "ff462551235d8d7d843a005950bc90924fcedede",
"versionType": "git"
},
{
"lessThan": "4cda78d6f8bf2b700529f2fbccb994c3e826d7c2",
"status": "affected",
"version": "ff462551235d8d7d843a005950bc90924fcedede",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/misc/uinput.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.19"
},
{
"lessThan": "2.6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.169",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.135",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.169",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.135",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.82",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "2.6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: uinput - fix circular locking dependency with ff-core\n\nA lockdep circular locking dependency warning can be triggered\nreproducibly when using a force-feedback gamepad with uinput (for\nexample, playing ELDEN RING under Wine with a Flydigi Vader 5\ncontroller):\n\n ff-\u003emutex -\u003e udev-\u003emutex -\u003e input_mutex -\u003e dev-\u003emutex -\u003e ff-\u003emutex\n\nThe cycle is caused by four lock acquisition paths:\n\n1. ff upload: input_ff_upload() holds ff-\u003emutex and calls\n uinput_dev_upload_effect() -\u003e uinput_request_submit() -\u003e\n uinput_request_send(), which acquires udev-\u003emutex.\n\n2. device create: uinput_ioctl_handler() holds udev-\u003emutex and calls\n uinput_create_device() -\u003e input_register_device(), which acquires\n input_mutex.\n\n3. device register: input_register_device() holds input_mutex and\n calls kbd_connect() -\u003e input_register_handle(), which acquires\n dev-\u003emutex.\n\n4. evdev release: evdev_release() calls input_flush_device() under\n dev-\u003emutex, which calls input_ff_flush() acquiring ff-\u003emutex.\n\nFix this by introducing a new state_lock spinlock to protect\nudev-\u003estate and udev-\u003edev access in uinput_request_send() instead of\nacquiring udev-\u003emutex. The function only needs to atomically check\ndevice state and queue an input event into the ring buffer via\nuinput_dev_event() -- both operations are safe under a spinlock\n(ktime_get_ts64() and wake_up_interruptible() do not sleep). This\nbreaks the ff-\u003emutex -\u003e udev-\u003emutex link since a spinlock is a leaf in\nthe lock ordering and cannot form cycles with mutexes.\n\nTo keep state transitions visible to uinput_request_send(), protect\nwrites to udev-\u003estate in uinput_create_device() and\nuinput_destroy_device() with the same state_lock spinlock.\n\nAdditionally, move init_completion(\u0026request-\u003edone) from\nuinput_request_send() to uinput_request_submit() before\nuinput_request_reserve_slot(). Once the slot is allocated,\nuinput_flush_requests() may call complete() on it at any time from\nthe destroy path, so the completion must be initialised before the\nrequest becomes visible.\n\nLock ordering after the fix:\n\n ff-\u003emutex -\u003e state_lock (spinlock, leaf)\n udev-\u003emutex -\u003e state_lock (spinlock, leaf)\n udev-\u003emutex -\u003e input_mutex -\u003e dev-\u003emutex -\u003e ff-\u003emutex (no back-edge)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through local uinput and evdev character-device operations, including uinput setup/destruction ioctls and evdev force-feedback upload ioctls. There is no network, adjacent, or physical packet/device insertion path.\nAC:L - The attacker can control the relevant operations by creating a force-feedback uinput device and racing/concurrently invoking force-feedback upload and device teardown paths. Because both sides of the race are attacker-driven, the complexity is Low.\nPR:L - The kernel code does not require CAP_SYS_ADMIN or another capability, but the attacker needs local access to the uinput/evdev device nodes. In the most severe reasonable deployments these are reachable by an unprivileged local user or input/session-privileged account, so this is Low rather than High.\nUI:N - No victim action is required once the attacker has local device-node access. The attacker can issue the needed ioctls and close/release operations directly.\nS:U - The impact remains within the local kernel/input subsystem security authority. This is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The fix includes moving completion initialization before publishing the request slot, because teardown could otherwise call complete() on an uninitialized stack completion. That is kernel memory corruption, and under the required higher-severity rule it is treated as potentially enabling kernel memory disclosure.\nI:H - Calling complete() on an uninitialized completion can operate on corrupted spinlock/list state and kernel pointers, not merely return an error. Under the required higher-severity rule, this memory corruption is scored as potentially enabling high-integrity kernel compromise.\nA:H - The documented locking cycle can deadlock, and the uninitialized completion race is consistent with prior uinput force-feedback crashes involving bad spinlock state. Either outcome can hang or crash the kernel, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:17.157Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/71a9729f412e2c692a35c542e14b706fb342927f"
},
{
"url": "https://git.kernel.org/stable/c/271ee71a1917b89f6d73ec82dd091c33d92ee617"
},
{
"url": "https://git.kernel.org/stable/c/974f7b138c3a96dd5cd53d1b33409cd7b2229dc6"
},
{
"url": "https://git.kernel.org/stable/c/546c18a14924eb521fe168d916d7ce28f1e13c1d"
},
{
"url": "https://git.kernel.org/stable/c/a3d6c9c053c9c605651508569230ead633b13f76"
},
{
"url": "https://git.kernel.org/stable/c/1e09dfbb4f5d20ee111f92325a00f85778a5f328"
},
{
"url": "https://git.kernel.org/stable/c/1534661043c434b81cfde26b97a2fb2460329cf0"
},
{
"url": "https://git.kernel.org/stable/c/4cda78d6f8bf2b700529f2fbccb994c3e826d7c2"
}
],
"title": "Input: uinput - fix circular locking dependency with ff-core",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31667",
"datePublished": "2026-04-24T14:45:15.937Z",
"dateReserved": "2026-03-09T15:48:24.129Z",
"dateUpdated": "2026-08-05T12:24:17.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53047 (GCVE-0-2026-53047)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
efi/capsule-loader: fix incorrect sizeof in phys array reallocation
The krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses
sizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be
causing an undersized allocation.
The allocation is also inconsistent with the initial array allocation in
efi_capsule_open() that allocates one entry with sizeof(phys_addr_t),
and the efi_capsule_write() function that stores phys_addr_t values (not
pointers) via page_to_phys().
On 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this
goes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but
pointers are 32-bit, this allocates half the required space, which might
lead to a heap buffer overflow when storing physical addresses.
This is similar to the bug fixed in commit fccfa646ef36 ("efi/capsule-loader:
fix incorrect allocation size") which fixed the same issue at the initial
allocation site.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f24c4d478013d82bd1b943df566fff3561d52864 Version: f24c4d478013d82bd1b943df566fff3561d52864 Version: f24c4d478013d82bd1b943df566fff3561d52864 Version: f24c4d478013d82bd1b943df566fff3561d52864 Version: f24c4d478013d82bd1b943df566fff3561d52864 Version: f24c4d478013d82bd1b943df566fff3561d52864 Version: f24c4d478013d82bd1b943df566fff3561d52864 Version: f24c4d478013d82bd1b943df566fff3561d52864 Version: 95a362c9a6892085f714eb6e31eea6a0e3aa93bf Version: 4.14.13 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/firmware/efi/capsule-loader.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "22022cd8851703a58f67615a17bc7e9e8682785b",
"status": "affected",
"version": "f24c4d478013d82bd1b943df566fff3561d52864",
"versionType": "git"
},
{
"lessThan": "67adde6bfdfd563a54b045d59aeb9a2d90c80697",
"status": "affected",
"version": "f24c4d478013d82bd1b943df566fff3561d52864",
"versionType": "git"
},
{
"lessThan": "608e1f7bc9d171ab26c1fba288c97fc76363c27d",
"status": "affected",
"version": "f24c4d478013d82bd1b943df566fff3561d52864",
"versionType": "git"
},
{
"lessThan": "8be69e9245f805566bac68ffc8574b64735fd996",
"status": "affected",
"version": "f24c4d478013d82bd1b943df566fff3561d52864",
"versionType": "git"
},
{
"lessThan": "5e185330d902b12fe8e6eb4b8514b5d736d8d66d",
"status": "affected",
"version": "f24c4d478013d82bd1b943df566fff3561d52864",
"versionType": "git"
},
{
"lessThan": "e0e6b14995fd6fa2c0df8c712d76ab32f0694c31",
"status": "affected",
"version": "f24c4d478013d82bd1b943df566fff3561d52864",
"versionType": "git"
},
{
"lessThan": "ab3f7098a3a27175b91cfc947950f5c26855801b",
"status": "affected",
"version": "f24c4d478013d82bd1b943df566fff3561d52864",
"versionType": "git"
},
{
"lessThan": "48a428215782321b56956974f23593e40ce84b7a",
"status": "affected",
"version": "f24c4d478013d82bd1b943df566fff3561d52864",
"versionType": "git"
},
{
"status": "affected",
"version": "95a362c9a6892085f714eb6e31eea6a0e3aa93bf",
"versionType": "git"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.13",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/firmware/efi/capsule-loader.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nefi/capsule-loader: fix incorrect sizeof in phys array reallocation\n\nThe krealloc() call for cap_info-\u003ephys in __efi_capsule_setup_info() uses\nsizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be\ncausing an undersized allocation.\n\nThe allocation is also inconsistent with the initial array allocation in\nefi_capsule_open() that allocates one entry with sizeof(phys_addr_t),\nand the efi_capsule_write() function that stores phys_addr_t values (not\npointers) via page_to_phys().\n\nOn 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this\ngoes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but\npointers are 32-bit, this allocates half the required space, which might\nlead to a heap buffer overflow when storing physical addresses.\n\nThis is similar to the bug fixed in commit fccfa646ef36 (\"efi/capsule-loader:\nfix incorrect allocation size\") which fixed the same issue at the initial\nallocation site."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:53.491Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/22022cd8851703a58f67615a17bc7e9e8682785b"
},
{
"url": "https://git.kernel.org/stable/c/67adde6bfdfd563a54b045d59aeb9a2d90c80697"
},
{
"url": "https://git.kernel.org/stable/c/608e1f7bc9d171ab26c1fba288c97fc76363c27d"
},
{
"url": "https://git.kernel.org/stable/c/8be69e9245f805566bac68ffc8574b64735fd996"
},
{
"url": "https://git.kernel.org/stable/c/5e185330d902b12fe8e6eb4b8514b5d736d8d66d"
},
{
"url": "https://git.kernel.org/stable/c/e0e6b14995fd6fa2c0df8c712d76ab32f0694c31"
},
{
"url": "https://git.kernel.org/stable/c/ab3f7098a3a27175b91cfc947950f5c26855801b"
},
{
"url": "https://git.kernel.org/stable/c/48a428215782321b56956974f23593e40ce84b7a"
}
],
"title": "efi/capsule-loader: fix incorrect sizeof in phys array reallocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53047",
"datePublished": "2026-06-24T16:29:53.491Z",
"dateReserved": "2026-06-09T07:44:35.381Z",
"dateUpdated": "2026-06-24T16:29:53.491Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31532 (GCVE-0-2026-31532)
Vulnerability from cvelistv5
Published
2026-04-23 11:12
Modified
2026-08-05 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: raw: fix ro->uniq use-after-free in raw_rcv()
raw_release() unregisters raw CAN receive filters via can_rx_unregister(),
but receiver deletion is deferred with call_rcu(). This leaves a window
where raw_rcv() may still be running in an RCU read-side critical section
after raw_release() frees ro->uniq, leading to a use-after-free of the
percpu uniq storage.
Move free_percpu(ro->uniq) out of raw_release() and into a raw-specific
socket destructor. can_rx_unregister() takes an extra reference to the
socket and only drops it from the RCU callback, so freeing uniq from
sk_destruct ensures the percpu area is not released until the relevant
callbacks have drained.
[mkl: applied manually]
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 514ac99c64b22d83b52dfee3b8becaa69a92bc4a Version: 514ac99c64b22d83b52dfee3b8becaa69a92bc4a Version: 514ac99c64b22d83b52dfee3b8becaa69a92bc4a Version: 514ac99c64b22d83b52dfee3b8becaa69a92bc4a Version: 514ac99c64b22d83b52dfee3b8becaa69a92bc4a Version: 514ac99c64b22d83b52dfee3b8becaa69a92bc4a Version: 514ac99c64b22d83b52dfee3b8becaa69a92bc4a Version: 514ac99c64b22d83b52dfee3b8becaa69a92bc4a Version: 514ac99c64b22d83b52dfee3b8becaa69a92bc4a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/raw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1de30576a6dfeaaa27ef91fa272e6b9240b6fbd3",
"status": "affected",
"version": "514ac99c64b22d83b52dfee3b8becaa69a92bc4a",
"versionType": "git"
},
{
"lessThan": "64c8553decf5a5f2417bd54761ea0a832c56c4ca",
"status": "affected",
"version": "514ac99c64b22d83b52dfee3b8becaa69a92bc4a",
"versionType": "git"
},
{
"lessThan": "3f43f12fde34737fba091b7e3ab391e14ddbb0be",
"status": "affected",
"version": "514ac99c64b22d83b52dfee3b8becaa69a92bc4a",
"versionType": "git"
},
{
"lessThan": "5e9cfffad898bbeaafd0ea608a6d267362f050fc",
"status": "affected",
"version": "514ac99c64b22d83b52dfee3b8becaa69a92bc4a",
"versionType": "git"
},
{
"lessThan": "572f0bf536ebc14f6e7da3d21a85cf076de8358e",
"status": "affected",
"version": "514ac99c64b22d83b52dfee3b8becaa69a92bc4a",
"versionType": "git"
},
{
"lessThan": "1a0f2de81f7fbdc538fc72d7d74609b79bc83cc0",
"status": "affected",
"version": "514ac99c64b22d83b52dfee3b8becaa69a92bc4a",
"versionType": "git"
},
{
"lessThan": "7201a531b9a5ed892bfda5ded9194ef622de8ffa",
"status": "affected",
"version": "514ac99c64b22d83b52dfee3b8becaa69a92bc4a",
"versionType": "git"
},
{
"lessThan": "34c1741254ff972e8375faf176678a248826fe3a",
"status": "affected",
"version": "514ac99c64b22d83b52dfee3b8becaa69a92bc4a",
"versionType": "git"
},
{
"lessThan": "a535a9217ca3f2fccedaafb2fddb4c48f27d36dc",
"status": "affected",
"version": "514ac99c64b22d83b52dfee3b8becaa69a92bc4a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/raw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: raw: fix ro-\u003euniq use-after-free in raw_rcv()\n\nraw_release() unregisters raw CAN receive filters via can_rx_unregister(),\nbut receiver deletion is deferred with call_rcu(). This leaves a window\nwhere raw_rcv() may still be running in an RCU read-side critical section\nafter raw_release() frees ro-\u003euniq, leading to a use-after-free of the\npercpu uniq storage.\n\nMove free_percpu(ro-\u003euniq) out of raw_release() and into a raw-specific\nsocket destructor. can_rx_unregister() takes an extra reference to the\nsocket and only drops it from the RCU callback, so freeing uniq from\nsk_destruct ensures the percpu area is not released until the relevant\ncallbacks have drained.\n\n[mkl: applied manually]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local access to create/bind/close CAN_RAW sockets and race them with CAN frame delivery into raw_rcv(). Received CAN frames can trigger the vulnerable callback, but the attacker-controlled setup and free path are local socket operations.\nAC:L - The race is between attacker-controlled socket teardown/filter unregistration and attacker-controlled CAN frame generation, for example using concurrent local sockets and loopback/vcan or an existing CAN interface. No unusual external condition is required beyond timing that can be retried.\nPR:L - CAN_RAW socket creation, bind, setsockopt, send, and close in this path do not impose a CAP_NET_RAW or CAP_NET_ADMIN check for an existing CAN device. If a virtual CAN device must be created, CAP_NET_ADMIN in a user namespace may suffice, so this is still not real init-namespace root.\nUI:N - No victim action is required once the attacker can run local code. The attacker can create the sockets, register filters, generate frames, and close sockets themselves.\nS:U - The vulnerable object and resulting corruption are within the kernel networking/CAN security authority. This is a standard kernel memory corruption issue, not a cross-VM or hardware boundary escape.\nC:H - This is a use-after-free of per-CPU storage accessed from raw_rcv(), and the freed area may be reallocated before the callback reads it. Per the kernel scoring guidance, UAF memory corruption is treated as enabling high confidentiality impact.\nI:H - raw_rcv() writes skb pointers, hashes, and counters through the freed ro-\u003euniq pointer, corrupting whatever per-CPU object reuses that storage. As a UAF with kernel memory corruption, it is defensibly scored as high integrity impact.\nA:H - The stale per-CPU pointer can lead to invalid memory accesses or corruption during softirq CAN receive processing. A kernel oops/panic is a direct plausible outcome."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:23:19.603Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1de30576a6dfeaaa27ef91fa272e6b9240b6fbd3"
},
{
"url": "https://git.kernel.org/stable/c/64c8553decf5a5f2417bd54761ea0a832c56c4ca"
},
{
"url": "https://git.kernel.org/stable/c/3f43f12fde34737fba091b7e3ab391e14ddbb0be"
},
{
"url": "https://git.kernel.org/stable/c/5e9cfffad898bbeaafd0ea608a6d267362f050fc"
},
{
"url": "https://git.kernel.org/stable/c/572f0bf536ebc14f6e7da3d21a85cf076de8358e"
},
{
"url": "https://git.kernel.org/stable/c/1a0f2de81f7fbdc538fc72d7d74609b79bc83cc0"
},
{
"url": "https://git.kernel.org/stable/c/7201a531b9a5ed892bfda5ded9194ef622de8ffa"
},
{
"url": "https://git.kernel.org/stable/c/34c1741254ff972e8375faf176678a248826fe3a"
},
{
"url": "https://git.kernel.org/stable/c/a535a9217ca3f2fccedaafb2fddb4c48f27d36dc"
}
],
"title": "can: raw: fix ro-\u003euniq use-after-free in raw_rcv()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31532",
"datePublished": "2026-04-23T11:12:44.829Z",
"dateReserved": "2026-03-09T15:48:24.112Z",
"dateUpdated": "2026-08-05T12:23:19.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43236 (GCVE-0-2026-43236)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release
The atmel_hlcdc_plane_atomic_duplicate_state() callback was copying
the atmel_hlcdc_plane state structure without properly duplicating the
drm_plane_state. In particular, state->commit remained set to the old
state commit, which can lead to a use-after-free in the next
drm_atomic_commit() call.
Fix this by calling
__drm_atomic_helper_duplicate_plane_state(), which correctly clones
the base drm_plane_state (including the ->commit pointer).
It has been seen when closing and re-opening the device node while
another DRM client (e.g. fbdev) is still attached:
=============================================================================
BUG kmalloc-64 (Not tainted): Poison overwritten
-----------------------------------------------------------------------------
0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b
FIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b
Allocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0
pid=29
drm_atomic_helper_setup_commit+0x1e8/0x7bc
drm_atomic_helper_commit+0x3c/0x15c
drm_atomic_commit+0xc0/0xf4
drm_framebuffer_remove+0x4cc/0x5a8
drm_mode_rmfb_work_fn+0x6c/0x80
process_one_work+0x12c/0x2cc
worker_thread+0x2a8/0x400
kthread+0xc0/0xdc
ret_from_fork+0x14/0x28
Freed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0
pid=169
drm_atomic_helper_commit_hw_done+0x100/0x150
drm_atomic_helper_commit_tail+0x64/0x8c
commit_tail+0x168/0x18c
drm_atomic_helper_commit+0x138/0x15c
drm_atomic_commit+0xc0/0xf4
drm_atomic_helper_set_config+0x84/0xb8
drm_mode_setcrtc+0x32c/0x810
drm_ioctl+0x20c/0x488
sys_ioctl+0x14c/0xc20
ret_fast_syscall+0x0/0x54
Slab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0
flags=0x200(workingset|zone=0)
Object 0xc611b340 @offset=832 fp=0xc611b7c0
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2389fc1305fc1e2cf8b310a75463fefd3058bf48 Version: 2389fc1305fc1e2cf8b310a75463fefd3058bf48 Version: 2389fc1305fc1e2cf8b310a75463fefd3058bf48 Version: 2389fc1305fc1e2cf8b310a75463fefd3058bf48 Version: 2389fc1305fc1e2cf8b310a75463fefd3058bf48 Version: 2389fc1305fc1e2cf8b310a75463fefd3058bf48 Version: 2389fc1305fc1e2cf8b310a75463fefd3058bf48 Version: 2389fc1305fc1e2cf8b310a75463fefd3058bf48 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fd4a4d0711f48a99b25bcd45e00eef8339eff82d",
"status": "affected",
"version": "2389fc1305fc1e2cf8b310a75463fefd3058bf48",
"versionType": "git"
},
{
"lessThan": "6404898af86d986db1dbbe06177c143e40652e49",
"status": "affected",
"version": "2389fc1305fc1e2cf8b310a75463fefd3058bf48",
"versionType": "git"
},
{
"lessThan": "796e77c14c4c1e2cd36473760fb6cc66c695eb47",
"status": "affected",
"version": "2389fc1305fc1e2cf8b310a75463fefd3058bf48",
"versionType": "git"
},
{
"lessThan": "ac2d898da5095d46bd1ff8585fdd753d58ad91e7",
"status": "affected",
"version": "2389fc1305fc1e2cf8b310a75463fefd3058bf48",
"versionType": "git"
},
{
"lessThan": "a205740a7231e967ac77cb731171642901c327af",
"status": "affected",
"version": "2389fc1305fc1e2cf8b310a75463fefd3058bf48",
"versionType": "git"
},
{
"lessThan": "7b4d0fab3ff2c00c6d34e1952c9df5129a826aee",
"status": "affected",
"version": "2389fc1305fc1e2cf8b310a75463fefd3058bf48",
"versionType": "git"
},
{
"lessThan": "549c6db503dbb85dbff4840830971853feac6625",
"status": "affected",
"version": "2389fc1305fc1e2cf8b310a75463fefd3058bf48",
"versionType": "git"
},
{
"lessThan": "bc847787233277a337788568e90a6ee1557595eb",
"status": "affected",
"version": "2389fc1305fc1e2cf8b310a75463fefd3058bf48",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release\n\nThe atmel_hlcdc_plane_atomic_duplicate_state() callback was copying\nthe atmel_hlcdc_plane state structure without properly duplicating the\ndrm_plane_state. In particular, state-\u003ecommit remained set to the old\nstate commit, which can lead to a use-after-free in the next\ndrm_atomic_commit() call.\n\nFix this by calling\n__drm_atomic_helper_duplicate_plane_state(), which correctly clones\nthe base drm_plane_state (including the -\u003ecommit pointer).\n\nIt has been seen when closing and re-opening the device node while\nanother DRM client (e.g. fbdev) is still attached:\n\n=============================================================================\nBUG kmalloc-64 (Not tainted): Poison overwritten\n-----------------------------------------------------------------------------\n\n0xc611b344-0xc611b344 @offset=836. First byte 0x6a instead of 0x6b\nFIX kmalloc-64: Restoring Poison 0xc611b344-0xc611b344=0x6b\nAllocated in drm_atomic_helper_setup_commit+0x1e8/0x7bc age=178 cpu=0\npid=29\n drm_atomic_helper_setup_commit+0x1e8/0x7bc\n drm_atomic_helper_commit+0x3c/0x15c\n drm_atomic_commit+0xc0/0xf4\n drm_framebuffer_remove+0x4cc/0x5a8\n drm_mode_rmfb_work_fn+0x6c/0x80\n process_one_work+0x12c/0x2cc\n worker_thread+0x2a8/0x400\n kthread+0xc0/0xdc\n ret_from_fork+0x14/0x28\nFreed in drm_atomic_helper_commit_hw_done+0x100/0x150 age=8 cpu=0\npid=169\n drm_atomic_helper_commit_hw_done+0x100/0x150\n drm_atomic_helper_commit_tail+0x64/0x8c\n commit_tail+0x168/0x18c\n drm_atomic_helper_commit+0x138/0x15c\n drm_atomic_commit+0xc0/0xf4\n drm_atomic_helper_set_config+0x84/0xb8\n drm_mode_setcrtc+0x32c/0x810\n drm_ioctl+0x20c/0x488\n sys_ioctl+0x14c/0xc20\n ret_fast_syscall+0x0/0x54\nSlab 0xef8bc360 objects=21 used=16 fp=0xc611b7c0\nflags=0x200(workingset|zone=0)\nObject 0xc611b340 @offset=832 fp=0xc611b7c0"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable atmel-hlcdc DRM driver is reached through local DRM/KMS device-node operations such as SETCRTC, atomic commits, framebuffer removal, and close/reopen cleanup. There is no network, adjacent-radio, or physical-device parsing path to this code.\nAC:L - The trigger is a repeatable local sequence that duplicates plane state with a stale commit pointer and then runs another atomic commit; it does not require winning an attacker-uncontrolled race. Closing/reopening while another DRM client such as fbdev is attached is a normal and reasonable display-device condition.\nPR:L - The relevant KMS modeset paths require DRM master, but an unprivileged local seat/display user can obtain or be delegated a DRM primary-node master fd without real root. Framebuffer removal and file-close cleanup paths are ordinary local file operations after that setup.\nUI:N - The attacker can trigger the needed DRM ioctls and file lifecycle operations directly from their own process. No separate victim action is required.\nS:U - The bug corrupts kernel DRM state within the same host kernel security authority. It is not a VM escape, IOMMU bypass, or cross-scope hardware isolation break.\nC:H - This is a kernel use-after-free of a kmalloc-backed drm_crtc_commit object, with stale references later used by DRM atomic commit handling. Such freed-object reuse can plausibly be shaped into kernel memory disclosure, so confidentiality impact is High.\nI:H - The stale commit pointer can lead to writes/refcount/completion operations on freed and potentially reallocated kernel heap memory. As a kernel UAF with plausible heap spraying and control-flow or data corruption potential, integrity impact is High.\nA:H - The reported failure already shows slab poison corruption after the freed commit object is reused, and repeated triggering can crash or destabilize the kernel. Kernel oops/panic-level denial of service makes availability impact High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:47.254Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fd4a4d0711f48a99b25bcd45e00eef8339eff82d"
},
{
"url": "https://git.kernel.org/stable/c/6404898af86d986db1dbbe06177c143e40652e49"
},
{
"url": "https://git.kernel.org/stable/c/796e77c14c4c1e2cd36473760fb6cc66c695eb47"
},
{
"url": "https://git.kernel.org/stable/c/ac2d898da5095d46bd1ff8585fdd753d58ad91e7"
},
{
"url": "https://git.kernel.org/stable/c/a205740a7231e967ac77cb731171642901c327af"
},
{
"url": "https://git.kernel.org/stable/c/7b4d0fab3ff2c00c6d34e1952c9df5129a826aee"
},
{
"url": "https://git.kernel.org/stable/c/549c6db503dbb85dbff4840830971853feac6625"
},
{
"url": "https://git.kernel.org/stable/c/bc847787233277a337788568e90a6ee1557595eb"
}
],
"title": "drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43236",
"datePublished": "2026-05-06T11:28:31.543Z",
"dateReserved": "2026-05-01T14:12:55.995Z",
"dateUpdated": "2026-08-05T12:26:47.254Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43298 (GCVE-0-2026-43298)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-05-11 22:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Skip vcn poison irq release on VF
VF doesn't enable VCN poison irq in VCNv2.5. Skip releasing it and avoid
call trace during deinitialization.
[ 71.913601] [drm] clean up the vf2pf work item
[ 71.915088] ------------[ cut here ]------------
[ 71.915092] WARNING: CPU: 3 PID: 1079 at /tmp/amd.aFkFvSQl/amd/amdgpu/amdgpu_irq.c:641 amdgpu_irq_put+0xc6/0xe0 [amdgpu]
[ 71.915355] Modules linked in: amdgpu(OE-) amddrm_ttm_helper(OE) amdttm(OE) amddrm_buddy(OE) amdxcp(OE) amddrm_exec(OE) amd_sched(OE) amdkcl(OE) drm_suballoc_helper drm_display_helper cec rc_core i2c_algo_bit video wmi binfmt_misc nls_iso8859_1 intel_rapl_msr intel_rapl_common input_leds joydev serio_raw mac_hid qemu_fw_cfg sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 hid_generic crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel usbhid 8139too sha256_ssse3 sha1_ssse3 hid psmouse bochs i2c_i801 ahci drm_vram_helper libahci i2c_smbus lpc_ich drm_ttm_helper 8139cp mii ttm aesni_intel crypto_simd cryptd
[ 71.915484] CPU: 3 PID: 1079 Comm: rmmod Tainted: G OE 6.8.0-87-generic #88~22.04.1-Ubuntu
[ 71.915489] Hardware name: Red Hat KVM/RHEL, BIOS 1.16.3-2.el9_5.1 04/01/2014
[ 71.915492] RIP: 0010:amdgpu_irq_put+0xc6/0xe0 [amdgpu]
[ 71.915768] Code: 75 84 b8 ea ff ff ff eb d4 44 89 ea 48 89 de 4c 89 e7 e8 fd fc ff ff 5b 41 5c 41 5d 41 5e 5d 31 d2 31 f6 31 ff e9 55 30 3b c7 <0f> 0b eb d4 b8 fe ff ff ff eb a8 e9 b7 3b 8a 00 66 2e 0f 1f 84 00
[ 71.915771] RSP: 0018:ffffcf0800eafa30 EFLAGS: 00010246
[ 71.915775] RAX: 0000000000000000 RBX: ffff891bda4b0668 RCX: 0000000000000000
[ 71.915777] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
[ 71.915779] RBP: ffffcf0800eafa50 R08: 0000000000000000 R09: 0000000000000000
[ 71.915781] R10: 0000000000000000 R11: 0000000000000000 R12: ffff891bda480000
[ 71.915782] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000
[ 71.915792] FS: 000070cff87c4c40(0000) GS:ffff893abfb80000(0000) knlGS:0000000000000000
[ 71.915795] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 71.915797] CR2: 00005fa13073e478 CR3: 000000010d634006 CR4: 0000000000770ef0
[ 71.915800] PKRU: 55555554
[ 71.915802] Call Trace:
[ 71.915805] <TASK>
[ 71.915809] vcn_v2_5_hw_fini+0x19e/0x1e0 [amdgpu]
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8ee9aa80d4f1893a6699d46c403a1731548b544b",
"status": "affected",
"version": "46d75d23005f87057881c460a94f9357d079087f",
"versionType": "git"
},
{
"lessThan": "f1db6fc5a834c8ca9485cc0596dd7df8b8619b64",
"status": "affected",
"version": "46d75d23005f87057881c460a94f9357d079087f",
"versionType": "git"
},
{
"lessThan": "8980be03b3f9a4b58197ef95d3b37efa41a25331",
"status": "affected",
"version": "46d75d23005f87057881c460a94f9357d079087f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/vcn_v2_5.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Skip vcn poison irq release on VF\n\nVF doesn\u0027t enable VCN poison irq in VCNv2.5. Skip releasing it and avoid\ncall trace during deinitialization.\n\n[ 71.913601] [drm] clean up the vf2pf work item\n[ 71.915088] ------------[ cut here ]------------\n[ 71.915092] WARNING: CPU: 3 PID: 1079 at /tmp/amd.aFkFvSQl/amd/amdgpu/amdgpu_irq.c:641 amdgpu_irq_put+0xc6/0xe0 [amdgpu]\n[ 71.915355] Modules linked in: amdgpu(OE-) amddrm_ttm_helper(OE) amdttm(OE) amddrm_buddy(OE) amdxcp(OE) amddrm_exec(OE) amd_sched(OE) amdkcl(OE) drm_suballoc_helper drm_display_helper cec rc_core i2c_algo_bit video wmi binfmt_misc nls_iso8859_1 intel_rapl_msr intel_rapl_common input_leds joydev serio_raw mac_hid qemu_fw_cfg sch_fq_codel dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua efi_pstore ip_tables x_tables autofs4 btrfs blake2b_generic raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 hid_generic crct10dif_pclmul crc32_pclmul polyval_clmulni polyval_generic ghash_clmulni_intel usbhid 8139too sha256_ssse3 sha1_ssse3 hid psmouse bochs i2c_i801 ahci drm_vram_helper libahci i2c_smbus lpc_ich drm_ttm_helper 8139cp mii ttm aesni_intel crypto_simd cryptd\n[ 71.915484] CPU: 3 PID: 1079 Comm: rmmod Tainted: G OE 6.8.0-87-generic #88~22.04.1-Ubuntu\n[ 71.915489] Hardware name: Red Hat KVM/RHEL, BIOS 1.16.3-2.el9_5.1 04/01/2014\n[ 71.915492] RIP: 0010:amdgpu_irq_put+0xc6/0xe0 [amdgpu]\n[ 71.915768] Code: 75 84 b8 ea ff ff ff eb d4 44 89 ea 48 89 de 4c 89 e7 e8 fd fc ff ff 5b 41 5c 41 5d 41 5e 5d 31 d2 31 f6 31 ff e9 55 30 3b c7 \u003c0f\u003e 0b eb d4 b8 fe ff ff ff eb a8 e9 b7 3b 8a 00 66 2e 0f 1f 84 00\n[ 71.915771] RSP: 0018:ffffcf0800eafa30 EFLAGS: 00010246\n[ 71.915775] RAX: 0000000000000000 RBX: ffff891bda4b0668 RCX: 0000000000000000\n[ 71.915777] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n[ 71.915779] RBP: ffffcf0800eafa50 R08: 0000000000000000 R09: 0000000000000000\n[ 71.915781] R10: 0000000000000000 R11: 0000000000000000 R12: ffff891bda480000\n[ 71.915782] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000\n[ 71.915792] FS: 000070cff87c4c40(0000) GS:ffff893abfb80000(0000) knlGS:0000000000000000\n[ 71.915795] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 71.915797] CR2: 00005fa13073e478 CR3: 000000010d634006 CR4: 0000000000770ef0\n[ 71.915800] PKRU: 55555554\n[ 71.915802] Call Trace:\n[ 71.915805] \u003cTASK\u003e\n[ 71.915809] vcn_v2_5_hw_fini+0x19e/0x1e0 [amdgpu]"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:21:51.058Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8ee9aa80d4f1893a6699d46c403a1731548b544b"
},
{
"url": "https://git.kernel.org/stable/c/f1db6fc5a834c8ca9485cc0596dd7df8b8619b64"
},
{
"url": "https://git.kernel.org/stable/c/8980be03b3f9a4b58197ef95d3b37efa41a25331"
}
],
"title": "drm/amdgpu: Skip vcn poison irq release on VF",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43298",
"datePublished": "2026-05-08T13:11:20.215Z",
"dateReserved": "2026-05-01T14:12:55.999Z",
"dateUpdated": "2026-05-11T22:21:51.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43167 (GCVE-0-2026-43167)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: always flush state and policy upon NETDEV_UNREGISTER event
syzbot is reporting that "struct xfrm_state" refcount is leaking.
unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 2
ref_tracker: netdev@ffff888052f24618 has 1/1 users at
__netdev_tracker_alloc include/linux/netdevice.h:4400 [inline]
netdev_tracker_alloc include/linux/netdevice.h:4412 [inline]
xfrm_dev_state_add+0x3a5/0x1080 net/xfrm/xfrm_device.c:316
xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline]
xfrm_add_sa+0x34ff/0x5fa0 net/xfrm/xfrm_user.c:1022
xfrm_user_rcv_msg+0x58e/0xc00 net/xfrm/xfrm_user.c:3507
netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2550
xfrm_netlink_rcv+0x71/0x90 net/xfrm/xfrm_user.c:3529
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0xa5d/0xc30 net/socket.c:2592
___sys_sendmsg+0x134/0x1d0 net/socket.c:2646
__sys_sendmsg+0x16d/0x220 net/socket.c:2678
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
This is because commit d77e38e612a0 ("xfrm: Add an IPsec hardware
offloading API") implemented xfrm_dev_unregister() as no-op despite
xfrm_dev_state_add() from xfrm_state_construct() acquires a reference
to "struct net_device".
I guess that that commit expected that NETDEV_DOWN event is fired before
NETDEV_UNREGISTER event fires, and also assumed that xfrm_dev_state_add()
is called only if (dev->features & NETIF_F_HW_ESP) != 0.
Sabrina Dubroca identified steps to reproduce the same symptoms as below.
echo 0 > /sys/bus/netdevsim/new_device
dev=$(ls -1 /sys/bus/netdevsim/devices/netdevsim0/net/)
ip xfrm state add src 192.168.13.1 dst 192.168.13.2 proto esp \
spi 0x1000 mode tunnel aead 'rfc4106(gcm(aes))' $key 128 \
offload crypto dev $dev dir out
ethtool -K $dev esp-hw-offload off
echo 0 > /sys/bus/netdevsim/del_device
Like these steps indicate, the NETIF_F_HW_ESP bit can be cleared after
xfrm_dev_state_add() acquired a reference to "struct net_device".
Also, xfrm_dev_state_add() does not check for the NETIF_F_HW_ESP bit
when acquiring a reference to "struct net_device".
Commit 03891f820c21 ("xfrm: handle NETDEV_UNREGISTER for xfrm device")
re-introduced the NETDEV_UNREGISTER event to xfrm_dev_event(), but that
commit for unknown reason chose to share xfrm_dev_down() between the
NETDEV_DOWN event and the NETDEV_UNREGISTER event.
I guess that that commit missed the behavior in the previous paragraph.
Therefore, we need to re-introduce xfrm_dev_unregister() in order to
release the reference to "struct net_device" by unconditionally flushing
state and policy.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "166801e49a5b5fc127b8c9e2f110f303cfddfbc3",
"status": "affected",
"version": "d77e38e612a017480157fe6d2c1422f42cb5b7e3",
"versionType": "git"
},
{
"lessThan": "a3c8fede034fa27892f87c863cbd5493167d17ed",
"status": "affected",
"version": "d77e38e612a017480157fe6d2c1422f42cb5b7e3",
"versionType": "git"
},
{
"lessThan": "59581778792cbaf8ad788f4a21dc663ce986050e",
"status": "affected",
"version": "d77e38e612a017480157fe6d2c1422f42cb5b7e3",
"versionType": "git"
},
{
"lessThan": "8c75c455ecd3bfd2f36abf66edb7021c4fa19ec4",
"status": "affected",
"version": "d77e38e612a017480157fe6d2c1422f42cb5b7e3",
"versionType": "git"
},
{
"lessThan": "4efa91a28576054aae0e6dad9cba8fed8293aef8",
"status": "affected",
"version": "d77e38e612a017480157fe6d2c1422f42cb5b7e3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: always flush state and policy upon NETDEV_UNREGISTER event\n\nsyzbot is reporting that \"struct xfrm_state\" refcount is leaking.\n\n unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 2\n ref_tracker: netdev@ffff888052f24618 has 1/1 users at\n __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline]\n netdev_tracker_alloc include/linux/netdevice.h:4412 [inline]\n xfrm_dev_state_add+0x3a5/0x1080 net/xfrm/xfrm_device.c:316\n xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline]\n xfrm_add_sa+0x34ff/0x5fa0 net/xfrm/xfrm_user.c:1022\n xfrm_user_rcv_msg+0x58e/0xc00 net/xfrm/xfrm_user.c:3507\n netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2550\n xfrm_netlink_rcv+0x71/0x90 net/xfrm/xfrm_user.c:3529\n netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1344\n netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1894\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n ____sys_sendmsg+0xa5d/0xc30 net/socket.c:2592\n ___sys_sendmsg+0x134/0x1d0 net/socket.c:2646\n __sys_sendmsg+0x16d/0x220 net/socket.c:2678\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThis is because commit d77e38e612a0 (\"xfrm: Add an IPsec hardware\noffloading API\") implemented xfrm_dev_unregister() as no-op despite\nxfrm_dev_state_add() from xfrm_state_construct() acquires a reference\nto \"struct net_device\".\nI guess that that commit expected that NETDEV_DOWN event is fired before\nNETDEV_UNREGISTER event fires, and also assumed that xfrm_dev_state_add()\nis called only if (dev-\u003efeatures \u0026 NETIF_F_HW_ESP) != 0.\n\nSabrina Dubroca identified steps to reproduce the same symptoms as below.\n\n echo 0 \u003e /sys/bus/netdevsim/new_device\n dev=$(ls -1 /sys/bus/netdevsim/devices/netdevsim0/net/)\n ip xfrm state add src 192.168.13.1 dst 192.168.13.2 proto esp \\\n spi 0x1000 mode tunnel aead \u0027rfc4106(gcm(aes))\u0027 $key 128 \\\n offload crypto dev $dev dir out\n ethtool -K $dev esp-hw-offload off\n echo 0 \u003e /sys/bus/netdevsim/del_device\n\nLike these steps indicate, the NETIF_F_HW_ESP bit can be cleared after\nxfrm_dev_state_add() acquired a reference to \"struct net_device\".\nAlso, xfrm_dev_state_add() does not check for the NETIF_F_HW_ESP bit\nwhen acquiring a reference to \"struct net_device\".\n\nCommit 03891f820c21 (\"xfrm: handle NETDEV_UNREGISTER for xfrm device\")\nre-introduced the NETDEV_UNREGISTER event to xfrm_dev_event(), but that\ncommit for unknown reason chose to share xfrm_dev_down() between the\nNETDEV_DOWN event and the NETDEV_UNREGISTER event.\nI guess that that commit missed the behavior in the previous paragraph.\n\nTherefore, we need to re-introduce xfrm_dev_unregister() in order to\nrelease the reference to \"struct net_device\" by unconditionally flushing\nstate and policy."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:19:04.940Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/166801e49a5b5fc127b8c9e2f110f303cfddfbc3"
},
{
"url": "https://git.kernel.org/stable/c/a3c8fede034fa27892f87c863cbd5493167d17ed"
},
{
"url": "https://git.kernel.org/stable/c/59581778792cbaf8ad788f4a21dc663ce986050e"
},
{
"url": "https://git.kernel.org/stable/c/8c75c455ecd3bfd2f36abf66edb7021c4fa19ec4"
},
{
"url": "https://git.kernel.org/stable/c/4efa91a28576054aae0e6dad9cba8fed8293aef8"
}
],
"title": "xfrm: always flush state and policy upon NETDEV_UNREGISTER event",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43167",
"datePublished": "2026-05-06T11:27:43.904Z",
"dateReserved": "2026-05-01T14:12:55.990Z",
"dateUpdated": "2026-05-11T22:19:04.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45954 (GCVE-0-2026-45954)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-05-27 12:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()
In au1200fb_drv_probe(), when platform_get_irq fails(), it directly
returns from the function with an error code, which causes a memory
leak.
Replace it with a goto label to ensure proper cleanup.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 49e435ca02c797e6e877bb79a9c3c3f580462fdb Version: 2400ae8fd86d0dfb67bdff6e206b090b0606bbf4 Version: 50e4b32d2e58b7487ebb0a16d5de9cbde56f7949 Version: 4e88761f5f8c7869f15a2046b1a1116f4fab4ac8 Version: 4e88761f5f8c7869f15a2046b1a1116f4fab4ac8 Version: 4e88761f5f8c7869f15a2046b1a1116f4fab4ac8 Version: 4e88761f5f8c7869f15a2046b1a1116f4fab4ac8 Version: 4e88761f5f8c7869f15a2046b1a1116f4fab4ac8 Version: 5cf4447039ef335768a6e61208ff2eebf1884f53 Version: 9386ddd88480a1b838c92ef1677a4768c8914505 Version: b07e31824df61c8866ab549a49e35826ea42609c Version: b492d371c6225d95f8ee34cac0eb40b58f5c5023 Version: 5.10.188 ≤ Version: 5.15.123 ≤ Version: 6.1.42 ≤ Version: 4.14.322 ≤ Version: 4.19.291 ≤ Version: 5.4.251 ≤ Version: 6.4.7 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/au1200fb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "81831d56b723bc1090ce3158feddaca88e85f939",
"status": "affected",
"version": "49e435ca02c797e6e877bb79a9c3c3f580462fdb",
"versionType": "git"
},
{
"lessThan": "071d8fb757a8318f72c8e02898c2cf7e14e21fb6",
"status": "affected",
"version": "2400ae8fd86d0dfb67bdff6e206b090b0606bbf4",
"versionType": "git"
},
{
"lessThan": "bd1ad63e11b2a568e98de536f319054d2de29f56",
"status": "affected",
"version": "50e4b32d2e58b7487ebb0a16d5de9cbde56f7949",
"versionType": "git"
},
{
"lessThan": "3e5349e54113e2dce1a659c57935e18032742e56",
"status": "affected",
"version": "4e88761f5f8c7869f15a2046b1a1116f4fab4ac8",
"versionType": "git"
},
{
"lessThan": "762a26818934241b8b0172a229d2cf5d87260e40",
"status": "affected",
"version": "4e88761f5f8c7869f15a2046b1a1116f4fab4ac8",
"versionType": "git"
},
{
"lessThan": "3d4202ee6494c0d576cdc104b12e0834ca8136a8",
"status": "affected",
"version": "4e88761f5f8c7869f15a2046b1a1116f4fab4ac8",
"versionType": "git"
},
{
"lessThan": "b024a8efee0f55d330a1cdd3eac8f79ac5acd3be",
"status": "affected",
"version": "4e88761f5f8c7869f15a2046b1a1116f4fab4ac8",
"versionType": "git"
},
{
"lessThan": "ce4e25198a6aaaaf36248edf8daf3d744ec8e309",
"status": "affected",
"version": "4e88761f5f8c7869f15a2046b1a1116f4fab4ac8",
"versionType": "git"
},
{
"status": "affected",
"version": "5cf4447039ef335768a6e61208ff2eebf1884f53",
"versionType": "git"
},
{
"status": "affected",
"version": "9386ddd88480a1b838c92ef1677a4768c8914505",
"versionType": "git"
},
{
"status": "affected",
"version": "b07e31824df61c8866ab549a49e35826ea42609c",
"versionType": "git"
},
{
"status": "affected",
"version": "b492d371c6225d95f8ee34cac0eb40b58f5c5023",
"versionType": "git"
},
{
"lessThan": "5.10.252",
"status": "affected",
"version": "5.10.188",
"versionType": "semver"
},
{
"lessThan": "5.15.202",
"status": "affected",
"version": "5.15.123",
"versionType": "semver"
},
{
"lessThan": "6.1.165",
"status": "affected",
"version": "6.1.42",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.322",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.291",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.251",
"versionType": "semver"
},
{
"lessThan": "6.5",
"status": "affected",
"version": "6.4.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/au1200fb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "5.10.188",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.15.123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.1.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.322",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.291",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.251",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()\n\nIn au1200fb_drv_probe(), when platform_get_irq fails(), it directly\nreturns from the function with an error code, which causes a memory\nleak.\n\nReplace it with a goto label to ensure proper cleanup."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:18:10.004Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/81831d56b723bc1090ce3158feddaca88e85f939"
},
{
"url": "https://git.kernel.org/stable/c/071d8fb757a8318f72c8e02898c2cf7e14e21fb6"
},
{
"url": "https://git.kernel.org/stable/c/bd1ad63e11b2a568e98de536f319054d2de29f56"
},
{
"url": "https://git.kernel.org/stable/c/3e5349e54113e2dce1a659c57935e18032742e56"
},
{
"url": "https://git.kernel.org/stable/c/762a26818934241b8b0172a229d2cf5d87260e40"
},
{
"url": "https://git.kernel.org/stable/c/3d4202ee6494c0d576cdc104b12e0834ca8136a8"
},
{
"url": "https://git.kernel.org/stable/c/b024a8efee0f55d330a1cdd3eac8f79ac5acd3be"
},
{
"url": "https://git.kernel.org/stable/c/ce4e25198a6aaaaf36248edf8daf3d744ec8e309"
}
],
"title": "fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45954",
"datePublished": "2026-05-27T12:18:10.004Z",
"dateReserved": "2026-05-13T15:03:33.088Z",
"dateUpdated": "2026-05-27T12:18:10.004Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53358 (GCVE-0-2026-53358)
Vulnerability from cvelistv5
Published
2026-07-02 13:43
Modified
2026-08-05 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
l2cap_chan_close() removes the channel from conn->chan_l, which
must be done under conn->lock. cleanup_listen() runs under the
parent sk_lock, so acquiring conn->lock would invert the
established conn->lock -> chan->lock -> sk_lock order.
Instead of calling l2cap_chan_close() directly, schedule
l2cap_chan_timeout with delay 0 to close the channel
asynchronously. The timeout handler already acquires conn->lock
and chan->lock in the correct order.
The timer is only armed when chan->conn is still set: if it is
already NULL, l2cap_conn_del() has already processed this channel
(l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb),
so there is nothing left to do. If l2cap_conn_del() races in
after the timer is armed, __clear_chan_timer() inside
l2cap_chan_del() cancels it; if the timer has already fired, the
handler returns harmlessly because chan->conn was cleared.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3df91ea20e744344100b10ae69a17211fcf5b207 Version: 3df91ea20e744344100b10ae69a17211fcf5b207 Version: 3df91ea20e744344100b10ae69a17211fcf5b207 Version: 3df91ea20e744344100b10ae69a17211fcf5b207 Version: 3df91ea20e744344100b10ae69a17211fcf5b207 Version: 3df91ea20e744344100b10ae69a17211fcf5b207 Version: 3df91ea20e744344100b10ae69a17211fcf5b207 Version: 3df91ea20e744344100b10ae69a17211fcf5b207 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3634cbdc2eb414b69ffa752ddbe5e0458518e321",
"status": "affected",
"version": "3df91ea20e744344100b10ae69a17211fcf5b207",
"versionType": "git"
},
{
"lessThan": "e1c100e2d61bd8c718b7d91fe3e050780a9bf72d",
"status": "affected",
"version": "3df91ea20e744344100b10ae69a17211fcf5b207",
"versionType": "git"
},
{
"lessThan": "deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9",
"status": "affected",
"version": "3df91ea20e744344100b10ae69a17211fcf5b207",
"versionType": "git"
},
{
"lessThan": "89dec92041717b027216e110599e4f6d6c921b79",
"status": "affected",
"version": "3df91ea20e744344100b10ae69a17211fcf5b207",
"versionType": "git"
},
{
"lessThan": "50dfec218808b148ab4247b1858031b7a32015c5",
"status": "affected",
"version": "3df91ea20e744344100b10ae69a17211fcf5b207",
"versionType": "git"
},
{
"lessThan": "859d3ace791ed878ae9ba5522c7844d960da8f88",
"status": "affected",
"version": "3df91ea20e744344100b10ae69a17211fcf5b207",
"versionType": "git"
},
{
"lessThan": "7555fd885a0603f50e49a655850a1f2bd8a25398",
"status": "affected",
"version": "3df91ea20e744344100b10ae69a17211fcf5b207",
"versionType": "git"
},
{
"lessThan": "8c8e620467a7b51562dbcefbd1f09f288d7d710d",
"status": "affected",
"version": "3df91ea20e744344100b10ae69a17211fcf5b207",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.4"
},
{
"lessThan": "3.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: use chan timer to close channels in cleanup_listen()\n\nl2cap_chan_close() removes the channel from conn-\u003echan_l, which\nmust be done under conn-\u003elock. cleanup_listen() runs under the\nparent sk_lock, so acquiring conn-\u003elock would invert the\nestablished conn-\u003elock -\u003e chan-\u003elock -\u003e sk_lock order.\n\nInstead of calling l2cap_chan_close() directly, schedule\nl2cap_chan_timeout with delay 0 to close the channel\nasynchronously. The timeout handler already acquires conn-\u003elock\nand chan-\u003elock in the correct order.\n\nThe timer is only armed when chan-\u003econn is still set: if it is\nalready NULL, l2cap_conn_del() has already processed this channel\n(l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb),\nso there is nothing left to do. If l2cap_conn_del() races in\nafter the timer is armed, __clear_chan_timer() inside\nl2cap_chan_del() cancels it; if the timer has already fired, the\nhandler returns harmlessly because chan-\u003econn was cleared."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable L2CAP child channels are created and torn down through Bluetooth BR/EDR or LE signaling from a nearby peer, so the remote reachability is adjacent. Bluetooth is not generally Internet-routable, but phones, embedded devices, and kiosks commonly expose this surface to nearby attackers.\nAC:L - The bug is a race, but the attacker can repeatedly create queued L2CAP children and trigger disconnect/cleanup timing; related reports show the listen/close versus HCI-disconnect race reproducing reliably. Under the required rule, the attacker-controlled repeatable race is scored Low complexity.\nPR:N - A nearby Bluetooth peer can reach L2CAP connection setup before application authentication, including low-security/SDP-style services, without an OS account on the target. If a local service lifecycle participates in cleanup, that is target state rather than attacker privilege.\nUI:N - No victim user action such as opening a file or accepting a prompt is required once Bluetooth and a listening L2CAP service are present. The attacker can drive the Bluetooth connection and disconnect attempts directly.\nS:U - The corruption occurs inside the Linux kernel Bluetooth stack and impacts the same kernel security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary change indicated.\nC:H - The old path called l2cap_chan_close() without conn-\u003elock, allowing unlocked removal from conn-\u003echan_l and races with l2cap_conn_del() over sock/l2cap_chan lifetime. This is kernel memory corruption/UAF-adjacent behavior, which is defensibly exploitable for high confidentiality impact.\nI:H - The race can corrupt kernel list/refcount state around l2cap_chan and sock teardown, giving a plausible route to use-after-free style heap manipulation. Kernel memory corruption is scored as high integrity impact under the provided guidance.\nA:H - At minimum, racing channel cleanup and connection deletion can cause list corruption, double teardown, UAF, KASAN splats, oops, or panic. A repeatable kernel crash is high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:35:07.724Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3634cbdc2eb414b69ffa752ddbe5e0458518e321"
},
{
"url": "https://git.kernel.org/stable/c/e1c100e2d61bd8c718b7d91fe3e050780a9bf72d"
},
{
"url": "https://git.kernel.org/stable/c/deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9"
},
{
"url": "https://git.kernel.org/stable/c/89dec92041717b027216e110599e4f6d6c921b79"
},
{
"url": "https://git.kernel.org/stable/c/50dfec218808b148ab4247b1858031b7a32015c5"
},
{
"url": "https://git.kernel.org/stable/c/859d3ace791ed878ae9ba5522c7844d960da8f88"
},
{
"url": "https://git.kernel.org/stable/c/7555fd885a0603f50e49a655850a1f2bd8a25398"
},
{
"url": "https://git.kernel.org/stable/c/8c8e620467a7b51562dbcefbd1f09f288d7d710d"
}
],
"title": "Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53358",
"datePublished": "2026-07-02T13:43:17.630Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-08-05T12:35:07.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31763 (GCVE-0-2026-31763)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-05-11 22:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: gyro: mpu3050: Fix incorrect free_irq() variable
The handler for the IRQ part of this driver is mpu3050->trig but,
in the teardown free_irq() is called with handler mpu3050.
Use correct IRQ handler when calling free_irq().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/gyro/mpu3050-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "11f7cd960f05b3f06747abfdc4e56dd0d8b8a157",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "fdbe4b5268cd41f9953d25a67d139e47cac34519",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "8001b42fbd5e510dced3a25665019982c99bc708",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "a09171d3f23e13bccd3dc34863186707c6301071",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "8631e755fc07b651b5d158cc3656ef76cc874068",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "ac1233397f4cfe55d71f6aa459b42c256c951531",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "2821f7b62c5b3633c4923c7e4f742380897cd511",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/gyro/mpu3050-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: mpu3050: Fix incorrect free_irq() variable\n\nThe handler for the IRQ part of this driver is mpu3050-\u003etrig but,\nin the teardown free_irq() is called with handler mpu3050.\n\nUse correct IRQ handler when calling free_irq()."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:15:20.588Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/11f7cd960f05b3f06747abfdc4e56dd0d8b8a157"
},
{
"url": "https://git.kernel.org/stable/c/fdbe4b5268cd41f9953d25a67d139e47cac34519"
},
{
"url": "https://git.kernel.org/stable/c/8001b42fbd5e510dced3a25665019982c99bc708"
},
{
"url": "https://git.kernel.org/stable/c/a09171d3f23e13bccd3dc34863186707c6301071"
},
{
"url": "https://git.kernel.org/stable/c/8631e755fc07b651b5d158cc3656ef76cc874068"
},
{
"url": "https://git.kernel.org/stable/c/ac1233397f4cfe55d71f6aa459b42c256c951531"
},
{
"url": "https://git.kernel.org/stable/c/2821f7b62c5b3633c4923c7e4f742380897cd511"
},
{
"url": "https://git.kernel.org/stable/c/edb11a1aef4011a4b7b22cc3c3396c6fe371f4a6"
}
],
"title": "iio: gyro: mpu3050: Fix incorrect free_irq() variable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31763",
"datePublished": "2026-05-01T14:14:54.557Z",
"dateReserved": "2026-03-09T15:48:24.139Z",
"dateUpdated": "2026-05-11T22:15:20.588Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31513 (GCVE-0-2026-31513)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-08-05 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
Syzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd()
that is triggered by a malformed Enhanced Credit Based Connection Request.
The vulnerability stems from l2cap_ecred_conn_req(). The function allocates
a local stack buffer (`pdu`) designed to hold a maximum of 5 Source Channel
IDs (SCIDs), totaling 18 bytes. When an attacker sends a request with more
than 5 SCIDs, the function calculates `rsp_len` based on this unvalidated
`cmd_len` before checking if the number of SCIDs exceeds
L2CAP_ECRED_MAX_CID.
If the SCID count is too high, the function correctly jumps to the
`response` label to reject the packet, but `rsp_len` retains the
attacker's oversized value. Consequently, l2cap_send_cmd() is instructed
to read past the end of the 18-byte `pdu` buffer, triggering a
KASAN panic.
Fix this by moving the assignment of `rsp_len` to after the `num_scid`
boundary check. If the packet is rejected, `rsp_len` will safely
remain 0, and the error response will only read the 8-byte base header
from the stack.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc",
"status": "affected",
"version": "935f324e4b2461df2cf7f02b4195082b4304c708",
"versionType": "git"
},
{
"lessThan": "5b35f8211a913cfe7ab9d54fa36a272d2059a588",
"status": "affected",
"version": "e981a9392800ce2c5bca196a6ab2c55e9370efaa",
"versionType": "git"
},
{
"lessThan": "a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b",
"status": "affected",
"version": "f3fdf2e7276a3edc5df55454275da20eac186970",
"versionType": "git"
},
{
"lessThan": "9d87cb22195b2c67405f5485d525190747ad5493",
"status": "affected",
"version": "c28d2bff70444a85b3b86aaf241ece9408c7858c",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.12.80",
"status": "affected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThan": "6.18.21",
"status": "affected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThan": "6.19.11",
"status": "affected",
"version": "6.19.6",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "6.12.75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "6.18.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "6.19.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req\n\nSyzbot reported a KASAN stack-out-of-bounds read in l2cap_build_cmd()\nthat is triggered by a malformed Enhanced Credit Based Connection Request.\n\nThe vulnerability stems from l2cap_ecred_conn_req(). The function allocates\na local stack buffer (`pdu`) designed to hold a maximum of 5 Source Channel\nIDs (SCIDs), totaling 18 bytes. When an attacker sends a request with more\nthan 5 SCIDs, the function calculates `rsp_len` based on this unvalidated\n`cmd_len` before checking if the number of SCIDs exceeds\nL2CAP_ECRED_MAX_CID.\n\nIf the SCID count is too high, the function correctly jumps to the\n`response` label to reject the packet, but `rsp_len` retains the\nattacker\u0027s oversized value. Consequently, l2cap_send_cmd() is instructed\nto read past the end of the 18-byte `pdu` buffer, triggering a\nKASAN panic.\n\nFix this by moving the assignment of `rsp_len` to after the `num_scid`\nboundary check. If the packet is rejected, `rsp_len` will safely\nremain 0, and the error response will only read the 8-byte base header\nfrom the stack."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable code is reached by a Bluetooth LE L2CAP signaling packet from a nearby Bluetooth peer, so exploitation requires adjacent radio proximity rather than internet routing or local code execution.\nAC:L - The attacker only needs to send a malformed Enhanced Credit Based Connection Request with more than 5 SCIDs; the bad length is used deterministically before the bounds check.\nPR:N - The vulnerable path is reached before PSM lookup and before `smp_sufficient_security()`, so no pairing, authentication, service authorization, or local privilege is required.\nUI:N - Once the target is reachable over Bluetooth LE, the malformed signaling request is processed by the kernel without requiring a victim user action.\nS:U - The impact is within the kernel Bluetooth stack on the same host security authority; this is not a cross-VM, IOMMU, or sandbox boundary escape by itself.\nC:H - The oversized response length causes `l2cap_send_cmd()` to copy beyond an 18-byte stack buffer into an outbound L2CAP response, exposing attacker-sized kernel stack contents rather than a strictly bounded few bytes.\nI:N - The bug is an out-of-bounds read used to build a response packet; it does not provide an out-of-bounds write or direct modification of kernel data.\nA:H - The same malformed packet triggers a demonstrated KASAN stack-out-of-bounds panic, and a sufficiently large kernel stack read can reasonably crash the kernel even outside KASAN builds."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:23:12.375Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c8e1a27edb8b4e5afb56b384acd7b6c2dec1b7cc"
},
{
"url": "https://git.kernel.org/stable/c/5b35f8211a913cfe7ab9d54fa36a272d2059a588"
},
{
"url": "https://git.kernel.org/stable/c/a3d9c50d69785ae02e153f000da1b5fd6dbfdf1b"
},
{
"url": "https://git.kernel.org/stable/c/9d87cb22195b2c67405f5485d525190747ad5493"
}
],
"title": "Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31513",
"datePublished": "2026-04-22T13:54:30.835Z",
"dateReserved": "2026-03-09T15:48:24.107Z",
"dateUpdated": "2026-08-05T12:23:12.375Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45916 (GCVE-0-2026-45916)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-27 12:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: supply: sbs-battery: Fix use-after-free in power_supply_changed()
Using the `devm_` variant for requesting IRQ _before_ the `devm_`
variant for allocating/registering the `power_supply` handle, means that
the `power_supply` handle will be deallocated/unregistered _before_ the
interrupt handler (since `devm_` naturally deallocates in reverse
allocation order). This means that during removal, there is a race
condition where an interrupt can fire just _after_ the `power_supply`
handle has been freed, *but* just _before_ the corresponding
unregistration of the IRQ handler has run.
This will lead to the IRQ handler calling `power_supply_changed()` with
a freed `power_supply` handle. Which usually crashes the system or
otherwise silently corrupts the memory...
Note that there is a similar situation which can also happen during
`probe()`; the possibility of an interrupt firing _before_ registering
the `power_supply` handle. This would then lead to the nasty situation
of using the `power_supply` handle *uninitialized* in
`power_supply_changed()`.
Fix this racy use-after-free by making sure the IRQ is requested _after_
the registration of the `power_supply` handle. Keep the old behavior of
just printing a warning in case of any failures during the IRQ request
and finishing the probe successfully.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d2cec82c28802da31596b395ad292cb8f132fd63 Version: d2cec82c28802da31596b395ad292cb8f132fd63 Version: d2cec82c28802da31596b395ad292cb8f132fd63 Version: d2cec82c28802da31596b395ad292cb8f132fd63 Version: d2cec82c28802da31596b395ad292cb8f132fd63 Version: d2cec82c28802da31596b395ad292cb8f132fd63 Version: d2cec82c28802da31596b395ad292cb8f132fd63 Version: d2cec82c28802da31596b395ad292cb8f132fd63 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/sbs-battery.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ca7dd71773e4e050b0fb98768b7eae60f8d1f38b",
"status": "affected",
"version": "d2cec82c28802da31596b395ad292cb8f132fd63",
"versionType": "git"
},
{
"lessThan": "f1f472b14ad56104ba228b8fbec60d5b21829913",
"status": "affected",
"version": "d2cec82c28802da31596b395ad292cb8f132fd63",
"versionType": "git"
},
{
"lessThan": "8010b745b436c3e1ca5dd960aa29fa3e0f6d8841",
"status": "affected",
"version": "d2cec82c28802da31596b395ad292cb8f132fd63",
"versionType": "git"
},
{
"lessThan": "2078830c32d1e49ac942c6f8c21f35c806ae5e94",
"status": "affected",
"version": "d2cec82c28802da31596b395ad292cb8f132fd63",
"versionType": "git"
},
{
"lessThan": "82d3eb97a976c9d56bb92b241397610e57a9c629",
"status": "affected",
"version": "d2cec82c28802da31596b395ad292cb8f132fd63",
"versionType": "git"
},
{
"lessThan": "861dda7a9074c0ff67788928165ae39d7f647491",
"status": "affected",
"version": "d2cec82c28802da31596b395ad292cb8f132fd63",
"versionType": "git"
},
{
"lessThan": "14d4dee5d8fb361bfff275832087254beab66d72",
"status": "affected",
"version": "d2cec82c28802da31596b395ad292cb8f132fd63",
"versionType": "git"
},
{
"lessThan": "8d59cf3887fbabacef53bfba473e33e8a8d9d07b",
"status": "affected",
"version": "d2cec82c28802da31596b395ad292cb8f132fd63",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/sbs-battery.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: sbs-battery: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle. Keep the old behavior of\njust printing a warning in case of any failures during the IRQ request\nand finishing the probe successfully."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:17:32.565Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ca7dd71773e4e050b0fb98768b7eae60f8d1f38b"
},
{
"url": "https://git.kernel.org/stable/c/f1f472b14ad56104ba228b8fbec60d5b21829913"
},
{
"url": "https://git.kernel.org/stable/c/8010b745b436c3e1ca5dd960aa29fa3e0f6d8841"
},
{
"url": "https://git.kernel.org/stable/c/2078830c32d1e49ac942c6f8c21f35c806ae5e94"
},
{
"url": "https://git.kernel.org/stable/c/82d3eb97a976c9d56bb92b241397610e57a9c629"
},
{
"url": "https://git.kernel.org/stable/c/861dda7a9074c0ff67788928165ae39d7f647491"
},
{
"url": "https://git.kernel.org/stable/c/14d4dee5d8fb361bfff275832087254beab66d72"
},
{
"url": "https://git.kernel.org/stable/c/8d59cf3887fbabacef53bfba473e33e8a8d9d07b"
}
],
"title": "power: supply: sbs-battery: Fix use-after-free in power_supply_changed()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45916",
"datePublished": "2026-05-27T12:17:32.565Z",
"dateReserved": "2026-05-13T15:03:33.085Z",
"dateUpdated": "2026-05-27T12:17:32.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53050 (GCVE-0-2026-53050)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
quota: Fix race of dquot_scan_active() with quota deactivation
dquot_scan_active() can race with quota deactivation in
quota_release_workfn() like:
CPU0 (quota_release_workfn) CPU1 (dquot_scan_active)
============================== ==============================
spin_lock(&dq_list_lock);
list_replace_init(
&releasing_dquots, &rls_head);
/* dquot X on rls_head,
dq_count == 0,
DQ_ACTIVE_B still set */
spin_unlock(&dq_list_lock);
synchronize_srcu(&dquot_srcu);
spin_lock(&dq_list_lock);
list_for_each_entry(dquot,
&inuse_list, dq_inuse) {
/* finds dquot X */
dquot_active(X) -> true
atomic_inc(&X->dq_count);
}
spin_unlock(&dq_list_lock);
spin_lock(&dq_list_lock);
dquot = list_first_entry(&rls_head);
WARN_ON_ONCE(atomic_read(&dquot->dq_count));
The problem is not only a cosmetic one as under memory pressure the
caller of dquot_scan_active() can end up working on freed dquot.
Fix the problem by making sure the dquot is removed from releasing list
when we acquire a reference to it.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 22c06bf1f99ec3ec16b1a81342becba4c59a1f16 Version: 56e96b38d2f7cd95b3c30eb70decac7233915e0a Version: 12a820a9923c11e8e898da9f82c8aded70cdcd16 Version: 869b6ea1609f655a43251bf41757aa44e5350a8f Version: 869b6ea1609f655a43251bf41757aa44e5350a8f Version: 869b6ea1609f655a43251bf41757aa44e5350a8f Version: 869b6ea1609f655a43251bf41757aa44e5350a8f Version: 869b6ea1609f655a43251bf41757aa44e5350a8f Version: bb7e3a019b52d829949d02b64ebab37838148fbf Version: 061a18239ced5eb086967a2b4451cb1cc5ce0702 Version: 2a1ddddba6541143c8f73962f3021f1789114284 Version: 5.10.199 ≤ Version: 5.15.136 ≤ Version: 6.1.59 ≤ Version: 4.19.297 ≤ Version: 5.4.259 ≤ Version: 6.5.8 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/quota/dquot.c",
"include/linux/quotaops.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2bdc80f4619411e5bd4a3ef23f51e14021ed457c",
"status": "affected",
"version": "22c06bf1f99ec3ec16b1a81342becba4c59a1f16",
"versionType": "git"
},
{
"lessThan": "f9438cb8c8ec3adc84b2b450a3aab0123d074c3b",
"status": "affected",
"version": "56e96b38d2f7cd95b3c30eb70decac7233915e0a",
"versionType": "git"
},
{
"lessThan": "ac8a2e0d287ebf35e5d7e51e260b4e146648ba4a",
"status": "affected",
"version": "12a820a9923c11e8e898da9f82c8aded70cdcd16",
"versionType": "git"
},
{
"lessThan": "6678dde265708003c2b42551af4a2e3cb05decd5",
"status": "affected",
"version": "869b6ea1609f655a43251bf41757aa44e5350a8f",
"versionType": "git"
},
{
"lessThan": "61e25f664dc2a08299e07d84c85776abc2350f75",
"status": "affected",
"version": "869b6ea1609f655a43251bf41757aa44e5350a8f",
"versionType": "git"
},
{
"lessThan": "fdd424d7c35633ac577fd87d1b043d1b8a6cd350",
"status": "affected",
"version": "869b6ea1609f655a43251bf41757aa44e5350a8f",
"versionType": "git"
},
{
"lessThan": "82cbdb4c1ebb5ea7d7bd45c18d3483b5bd32ebc1",
"status": "affected",
"version": "869b6ea1609f655a43251bf41757aa44e5350a8f",
"versionType": "git"
},
{
"lessThan": "e93ab401da4b2e2c1b8ef2424de2f238d51c8b2d",
"status": "affected",
"version": "869b6ea1609f655a43251bf41757aa44e5350a8f",
"versionType": "git"
},
{
"status": "affected",
"version": "bb7e3a019b52d829949d02b64ebab37838148fbf",
"versionType": "git"
},
{
"status": "affected",
"version": "061a18239ced5eb086967a2b4451cb1cc5ce0702",
"versionType": "git"
},
{
"status": "affected",
"version": "2a1ddddba6541143c8f73962f3021f1789114284",
"versionType": "git"
},
{
"lessThan": "5.10.258",
"status": "affected",
"version": "5.10.199",
"versionType": "semver"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.136",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.59",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.297",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.259",
"versionType": "semver"
},
{
"lessThan": "6.6",
"status": "affected",
"version": "6.5.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/quota/dquot.c",
"include/linux/quotaops.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10.199",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.136",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.297",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.259",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nquota: Fix race of dquot_scan_active() with quota deactivation\n\ndquot_scan_active() can race with quota deactivation in\nquota_release_workfn() like:\n\n CPU0 (quota_release_workfn) CPU1 (dquot_scan_active)\n ============================== ==============================\n spin_lock(\u0026dq_list_lock);\n list_replace_init(\n \u0026releasing_dquots, \u0026rls_head);\n /* dquot X on rls_head,\n dq_count == 0,\n DQ_ACTIVE_B still set */\n spin_unlock(\u0026dq_list_lock);\n synchronize_srcu(\u0026dquot_srcu);\n spin_lock(\u0026dq_list_lock);\n list_for_each_entry(dquot,\n \u0026inuse_list, dq_inuse) {\n /* finds dquot X */\n dquot_active(X) -\u003e true\n atomic_inc(\u0026X-\u003edq_count);\n }\n spin_unlock(\u0026dq_list_lock);\n spin_lock(\u0026dq_list_lock);\n dquot = list_first_entry(\u0026rls_head);\n WARN_ON_ONCE(atomic_read(\u0026dquot-\u003edq_count));\n\nThe problem is not only a cosmetic one as under memory pressure the\ncaller of dquot_scan_active() can end up working on freed dquot.\n\nFix the problem by making sure the dquot is removed from releasing list\nwhen we acquire a reference to it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local filesystem quota activity on a mounted OCFS2 filesystem, via ordinary dquot lifetime changes racing with the OCFS2 quota sync worker. It is not reachable by remote packets or adjacent/physical input.\nAC:L - This is a race, but a local attacker can repeatedly churn dquot references with filesystem operations while the periodic scanner runs. When uncertain, the higher-severity AC:L is appropriate.\nPR:L - After OCFS2 quotas are enabled, an unprivileged local user with write access to the filesystem can trigger dquot allocation and release paths. Mounting/configuring quotas is an environmental prerequisite, not a privilege needed for each exploit attempt.\nUI:N - No victim interaction is required once the affected filesystem is mounted and quotas are active. The attacker can trigger the relevant filesystem operations directly.\nS:U - The impact remains within the kernel and the same host security authority. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The bug can lead to use-after-free of a dquot object under memory pressure. Kernel UAF conditions can be leveraged for memory disclosure, so confidentiality impact is High.\nI:H - The stale dquot/list state creates kernel heap use-after-free/list corruption, which can plausibly be shaped into write primitives or code execution. Integrity impact is therefore High.\nA:H - The race already produces kernel WARN/oops-style failure conditions and can dereference freed kernel objects. This can crash or destabilize the kernel, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:56.160Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2bdc80f4619411e5bd4a3ef23f51e14021ed457c"
},
{
"url": "https://git.kernel.org/stable/c/f9438cb8c8ec3adc84b2b450a3aab0123d074c3b"
},
{
"url": "https://git.kernel.org/stable/c/ac8a2e0d287ebf35e5d7e51e260b4e146648ba4a"
},
{
"url": "https://git.kernel.org/stable/c/6678dde265708003c2b42551af4a2e3cb05decd5"
},
{
"url": "https://git.kernel.org/stable/c/61e25f664dc2a08299e07d84c85776abc2350f75"
},
{
"url": "https://git.kernel.org/stable/c/fdd424d7c35633ac577fd87d1b043d1b8a6cd350"
},
{
"url": "https://git.kernel.org/stable/c/82cbdb4c1ebb5ea7d7bd45c18d3483b5bd32ebc1"
},
{
"url": "https://git.kernel.org/stable/c/e93ab401da4b2e2c1b8ef2424de2f238d51c8b2d"
}
],
"title": "quota: Fix race of dquot_scan_active() with quota deactivation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53050",
"datePublished": "2026-06-24T16:29:56.043Z",
"dateReserved": "2026-06-09T07:44:35.381Z",
"dateUpdated": "2026-08-05T12:32:56.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43324 (GCVE-0-2026-43324)
Vulnerability from cvelistv5
Published
2026-05-08 13:31
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: dummy-hcd: Fix interrupt synchronization error
This fixes an error in synchronization in the dummy-hcd driver. The
error has a somewhat involved history. The synchronization mechanism
was introduced by commit 7dbd8f4cabd9 ("USB: dummy-hcd: Fix erroneous
synchronization change"), which added an emulated "interrupts enabled"
flag together with code emulating synchronize_irq() (it waits until
all current handler callbacks have returned).
But the emulated interrupt-disable occurred too late, after the driver
containing the handler callback routines had been told that it was
unbound and no more callbacks would occur. Commit 4a5d797a9f9c ("usb:
gadget: dummy_hcd: fix gpf in gadget_setup") tried to fix this by
moving the synchronize_irq() emulation code from dummy_stop() to
dummy_pullup(), which runs before the unbind callback.
There still were races, though, because the emulated interrupt-disable
still occurred too late. It couldn't be moved to dummy_pullup(),
because that routine can be called for reasons other than an impending
unbind. Therefore commits 7dc0c55e9f30 ("USB: UDC core: Add
udc_async_callbacks gadget op") and 04145a03db9d ("USB: UDC: Implement
udc_async_callbacks in dummy-hcd") added an API allowing the UDC core
to tell dummy-hcd exactly when emulated interrupts and their callbacks
should be disabled.
That brings us to the current state of things, which is still wrong
because the emulated synchronize_irq() occurs before the emulated
interrupt-disable! That's no good, beause it means that more emulated
interrupts can occur after the synchronize_irq() emulation has run,
leading to the possibility that a callback handler may be running when
the gadget driver is unbound.
To fix this, we have to move the synchronize_irq() emulation code yet
again, to the dummy_udc_async_callbacks() routine, which takes care of
enabling and disabling emulated interrupt requests. The
synchronization will now run immediately after emulated interrupts are
disabled, which is where it belongs.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 04145a03db9d78469e0817ab3a767c76c0fb0947 Version: 04145a03db9d78469e0817ab3a767c76c0fb0947 Version: 04145a03db9d78469e0817ab3a767c76c0fb0947 Version: 04145a03db9d78469e0817ab3a767c76c0fb0947 Version: 04145a03db9d78469e0817ab3a767c76c0fb0947 Version: 04145a03db9d78469e0817ab3a767c76c0fb0947 Version: 04145a03db9d78469e0817ab3a767c76c0fb0947 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/udc/dummy_hcd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d847f375b1bcea713143bc02720d13d2d01b012a",
"status": "affected",
"version": "04145a03db9d78469e0817ab3a767c76c0fb0947",
"versionType": "git"
},
{
"lessThan": "cbf7df5e5d27cd5bea92ee9a75a4b28dbcc718d4",
"status": "affected",
"version": "04145a03db9d78469e0817ab3a767c76c0fb0947",
"versionType": "git"
},
{
"lessThan": "5aa776c8615bea3b1eaeec87b0788375800ead4f",
"status": "affected",
"version": "04145a03db9d78469e0817ab3a767c76c0fb0947",
"versionType": "git"
},
{
"lessThan": "94d4fab1dd9e64f45449bcc7d6a5acf796b13015",
"status": "affected",
"version": "04145a03db9d78469e0817ab3a767c76c0fb0947",
"versionType": "git"
},
{
"lessThan": "5687a09776069bd915560021c9728ca528440128",
"status": "affected",
"version": "04145a03db9d78469e0817ab3a767c76c0fb0947",
"versionType": "git"
},
{
"lessThan": "8bcd80219d8e10e660bf29b20e41bb8beb4e4cb7",
"status": "affected",
"version": "04145a03db9d78469e0817ab3a767c76c0fb0947",
"versionType": "git"
},
{
"lessThan": "2ca9e46f8f1f5a297eb0ac83f79d35d5b3a02541",
"status": "affected",
"version": "04145a03db9d78469e0817ab3a767c76c0fb0947",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/udc/dummy_hcd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: dummy-hcd: Fix interrupt synchronization error\n\nThis fixes an error in synchronization in the dummy-hcd driver. The\nerror has a somewhat involved history. The synchronization mechanism\nwas introduced by commit 7dbd8f4cabd9 (\"USB: dummy-hcd: Fix erroneous\nsynchronization change\"), which added an emulated \"interrupts enabled\"\nflag together with code emulating synchronize_irq() (it waits until\nall current handler callbacks have returned).\n\nBut the emulated interrupt-disable occurred too late, after the driver\ncontaining the handler callback routines had been told that it was\nunbound and no more callbacks would occur. Commit 4a5d797a9f9c (\"usb:\ngadget: dummy_hcd: fix gpf in gadget_setup\") tried to fix this by\nmoving the synchronize_irq() emulation code from dummy_stop() to\ndummy_pullup(), which runs before the unbind callback.\n\nThere still were races, though, because the emulated interrupt-disable\nstill occurred too late. It couldn\u0027t be moved to dummy_pullup(),\nbecause that routine can be called for reasons other than an impending\nunbind. Therefore commits 7dc0c55e9f30 (\"USB: UDC core: Add\nudc_async_callbacks gadget op\") and 04145a03db9d (\"USB: UDC: Implement\nudc_async_callbacks in dummy-hcd\") added an API allowing the UDC core\nto tell dummy-hcd exactly when emulated interrupts and their callbacks\nshould be disabled.\n\nThat brings us to the current state of things, which is still wrong\nbecause the emulated synchronize_irq() occurs before the emulated\ninterrupt-disable! That\u0027s no good, beause it means that more emulated\ninterrupts can occur after the synchronize_irq() emulation has run,\nleading to the possibility that a callback handler may be running when\nthe gadget driver is unbound.\n\nTo fix this, we have to move the synchronize_irq() emulation code yet\nagain, to the dummy_udc_async_callbacks() routine, which takes care of\nenabling and disabling emulated interrupt requests. The\nsynchronization will now run immediately after emulated interrupts are\ndisabled, which is where it belongs."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable dummy-hcd path is reached through local USB gadget/host emulator interfaces such as raw-gadget, usbfs, configfs, or sysfs unbind paths. It is not network-reachable and dummy-hcd is an in-kernel emulator rather than a physically attached USB device.\nAC:L - Although this is a race, a local attacker can drive both sides by generating emulated USB activity while triggering gadget driver unbind, and the race can be retried. There are no special external conditions beyond attacker-controlled timing.\nPR:L - Exploitation requires local access to the configured dummy-hcd/gadget userspace interfaces, but the relevant raw-gadget and usbfs paths do not themselves impose a kernel capability check once accessible. When uncertain between root-only setup and normal local device access, the higher-severity PR:L is appropriate.\nUI:N - No victim action is needed after the attacker has local access to the relevant device interfaces. The attacker can trigger emulated USB callbacks and unbind locally.\nS:U - The impact remains within the same kernel security authority. This is a standard local kernel memory-safety/availability issue, not a VM escape or cross-authority boundary violation.\nC:H - The synchronization bug can allow asynchronous gadget callbacks to run after or during gadget driver unbind, leaving callback code operating on stale or cleared gadget-driver state. This is a use-after-unbind/use-after-free class condition, so kernel memory disclosure is a defensible worst-case impact.\nI:H - Callback execution against freed or invalid gadget-driver state can be leveraged as kernel memory corruption rather than merely a clean failure. Under the required higher-severity rule, a UAF-style kernel race supports potential arbitrary write or code execution.\nA:H - At minimum, the race can crash the kernel through NULL dereference or stale pointer use in gadget callbacks, as related dummy-hcd synchronization bugs have done. Kernel oops/panic is high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:14.134Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d847f375b1bcea713143bc02720d13d2d01b012a"
},
{
"url": "https://git.kernel.org/stable/c/cbf7df5e5d27cd5bea92ee9a75a4b28dbcc718d4"
},
{
"url": "https://git.kernel.org/stable/c/5aa776c8615bea3b1eaeec87b0788375800ead4f"
},
{
"url": "https://git.kernel.org/stable/c/94d4fab1dd9e64f45449bcc7d6a5acf796b13015"
},
{
"url": "https://git.kernel.org/stable/c/5687a09776069bd915560021c9728ca528440128"
},
{
"url": "https://git.kernel.org/stable/c/8bcd80219d8e10e660bf29b20e41bb8beb4e4cb7"
},
{
"url": "https://git.kernel.org/stable/c/2ca9e46f8f1f5a297eb0ac83f79d35d5b3a02541"
}
],
"title": "USB: dummy-hcd: Fix interrupt synchronization error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43324",
"datePublished": "2026-05-08T13:31:08.850Z",
"dateReserved": "2026-05-01T14:12:56.002Z",
"dateUpdated": "2026-08-05T12:27:14.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53306 (GCVE-0-2026-53306)
Vulnerability from cvelistv5
Published
2026-06-26 19:41
Modified
2026-06-26 19:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tty: hvc_iucv: fix off-by-one in number of supported devices
MAX_HVC_IUCV_LINES == HVC_ALLOC_TTY_ADAPTERS == 8.
This is the number of entries in:
static struct hvc_iucv_private *hvc_iucv_table[MAX_HVC_IUCV_LINES];
Sometimes hvc_iucv_table[] is limited by:
(a) if (num > hvc_iucv_devices) // for error detection
or
(b) for (i = 0; i < hvc_iucv_devices; i++) // in 2 places
(so these 2 don't agree; second one appears to be correct to me.)
hvc_iucv_devices can be 0..8. This is a counter.
(c) if (hvc_iucv_devices > MAX_HVC_IUCV_LINES)
If hvc_iucv_devices == 8, (a) allows the code to access hvc_iucv_table[8].
Oops.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 44a01d5ba8a4d543694461cd3e178cfa6b3f221b Version: 44a01d5ba8a4d543694461cd3e178cfa6b3f221b Version: 44a01d5ba8a4d543694461cd3e178cfa6b3f221b Version: 44a01d5ba8a4d543694461cd3e178cfa6b3f221b Version: 44a01d5ba8a4d543694461cd3e178cfa6b3f221b Version: 44a01d5ba8a4d543694461cd3e178cfa6b3f221b Version: 44a01d5ba8a4d543694461cd3e178cfa6b3f221b Version: 44a01d5ba8a4d543694461cd3e178cfa6b3f221b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/hvc/hvc_iucv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d3b89e6ab93bdd0efd45828bda6b0e61cc46dff",
"status": "affected",
"version": "44a01d5ba8a4d543694461cd3e178cfa6b3f221b",
"versionType": "git"
},
{
"lessThan": "484357dff256c816d9466bda35eb765685e4dc86",
"status": "affected",
"version": "44a01d5ba8a4d543694461cd3e178cfa6b3f221b",
"versionType": "git"
},
{
"lessThan": "11207e42a332eb8bbcb9fe74df9edd2a807c5607",
"status": "affected",
"version": "44a01d5ba8a4d543694461cd3e178cfa6b3f221b",
"versionType": "git"
},
{
"lessThan": "fed8b8f33a46db0ee2efdb000f4f630c86ed8ca4",
"status": "affected",
"version": "44a01d5ba8a4d543694461cd3e178cfa6b3f221b",
"versionType": "git"
},
{
"lessThan": "a76511bc654819425d3b15e77b523d7f9d81f064",
"status": "affected",
"version": "44a01d5ba8a4d543694461cd3e178cfa6b3f221b",
"versionType": "git"
},
{
"lessThan": "3104a3f40feb107f77d7116ad9bf6c210ab7babf",
"status": "affected",
"version": "44a01d5ba8a4d543694461cd3e178cfa6b3f221b",
"versionType": "git"
},
{
"lessThan": "f1dc8e72de9aabe5d96767a4e97219ac26b79fe5",
"status": "affected",
"version": "44a01d5ba8a4d543694461cd3e178cfa6b3f221b",
"versionType": "git"
},
{
"lessThan": "f2a880e802ad12d1e38039d1334fb1475d0f5241",
"status": "affected",
"version": "44a01d5ba8a4d543694461cd3e178cfa6b3f221b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/hvc/hvc_iucv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: hvc_iucv: fix off-by-one in number of supported devices\n\nMAX_HVC_IUCV_LINES == HVC_ALLOC_TTY_ADAPTERS == 8.\nThis is the number of entries in:\n static struct hvc_iucv_private *hvc_iucv_table[MAX_HVC_IUCV_LINES];\n\nSometimes hvc_iucv_table[] is limited by:\n(a)\tif (num \u003e hvc_iucv_devices) // for error detection\nor\n(b)\tfor (i = 0; i \u003c hvc_iucv_devices; i++) // in 2 places\n(so these 2 don\u0027t agree; second one appears to be correct to me.)\n\nhvc_iucv_devices can be 0..8. This is a counter.\n(c)\tif (hvc_iucv_devices \u003e MAX_HVC_IUCV_LINES)\n\nIf hvc_iucv_devices == 8, (a) allows the code to access hvc_iucv_table[8].\nOops."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-26T19:41:01.338Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d3b89e6ab93bdd0efd45828bda6b0e61cc46dff"
},
{
"url": "https://git.kernel.org/stable/c/484357dff256c816d9466bda35eb765685e4dc86"
},
{
"url": "https://git.kernel.org/stable/c/11207e42a332eb8bbcb9fe74df9edd2a807c5607"
},
{
"url": "https://git.kernel.org/stable/c/fed8b8f33a46db0ee2efdb000f4f630c86ed8ca4"
},
{
"url": "https://git.kernel.org/stable/c/a76511bc654819425d3b15e77b523d7f9d81f064"
},
{
"url": "https://git.kernel.org/stable/c/3104a3f40feb107f77d7116ad9bf6c210ab7babf"
},
{
"url": "https://git.kernel.org/stable/c/f1dc8e72de9aabe5d96767a4e97219ac26b79fe5"
},
{
"url": "https://git.kernel.org/stable/c/f2a880e802ad12d1e38039d1334fb1475d0f5241"
}
],
"title": "tty: hvc_iucv: fix off-by-one in number of supported devices",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53306",
"datePublished": "2026-06-26T19:41:01.338Z",
"dateReserved": "2026-06-09T07:44:35.397Z",
"dateUpdated": "2026-06-26T19:41:01.338Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43312 (GCVE-0-2026-43312)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-05-11 22:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: i2c: ov5647: Initialize subdev before controls
In ov5647_init_controls() we call v4l2_get_subdevdata, but it is
initialized by v4l2_i2c_subdev_init() in the probe, which currently
happens after init_controls(). This can result in a segfault if the
error condition is hit, and we try to access i2c_client, so fix the
order.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4974c2f19fd810ec9a4e534bfc69e176256b7a03 Version: 4974c2f19fd810ec9a4e534bfc69e176256b7a03 Version: 4974c2f19fd810ec9a4e534bfc69e176256b7a03 Version: 4974c2f19fd810ec9a4e534bfc69e176256b7a03 Version: 4974c2f19fd810ec9a4e534bfc69e176256b7a03 Version: 4974c2f19fd810ec9a4e534bfc69e176256b7a03 Version: 4974c2f19fd810ec9a4e534bfc69e176256b7a03 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/i2c/ov5647.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f2a1998bc0053ebfe137f65081ed13afd9f34502",
"status": "affected",
"version": "4974c2f19fd810ec9a4e534bfc69e176256b7a03",
"versionType": "git"
},
{
"lessThan": "59e372aa4cf60e2500eba7f978acdcb18bb49032",
"status": "affected",
"version": "4974c2f19fd810ec9a4e534bfc69e176256b7a03",
"versionType": "git"
},
{
"lessThan": "cabd025182cfed4a19b3aab57493e312d681e398",
"status": "affected",
"version": "4974c2f19fd810ec9a4e534bfc69e176256b7a03",
"versionType": "git"
},
{
"lessThan": "2dedda97a64e7735844609c6c77c0dd953d73833",
"status": "affected",
"version": "4974c2f19fd810ec9a4e534bfc69e176256b7a03",
"versionType": "git"
},
{
"lessThan": "8ecb21c20387cc0c8aa00489a21ccc69f6b0f5d1",
"status": "affected",
"version": "4974c2f19fd810ec9a4e534bfc69e176256b7a03",
"versionType": "git"
},
{
"lessThan": "fb69e4842f5b463ff5f121d2ac7746014e3477ea",
"status": "affected",
"version": "4974c2f19fd810ec9a4e534bfc69e176256b7a03",
"versionType": "git"
},
{
"lessThan": "eee13cbccacb6d0a3120c126b8544030905b069d",
"status": "affected",
"version": "4974c2f19fd810ec9a4e534bfc69e176256b7a03",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/i2c/ov5647.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c: ov5647: Initialize subdev before controls\n\nIn ov5647_init_controls() we call v4l2_get_subdevdata, but it is\ninitialized by v4l2_i2c_subdev_init() in the probe, which currently\nhappens after init_controls(). This can result in a segfault if the\nerror condition is hit, and we try to access i2c_client, so fix the\norder."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:22:07.459Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f2a1998bc0053ebfe137f65081ed13afd9f34502"
},
{
"url": "https://git.kernel.org/stable/c/59e372aa4cf60e2500eba7f978acdcb18bb49032"
},
{
"url": "https://git.kernel.org/stable/c/cabd025182cfed4a19b3aab57493e312d681e398"
},
{
"url": "https://git.kernel.org/stable/c/2dedda97a64e7735844609c6c77c0dd953d73833"
},
{
"url": "https://git.kernel.org/stable/c/8ecb21c20387cc0c8aa00489a21ccc69f6b0f5d1"
},
{
"url": "https://git.kernel.org/stable/c/fb69e4842f5b463ff5f121d2ac7746014e3477ea"
},
{
"url": "https://git.kernel.org/stable/c/eee13cbccacb6d0a3120c126b8544030905b069d"
}
],
"title": "media: i2c: ov5647: Initialize subdev before controls",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43312",
"datePublished": "2026-05-08T13:11:29.719Z",
"dateReserved": "2026-05-01T14:12:56.001Z",
"dateUpdated": "2026-05-11T22:22:07.459Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45958 (GCVE-0-2026-45958)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/exynos: vidi: fix to avoid directly dereferencing user pointer
In vidi_connection_ioctl(), vidi->edid(user pointer) is directly
dereferenced in the kernel.
This allows arbitrary kernel memory access from the user space, so instead
of directly accessing the user pointer in the kernel, we should modify it
to copy edid to kernel memory using copy_from_user() and use it.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b73d12303ecfc91123363d8900e127da44bf42a6 Version: b73d12303ecfc91123363d8900e127da44bf42a6 Version: b73d12303ecfc91123363d8900e127da44bf42a6 Version: b73d12303ecfc91123363d8900e127da44bf42a6 Version: b73d12303ecfc91123363d8900e127da44bf42a6 Version: b73d12303ecfc91123363d8900e127da44bf42a6 Version: b73d12303ecfc91123363d8900e127da44bf42a6 Version: b73d12303ecfc91123363d8900e127da44bf42a6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/exynos/exynos_drm_vidi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "13537f7f6d28a87ee2e496e071b6ad9541905f23",
"status": "affected",
"version": "b73d12303ecfc91123363d8900e127da44bf42a6",
"versionType": "git"
},
{
"lessThan": "c2914c0ca7557c6c5c845621cb6d6c9f26ab5a8c",
"status": "affected",
"version": "b73d12303ecfc91123363d8900e127da44bf42a6",
"versionType": "git"
},
{
"lessThan": "7efb6a4e6b1b523e744d17e6249757ed97caae7c",
"status": "affected",
"version": "b73d12303ecfc91123363d8900e127da44bf42a6",
"versionType": "git"
},
{
"lessThan": "2e147aa3169b83eaf044776f81d86235bf147de1",
"status": "affected",
"version": "b73d12303ecfc91123363d8900e127da44bf42a6",
"versionType": "git"
},
{
"lessThan": "4c4193829109f38b2855de77981adc2e066286c7",
"status": "affected",
"version": "b73d12303ecfc91123363d8900e127da44bf42a6",
"versionType": "git"
},
{
"lessThan": "4949e32387fe315b59ad5f422c9fc52836fbdd1e",
"status": "affected",
"version": "b73d12303ecfc91123363d8900e127da44bf42a6",
"versionType": "git"
},
{
"lessThan": "235d702b771416b8a61e81bb09ba39282e4268fd",
"status": "affected",
"version": "b73d12303ecfc91123363d8900e127da44bf42a6",
"versionType": "git"
},
{
"lessThan": "d4c98c077c7fb2dfdece7d605e694b5ea2665085",
"status": "affected",
"version": "b73d12303ecfc91123363d8900e127da44bf42a6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/exynos/exynos_drm_vidi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.4"
},
{
"lessThan": "3.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.77",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/exynos: vidi: fix to avoid directly dereferencing user pointer\n\nIn vidi_connection_ioctl(), vidi-\u003eedid(user pointer) is directly\ndereferenced in the kernel.\n\nThis allows arbitrary kernel memory access from the user space, so instead\nof directly accessing the user pointer in the kernel, we should modify it\nto copy edid to kernel memory using copy_from_user() and use it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached through the EXYNOS_VIDI_CONNECTION DRM ioctl on the local primary device node (/dev/dri/cardN); it requires local system access, not network or adjacent reachability.\nAC:L - The attacker fully controls the vidi-\u003eedid pointer value passed in the ioctl and can reliably trigger the dereference/copy on demand; no race or uncontrolled condition is involved.\nPR:L - The ioctl is flagged DRM_AUTH, so the caller must be an authenticated DRM client (a local user with access to the DRM device node, who can become master on first open); no elevated/root privileges are needed.\nUI:N - The attacker issues the ioctl and reads back the connector EDID property entirely on their own; no action by another user is required.\nS:U - The impact stays within the kernel\u0027s own security authority; no crossing of a VM, IOMMU, or sandbox boundary occurs.\nC:H - The user-supplied value is dereferenced as a kernel pointer and up to 32 KB is kmemdup\u0027d from any attacker-chosen kernel address, then exposed back to userspace via the connector\u0027s EDID blob property \u2014 an arbitrary kernel-memory read/info-leak primitive.\nI:N - The flaw copies data from the attacker-controlled address into a freshly allocated kernel buffer; it provides no primitive to write or modify attacker-controlled kernel memory.\nA:H - Supplying an unmapped or invalid kernel address causes the direct dereference/kmemdup to fault, producing a kernel oops/panic and denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:56.396Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/13537f7f6d28a87ee2e496e071b6ad9541905f23"
},
{
"url": "https://git.kernel.org/stable/c/c2914c0ca7557c6c5c845621cb6d6c9f26ab5a8c"
},
{
"url": "https://git.kernel.org/stable/c/7efb6a4e6b1b523e744d17e6249757ed97caae7c"
},
{
"url": "https://git.kernel.org/stable/c/2e147aa3169b83eaf044776f81d86235bf147de1"
},
{
"url": "https://git.kernel.org/stable/c/4c4193829109f38b2855de77981adc2e066286c7"
},
{
"url": "https://git.kernel.org/stable/c/4949e32387fe315b59ad5f422c9fc52836fbdd1e"
},
{
"url": "https://git.kernel.org/stable/c/235d702b771416b8a61e81bb09ba39282e4268fd"
},
{
"url": "https://git.kernel.org/stable/c/d4c98c077c7fb2dfdece7d605e694b5ea2665085"
}
],
"title": "drm/exynos: vidi: fix to avoid directly dereferencing user pointer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45958",
"datePublished": "2026-05-27T12:18:14.878Z",
"dateReserved": "2026-05-13T15:03:33.088Z",
"dateUpdated": "2026-08-05T12:28:56.396Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43387 (GCVE-0-2026-43387)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-05-11 22:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
Just like in commit 154828bf9559 ("staging: rtl8723bs: fix out-of-bounds
read in rtw_get_ie() parser"), we don't trust the data in the frame so
we should check the length better before acting on it
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_ieee80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ac38856092b4c994f94343251b30520bdeb7f475",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "35969c3a208a07cb8642301df5869c34e2db7071",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "8097a48c606a9306281ea7bd73bf2afc97553733",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "740bca8bbdb707c0e4bb11e3316deb2f04fc7ce1",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "821f7d759fb2de33c5e5b0c4981181c4d0c3e9b1",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "6d62fa548387e159a21ea95132c09bfc96d336ed",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "9a4cd4c37593cc8b8d28f9a6732b490a8032006a",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "f0109b9d3e1e455429279d602f6276e34689750a",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_ieee80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: properly validate the data in rtw_get_ie_ex()\n\nJust like in commit 154828bf9559 (\"staging: rtl8723bs: fix out-of-bounds\nread in rtw_get_ie() parser\"), we don\u0027t trust the data in the frame so\nwe should check the length better before acting on it"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:23:36.159Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ac38856092b4c994f94343251b30520bdeb7f475"
},
{
"url": "https://git.kernel.org/stable/c/35969c3a208a07cb8642301df5869c34e2db7071"
},
{
"url": "https://git.kernel.org/stable/c/8097a48c606a9306281ea7bd73bf2afc97553733"
},
{
"url": "https://git.kernel.org/stable/c/740bca8bbdb707c0e4bb11e3316deb2f04fc7ce1"
},
{
"url": "https://git.kernel.org/stable/c/821f7d759fb2de33c5e5b0c4981181c4d0c3e9b1"
},
{
"url": "https://git.kernel.org/stable/c/6d62fa548387e159a21ea95132c09bfc96d336ed"
},
{
"url": "https://git.kernel.org/stable/c/9a4cd4c37593cc8b8d28f9a6732b490a8032006a"
},
{
"url": "https://git.kernel.org/stable/c/f0109b9d3e1e455429279d602f6276e34689750a"
}
],
"title": "staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43387",
"datePublished": "2026-05-08T14:21:33.323Z",
"dateReserved": "2026-05-01T14:12:56.006Z",
"dateUpdated": "2026-05-11T22:23:36.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45969 (GCVE-0-2026-45969)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-05-27 12:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: playstation: Add missing check for input_ff_create_memless
The ps_gamepad_create() function calls input_ff_create_memless()
without verifying its return value, which can lead to incorrect
behavior or potential crashes when FF effects are triggered.
Add a check for the return value of input_ff_create_memless().
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 51151098d7ab832f2a8b8f5c51fe224a9c98fdd5 Version: 51151098d7ab832f2a8b8f5c51fe224a9c98fdd5 Version: 51151098d7ab832f2a8b8f5c51fe224a9c98fdd5 Version: 51151098d7ab832f2a8b8f5c51fe224a9c98fdd5 Version: 51151098d7ab832f2a8b8f5c51fe224a9c98fdd5 Version: 51151098d7ab832f2a8b8f5c51fe224a9c98fdd5 Version: 51151098d7ab832f2a8b8f5c51fe224a9c98fdd5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-playstation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "496a345cc047a2c2d9d5a76956e1182525578bd5",
"status": "affected",
"version": "51151098d7ab832f2a8b8f5c51fe224a9c98fdd5",
"versionType": "git"
},
{
"lessThan": "987dee1486e975e2baa6a5d062cfdf18bbe901c8",
"status": "affected",
"version": "51151098d7ab832f2a8b8f5c51fe224a9c98fdd5",
"versionType": "git"
},
{
"lessThan": "33acf9a4d6eb1f6d01691faca96ad6b2ab0fcfc0",
"status": "affected",
"version": "51151098d7ab832f2a8b8f5c51fe224a9c98fdd5",
"versionType": "git"
},
{
"lessThan": "d955aeb26e1210a018492b3b32cbdfaf017aaa25",
"status": "affected",
"version": "51151098d7ab832f2a8b8f5c51fe224a9c98fdd5",
"versionType": "git"
},
{
"lessThan": "35301ca2a83d17aac2f3e8e35c696f0da2a13111",
"status": "affected",
"version": "51151098d7ab832f2a8b8f5c51fe224a9c98fdd5",
"versionType": "git"
},
{
"lessThan": "45b01d85265bc1ccdd69e0a7887db4b905a778f4",
"status": "affected",
"version": "51151098d7ab832f2a8b8f5c51fe224a9c98fdd5",
"versionType": "git"
},
{
"lessThan": "e6807641ac94e832988655a1c0e60ccc806b76dc",
"status": "affected",
"version": "51151098d7ab832f2a8b8f5c51fe224a9c98fdd5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-playstation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: playstation: Add missing check for input_ff_create_memless\n\nThe ps_gamepad_create() function calls input_ff_create_memless()\nwithout verifying its return value, which can lead to incorrect\nbehavior or potential crashes when FF effects are triggered.\n\nAdd a check for the return value of input_ff_create_memless()."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:18:28.112Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/496a345cc047a2c2d9d5a76956e1182525578bd5"
},
{
"url": "https://git.kernel.org/stable/c/987dee1486e975e2baa6a5d062cfdf18bbe901c8"
},
{
"url": "https://git.kernel.org/stable/c/33acf9a4d6eb1f6d01691faca96ad6b2ab0fcfc0"
},
{
"url": "https://git.kernel.org/stable/c/d955aeb26e1210a018492b3b32cbdfaf017aaa25"
},
{
"url": "https://git.kernel.org/stable/c/35301ca2a83d17aac2f3e8e35c696f0da2a13111"
},
{
"url": "https://git.kernel.org/stable/c/45b01d85265bc1ccdd69e0a7887db4b905a778f4"
},
{
"url": "https://git.kernel.org/stable/c/e6807641ac94e832988655a1c0e60ccc806b76dc"
}
],
"title": "HID: playstation: Add missing check for input_ff_create_memless",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45969",
"datePublished": "2026-05-27T12:18:28.112Z",
"dateReserved": "2026-05-13T15:03:33.089Z",
"dateUpdated": "2026-05-27T12:18:28.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53009 (GCVE-0-2026-53009)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-12 12:04
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ice: fix double-free of tx_buf skb
If ice_tso() or ice_tx_csum() fail, the error path in
ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points
to it and is marked as valid (ICE_TX_BUF_SKB).
'next_to_use' remains unchanged, so the potential problem will
likely fix itself when the next packet is transmitted and the tx_buf
gets overwritten. But if there is no next packet and the interface is
brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf()
will find the tx_buf and free the skb for the second time.
The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error
path, so that ice_unmap_and_free_tx_buf().
Move the initialization of 'first' up, to ensure it's already valid in
case we hit the linearization error path.
The bug was spotted by AI while I had it looking for something else.
It also proposed an initial version of the patch.
I reproduced the bug and tested the fix by adding code to inject
failures, on a build with KASAN.
I looked for similar bugs in related Intel drivers and did not find any.
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.37.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s ice network driver. An error in the driver\u0027s handling of network packet transmission, specifically when ice_tso() or ice_tx_csum() functions fail, can lead to a double-free of a network buffer (skb). This occurs because a transmit buffer (tx_buf) may still point to an already freed buffer. If the network interface is subsequently brought down, this double-free can be triggered, potentially leading to a system crash or denial of service (DoS)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T12:04:47.560Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53009"
},
{
"name": "RHBZ#2492390",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492390"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53009.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42919"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54246"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54247"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:42919: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:54246: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:54247: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: ice: fix double-free of tx_buf skb",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, prevent module ice from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_txrx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4c08fc2119ef0281cfa2cee007acf0a251be55f2",
"status": "affected",
"version": "d76a60ba7afb89523c88cf2ed3a044ce4180289e",
"versionType": "git"
},
{
"lessThan": "1a303baa715e6b78d6a406aaf335f87ff35acfcd",
"status": "affected",
"version": "d76a60ba7afb89523c88cf2ed3a044ce4180289e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_txrx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix double-free of tx_buf skb\n\nIf ice_tso() or ice_tx_csum() fail, the error path in\nice_xmit_frame_ring() frees the skb, but the \u0027first\u0027 tx_buf still points\nto it and is marked as valid (ICE_TX_BUF_SKB).\n\u0027next_to_use\u0027 remains unchanged, so the potential problem will\nlikely fix itself when the next packet is transmitted and the tx_buf\ngets overwritten. But if there is no next packet and the interface is\nbrought down instead, ice_clean_tx_ring() -\u003e ice_unmap_and_free_tx_buf()\nwill find the tx_buf and free the skb for the second time.\n\nThe fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error\npath, so that ice_unmap_and_free_tx_buf().\nMove the initialization of \u0027first\u0027 up, to ensure it\u0027s already valid in\ncase we hit the linearization error path.\n\nThe bug was spotted by AI while I had it looking for something else.\nIt also proposed an initial version of the patch.\n\nI reproduced the bug and tested the fix by adding code to inject\nfailures, on a build with KASAN.\n\nI looked for similar bugs in related Intel drivers and did not find any."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is in the ice driver\u0027s local transmit path reached through socket/netdev transmission, not by parsing received network packets directly. A remote peer may induce ordinary replies, but the malformed/offload-error SKB state needed for this bug is locally generated.\nAC:L - There is no race; once an attacker can create an SKB that makes ice_tso() or ice_tx_csum() fail, the stale tx_buf state is deterministic. In a controlled netdev namespace or delegated ice/SF deployment, the attacker can also quiesce/bring down the interface before the next packet overwrites the slot.\nPR:L - The strongest reasonable path requires local ability to generate crafted/offloaded transmit SKBs and control the affected netdev lifecycle, which can be namespace-level CAP_NET_ADMIN over a delegated ice netdev rather than host init-namespace root. It is therefore more than unauthenticated remote access but not necessarily high host administrator privilege.\nUI:N - No victim user action is required in the attacker-controlled local scenario; the attacker can send the triggering packet and then cause cleanup. The bug is completed by driver cleanup, not by a separate user opening or mounting content.\nS:U - The corruption occurs within the host kernel/driver memory management context and affects the same security authority. This is not a KVM guest-to-host, IOMMU, or separate-scope boundary bypass.\nC:H - This is a double-free of an skb pointer retained in the TX ring, a heap memory corruption condition equivalent to a use-after-free primitive. Such corruption can plausibly be shaped into kernel memory disclosure.\nI:H - A double-free of a kernel heap object can corrupt allocator metadata or a reallocated object and can plausibly be leveraged for arbitrary write or control-flow impact. Under the required conservative scoring rule, this warrants high integrity impact.\nA:H - Even without full exploitation, the second dev_kfree_skb_any() on an already freed skb can trigger allocator/KASAN/slab corruption detection or a kernel crash. Repeated triggering can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:36.500Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4c08fc2119ef0281cfa2cee007acf0a251be55f2"
},
{
"url": "https://git.kernel.org/stable/c/1a303baa715e6b78d6a406aaf335f87ff35acfcd"
}
],
"title": "ice: fix double-free of tx_buf skb",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53009",
"datePublished": "2026-06-24T16:29:20.332Z",
"dateReserved": "2026-06-09T07:44:35.378Z",
"dateUpdated": "2026-08-12T12:04:47.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43159 (GCVE-0-2026-43159)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix null dereference in find_network
The variable pwlan has the possibility of being NULL when passed into
rtw_free_network_nolock() which would later dereference the variable.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3b1d0c9a1f78836d0bce6fdd37f596f22c19b03e",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "1aa9c59f4b96a9056c02476c7ca89e96d15e0645",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "48b4dec3a8bfd667cd0cd767eaf511176193e9a1",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "cc3f83b6fb3773ad943365d1cd774b4ec050332e",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "04d24a3654ed195485bc6346a9ef326fc494a34e",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "677490a6bd4c63acdf6f48e4aaf6a23d7e6a446f",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "7fa16ffed2b9d9d44940990c1f31159770769aeb",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "41460a19654c32d39fd0e3a3671cd8d4b7b8479f",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix null dereference in find_network\n\nThe variable pwlan has the possibility of being NULL when passed into\nrtw_free_network_nolock() which would later dereference the variable."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:18:54.249Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3b1d0c9a1f78836d0bce6fdd37f596f22c19b03e"
},
{
"url": "https://git.kernel.org/stable/c/1aa9c59f4b96a9056c02476c7ca89e96d15e0645"
},
{
"url": "https://git.kernel.org/stable/c/48b4dec3a8bfd667cd0cd767eaf511176193e9a1"
},
{
"url": "https://git.kernel.org/stable/c/cc3f83b6fb3773ad943365d1cd774b4ec050332e"
},
{
"url": "https://git.kernel.org/stable/c/04d24a3654ed195485bc6346a9ef326fc494a34e"
},
{
"url": "https://git.kernel.org/stable/c/677490a6bd4c63acdf6f48e4aaf6a23d7e6a446f"
},
{
"url": "https://git.kernel.org/stable/c/7fa16ffed2b9d9d44940990c1f31159770769aeb"
},
{
"url": "https://git.kernel.org/stable/c/41460a19654c32d39fd0e3a3671cd8d4b7b8479f"
}
],
"title": "staging: rtl8723bs: fix null dereference in find_network",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43159",
"datePublished": "2026-05-06T11:27:38.541Z",
"dateReserved": "2026-05-01T14:12:55.990Z",
"dateUpdated": "2026-05-11T22:18:54.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46140 (GCVE-0-2026-46140)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-07-04 11:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: btmtk: validate WMT event SKB length before struct access
btmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to
struct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc
(9 bytes) without first checking that the SKB contains enough data.
A short firmware response causes out-of-bounds reads from SKB tailroom.
Use skb_pull_data() to validate and advance past the base WMT event
header. For the FUNC_CTRL case, pull the additional status field bytes
before accessing them.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f0457842215438786e2e205ad06a4fbb8ab63cd0 Version: d019930b0049fc2648a6b279893d8ad330596e81 Version: d019930b0049fc2648a6b279893d8ad330596e81 Version: d019930b0049fc2648a6b279893d8ad330596e81 Version: d019930b0049fc2648a6b279893d8ad330596e81 Version: 6.6.142 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btmtk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "36c85f7029484d5ede769f8873d16e9c8e35533c",
"status": "affected",
"version": "f0457842215438786e2e205ad06a4fbb8ab63cd0",
"versionType": "git"
},
{
"lessThan": "c411cf1bfde951cfa821809cf4020ba177f76e0c",
"status": "affected",
"version": "d019930b0049fc2648a6b279893d8ad330596e81",
"versionType": "git"
},
{
"lessThan": "624fb79dadc1b65757986a9d0fdde5c0cf3fe179",
"status": "affected",
"version": "d019930b0049fc2648a6b279893d8ad330596e81",
"versionType": "git"
},
{
"lessThan": "70d37a8b9229e394cc17ddad47e90b81d80fcd09",
"status": "affected",
"version": "d019930b0049fc2648a6b279893d8ad330596e81",
"versionType": "git"
},
{
"lessThan": "634a4408c0615c523cf7531790f4f14a422b9206",
"status": "affected",
"version": "d019930b0049fc2648a6b279893d8ad330596e81",
"versionType": "git"
},
{
"lessThan": "6.6.144",
"status": "affected",
"version": "6.6.142",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/btmtk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.6.142",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: btmtk: validate WMT event SKB length before struct access\n\nbtmtk_usb_hci_wmt_sync() casts the WMT event response SKB data to\nstruct btmtk_hci_wmt_evt (7 bytes) and struct btmtk_hci_wmt_evt_funcc\n(9 bytes) without first checking that the SKB contains enough data.\nA short firmware response causes out-of-bounds reads from SKB tailroom.\n\nUse skb_pull_data() to validate and advance past the base WMT event\nheader. For the FUNC_CTRL case, pull the additional status field bytes\nbefore accessing them."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:50:42.029Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/36c85f7029484d5ede769f8873d16e9c8e35533c"
},
{
"url": "https://git.kernel.org/stable/c/c411cf1bfde951cfa821809cf4020ba177f76e0c"
},
{
"url": "https://git.kernel.org/stable/c/624fb79dadc1b65757986a9d0fdde5c0cf3fe179"
},
{
"url": "https://git.kernel.org/stable/c/70d37a8b9229e394cc17ddad47e90b81d80fcd09"
},
{
"url": "https://git.kernel.org/stable/c/634a4408c0615c523cf7531790f4f14a422b9206"
}
],
"title": "Bluetooth: btmtk: validate WMT event SKB length before struct access",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46140",
"datePublished": "2026-05-28T09:35:56.104Z",
"dateReserved": "2026-05-13T15:03:33.100Z",
"dateUpdated": "2026-07-04T11:50:42.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71291 (GCVE-0-2025-71291)
Vulnerability from cvelistv5
Published
2026-05-06 11:32
Modified
2026-05-11 21:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()
In the function bcm_vk_read(), the pointer entry is checked, indicating
that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the
following code may cause null-pointer dereferences:
struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
set_msg_id(&tmp_msg, entry->usr_msg_id);
tmp_msg.size = entry->to_h_blks - 1;
To prevent these possible null-pointer dereferences, copy to_h_msg,
usr_msg_id, and to_h_blks from iter into temporary variables, and return
these temporary variables to the application instead of accessing them
through a potentially NULL entry.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 88517757a829e9ce146a6c7233ad5dcdc66fcbb0 Version: 88517757a829e9ce146a6c7233ad5dcdc66fcbb0 Version: 88517757a829e9ce146a6c7233ad5dcdc66fcbb0 Version: 88517757a829e9ce146a6c7233ad5dcdc66fcbb0 Version: 88517757a829e9ce146a6c7233ad5dcdc66fcbb0 Version: 88517757a829e9ce146a6c7233ad5dcdc66fcbb0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/misc/bcm-vk/bcm_vk_msg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "741c5a3a0cd893a4218fc0fc8c18403e54fcfb22",
"status": "affected",
"version": "88517757a829e9ce146a6c7233ad5dcdc66fcbb0",
"versionType": "git"
},
{
"lessThan": "ece3722169ba93734bfd1f06255e8ab7f19fe964",
"status": "affected",
"version": "88517757a829e9ce146a6c7233ad5dcdc66fcbb0",
"versionType": "git"
},
{
"lessThan": "aa97ccc3dc1eba9f4537f0410e9dbb0b05ccf2fb",
"status": "affected",
"version": "88517757a829e9ce146a6c7233ad5dcdc66fcbb0",
"versionType": "git"
},
{
"lessThan": "3842f93e6e29d5cc1dcb9e5bda70587b444bed69",
"status": "affected",
"version": "88517757a829e9ce146a6c7233ad5dcdc66fcbb0",
"versionType": "git"
},
{
"lessThan": "20f2d9dbe5e972516f8f9948d7ae5b95d1ad77bd",
"status": "affected",
"version": "88517757a829e9ce146a6c7233ad5dcdc66fcbb0",
"versionType": "git"
},
{
"lessThan": "ba75ecb97d3f4e95d59002c13afb6519205be6cb",
"status": "affected",
"version": "88517757a829e9ce146a6c7233ad5dcdc66fcbb0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/misc/bcm-vk/bcm_vk_msg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()\n\nIn the function bcm_vk_read(), the pointer entry is checked, indicating\nthat it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the\nfollowing code may cause null-pointer dereferences:\n\n struct vk_msg_blk tmp_msg = entry-\u003eto_h_msg[0];\n set_msg_id(\u0026tmp_msg, entry-\u003eusr_msg_id);\n tmp_msg.size = entry-\u003eto_h_blks - 1;\n\nTo prevent these possible null-pointer dereferences, copy to_h_msg,\nusr_msg_id, and to_h_blks from iter into temporary variables, and return\nthese temporary variables to the application instead of accessing them\nthrough a potentially NULL entry."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T21:57:21.624Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/741c5a3a0cd893a4218fc0fc8c18403e54fcfb22"
},
{
"url": "https://git.kernel.org/stable/c/ece3722169ba93734bfd1f06255e8ab7f19fe964"
},
{
"url": "https://git.kernel.org/stable/c/aa97ccc3dc1eba9f4537f0410e9dbb0b05ccf2fb"
},
{
"url": "https://git.kernel.org/stable/c/3842f93e6e29d5cc1dcb9e5bda70587b444bed69"
},
{
"url": "https://git.kernel.org/stable/c/20f2d9dbe5e972516f8f9948d7ae5b95d1ad77bd"
},
{
"url": "https://git.kernel.org/stable/c/ba75ecb97d3f4e95d59002c13afb6519205be6cb"
}
],
"title": "misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-71291",
"datePublished": "2026-05-06T11:32:23.223Z",
"dateReserved": "2026-05-06T11:31:45.509Z",
"dateUpdated": "2026-05-11T21:57:21.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46205 (GCVE-0-2026-46205)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: media: atomisp: Disallow all private IOCTLs
Disallow all private IOCTLs. These aren't quite as safe as one could
assume of IOCTL handlers; disable them for now. Instead of removing the
code, return in the beginning of the function if cmd is non-zero in order
to keep static checkers happy.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a49d25364dfb9f8a64037488a39ab1f56c5fa419 Version: ad85094b293e40e7a2f831b0311a389d952ebd5e Version: ad85094b293e40e7a2f831b0311a389d952ebd5e Version: ad85094b293e40e7a2f831b0311a389d952ebd5e Version: ad85094b293e40e7a2f831b0311a389d952ebd5e Version: ad85094b293e40e7a2f831b0311a389d952ebd5e Version: ad85094b293e40e7a2f831b0311a389d952ebd5e Version: ad85094b293e40e7a2f831b0311a389d952ebd5e Version: ad85094b293e40e7a2f831b0311a389d952ebd5e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/media/atomisp/pci/atomisp_ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654",
"status": "affected",
"version": "a49d25364dfb9f8a64037488a39ab1f56c5fa419",
"versionType": "git"
},
{
"lessThan": "64e85679beafe082fc2e70a557ec356c7fd27548",
"status": "affected",
"version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
"versionType": "git"
},
{
"lessThan": "8774f8cb661f57ae43cc3bc0509d16ef1f406e45",
"status": "affected",
"version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
"versionType": "git"
},
{
"lessThan": "ceb1b5f910e58986ea544ff8c9c2f23ae9a52414",
"status": "affected",
"version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
"versionType": "git"
},
{
"lessThan": "8c7a281a99224a5b9af99c4dcd98d68eea75926c",
"status": "affected",
"version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
"versionType": "git"
},
{
"lessThan": "6f1ce75a75c65061e7a720c3d0ee5f8adab7a2d3",
"status": "affected",
"version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
"versionType": "git"
},
{
"lessThan": "c7848b67ef10f581114b6a2f52b160fc20eb52c9",
"status": "affected",
"version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
"versionType": "git"
},
{
"lessThan": "6850a439f8d23d4979624f1d6880d3118d473a28",
"status": "affected",
"version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
"versionType": "git"
},
{
"lessThan": "2b7eb2c5dc72f0fc954ac4aa155f9e285e937f7c",
"status": "affected",
"version": "ad85094b293e40e7a2f831b0311a389d952ebd5e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/media/atomisp/pci/atomisp_ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "4.18",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.18",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: media: atomisp: Disallow all private IOCTLs\n\nDisallow all private IOCTLs. These aren\u0027t quite as safe as one could\nassume of IOCTL handlers; disable them for now. Instead of removing the\ncode, return in the beginning of the function if cmd is non-zero in order\nto keep static checkers happy."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached only via ioctl() on the local /dev/video* device node of the atomisp PCI ISP; there is no network or remote-peer path, and no physical interaction is required.\nAC:L - The attacker fully controls the ioctl arguments (embedded user pointers and width/height fields) and the device state (open, configure, stream, then issue the malicious ioctl), so the overflow can be triggered reliably with no conditions outside the attacker\u0027s control.\nPR:L - Private IOCTLs hit the vidioc_default path with flags=0 (no capability or priority check) and atomisp_open performs no capability check; an unprivileged local user holding the device-node ACL/video-group access (typical for the active desktop/camera session) can reach it without real root.\nUI:N - Exploitation is a self-contained sequence of ioctl calls by the attacker; no action by any other user is required.\nS:U - The corruption is confined to kernel memory within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossing.\nC:H - The handlers provide kernel-heap out-of-bounds reads and the heap-overflow primitive can be leveraged to disclose adjacent kernel memory, enabling extensive information disclosure.\nI:H - atomisp_cp_dvs_6axis_config copies user-controlled-sized data into a smaller stream-sized heap allocation, giving a controlled kernel heap out-of-bounds write that can be leveraged for arbitrary write and code execution.\nA:H - The heap overflow corrupts kernel allocations and adjacent structures, readily causing a kernel oops/panic and full denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:27.283Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/51b8dc5163d2ff2bf04019f8bf7e3bd0e75bb654"
},
{
"url": "https://git.kernel.org/stable/c/64e85679beafe082fc2e70a557ec356c7fd27548"
},
{
"url": "https://git.kernel.org/stable/c/8774f8cb661f57ae43cc3bc0509d16ef1f406e45"
},
{
"url": "https://git.kernel.org/stable/c/ceb1b5f910e58986ea544ff8c9c2f23ae9a52414"
},
{
"url": "https://git.kernel.org/stable/c/8c7a281a99224a5b9af99c4dcd98d68eea75926c"
},
{
"url": "https://git.kernel.org/stable/c/6f1ce75a75c65061e7a720c3d0ee5f8adab7a2d3"
},
{
"url": "https://git.kernel.org/stable/c/c7848b67ef10f581114b6a2f52b160fc20eb52c9"
},
{
"url": "https://git.kernel.org/stable/c/6850a439f8d23d4979624f1d6880d3118d473a28"
},
{
"url": "https://git.kernel.org/stable/c/2b7eb2c5dc72f0fc954ac4aa155f9e285e937f7c"
}
],
"title": "staging: media: atomisp: Disallow all private IOCTLs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46205",
"datePublished": "2026-05-28T09:40:23.117Z",
"dateReserved": "2026-05-13T15:03:33.105Z",
"dateUpdated": "2026-08-05T12:30:27.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45982 (GCVE-0-2026-45982)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-05-27 12:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()
Cover a missed execution path with a new check.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0acf24ad7e10f547809faefb8069f8f5482eb4d9 Version: 0acf24ad7e10f547809faefb8069f8f5482eb4d9 Version: 0acf24ad7e10f547809faefb8069f8f5482eb4d9 Version: 0acf24ad7e10f547809faefb8069f8f5482eb4d9 Version: 0acf24ad7e10f547809faefb8069f8f5482eb4d9 Version: 0acf24ad7e10f547809faefb8069f8f5482eb4d9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/acpica/evregion.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7d99cbe717c1b15a66559215df32312d8cf7e525",
"status": "affected",
"version": "0acf24ad7e10f547809faefb8069f8f5482eb4d9",
"versionType": "git"
},
{
"lessThan": "f2cf475d23b8486dfa414f7ac09f918ffd3c32a5",
"status": "affected",
"version": "0acf24ad7e10f547809faefb8069f8f5482eb4d9",
"versionType": "git"
},
{
"lessThan": "cce354524da4d10fd2c7eb835e2e4e8ab8c0ce97",
"status": "affected",
"version": "0acf24ad7e10f547809faefb8069f8f5482eb4d9",
"versionType": "git"
},
{
"lessThan": "b24595b86920911d2b04f862422b896a0620e9ad",
"status": "affected",
"version": "0acf24ad7e10f547809faefb8069f8f5482eb4d9",
"versionType": "git"
},
{
"lessThan": "56024dbe8c76cff22f53ba81a95d9efd4d0c9c44",
"status": "affected",
"version": "0acf24ad7e10f547809faefb8069f8f5482eb4d9",
"versionType": "git"
},
{
"lessThan": "f851e03bce968ff9b3faad1b616062e1244fd38d",
"status": "affected",
"version": "0acf24ad7e10f547809faefb8069f8f5482eb4d9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/acpi/acpica/evregion.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()\n\nCover a missed execution path with a new check."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:18:40.822Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7d99cbe717c1b15a66559215df32312d8cf7e525"
},
{
"url": "https://git.kernel.org/stable/c/f2cf475d23b8486dfa414f7ac09f918ffd3c32a5"
},
{
"url": "https://git.kernel.org/stable/c/cce354524da4d10fd2c7eb835e2e4e8ab8c0ce97"
},
{
"url": "https://git.kernel.org/stable/c/b24595b86920911d2b04f862422b896a0620e9ad"
},
{
"url": "https://git.kernel.org/stable/c/56024dbe8c76cff22f53ba81a95d9efd4d0c9c44"
},
{
"url": "https://git.kernel.org/stable/c/f851e03bce968ff9b3faad1b616062e1244fd38d"
}
],
"title": "ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45982",
"datePublished": "2026-05-27T12:18:40.822Z",
"dateReserved": "2026-05-13T15:03:33.090Z",
"dateUpdated": "2026-05-27T12:18:40.822Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43449 (GCVE-0-2026-43449)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-23 16:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
dev->online_queues is a count incremented in nvme_init_queue. Thus,
valid indices are 0 through dev->online_queues − 1.
This patch fixes the loop condition to ensure the index stays within the
valid range. Index 0 is excluded because it is the admin queue.
KASAN splat:
==================================================================
BUG: KASAN: slab-out-of-bounds in nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]
BUG: KASAN: slab-out-of-bounds in nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404
Read of size 2 at addr ffff88800592a574 by task kworker/u8:5/74
CPU: 0 UID: 0 PID: 74 Comm: kworker/u8:5 Not tainted 6.19.0-dirty #10 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
Workqueue: nvme-reset-wq nvme_reset_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xea/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xce/0x5d0 mm/kasan/report.c:482
kasan_report+0xdc/0x110 mm/kasan/report.c:595
__asan_report_load2_noabort+0x18/0x20 mm/kasan/report_generic.c:379
nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]
nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404
nvme_reset_work+0x36b/0x8c0 drivers/nvme/host/pci.c:3252
process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x65c/0xe60 kernel/workqueue.c:3421
kthread+0x41a/0x930 kernel/kthread.c:463
ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Allocated by task 34 on cpu 1 at 4.241550s:
kasan_save_stack+0x2c/0x60 mm/kasan/common.c:57
kasan_save_track+0x1c/0x70 mm/kasan/common.c:78
kasan_save_alloc_info+0x3c/0x50 mm/kasan/generic.c:570
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xb5/0xc0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5657 [inline]
__kmalloc_node_noprof+0x2bf/0x8d0 mm/slub.c:5663
kmalloc_array_node_noprof include/linux/slab.h:1075 [inline]
nvme_pci_alloc_dev drivers/nvme/host/pci.c:3479 [inline]
nvme_probe+0x2f1/0x1820 drivers/nvme/host/pci.c:3534
local_pci_probe+0xef/0x1c0 drivers/pci/pci-driver.c:324
pci_call_probe drivers/pci/pci-driver.c:392 [inline]
__pci_device_probe drivers/pci/pci-driver.c:417 [inline]
pci_device_probe+0x743/0x920 drivers/pci/pci-driver.c:451
call_driver_probe drivers/base/dd.c:583 [inline]
really_probe+0x29b/0xb70 drivers/base/dd.c:661
__driver_probe_device+0x3b0/0x4a0 drivers/base/dd.c:803
driver_probe_device+0x56/0x1f0 drivers/base/dd.c:833
__driver_attach_async_helper+0x155/0x340 drivers/base/dd.c:1159
async_run_entry_fn+0xa6/0x4b0 kernel/async.c:129
process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x65c/0xe60 kernel/workqueue.c:3421
kthread+0x41a/0x930 kernel/kthread.c:463
ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
The buggy address belongs to the object at ffff88800592a000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 244 bytes to the right of
allocated 1152-byte region [ffff88800592a000, ffff88800592a480)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5928
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfffffc0000040(head|node=0|zone=1|lastcpupid=0x1fffff)
page_type: f5(slab)
raw: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
head: 000fffffc0000040 ffff888001042000 00000
---truncated---
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf Version: 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf Version: 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf Version: 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf Version: 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf Version: 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf Version: 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf Version: 0f0d2c876c96d4908a9ef40959a44bec21bdd6cf Version: 930bb3092fe606baa23d57ae59b70b291d67a8af Version: fd1c1de8c4589fdd528733bfd01ed0c5f3f69204 Version: 4940816604e3ce7e05e8df297773ee86c0476d48 Version: 55a3b1ad694631cc2698b5500ac5865d7d0f064e Version: 4.14.210 ≤ Version: 4.19.161 ≤ Version: 5.4.81 ≤ Version: 5.9.12 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2b9d605c3f0d3262142f196249cd3bd58c857c71",
"status": "affected",
"version": "0f0d2c876c96d4908a9ef40959a44bec21bdd6cf",
"versionType": "git"
},
{
"lessThan": "86183d550559e45e07059bbdf17331fea469e38c",
"status": "affected",
"version": "0f0d2c876c96d4908a9ef40959a44bec21bdd6cf",
"versionType": "git"
},
{
"lessThan": "d7990c936e25f484b61a5adeeadc1d290a9fd16e",
"status": "affected",
"version": "0f0d2c876c96d4908a9ef40959a44bec21bdd6cf",
"versionType": "git"
},
{
"lessThan": "83e6edd6358326c9c2de31a54bb4a1ec50703f1f",
"status": "affected",
"version": "0f0d2c876c96d4908a9ef40959a44bec21bdd6cf",
"versionType": "git"
},
{
"lessThan": "50bad78f03a02d3c0f228edf9912b494d3e7acb9",
"status": "affected",
"version": "0f0d2c876c96d4908a9ef40959a44bec21bdd6cf",
"versionType": "git"
},
{
"lessThan": "328c551f0cc81ee776b186b86cc6e5253bb6fda7",
"status": "affected",
"version": "0f0d2c876c96d4908a9ef40959a44bec21bdd6cf",
"versionType": "git"
},
{
"lessThan": "78279d2d74c58a0ed64e43cf601a02649771182e",
"status": "affected",
"version": "0f0d2c876c96d4908a9ef40959a44bec21bdd6cf",
"versionType": "git"
},
{
"lessThan": "b4e78f1427c7d6859229ae9616df54e1fc05a516",
"status": "affected",
"version": "0f0d2c876c96d4908a9ef40959a44bec21bdd6cf",
"versionType": "git"
},
{
"status": "affected",
"version": "930bb3092fe606baa23d57ae59b70b291d67a8af",
"versionType": "git"
},
{
"status": "affected",
"version": "fd1c1de8c4589fdd528733bfd01ed0c5f3f69204",
"versionType": "git"
},
{
"status": "affected",
"version": "4940816604e3ce7e05e8df297773ee86c0476d48",
"versionType": "git"
},
{
"status": "affected",
"version": "55a3b1ad694631cc2698b5500ac5865d7d0f064e",
"versionType": "git"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.210",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.161",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.81",
"versionType": "semver"
},
{
"lessThan": "5.10",
"status": "affected",
"version": "5.9.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.210",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.161",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.81",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.9.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set\n\ndev-\u003eonline_queues is a count incremented in nvme_init_queue. Thus,\nvalid indices are 0 through dev-\u003eonline_queues \u2212 1.\n\nThis patch fixes the loop condition to ensure the index stays within the\nvalid range. Index 0 is excluded because it is the admin queue.\n\nKASAN splat:\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]\nBUG: KASAN: slab-out-of-bounds in nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404\nRead of size 2 at addr ffff88800592a574 by task kworker/u8:5/74\n\nCPU: 0 UID: 0 PID: 74 Comm: kworker/u8:5 Not tainted 6.19.0-dirty #10 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\nWorkqueue: nvme-reset-wq nvme_reset_work\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xea/0x150 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xce/0x5d0 mm/kasan/report.c:482\n kasan_report+0xdc/0x110 mm/kasan/report.c:595\n __asan_report_load2_noabort+0x18/0x20 mm/kasan/report_generic.c:379\n nvme_dbbuf_free drivers/nvme/host/pci.c:377 [inline]\n nvme_dbbuf_set+0x39c/0x400 drivers/nvme/host/pci.c:404\n nvme_reset_work+0x36b/0x8c0 drivers/nvme/host/pci.c:3252\n process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257\n process_scheduled_works kernel/workqueue.c:3340 [inline]\n worker_thread+0x65c/0xe60 kernel/workqueue.c:3421\n kthread+0x41a/0x930 kernel/kthread.c:463\n ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246\n \u003c/TASK\u003e\n\nAllocated by task 34 on cpu 1 at 4.241550s:\n kasan_save_stack+0x2c/0x60 mm/kasan/common.c:57\n kasan_save_track+0x1c/0x70 mm/kasan/common.c:78\n kasan_save_alloc_info+0x3c/0x50 mm/kasan/generic.c:570\n poison_kmalloc_redzone mm/kasan/common.c:398 [inline]\n __kasan_kmalloc+0xb5/0xc0 mm/kasan/common.c:415\n kasan_kmalloc include/linux/kasan.h:263 [inline]\n __do_kmalloc_node mm/slub.c:5657 [inline]\n __kmalloc_node_noprof+0x2bf/0x8d0 mm/slub.c:5663\n kmalloc_array_node_noprof include/linux/slab.h:1075 [inline]\n nvme_pci_alloc_dev drivers/nvme/host/pci.c:3479 [inline]\n nvme_probe+0x2f1/0x1820 drivers/nvme/host/pci.c:3534\n local_pci_probe+0xef/0x1c0 drivers/pci/pci-driver.c:324\n pci_call_probe drivers/pci/pci-driver.c:392 [inline]\n __pci_device_probe drivers/pci/pci-driver.c:417 [inline]\n pci_device_probe+0x743/0x920 drivers/pci/pci-driver.c:451\n call_driver_probe drivers/base/dd.c:583 [inline]\n really_probe+0x29b/0xb70 drivers/base/dd.c:661\n __driver_probe_device+0x3b0/0x4a0 drivers/base/dd.c:803\n driver_probe_device+0x56/0x1f0 drivers/base/dd.c:833\n __driver_attach_async_helper+0x155/0x340 drivers/base/dd.c:1159\n async_run_entry_fn+0xa6/0x4b0 kernel/async.c:129\n process_one_work+0x956/0x1aa0 kernel/workqueue.c:3257\n process_scheduled_works kernel/workqueue.c:3340 [inline]\n worker_thread+0x65c/0xe60 kernel/workqueue.c:3421\n kthread+0x41a/0x930 kernel/kthread.c:463\n ret_from_fork+0x6f8/0x8c0 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246\n\nThe buggy address belongs to the object at ffff88800592a000\n which belongs to the cache kmalloc-2k of size 2048\nThe buggy address is located 244 bytes to the right of\n allocated 1152-byte region [ffff88800592a000, ffff88800592a480)\n\nThe buggy address belongs to the physical page:\npage: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5928\nhead: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\nanon flags: 0xfffffc0000040(head|node=0|zone=1|lastcpupid=0x1fffff)\npage_type: f5(slab)\nraw: 000fffffc0000040 ffff888001042000 0000000000000000 dead000000000001\nraw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000\nhead: 000fffffc0000040 ffff888001042000 00000\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:07:01.436Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2b9d605c3f0d3262142f196249cd3bd58c857c71"
},
{
"url": "https://git.kernel.org/stable/c/86183d550559e45e07059bbdf17331fea469e38c"
},
{
"url": "https://git.kernel.org/stable/c/d7990c936e25f484b61a5adeeadc1d290a9fd16e"
},
{
"url": "https://git.kernel.org/stable/c/83e6edd6358326c9c2de31a54bb4a1ec50703f1f"
},
{
"url": "https://git.kernel.org/stable/c/50bad78f03a02d3c0f228edf9912b494d3e7acb9"
},
{
"url": "https://git.kernel.org/stable/c/328c551f0cc81ee776b186b86cc6e5253bb6fda7"
},
{
"url": "https://git.kernel.org/stable/c/78279d2d74c58a0ed64e43cf601a02649771182e"
},
{
"url": "https://git.kernel.org/stable/c/b4e78f1427c7d6859229ae9616df54e1fc05a516"
}
],
"title": "nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43449",
"datePublished": "2026-05-08T14:22:15.276Z",
"dateReserved": "2026-05-01T14:12:56.010Z",
"dateUpdated": "2026-05-23T16:07:01.436Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45877 (GCVE-0-2026-45877)
Vulnerability from cvelistv5
Published
2026-05-27 12:16
Modified
2026-05-27 12:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients
During a warm reset flow, the cl->device pointer may be NULL if the
reset occurs while clients are still being enumerated. Accessing
cl->device->reference_count without a NULL check leads to a kernel panic.
This issue was identified during multi-unit warm reboot stress clycles.
Add a defensive NULL check for cl->device to ensure stability under
such intensive testing conditions.
KASAN: null-ptr-deref in range [0000000000000000-0000000000000007]
Workqueue: ish_fw_update_wq fw_reset_work_fn
Call Trace:
ishtp_bus_remove_all_clients+0xbe/0x130 [intel_ishtp]
ishtp_reset_handler+0x85/0x1a0 [intel_ishtp]
fw_reset_work_fn+0x8a/0xc0 [intel_ish_ipc]
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/intel-ish-hid/ishtp/bus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0b605e8ce60698c27a26f512968a597fd620d2e8",
"status": "affected",
"version": "3703f53b99e4a7c373ce3568dd3f91f175ebb626",
"versionType": "git"
},
{
"lessThan": "feb4bcfd405282de60aba321f13a1272b30c5af4",
"status": "affected",
"version": "3703f53b99e4a7c373ce3568dd3f91f175ebb626",
"versionType": "git"
},
{
"lessThan": "272dac57caa981718e7188c80c703e7bb1998054",
"status": "affected",
"version": "3703f53b99e4a7c373ce3568dd3f91f175ebb626",
"versionType": "git"
},
{
"lessThan": "56f7db581ee73af53cd512e00a6261a025bf1d58",
"status": "affected",
"version": "3703f53b99e4a7c373ce3568dd3f91f175ebb626",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/intel-ish-hid/ishtp/bus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients\n\nDuring a warm reset flow, the cl-\u003edevice pointer may be NULL if the\nreset occurs while clients are still being enumerated. Accessing\ncl-\u003edevice-\u003ereference_count without a NULL check leads to a kernel panic.\n\nThis issue was identified during multi-unit warm reboot stress clycles.\nAdd a defensive NULL check for cl-\u003edevice to ensure stability under\nsuch intensive testing conditions.\n\nKASAN: null-ptr-deref in range [0000000000000000-0000000000000007]\nWorkqueue: ish_fw_update_wq fw_reset_work_fn\n\nCall Trace:\n ishtp_bus_remove_all_clients+0xbe/0x130 [intel_ishtp]\n ishtp_reset_handler+0x85/0x1a0 [intel_ishtp]\n fw_reset_work_fn+0x8a/0xc0 [intel_ish_ipc]"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:16:46.910Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0b605e8ce60698c27a26f512968a597fd620d2e8"
},
{
"url": "https://git.kernel.org/stable/c/feb4bcfd405282de60aba321f13a1272b30c5af4"
},
{
"url": "https://git.kernel.org/stable/c/272dac57caa981718e7188c80c703e7bb1998054"
},
{
"url": "https://git.kernel.org/stable/c/56f7db581ee73af53cd512e00a6261a025bf1d58"
}
],
"title": "HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45877",
"datePublished": "2026-05-27T12:16:46.910Z",
"dateReserved": "2026-05-13T15:03:33.081Z",
"dateUpdated": "2026-05-27T12:16:46.910Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31657 (GCVE-0-2026-31657)
Vulnerability from cvelistv5
Published
2026-04-24 14:45
Modified
2026-08-05 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: hold claim backbone gateways by reference
batadv_bla_add_claim() can replace claim->backbone_gw and drop the old
gateway's last reference while readers still follow the pointer.
The netlink claim dump path dereferences claim->backbone_gw->orig and
takes claim->backbone_gw->crc_lock without pinning the underlying
backbone gateway. batadv_bla_check_claim() still has the same naked
pointer access pattern.
Reuse batadv_bla_claim_get_backbone_gw() in both readers so they operate
on a stable gateway reference until the read-side work is complete.
This keeps the dump and claim-check paths aligned with the lifetime
rules introduced for the other BLA claim readers.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/bridge_loop_avoidance.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5202f071b367ffbc8e279fc7a00db14f5e587f52",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "69d1ce9c72eca91203ffdb8d08bacd511100aec6",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "f4858832ddef2f39f21e30b7226bbcd3c4b2bc96",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "2f55b58b5a0bbed192d60c444a45a49cdf1b545f",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "7962b522222628596ca9ecc8722efc95367aadbd",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "4dee4c0688443aaf5bbec74aa203c851d1d53c35",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "1f2dc36c297d27733f1b380ea644cf15a361bd7b",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "82d8701b2c930d0e96b0dbc9115a218d791cb0d2",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/bridge_loop_avoidance.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.169",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.135",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.169",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.135",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.82",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: hold claim backbone gateways by reference\n\nbatadv_bla_add_claim() can replace claim-\u003ebackbone_gw and drop the old\ngateway\u0027s last reference while readers still follow the pointer.\n\nThe netlink claim dump path dereferences claim-\u003ebackbone_gw-\u003eorig and\ntakes claim-\u003ebackbone_gw-\u003ecrc_lock without pinning the underlying\nbackbone gateway. batadv_bla_check_claim() still has the same naked\npointer access pattern.\n\nReuse batadv_bla_claim_get_backbone_gw() in both readers so they operate\non a stable gateway reference until the read-side work is complete.\nThis keeps the dump and claim-check paths aligned with the lifetime\nrules introduced for the other BLA claim readers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable BLA claim state is reachable through received batman-adv mesh packets carrying claim and ARP/DAT traffic, not through a local-only syscall path. In a multi-hop batman-adv deployment, a remote mesh peer can drive the packet paths that update and read the claim.\nAC:L - Although this is a race, the attacker can control both sides by flooding claim ownership changes and packets that trigger the claim readers. No special memory layout or victim timing condition beyond attacker-induced concurrency is required.\nPR:N - The packet receive path has no authentication or privilege check for a peer already able to send batman-adv mesh traffic. The netlink dump path has a CAP_NET_ADMIN-in-netns gate, but the packet-triggered path does not require local privileges.\nUI:N - No user action is required once the affected batman-adv mesh interface and default BLA/DAT features are active. The attacker only needs to send crafted/concurrent network traffic.\nS:U - The impact is within the Linux kernel on the vulnerable host. It does not cross a separate hypervisor, guest/host, or hardware-enforced security authority boundary.\nC:H - This is a use-after-free of a kernel heap `batadv_bla_backbone_gw` object, with readers accessing fields after the object can be freed and reused. Such UAF conditions are defensibly treated as enabling high confidentiality impact.\nI:H - The stale object includes a spinlock and mutable state, so dereferencing and locking freed/reused memory can corrupt kernel heap state. A kernel UAF is also potentially exploitable for write/control-flow primitives.\nA:H - The stale pointer can lead to invalid dereferences or spinlock operations on freed memory, causing kernel oops, panic, or hang. Repeated network traffic can retrigger the condition."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:10.743Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5202f071b367ffbc8e279fc7a00db14f5e587f52"
},
{
"url": "https://git.kernel.org/stable/c/69d1ce9c72eca91203ffdb8d08bacd511100aec6"
},
{
"url": "https://git.kernel.org/stable/c/f4858832ddef2f39f21e30b7226bbcd3c4b2bc96"
},
{
"url": "https://git.kernel.org/stable/c/2f55b58b5a0bbed192d60c444a45a49cdf1b545f"
},
{
"url": "https://git.kernel.org/stable/c/7962b522222628596ca9ecc8722efc95367aadbd"
},
{
"url": "https://git.kernel.org/stable/c/4dee4c0688443aaf5bbec74aa203c851d1d53c35"
},
{
"url": "https://git.kernel.org/stable/c/1f2dc36c297d27733f1b380ea644cf15a361bd7b"
},
{
"url": "https://git.kernel.org/stable/c/82d8701b2c930d0e96b0dbc9115a218d791cb0d2"
}
],
"title": "batman-adv: hold claim backbone gateways by reference",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31657",
"datePublished": "2026-04-24T14:45:08.867Z",
"dateReserved": "2026-03-09T15:48:24.129Z",
"dateUpdated": "2026-08-05T12:24:10.743Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53329 (GCVE-0-2026-53329)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-08-05 12:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Use krealloc_array() in dal_vector_reserve()
[Why & How]
dal_vector_reserve() computes the allocation size as
"capacity * vector->struct_size" using uint32_t arithmetic, which can
silently wrap to a small value on overflow. This would cause krealloc to
return a smaller buffer than expected, leading to heap overflows on
subsequent vector appends.
Replace krealloc() with krealloc_array() which performs an internal
overflow check and returns NULL on wrap, preventing the issue.
(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2004f45ef83f07f43f5da6ede780b08068c7583d Version: 2004f45ef83f07f43f5da6ede780b08068c7583d Version: 2004f45ef83f07f43f5da6ede780b08068c7583d Version: 2004f45ef83f07f43f5da6ede780b08068c7583d Version: 2004f45ef83f07f43f5da6ede780b08068c7583d Version: 2004f45ef83f07f43f5da6ede780b08068c7583d Version: 2004f45ef83f07f43f5da6ede780b08068c7583d Version: 2004f45ef83f07f43f5da6ede780b08068c7583d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/basics/vector.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9540b0a4d13e4ede64ae1197d66a176d2149daa9",
"status": "affected",
"version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
"versionType": "git"
},
{
"lessThan": "31180638a33acad12c863132704a76536fb66211",
"status": "affected",
"version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
"versionType": "git"
},
{
"lessThan": "b15825deac1acff72638bbc8f05b89ceef8dfb13",
"status": "affected",
"version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
"versionType": "git"
},
{
"lessThan": "201151e120f0062bcda21cad5d007b82725ad23b",
"status": "affected",
"version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
"versionType": "git"
},
{
"lessThan": "a914aa802669e073f014dae2e5708633b5cecd34",
"status": "affected",
"version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
"versionType": "git"
},
{
"lessThan": "e09689286385a66311ac6922af95339d7a3cef8d",
"status": "affected",
"version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
"versionType": "git"
},
{
"lessThan": "de988c7a31f0774f07894cfe4802996f318e2870",
"status": "affected",
"version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
"versionType": "git"
},
{
"lessThan": "da48bc4461b8a5ebfb9264c9b191a701d8e99009",
"status": "affected",
"version": "2004f45ef83f07f43f5da6ede780b08068c7583d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/basics/vector.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Use krealloc_array() in dal_vector_reserve()\n\n[Why \u0026 How]\ndal_vector_reserve() computes the allocation size as\n\"capacity * vector-\u003estruct_size\" using uint32_t arithmetic, which can\nsilently wrap to a small value on overflow. This would cause krealloc to\nreturn a smaller buffer than expected, leading to heap overflows on\nsubsequent vector appends.\n\nReplace krealloc() with krealloc_array() which performs an internal\noverflow check and returns NULL on wrap, preventing the issue.\n\n(cherry picked from commit 37668568641ccc4cc1dbca4923d0a16609dd5707)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The reachable kernel path is AMDGPU DRM display handling via local DRM connector probing or modeset operations; it is not network or namespace reachable. Physical hotplug can also reach related detection paths, but local DRM access is the higher-severity reasonable vector.\nAC:H - The overflow is deterministic once vector capacity crosses the uint32 multiplication limit, but the reachable DDC callers I found pass fixed tiny payload lengths and an attacker would need an unusual path causing enormous vector growth. That prerequisite is outside normal attacker control.\nPR:L - Triggering the relevant DRM display paths requires local access to the KMS device or DRM master-style display control, not real root in the init namespace. No user-namespace route or network-facing unauthenticated path reaches this code.\nUI:N - A local attacker who has the needed DRM access can trigger connector probing or modeset paths directly. No separate victim action is required.\nS:U - The corruption occurs inside the host kernel display driver and affects the same kernel security authority. There is no VM escape, IOMMU boundary bypass, or cross-scope component involved.\nC:H - The vulnerable allocation can leave the vector with a logical capacity larger than its actual heap buffer, and subsequent appends can corrupt adjacent kernel heap memory. Kernel heap corruption is reasonably leverageable for information disclosure.\nI:H - Subsequent vector appends perform out-of-bounds writes of controlled `struct i2c_payload` contents into adjacent kernel heap memory. That is kernel memory corruption and can plausibly support control-flow or data-integrity compromise.\nA:H - Even without full exploitation, the undersized allocation followed by appends can corrupt heap metadata or neighboring objects. That can cause kernel oops, panic, or display-driver crashes."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:35:01.324Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9540b0a4d13e4ede64ae1197d66a176d2149daa9"
},
{
"url": "https://git.kernel.org/stable/c/31180638a33acad12c863132704a76536fb66211"
},
{
"url": "https://git.kernel.org/stable/c/b15825deac1acff72638bbc8f05b89ceef8dfb13"
},
{
"url": "https://git.kernel.org/stable/c/201151e120f0062bcda21cad5d007b82725ad23b"
},
{
"url": "https://git.kernel.org/stable/c/a914aa802669e073f014dae2e5708633b5cecd34"
},
{
"url": "https://git.kernel.org/stable/c/e09689286385a66311ac6922af95339d7a3cef8d"
},
{
"url": "https://git.kernel.org/stable/c/de988c7a31f0774f07894cfe4802996f318e2870"
},
{
"url": "https://git.kernel.org/stable/c/da48bc4461b8a5ebfb9264c9b191a701d8e99009"
}
],
"title": "drm/amd/display: Use krealloc_array() in dal_vector_reserve()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53329",
"datePublished": "2026-07-01T13:32:14.598Z",
"dateReserved": "2026-06-09T07:44:35.398Z",
"dateUpdated": "2026-08-05T12:35:01.324Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31661 (GCVE-0-2026-31661)
Vulnerability from cvelistv5
Published
2026-04-24 14:45
Modified
2026-05-11 22:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmsmac: Fix dma_free_coherent() size
dma_alloc_consistent() may change the size to align it. The new size is
saved in alloced.
Change the free size to match the allocation size.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5b435de0d786869c95d1962121af0d7df2542009 Version: 5b435de0d786869c95d1962121af0d7df2542009 Version: 5b435de0d786869c95d1962121af0d7df2542009 Version: 5b435de0d786869c95d1962121af0d7df2542009 Version: 5b435de0d786869c95d1962121af0d7df2542009 Version: 5b435de0d786869c95d1962121af0d7df2542009 Version: 5b435de0d786869c95d1962121af0d7df2542009 Version: 5b435de0d786869c95d1962121af0d7df2542009 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f449676bab54fea1440775c8c915dadb323fe015",
"status": "affected",
"version": "5b435de0d786869c95d1962121af0d7df2542009",
"versionType": "git"
},
{
"lessThan": "3c204a0fd079fa7a867151a47d830ad1c2db5177",
"status": "affected",
"version": "5b435de0d786869c95d1962121af0d7df2542009",
"versionType": "git"
},
{
"lessThan": "0f87777b74bcce29b966ec42d9aa8f9edd9b1667",
"status": "affected",
"version": "5b435de0d786869c95d1962121af0d7df2542009",
"versionType": "git"
},
{
"lessThan": "4bf41c2731a0549e21f66180ff780b1e036639ab",
"status": "affected",
"version": "5b435de0d786869c95d1962121af0d7df2542009",
"versionType": "git"
},
{
"lessThan": "77263f053963dea9f3962505ac0c768853d7dc59",
"status": "affected",
"version": "5b435de0d786869c95d1962121af0d7df2542009",
"versionType": "git"
},
{
"lessThan": "b27fa888e4a426a3bcf6f6ab24701d888d9bf5aa",
"status": "affected",
"version": "5b435de0d786869c95d1962121af0d7df2542009",
"versionType": "git"
},
{
"lessThan": "01f1330d3d1bee07e0c42d40cc48b7be8b6dad84",
"status": "affected",
"version": "5b435de0d786869c95d1962121af0d7df2542009",
"versionType": "git"
},
{
"lessThan": "12cd7632757a54ce586e36040210b1a738a0fc53",
"status": "affected",
"version": "5b435de0d786869c95d1962121af0d7df2542009",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmsmac/dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.169",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.135",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.169",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.135",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.82",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmsmac: Fix dma_free_coherent() size\n\ndma_alloc_consistent() may change the size to align it. The new size is\nsaved in alloced.\n\nChange the free size to match the allocation size."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:13:08.559Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f449676bab54fea1440775c8c915dadb323fe015"
},
{
"url": "https://git.kernel.org/stable/c/3c204a0fd079fa7a867151a47d830ad1c2db5177"
},
{
"url": "https://git.kernel.org/stable/c/0f87777b74bcce29b966ec42d9aa8f9edd9b1667"
},
{
"url": "https://git.kernel.org/stable/c/4bf41c2731a0549e21f66180ff780b1e036639ab"
},
{
"url": "https://git.kernel.org/stable/c/77263f053963dea9f3962505ac0c768853d7dc59"
},
{
"url": "https://git.kernel.org/stable/c/b27fa888e4a426a3bcf6f6ab24701d888d9bf5aa"
},
{
"url": "https://git.kernel.org/stable/c/01f1330d3d1bee07e0c42d40cc48b7be8b6dad84"
},
{
"url": "https://git.kernel.org/stable/c/12cd7632757a54ce586e36040210b1a738a0fc53"
}
],
"title": "wifi: brcmsmac: Fix dma_free_coherent() size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31661",
"datePublished": "2026-04-24T14:45:11.917Z",
"dateReserved": "2026-03-09T15:48:24.129Z",
"dateUpdated": "2026-05-11T22:13:08.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46016 (GCVE-0-2026-46016)
Vulnerability from cvelistv5
Published
2026-05-27 12:56
Modified
2026-06-14 17:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
remoteproc: xlnx: Only access buffer information if IPI is buffered
In the receive callback check if message is NULL to prevent
possibility of crash by NULL pointer dereferencing.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/remoteproc/xlnx_r5_remoteproc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5d1451cb2cf6f3d9884d76035a1460aa9bb4b053",
"status": "affected",
"version": "5dfb28c257b7c515624ba6b163410ceada451bf2",
"versionType": "git"
},
{
"lessThan": "7ddbf21116770b7011f2bb0a6056b7604b24c497",
"status": "affected",
"version": "5dfb28c257b7c515624ba6b163410ceada451bf2",
"versionType": "git"
},
{
"lessThan": "06d0bed2552fd0dae27d374d4492a2b672e24eed",
"status": "affected",
"version": "5dfb28c257b7c515624ba6b163410ceada451bf2",
"versionType": "git"
},
{
"lessThan": "8242579859a78c801bb626e9aa4823aca93e28e7",
"status": "affected",
"version": "5dfb28c257b7c515624ba6b163410ceada451bf2",
"versionType": "git"
},
{
"lessThan": "38dd6ccfdfbbe865569a52fe1ba9fa1478f672e6",
"status": "affected",
"version": "5dfb28c257b7c515624ba6b163410ceada451bf2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/remoteproc/xlnx_r5_remoteproc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: xlnx: Only access buffer information if IPI is buffered\n\nIn the receive callback check if message is NULL to prevent\npossibility of crash by NULL pointer dereferencing."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:48:10.556Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5d1451cb2cf6f3d9884d76035a1460aa9bb4b053"
},
{
"url": "https://git.kernel.org/stable/c/7ddbf21116770b7011f2bb0a6056b7604b24c497"
},
{
"url": "https://git.kernel.org/stable/c/06d0bed2552fd0dae27d374d4492a2b672e24eed"
},
{
"url": "https://git.kernel.org/stable/c/8242579859a78c801bb626e9aa4823aca93e28e7"
},
{
"url": "https://git.kernel.org/stable/c/38dd6ccfdfbbe865569a52fe1ba9fa1478f672e6"
}
],
"title": "remoteproc: xlnx: Only access buffer information if IPI is buffered",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46016",
"datePublished": "2026-05-27T12:56:17.970Z",
"dateReserved": "2026-05-13T15:03:33.092Z",
"dateUpdated": "2026-06-14T17:48:10.556Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53112 (GCVE-0-2026-53112)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet
The irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and
scheduled when RTL_IMR_BCNINT interrupt is triggered by hardware.
But it is never killed in rtl_pci_deinit(). When the rtlwifi card
probe fails or is being detached, the ieee80211_hw is deallocated.
However, irq_prepare_bcn_tasklet may still be running or pending,
leading to use-after-free when the freed ieee80211_hw is accessed
in _rtl_pci_prepare_bcn_tasklet().
Similar to irq_tasklet, add tasklet_kill() in rtl_pci_deinit() to
ensure that irq_prepare_bcn_tasklet is properly terminated before
the ieee80211_hw is released.
The issue was identified through static analysis.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0c8173385e549f95cd80c3fff5aab87b4f881d8d Version: 0c8173385e549f95cd80c3fff5aab87b4f881d8d Version: 0c8173385e549f95cd80c3fff5aab87b4f881d8d Version: 0c8173385e549f95cd80c3fff5aab87b4f881d8d Version: 0c8173385e549f95cd80c3fff5aab87b4f881d8d Version: 0c8173385e549f95cd80c3fff5aab87b4f881d8d Version: 0c8173385e549f95cd80c3fff5aab87b4f881d8d Version: 0c8173385e549f95cd80c3fff5aab87b4f881d8d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtlwifi/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae10d4a1ab6bcaa1336abb171908a9a365761d3e",
"status": "affected",
"version": "0c8173385e549f95cd80c3fff5aab87b4f881d8d",
"versionType": "git"
},
{
"lessThan": "fac1079e0fdec6df6d7562c21941587236dc3def",
"status": "affected",
"version": "0c8173385e549f95cd80c3fff5aab87b4f881d8d",
"versionType": "git"
},
{
"lessThan": "e40873820c9d245ce482faa7ad514ebdb3b8d23d",
"status": "affected",
"version": "0c8173385e549f95cd80c3fff5aab87b4f881d8d",
"versionType": "git"
},
{
"lessThan": "008c456b76e9070979bc0e763897a5d3b0fdd4dc",
"status": "affected",
"version": "0c8173385e549f95cd80c3fff5aab87b4f881d8d",
"versionType": "git"
},
{
"lessThan": "7731b67bd59d1284d150cbe40a47e95a10613234",
"status": "affected",
"version": "0c8173385e549f95cd80c3fff5aab87b4f881d8d",
"versionType": "git"
},
{
"lessThan": "aa10a452e34810987fb9f4a047995b30003fb53f",
"status": "affected",
"version": "0c8173385e549f95cd80c3fff5aab87b4f881d8d",
"versionType": "git"
},
{
"lessThan": "3c0e8a3179e6325a7dc6ce221aef0e03d854ab4b",
"status": "affected",
"version": "0c8173385e549f95cd80c3fff5aab87b4f881d8d",
"versionType": "git"
},
{
"lessThan": "039cd522dc70151da13329a5e3ae19b1736f468a",
"status": "affected",
"version": "0c8173385e549f95cd80c3fff5aab87b4f881d8d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtlwifi/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet\n\nThe irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and\nscheduled when RTL_IMR_BCNINT interrupt is triggered by hardware.\nBut it is never killed in rtl_pci_deinit(). When the rtlwifi card\nprobe fails or is being detached, the ieee80211_hw is deallocated.\nHowever, irq_prepare_bcn_tasklet may still be running or pending,\nleading to use-after-free when the freed ieee80211_hw is accessed\nin _rtl_pci_prepare_bcn_tasklet().\n\nSimilar to irq_tasklet, add tasklet_kill() in rtl_pci_deinit() to\nensure that irq_prepare_bcn_tasklet is properly terminated before\nthe ieee80211_hw is released.\n\nThe issue was identified through static analysis."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:45.359Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae10d4a1ab6bcaa1336abb171908a9a365761d3e"
},
{
"url": "https://git.kernel.org/stable/c/fac1079e0fdec6df6d7562c21941587236dc3def"
},
{
"url": "https://git.kernel.org/stable/c/e40873820c9d245ce482faa7ad514ebdb3b8d23d"
},
{
"url": "https://git.kernel.org/stable/c/008c456b76e9070979bc0e763897a5d3b0fdd4dc"
},
{
"url": "https://git.kernel.org/stable/c/7731b67bd59d1284d150cbe40a47e95a10613234"
},
{
"url": "https://git.kernel.org/stable/c/aa10a452e34810987fb9f4a047995b30003fb53f"
},
{
"url": "https://git.kernel.org/stable/c/3c0e8a3179e6325a7dc6ce221aef0e03d854ab4b"
},
{
"url": "https://git.kernel.org/stable/c/039cd522dc70151da13329a5e3ae19b1736f468a"
}
],
"title": "wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53112",
"datePublished": "2026-06-24T16:30:45.359Z",
"dateReserved": "2026-06-09T07:44:35.385Z",
"dateUpdated": "2026-06-24T16:30:45.359Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53194 (GCVE-0-2026-53194)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: kl5kusb105: fix bulk-out buffer overflow
klsi_105_prepare_write_buffer() is called by the generic write path
with the bulk-out buffer and its size (bulk_out_size, 64 bytes). It
stores a two-byte length header at the start of the buffer and copies
the payload from the write fifo starting at buf + KLSI_HDR_LEN, but
passes the full buffer size as the number of bytes to copy:
count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN,
size, &port->lock);
When the fifo holds at least size bytes, size bytes are copied starting
two bytes into the size-byte buffer, writing KLSI_HDR_LEN bytes past its
end. Copy at most size - KLSI_HDR_LEN bytes instead, leaving room for
the header as safe_serial already does.
Writing bulk_out_size or more bytes to the tty triggers a slab
out-of-bounds write, observed with KASAN by emulating the device with
dummy_hcd and raw-gadget:
BUG: KASAN: slab-out-of-bounds in kfifo_copy_out+0x83/0xc0
Write of size 64 at addr ffff888112c62202 by task python3
kfifo_copy_out
klsi_105_prepare_write_buffer [kl5kusb105]
usb_serial_generic_write_start [usbserial]
Allocated by task 139:
usb_serial_probe [usbserial]
The buggy address is located 2 bytes inside of allocated 64-byte region
The out-of-bounds write no longer occurs with this change applied.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 Version: 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 Version: 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 Version: 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 Version: 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 Version: 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 Version: 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 Version: 60b3013cdaf3fa8a17243ca46b19db3cbe08d943 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s `kl5kusb105` USB serial driver. This buffer overflow vulnerability allows a local attacker to write data beyond the intended memory boundary (if attacker controls USB device or driver, because triggered from the internals of the device). By sending a specially crafted input to the USB serial port, an attacker can trigger an out-of-bounds write, which may lead to memory corruption. The primary consequence of this flaw is a denial of service (DoS), potentially causing system instability or crashes."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:44:36.635Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53194"
},
{
"name": "RHBZ#2492703",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492703"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53194.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: USB: serial: kl5kusb105: fix bulk-out buffer overflow",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, prevent module kl5kusb105 from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/kl5kusb105.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "60af1fd82983c26604102e63a3fcc822c186cceb",
"status": "affected",
"version": "60b3013cdaf3fa8a17243ca46b19db3cbe08d943",
"versionType": "git"
},
{
"lessThan": "0a57320f71941d4e0b1307453c9a1f0939afe666",
"status": "affected",
"version": "60b3013cdaf3fa8a17243ca46b19db3cbe08d943",
"versionType": "git"
},
{
"lessThan": "14147b7963685957839c76ba8094924e22777d79",
"status": "affected",
"version": "60b3013cdaf3fa8a17243ca46b19db3cbe08d943",
"versionType": "git"
},
{
"lessThan": "a1288cd700f721c1a119c4f1e8efa234e59caada",
"status": "affected",
"version": "60b3013cdaf3fa8a17243ca46b19db3cbe08d943",
"versionType": "git"
},
{
"lessThan": "70d86e355c564b5510fde61361df014f5476c83e",
"status": "affected",
"version": "60b3013cdaf3fa8a17243ca46b19db3cbe08d943",
"versionType": "git"
},
{
"lessThan": "372f33ebed747d91870f57c0a2e62884a870bffa",
"status": "affected",
"version": "60b3013cdaf3fa8a17243ca46b19db3cbe08d943",
"versionType": "git"
},
{
"lessThan": "bde742b076cbe26ecc89c8c68c76ae076a524d02",
"status": "affected",
"version": "60b3013cdaf3fa8a17243ca46b19db3cbe08d943",
"versionType": "git"
},
{
"lessThan": "96d47e40bf9db4a9efd5c8fb53287a508d165f14",
"status": "affected",
"version": "60b3013cdaf3fa8a17243ca46b19db3cbe08d943",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/kl5kusb105.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.35"
},
{
"lessThan": "2.6.35",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: kl5kusb105: fix bulk-out buffer overflow\n\nklsi_105_prepare_write_buffer() is called by the generic write path\nwith the bulk-out buffer and its size (bulk_out_size, 64 bytes). It\nstores a two-byte length header at the start of the buffer and copies\nthe payload from the write fifo starting at buf + KLSI_HDR_LEN, but\npasses the full buffer size as the number of bytes to copy:\n\n count = kfifo_out_locked(\u0026port-\u003ewrite_fifo, buf + KLSI_HDR_LEN,\n size, \u0026port-\u003elock);\n\nWhen the fifo holds at least size bytes, size bytes are copied starting\ntwo bytes into the size-byte buffer, writing KLSI_HDR_LEN bytes past its\nend. Copy at most size - KLSI_HDR_LEN bytes instead, leaving room for\nthe header as safe_serial already does.\n\nWriting bulk_out_size or more bytes to the tty triggers a slab\nout-of-bounds write, observed with KASAN by emulating the device with\ndummy_hcd and raw-gadget:\n\n BUG: KASAN: slab-out-of-bounds in kfifo_copy_out+0x83/0xc0\n Write of size 64 at addr ffff888112c62202 by task python3\n kfifo_copy_out\n klsi_105_prepare_write_buffer [kl5kusb105]\n usb_serial_generic_write_start [usbserial]\n Allocated by task 139:\n usb_serial_probe [usbserial]\n The buggy address is located 2 bytes inside of allocated 64-byte region\n\nThe out-of-bounds write no longer occurs with this change applied."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Although this is USB serial code, the vulnerable copy is reached by a local write to the registered /dev/ttyUSB device once a matching adapter is present.\nAC:L - Writing bulk_out_size or more bytes deterministically fills the FIFO and triggers the out-of-bounds copy; no race or attacker-uncontrolled timing is required.\nPR:L - There is no capability or authentication check in the tty/USB-serial write path, but the attacker needs local access to open and write the tty device.\nUI:N - The attacker can trigger the bug directly by writing to the tty device; no separate victim action is required.\nS:U - The corruption occurs within the host kernel and does not cross a VM, IOMMU, or similar security authority boundary.\nC:H - The bug is kernel heap memory corruption, and the overlong bulk-out URB may also expose adjacent heap bytes to the USB device.\nI:H - The attacker controls the data copied past the 64-byte bulk-out buffer, making this an out-of-bounds kernel heap write.\nA:H - The issue was observed as a KASAN slab out-of-bounds write and can reasonably cause kernel memory corruption, oops, or panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:00.760Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/60af1fd82983c26604102e63a3fcc822c186cceb"
},
{
"url": "https://git.kernel.org/stable/c/0a57320f71941d4e0b1307453c9a1f0939afe666"
},
{
"url": "https://git.kernel.org/stable/c/14147b7963685957839c76ba8094924e22777d79"
},
{
"url": "https://git.kernel.org/stable/c/a1288cd700f721c1a119c4f1e8efa234e59caada"
},
{
"url": "https://git.kernel.org/stable/c/70d86e355c564b5510fde61361df014f5476c83e"
},
{
"url": "https://git.kernel.org/stable/c/372f33ebed747d91870f57c0a2e62884a870bffa"
},
{
"url": "https://git.kernel.org/stable/c/bde742b076cbe26ecc89c8c68c76ae076a524d02"
},
{
"url": "https://git.kernel.org/stable/c/96d47e40bf9db4a9efd5c8fb53287a508d165f14"
}
],
"title": "USB: serial: kl5kusb105: fix bulk-out buffer overflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53194",
"datePublished": "2026-06-25T08:39:05.017Z",
"dateReserved": "2026-06-09T07:44:35.390Z",
"dateUpdated": "2026-08-05T12:34:00.760Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43287 (GCVE-0-2026-43287)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-05-11 22:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm: Account property blob allocations to memcg
DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized
property blobs backed by kernel memory.
Currently, the blob data allocation is not accounted to the allocating
process's memory cgroup, allowing unprivileged users to trigger unbounded
kernel memory consumption and potentially cause system-wide OOM.
Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory
is properly charged to the caller's memcg. This ensures existing cgroup
memory limits apply and prevents uncontrolled kernel memory growth without
introducing additional policy or per-file limits.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e2f5d2ea479b9b2619965d43db70939589afe43a Version: e2f5d2ea479b9b2619965d43db70939589afe43a Version: e2f5d2ea479b9b2619965d43db70939589afe43a Version: e2f5d2ea479b9b2619965d43db70939589afe43a Version: e2f5d2ea479b9b2619965d43db70939589afe43a Version: e2f5d2ea479b9b2619965d43db70939589afe43a Version: e2f5d2ea479b9b2619965d43db70939589afe43a Version: e2f5d2ea479b9b2619965d43db70939589afe43a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_property.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b6117210ed349356f8e6027ff020b4d620bca42b",
"status": "affected",
"version": "e2f5d2ea479b9b2619965d43db70939589afe43a",
"versionType": "git"
},
{
"lessThan": "815fa29cab3c67bebb9d0b5f41145cdd3a14d04d",
"status": "affected",
"version": "e2f5d2ea479b9b2619965d43db70939589afe43a",
"versionType": "git"
},
{
"lessThan": "866e0c1a9e7244d58ed74853cb22b81e1900cfdd",
"status": "affected",
"version": "e2f5d2ea479b9b2619965d43db70939589afe43a",
"versionType": "git"
},
{
"lessThan": "bbfaa5761f589a81031b493cb01275a990d6fb25",
"status": "affected",
"version": "e2f5d2ea479b9b2619965d43db70939589afe43a",
"versionType": "git"
},
{
"lessThan": "8e1664b9ee43608eb973d357ae5d858d30cbc9ca",
"status": "affected",
"version": "e2f5d2ea479b9b2619965d43db70939589afe43a",
"versionType": "git"
},
{
"lessThan": "cb8b9a1755fe9f38e4fb7f287486d7e7fab3dba4",
"status": "affected",
"version": "e2f5d2ea479b9b2619965d43db70939589afe43a",
"versionType": "git"
},
{
"lessThan": "405fd652d8fedff219a8f48daf8f20e881e303ab",
"status": "affected",
"version": "e2f5d2ea479b9b2619965d43db70939589afe43a",
"versionType": "git"
},
{
"lessThan": "26b4309a3ab82a0697751cde52eb336c29c19035",
"status": "affected",
"version": "e2f5d2ea479b9b2619965d43db70939589afe43a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_property.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: Account property blob allocations to memcg\n\nDRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized\nproperty blobs backed by kernel memory.\n\nCurrently, the blob data allocation is not accounted to the allocating\nprocess\u0027s memory cgroup, allowing unprivileged users to trigger unbounded\nkernel memory consumption and potentially cause system-wide OOM.\n\nMark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory\nis properly charged to the caller\u0027s memcg. This ensures existing cgroup\nmemory limits apply and prevents uncontrolled kernel memory growth without\nintroducing additional policy or per-file limits."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:21:38.413Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b6117210ed349356f8e6027ff020b4d620bca42b"
},
{
"url": "https://git.kernel.org/stable/c/815fa29cab3c67bebb9d0b5f41145cdd3a14d04d"
},
{
"url": "https://git.kernel.org/stable/c/866e0c1a9e7244d58ed74853cb22b81e1900cfdd"
},
{
"url": "https://git.kernel.org/stable/c/bbfaa5761f589a81031b493cb01275a990d6fb25"
},
{
"url": "https://git.kernel.org/stable/c/8e1664b9ee43608eb973d357ae5d858d30cbc9ca"
},
{
"url": "https://git.kernel.org/stable/c/cb8b9a1755fe9f38e4fb7f287486d7e7fab3dba4"
},
{
"url": "https://git.kernel.org/stable/c/405fd652d8fedff219a8f48daf8f20e881e303ab"
},
{
"url": "https://git.kernel.org/stable/c/26b4309a3ab82a0697751cde52eb336c29c19035"
}
],
"title": "drm: Account property blob allocations to memcg",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43287",
"datePublished": "2026-05-08T13:11:12.541Z",
"dateReserved": "2026-05-01T14:12:55.999Z",
"dateUpdated": "2026-05-11T22:21:38.413Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53035 (GCVE-0-2026-53035)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Fix af_unix iter deadlock
bpf_iter_unix_seq_show() may deadlock when lock_sock_fast() takes the fast
path and the iter prog attempts to update a sockmap. Which ends up spinning
at sock_map_update_elem()'s bh_lock_sock():
WARNING: possible recursive locking detected
test_progs/1393 is trying to acquire lock:
ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: sock_map_update_elem+0xdb/0x1f0
but task is already holding lock:
ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(slock-AF_UNIX);
lock(slock-AF_UNIX);
*** DEADLOCK ***
May be due to missing lock nesting notation
4 locks held by test_progs/1393:
#0: ffff88814b59c790 (&p->lock){+.+.}-{4:4}, at: bpf_seq_read+0x59/0x10d0
#1: ffff88811ec25fd8 (sk_lock-AF_UNIX){+.+.}-{0:0}, at: bpf_seq_read+0x42c/0x10d0
#2: ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0
#3: ffffffff85a6a7c0 (rcu_read_lock){....}-{1:3}, at: bpf_iter_run_prog+0x51d/0xb00
Call Trace:
dump_stack_lvl+0x5d/0x80
print_deadlock_bug.cold+0xc0/0xce
__lock_acquire+0x130f/0x2590
lock_acquire+0x14e/0x2b0
_raw_spin_lock+0x30/0x40
sock_map_update_elem+0xdb/0x1f0
bpf_prog_2d0075e5d9b721cd_dump_unix+0x55/0x4f4
bpf_iter_run_prog+0x5b9/0xb00
bpf_iter_unix_seq_show+0x1f7/0x2e0
bpf_seq_read+0x42c/0x10d0
vfs_read+0x171/0xb20
ksys_read+0xff/0x200
do_syscall_64+0x6b/0x3a0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2c860a43dd77f969bb959336a2f743d7103a8f63 Version: 2c860a43dd77f969bb959336a2f743d7103a8f63 Version: 2c860a43dd77f969bb959336a2f743d7103a8f63 Version: 2c860a43dd77f969bb959336a2f743d7103a8f63 Version: 2c860a43dd77f969bb959336a2f743d7103a8f63 Version: 2c860a43dd77f969bb959336a2f743d7103a8f63 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/unix/af_unix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bd3592129f24243713673a07225cf1f15a9bb835",
"status": "affected",
"version": "2c860a43dd77f969bb959336a2f743d7103a8f63",
"versionType": "git"
},
{
"lessThan": "3cef33b9813b78f227942572fb317afcd5c9ac94",
"status": "affected",
"version": "2c860a43dd77f969bb959336a2f743d7103a8f63",
"versionType": "git"
},
{
"lessThan": "87828b380956d4986f59f2c086e0b09b3e6cdaae",
"status": "affected",
"version": "2c860a43dd77f969bb959336a2f743d7103a8f63",
"versionType": "git"
},
{
"lessThan": "527057ebe8076dfbcaef51195ff1b7508646be2c",
"status": "affected",
"version": "2c860a43dd77f969bb959336a2f743d7103a8f63",
"versionType": "git"
},
{
"lessThan": "66d9fab4565eafe1afe7ba0581f79b76073b60fa",
"status": "affected",
"version": "2c860a43dd77f969bb959336a2f743d7103a8f63",
"versionType": "git"
},
{
"lessThan": "4d328dd695383224aa750ddee6b4ad40c0f8d205",
"status": "affected",
"version": "2c860a43dd77f969bb959336a2f743d7103a8f63",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/unix/af_unix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix af_unix iter deadlock\n\nbpf_iter_unix_seq_show() may deadlock when lock_sock_fast() takes the fast\npath and the iter prog attempts to update a sockmap. Which ends up spinning\nat sock_map_update_elem()\u0027s bh_lock_sock():\n\nWARNING: possible recursive locking detected\ntest_progs/1393 is trying to acquire lock:\nffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: sock_map_update_elem+0xdb/0x1f0\n\nbut task is already holding lock:\nffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0\n\nother info that might help us debug this:\n Possible unsafe locking scenario:\n\n CPU0\n ----\n lock(slock-AF_UNIX);\n lock(slock-AF_UNIX);\n\n *** DEADLOCK ***\n\n May be due to missing lock nesting notation\n\n4 locks held by test_progs/1393:\n #0: ffff88814b59c790 (\u0026p-\u003elock){+.+.}-{4:4}, at: bpf_seq_read+0x59/0x10d0\n #1: ffff88811ec25fd8 (sk_lock-AF_UNIX){+.+.}-{0:0}, at: bpf_seq_read+0x42c/0x10d0\n #2: ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0\n #3: ffffffff85a6a7c0 (rcu_read_lock){....}-{1:3}, at: bpf_iter_run_prog+0x51d/0xb00\n\nCall Trace:\n dump_stack_lvl+0x5d/0x80\n print_deadlock_bug.cold+0xc0/0xce\n __lock_acquire+0x130f/0x2590\n lock_acquire+0x14e/0x2b0\n _raw_spin_lock+0x30/0x40\n sock_map_update_elem+0xdb/0x1f0\n bpf_prog_2d0075e5d9b721cd_dump_unix+0x55/0x4f4\n bpf_iter_run_prog+0x5b9/0xb00\n bpf_iter_unix_seq_show+0x1f7/0x2e0\n bpf_seq_read+0x42c/0x10d0\n vfs_read+0x171/0xb20\n ksys_read+0xff/0x200\n do_syscall_64+0x6b/0x3a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:42.560Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bd3592129f24243713673a07225cf1f15a9bb835"
},
{
"url": "https://git.kernel.org/stable/c/3cef33b9813b78f227942572fb317afcd5c9ac94"
},
{
"url": "https://git.kernel.org/stable/c/87828b380956d4986f59f2c086e0b09b3e6cdaae"
},
{
"url": "https://git.kernel.org/stable/c/527057ebe8076dfbcaef51195ff1b7508646be2c"
},
{
"url": "https://git.kernel.org/stable/c/66d9fab4565eafe1afe7ba0581f79b76073b60fa"
},
{
"url": "https://git.kernel.org/stable/c/4d328dd695383224aa750ddee6b4ad40c0f8d205"
}
],
"title": "bpf, sockmap: Fix af_unix iter deadlock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53035",
"datePublished": "2026-06-24T16:29:42.560Z",
"dateReserved": "2026-06-09T07:44:35.380Z",
"dateUpdated": "2026-06-24T16:29:42.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43062 (GCVE-0-2026-43062)
Vulnerability from cvelistv5
Published
2026-05-05 15:17
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()
l2cap_ecred_reconf_rsp() casts the incoming data to struct
l2cap_ecred_conn_rsp (the ECRED *connection* response, 8 bytes with
result at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes
with result at offset 0).
This causes two problems:
- The sizeof(*rsp) length check requires 8 bytes instead of the
correct 2, so valid L2CAP_ECRED_RECONF_RSP packets are rejected
with -EPROTO.
- rsp->result reads from offset 6 instead of offset 0, returning
wrong data when the packet is large enough to pass the check.
Fix by using the correct type. Also pass the already byte-swapped
result variable to BT_DBG instead of the raw __le16 field.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 Version: 15f02b91056253e8cdc592888f431da0731337b8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "21d3ba696918d6373233aac0b9d51fcabdedddc0",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "3b94e62caa1dc1198d0d55d97bd710da1dee15d7",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "111f74547eee8cfedfb854284e80f35c8a491186",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "dd3b221e21079ade8263fbb7176f3d55ad75d3b6",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "d90150c72d2e6a8a3079e88755dafcfbe91c746d",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "5a1ea296f8589ce8f1e3141b2b123b34ad010e19",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "f110b8f58b254bf997cec1bd60701b7798e9bb82",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
},
{
"lessThan": "15145675690cab2de1056e7ed68e59cbd0452529",
"status": "affected",
"version": "15f02b91056253e8cdc592888f431da0731337b8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()\n\nl2cap_ecred_reconf_rsp() casts the incoming data to struct\nl2cap_ecred_conn_rsp (the ECRED *connection* response, 8 bytes with\nresult at offset 6) instead of struct l2cap_ecred_reconf_rsp (2 bytes\nwith result at offset 0).\n\nThis causes two problems:\n\n - The sizeof(*rsp) length check requires 8 bytes instead of the\n correct 2, so valid L2CAP_ECRED_RECONF_RSP packets are rejected\n with -EPROTO.\n\n - rsp-\u003eresult reads from offset 6 instead of offset 0, returning\n wrong data when the packet is large enough to pass the check.\n\nFix by using the correct type. Also pass the already byte-swapped\nresult variable to BT_DBG instead of the raw __le16 field."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - Bluetooth L2CAP is reachable only by a nearby Bluetooth LE peer over the local radio link, not over routed IP networks.\nAC:L - Once an LE L2CAP ECRED channel/reconfiguration exchange exists, the attacker controls the response length and bytes; no hard-to-win race or environmental condition is required to hit the misparse.\nPR:N - The inbound HCI ACL/L2CAP signaling receive path has no local privilege or authentication check before parsing the peer\u0027s ECRED reconfiguration response.\nUI:N - No victim user action is required for packet processing beyond the system participating in a Bluetooth LE L2CAP session.\nS:U - The impact remains within the kernel/Bluetooth stack security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:N - The wrong struct makes the kernel read the result from attacker-controlled packet bytes at offset 6 after an 8-byte length check, so this commit does not expose kernel memory.\nI:H - The bug is a kernel protocol-parser type confusion that lets an adjacent peer drive incorrect ECRED reconfiguration state and channel teardown based on the wrong field; per the supplied guidance, type confusion is scored High for integrity.\nA:L - The practical availability impact is disruption or failure of ECRED reconfiguration/channel state, not a demonstrated kernel panic, hang, or whole-system crash from this fix."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:40.332Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/21d3ba696918d6373233aac0b9d51fcabdedddc0"
},
{
"url": "https://git.kernel.org/stable/c/3b94e62caa1dc1198d0d55d97bd710da1dee15d7"
},
{
"url": "https://git.kernel.org/stable/c/111f74547eee8cfedfb854284e80f35c8a491186"
},
{
"url": "https://git.kernel.org/stable/c/dd3b221e21079ade8263fbb7176f3d55ad75d3b6"
},
{
"url": "https://git.kernel.org/stable/c/d90150c72d2e6a8a3079e88755dafcfbe91c746d"
},
{
"url": "https://git.kernel.org/stable/c/5a1ea296f8589ce8f1e3141b2b123b34ad010e19"
},
{
"url": "https://git.kernel.org/stable/c/f110b8f58b254bf997cec1bd60701b7798e9bb82"
},
{
"url": "https://git.kernel.org/stable/c/15145675690cab2de1056e7ed68e59cbd0452529"
}
],
"title": "Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43062",
"datePublished": "2026-05-05T15:17:27.830Z",
"dateReserved": "2026-05-01T14:12:55.981Z",
"dateUpdated": "2026-08-05T12:25:40.332Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53040 (GCVE-0-2026-53040)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: validate bg_bits during freefrag scan
[BUG]
A crafted filesystem can trigger an out-of-bounds bitmap walk when
OCFS2_IOC_INFO is issued with OCFS2_INFO_FL_NON_COHERENT.
BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: use-after-free in test_bit_le include/asm-generic/bitops/le.h:21 [inline]
BUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline]
BUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline]
BUG: KASAN: use-after-free in ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline]
BUG: KASAN: use-after-free in ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754
Read of size 8 at addr ffff888031bce000 by task syz.0.636/1435
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xd1/0x650 mm/kasan/report.c:482
kasan_report+0xfb/0x140 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:186 [inline]
kasan_check_range+0x11c/0x200 mm/kasan/generic.c:200
__kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31
instrument_atomic_read include/linux/instrumented.h:68 [inline]
_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
test_bit_le include/asm-generic/bitops/le.h:21 [inline]
ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline]
ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline]
ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline]
ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754
ocfs2_info_handle+0x18d/0x2a0 fs/ocfs2/ioctl.c:828
ocfs2_ioctl+0x632/0x6e0 fs/ocfs2/ioctl.c:913
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583
...
[CAUSE]
ocfs2_info_freefrag_scan_chain() uses on-disk bg_bits directly as the
bitmap scan limit. The coherent path reads group descriptors through
ocfs2_read_group_descriptor(), which validates the descriptor before
use. The non-coherent path uses ocfs2_read_blocks_sync() instead and
skips that validation, so an impossible bg_bits value can drive the
bitmap walk past the end of the block.
[FIX]
Compute the bitmap capacity from the filesystem format with
ocfs2_group_bitmap_size(), report descriptors whose bg_bits exceeds
that limit, and clamp the scan to the computed capacity. This keeps the
freefrag report going while avoiding reads beyond the buffer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d24a10b9f8ed548981696cd36e2b4f16e6f360b1 Version: d24a10b9f8ed548981696cd36e2b4f16e6f360b1 Version: d24a10b9f8ed548981696cd36e2b4f16e6f360b1 Version: d24a10b9f8ed548981696cd36e2b4f16e6f360b1 Version: d24a10b9f8ed548981696cd36e2b4f16e6f360b1 Version: d24a10b9f8ed548981696cd36e2b4f16e6f360b1 Version: d24a10b9f8ed548981696cd36e2b4f16e6f360b1 Version: d24a10b9f8ed548981696cd36e2b4f16e6f360b1 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bb2906a1065ec28de021bac2ed03f2624edd7d07",
"status": "affected",
"version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1",
"versionType": "git"
},
{
"lessThan": "3e167e230d19cd273108bab2e4c61800fc335ae8",
"status": "affected",
"version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1",
"versionType": "git"
},
{
"lessThan": "0998674eec138c55e9e349b9cbd9dbc5129a9cc8",
"status": "affected",
"version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1",
"versionType": "git"
},
{
"lessThan": "bb3c54d1e71578521111f1a1ee7d5f4761a242b8",
"status": "affected",
"version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1",
"versionType": "git"
},
{
"lessThan": "05d0cbea41167b6b061c6ba5b70ee5a9a7a24c9e",
"status": "affected",
"version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1",
"versionType": "git"
},
{
"lessThan": "4c2d62ddde8928db12f4608950b67a20e67deab2",
"status": "affected",
"version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1",
"versionType": "git"
},
{
"lessThan": "e0dcf12665d6dde37facf790803cdad44d5c328c",
"status": "affected",
"version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1",
"versionType": "git"
},
{
"lessThan": "8f687eeed3da3012152b0f9473f578869de0cd7b",
"status": "affected",
"version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate bg_bits during freefrag scan\n\n[BUG]\nA crafted filesystem can trigger an out-of-bounds bitmap walk when\nOCFS2_IOC_INFO is issued with OCFS2_INFO_FL_NON_COHERENT.\n\nBUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]\nBUG: KASAN: use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\nBUG: KASAN: use-after-free in test_bit_le include/asm-generic/bitops/le.h:21 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754\nRead of size 8 at addr ffff888031bce000 by task syz.0.636/1435\nCall Trace:\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xd1/0x650 mm/kasan/report.c:482\n kasan_report+0xfb/0x140 mm/kasan/report.c:595\n check_region_inline mm/kasan/generic.c:186 [inline]\n kasan_check_range+0x11c/0x200 mm/kasan/generic.c:200\n __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31\n instrument_atomic_read include/linux/instrumented.h:68 [inline]\n _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\n test_bit_le include/asm-generic/bitops/le.h:21 [inline]\n ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline]\n ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline]\n ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline]\n ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754\n ocfs2_info_handle+0x18d/0x2a0 fs/ocfs2/ioctl.c:828\n ocfs2_ioctl+0x632/0x6e0 fs/ocfs2/ioctl.c:913\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583\n ...\n\n[CAUSE]\nocfs2_info_freefrag_scan_chain() uses on-disk bg_bits directly as the\nbitmap scan limit. The coherent path reads group descriptors through\nocfs2_read_group_descriptor(), which validates the descriptor before\nuse. The non-coherent path uses ocfs2_read_blocks_sync() instead and\nskips that validation, so an impossible bg_bits value can drive the\nbitmap walk past the end of the block.\n\n[FIX]\nCompute the bitmap capacity from the filesystem format with\nocfs2_group_bitmap_size(), report descriptors whose bg_bits exceeds\nthat limit, and clamp the scan to the computed capacity. This keeps the\nfreefrag report going while avoiding reads beyond the buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through the local `OCFS2_IOC_INFO` ioctl on an opened OCFS2 file or directory, not by network packet processing. A crafted OCFS2 filesystem/metadata is required, but the trigger is a local syscall path.\nAC:L - There is no race or timing dependency; the attacker supplies the non-coherent freefrag request and an impossible on-disk `bg_bits` value. Once the crafted metadata is present, the out-of-bounds bitmap walk is deterministic.\nPR:L - `OCFS2_IOC_INFO` has no capability check, and ordinary local users can issue it against an accessible mounted OCFS2 file. Although mounting or creating the crafted block device is privileged because OCFS2 is not `FS_USERNS_MOUNT`, the direct ioctl trigger is available to a low-privileged local user, so the higher-severity PR:L is chosen.\nUI:N - No victim action is required for a local attacker who can access the mounted OCFS2 filesystem and issue the ioctl. The vulnerable request is initiated entirely by the attacker-controlled process.\nS:U - The impact remains within the kernel/filesystem security authority on the same host. There is no VM, IOMMU, container-boundary, or cross-authority escape specific to this bug.\nC:H - The bug is an out-of-bounds read past the group bitmap buffer, and the requested guidance treats non-trivially bounded out-of-bounds reads as high confidentiality impact. The read can cover more than a few bytes of adjacent kernel memory and influence data returned in freefrag statistics.\nI:N - The vulnerable loop only tests bitmap bits and updates local free-fragmentation counters; it does not write beyond the buffer or provide a write primitive. I found no control-flow or metadata modification path from the invalid `bg_bits` read.\nA:H - The reported failure is a KASAN use-after-free/out-of-bounds read in kernel context, and such invalid kernel memory access can oops or panic the system. The crafted request can be issued repeatedly once the filesystem is accessible."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:48.568Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bb2906a1065ec28de021bac2ed03f2624edd7d07"
},
{
"url": "https://git.kernel.org/stable/c/3e167e230d19cd273108bab2e4c61800fc335ae8"
},
{
"url": "https://git.kernel.org/stable/c/0998674eec138c55e9e349b9cbd9dbc5129a9cc8"
},
{
"url": "https://git.kernel.org/stable/c/bb3c54d1e71578521111f1a1ee7d5f4761a242b8"
},
{
"url": "https://git.kernel.org/stable/c/05d0cbea41167b6b061c6ba5b70ee5a9a7a24c9e"
},
{
"url": "https://git.kernel.org/stable/c/4c2d62ddde8928db12f4608950b67a20e67deab2"
},
{
"url": "https://git.kernel.org/stable/c/e0dcf12665d6dde37facf790803cdad44d5c328c"
},
{
"url": "https://git.kernel.org/stable/c/8f687eeed3da3012152b0f9473f578869de0cd7b"
}
],
"title": "ocfs2: validate bg_bits during freefrag scan",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53040",
"datePublished": "2026-06-24T16:29:46.737Z",
"dateReserved": "2026-06-09T07:44:35.380Z",
"dateUpdated": "2026-08-05T12:32:48.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43019 (GCVE-0-2026-43019)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync
hci_conn lookup and field access must be covered by hdev lock in
set_cig_params_sync, otherwise it's possible it is freed concurrently.
Take hdev lock to prevent hci_conn from being deleted or modified
concurrently. Just RCU lock is not suitable here, as we also want to
avoid "tearing" in the configuration.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a091289218202bc09d9b9caa8afcde1018584aec Version: a091289218202bc09d9b9caa8afcde1018584aec Version: a091289218202bc09d9b9caa8afcde1018584aec Version: a091289218202bc09d9b9caa8afcde1018584aec Version: a091289218202bc09d9b9caa8afcde1018584aec Version: 3a273cd0f47dd672d37736e623849374f9ab9ce9 Version: d8570c4c3f2a3e51b3c8b5e6ec898364c5c03062 Version: 6.4.16 ≤ Version: 6.5.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7502c1cf303b69f71d085f5ff7251b0e1b0f09df",
"status": "affected",
"version": "a091289218202bc09d9b9caa8afcde1018584aec",
"versionType": "git"
},
{
"lessThan": "66d432e9b45bae7881ffcdb12cd8fd0bf254ef02",
"status": "affected",
"version": "a091289218202bc09d9b9caa8afcde1018584aec",
"versionType": "git"
},
{
"lessThan": "7d568fede8eac91161a60b710aa920abe9b0fb9f",
"status": "affected",
"version": "a091289218202bc09d9b9caa8afcde1018584aec",
"versionType": "git"
},
{
"lessThan": "bad65b4b0a96139f023eadc28a33125963208449",
"status": "affected",
"version": "a091289218202bc09d9b9caa8afcde1018584aec",
"versionType": "git"
},
{
"lessThan": "a2639a7f0f5bf7d73f337f8f077c19415c62ed2c",
"status": "affected",
"version": "a091289218202bc09d9b9caa8afcde1018584aec",
"versionType": "git"
},
{
"status": "affected",
"version": "3a273cd0f47dd672d37736e623849374f9ab9ce9",
"versionType": "git"
},
{
"status": "affected",
"version": "d8570c4c3f2a3e51b3c8b5e6ec898364c5c03062",
"versionType": "git"
},
{
"lessThan": "6.5",
"status": "affected",
"version": "6.4.16",
"versionType": "semver"
},
{
"lessThan": "6.6",
"status": "affected",
"version": "6.5.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: fix potential UAF in set_cig_params_sync\n\nhci_conn lookup and field access must be covered by hdev lock in\nset_cig_params_sync, otherwise it\u0027s possible it is freed concurrently.\n\nTake hdev lock to prevent hci_conn from being deleted or modified\nconcurrently. Just RCU lock is not suitable here, as we also want to\navoid \"tearing\" in the configuration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable `set_cig_params_sync` path is reached through local AF_BLUETOOTH ISO socket operations such as creating a `BTPROTO_ISO` socket, setting ISO QoS/deferred setup, and calling `connect()` or deferred `recvmsg()`. A Bluetooth peer may be involved in normal CIS use, but the vulnerable queueing and racing can be driven by local socket syscalls.\nAC:L - The bug is a race/use-after-free, but the attacker can control the relevant operations by repeatedly creating/binding/connecting and closing ISO sockets while the HCI command work item runs asynchronously. The fix adds `hci_dev_lock`, indicating normal locking, not rare external state, is the missing condition.\nPR:L - AF_BLUETOOTH ISO socket creation and the relevant `BT_ISO_QOS`, `BT_DEFER_SETUP`, and `connect()` path do not require CAP_NET_ADMIN or another privileged check in the inspected path. The attacker needs local code execution as an unprivileged user on a system with a running Bluetooth ISO-capable controller.\nUI:N - No victim action is required once the local attacker can execute socket syscalls. The attacker can create, configure, connect, and close the sockets directly.\nS:U - The vulnerability corrupts or reuses memory within the kernel Bluetooth/HCI connection management context. Exploitation would be kernel compromise or denial of service within the same security authority, not a boundary crossing such as guest-to-host escape.\nC:H - This is a use-after-free of `struct hci_conn`, with freed object fields read after lookup without holding the device lock. Per kernel UAF scoring guidance and plausible heap reuse, this can support high confidentiality impact.\nI:H - The stale `hci_conn` contents are used to build HCI command parameters, and UAF conditions in kernel heap objects are generally exploitable with heap grooming for control/data corruption. Following the required higher-severity rule for UAFs, integrity impact is High.\nA:H - A stale `hci_conn` dereference in asynchronous HCI command work can trigger kernel memory safety failures, including KASAN-detected slab-use-after-free, oops, or panic. Repeated local triggering makes denial of service high impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:18.558Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7502c1cf303b69f71d085f5ff7251b0e1b0f09df"
},
{
"url": "https://git.kernel.org/stable/c/66d432e9b45bae7881ffcdb12cd8fd0bf254ef02"
},
{
"url": "https://git.kernel.org/stable/c/7d568fede8eac91161a60b710aa920abe9b0fb9f"
},
{
"url": "https://git.kernel.org/stable/c/bad65b4b0a96139f023eadc28a33125963208449"
},
{
"url": "https://git.kernel.org/stable/c/a2639a7f0f5bf7d73f337f8f077c19415c62ed2c"
}
],
"title": "Bluetooth: hci_conn: fix potential UAF in set_cig_params_sync",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43019",
"datePublished": "2026-05-01T14:15:23.035Z",
"dateReserved": "2026-05-01T14:12:55.975Z",
"dateUpdated": "2026-08-05T12:25:18.558Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31747 (GCVE-0-2026-31747)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-05-11 22:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
comedi: me4000: Fix potential overrun of firmware buffer
`me4000_xilinx_download()` loads the firmware that was requested by
`request_firmware()`. It is possible for it to overrun the source
buffer because it blindly trusts the file format. It reads a data
stream length from the first 4 bytes into variable `file_length` and
reads the data stream contents of length `file_length` from offset 16
onwards.
Add a test to ensure that the supplied firmware is long enough to
contain the header and the data stream. On failure, log an error and
return `-EINVAL`.
Note: The firmware loading was totally broken before commit ac584af59945
("staging: comedi: me4000: fix firmware downloading"), but that is the
most sensible target for this fix.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ac584af599452748187cf6d7865b1607c54ee443 Version: ac584af599452748187cf6d7865b1607c54ee443 Version: ac584af599452748187cf6d7865b1607c54ee443 Version: ac584af599452748187cf6d7865b1607c54ee443 Version: ac584af599452748187cf6d7865b1607c54ee443 Version: ac584af599452748187cf6d7865b1607c54ee443 Version: ac584af599452748187cf6d7865b1607c54ee443 Version: ac584af599452748187cf6d7865b1607c54ee443 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/comedi/drivers/me4000.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8ddfe6495c245226a30d8b36e2f4a7aa7712e8d6",
"status": "affected",
"version": "ac584af599452748187cf6d7865b1607c54ee443",
"versionType": "git"
},
{
"lessThan": "64b24b713e1a3ea6624480594b4f8c2ff86502f2",
"status": "affected",
"version": "ac584af599452748187cf6d7865b1607c54ee443",
"versionType": "git"
},
{
"lessThan": "f72b5567f7c117b46b4058dc6a0c7554f8565561",
"status": "affected",
"version": "ac584af599452748187cf6d7865b1607c54ee443",
"versionType": "git"
},
{
"lessThan": "1603dd471f47762e9d1f52304edb3e49a7e62655",
"status": "affected",
"version": "ac584af599452748187cf6d7865b1607c54ee443",
"versionType": "git"
},
{
"lessThan": "99f31aa98ab6e3805c455b65bcd01b3d48bdf1a5",
"status": "affected",
"version": "ac584af599452748187cf6d7865b1607c54ee443",
"versionType": "git"
},
{
"lessThan": "eae19cab44204537f79146f15a51811b13227c38",
"status": "affected",
"version": "ac584af599452748187cf6d7865b1607c54ee443",
"versionType": "git"
},
{
"lessThan": "de3f923ae7d91480ed3ecea1b1e1fc0dc25b597d",
"status": "affected",
"version": "ac584af599452748187cf6d7865b1607c54ee443",
"versionType": "git"
},
{
"lessThan": "3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7",
"status": "affected",
"version": "ac584af599452748187cf6d7865b1607c54ee443",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/comedi/drivers/me4000.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: me4000: Fix potential overrun of firmware buffer\n\n`me4000_xilinx_download()` loads the firmware that was requested by\n`request_firmware()`. It is possible for it to overrun the source\nbuffer because it blindly trusts the file format. It reads a data\nstream length from the first 4 bytes into variable `file_length` and\nreads the data stream contents of length `file_length` from offset 16\nonwards.\n\nAdd a test to ensure that the supplied firmware is long enough to\ncontain the header and the data stream. On failure, log an error and\nreturn `-EINVAL`.\n\nNote: The firmware loading was totally broken before commit ac584af59945\n(\"staging: comedi: me4000: fix firmware downloading\"), but that is the\nmost sensible target for this fix."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:14:59.031Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8ddfe6495c245226a30d8b36e2f4a7aa7712e8d6"
},
{
"url": "https://git.kernel.org/stable/c/64b24b713e1a3ea6624480594b4f8c2ff86502f2"
},
{
"url": "https://git.kernel.org/stable/c/f72b5567f7c117b46b4058dc6a0c7554f8565561"
},
{
"url": "https://git.kernel.org/stable/c/1603dd471f47762e9d1f52304edb3e49a7e62655"
},
{
"url": "https://git.kernel.org/stable/c/99f31aa98ab6e3805c455b65bcd01b3d48bdf1a5"
},
{
"url": "https://git.kernel.org/stable/c/eae19cab44204537f79146f15a51811b13227c38"
},
{
"url": "https://git.kernel.org/stable/c/de3f923ae7d91480ed3ecea1b1e1fc0dc25b597d"
},
{
"url": "https://git.kernel.org/stable/c/3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7"
}
],
"title": "comedi: me4000: Fix potential overrun of firmware buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31747",
"datePublished": "2026-05-01T14:14:40.844Z",
"dateReserved": "2026-03-09T15:48:24.138Z",
"dateUpdated": "2026-05-11T22:14:59.031Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52915 (GCVE-0-2026-52915)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ip6t_hbh: reject oversized option lists
struct ip6t_opts stores at most IP6T_OPTS_OPTSNR option descriptors,
but hbh_mt6_check() does not reject larger optsnr values supplied from
userspace.
Validate optsnr in the rule setup path so only match data that fits the
fixed-size opts array can be installed. This follows the existing xtables
pattern of rejecting invalid user-provided counts in checkentry() and
keeps the packet matching path unchanged.
`struct ip6t_opts` has a fixed `opts[IP6T_OPTS_OPTSNR]` array,
where `IP6T_OPTS_OPTSNR` is 16, then off-by-one array access is possible:
[ 137.924693][ T8692] UBSAN: array-index-out-of-bounds in ../net/ipv6/netfilter/ip6t_hbh.c:110:29
[ 137.926167][ T8692] index 16 is out of range for type '__u16 [16]'
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter/ip6t_hbh.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2d523ba48d4ecc46acfb6aba548292cfcce1ac02",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "588933f1a2ca5ff99274f8c9f25dc3a25d0191c3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "784aadea7a108c9f90985683caa87fb0198c6a39",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "41ec2e242f1702e8370ddfe14d22b7a766021c3e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "db0250470f023f159094052c0bd5ab026a88ae93",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "57b0ac5e1b46f1f0338dff392ef2092e2871b412",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6feb43c0995ab3a9c826707eb46541a1696fe4f7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4322dcde6b4173c2d8e8e6118ed290794263bcc8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter/ip6t_hbh.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ip6t_hbh: reject oversized option lists\n\nstruct ip6t_opts stores at most IP6T_OPTS_OPTSNR option descriptors,\nbut hbh_mt6_check() does not reject larger optsnr values supplied from\nuserspace.\n\nValidate optsnr in the rule setup path so only match data that fits the\nfixed-size opts array can be installed. This follows the existing xtables\npattern of rejecting invalid user-provided counts in checkentry() and\nkeeps the packet matching path unchanged.\n\n`struct ip6t_opts` has a fixed `opts[IP6T_OPTS_OPTSNR]` array,\nwhere `IP6T_OPTS_OPTSNR` is 16, then off-by-one array access is possible:\n\n[ 137.924693][ T8692] UBSAN: array-index-out-of-bounds in ../net/ipv6/netfilter/ip6t_hbh.c:110:29\n[ 137.926167][ T8692] index 16 is out of range for type \u0027__u16 [16]\u0027"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker must locally install a malformed IPv6 xtables/nft_compat hbh or dst match rule; the later packet evaluation can be driven by traffic, but the vulnerable state is created through local netfilter control interfaces.\nAC:L - No race or rare external condition is required: the attacker supplies optsnr \u003e 16 and then causes matching IPv6 extension-header traffic to be evaluated.\nPR:L - Rule installation requires CAP_NET_ADMIN in the target network namespace, and netfilter configuration is reachable by an unprivileged local user via a user+network namespace on systems allowing user namespaces.\nUI:N - Once the attacker has local access and required namespace capability, no victim action is needed to install the malformed rule or trigger packet evaluation.\nS:U - The impact remains within the kernel/network namespace security authority; this is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The oversized optsnr causes out-of-bounds reads past the fixed opts[16] array into adjacent kernel memory, and repeated attacker-controlled packet comparisons can serve as a kernel-memory disclosure oracle.\nI:N - The vulnerable code only reads out-of-bounds values and compares them with packet option bytes; it does not provide an out-of-bounds write or direct data modification primitive.\nA:H - The out-of-bounds array access can run past the installed match object during packet evaluation and was observed by UBSAN; in hardened or unlucky memory layouts this can produce an oops/panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:37.987Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2d523ba48d4ecc46acfb6aba548292cfcce1ac02"
},
{
"url": "https://git.kernel.org/stable/c/588933f1a2ca5ff99274f8c9f25dc3a25d0191c3"
},
{
"url": "https://git.kernel.org/stable/c/784aadea7a108c9f90985683caa87fb0198c6a39"
},
{
"url": "https://git.kernel.org/stable/c/41ec2e242f1702e8370ddfe14d22b7a766021c3e"
},
{
"url": "https://git.kernel.org/stable/c/db0250470f023f159094052c0bd5ab026a88ae93"
},
{
"url": "https://git.kernel.org/stable/c/57b0ac5e1b46f1f0338dff392ef2092e2871b412"
},
{
"url": "https://git.kernel.org/stable/c/6feb43c0995ab3a9c826707eb46541a1696fe4f7"
},
{
"url": "https://git.kernel.org/stable/c/4322dcde6b4173c2d8e8e6118ed290794263bcc8"
}
],
"title": "netfilter: ip6t_hbh: reject oversized option lists",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52915",
"datePublished": "2026-06-24T07:14:12.569Z",
"dateReserved": "2026-06-09T07:44:35.367Z",
"dateUpdated": "2026-08-05T12:31:37.987Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31560 (GCVE-0-2026-31560)
Vulnerability from cvelistv5
Published
2026-04-24 14:35
Modified
2026-06-01 16:11
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
spi: spi-dw-dma: fix print error log when wait finish transaction
If an error occurs, the device may not have a current message. In this
case, the system will crash.
In this case, it's better to use dev from the struct ctlr (struct spi_controller*).
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-dw-dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b8188ff3cfaa5621212b08473488cdbe41f86531",
"status": "affected",
"version": "bdbdf0f06337d3661b64c0288c291cb06624065e",
"versionType": "git"
},
{
"lessThan": "aae4a47073b12c23eb1d2c5401bda442fbe27bd1",
"status": "affected",
"version": "bdbdf0f06337d3661b64c0288c291cb06624065e",
"versionType": "git"
},
{
"lessThan": "184f5aaf72f1f1c73e66bae0b8d28e81c2f2a72f",
"status": "affected",
"version": "bdbdf0f06337d3661b64c0288c291cb06624065e",
"versionType": "git"
},
{
"lessThan": "3b46d61890632c8f8b117147b6923bff4b42ccb7",
"status": "affected",
"version": "bdbdf0f06337d3661b64c0288c291cb06624065e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-dw-dma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-dw-dma: fix print error log when wait finish transaction\n\nIf an error occurs, the device may not have a current message. In this\ncase, the system will crash.\n\nIn this case, it\u0027s better to use dev from the struct ctlr (struct spi_controller*)."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T16:11:44.450Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b8188ff3cfaa5621212b08473488cdbe41f86531"
},
{
"url": "https://git.kernel.org/stable/c/aae4a47073b12c23eb1d2c5401bda442fbe27bd1"
},
{
"url": "https://git.kernel.org/stable/c/184f5aaf72f1f1c73e66bae0b8d28e81c2f2a72f"
},
{
"url": "https://git.kernel.org/stable/c/3b46d61890632c8f8b117147b6923bff4b42ccb7"
}
],
"title": "spi: spi-dw-dma: fix print error log when wait finish transaction",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31560",
"datePublished": "2026-04-24T14:35:42.634Z",
"dateReserved": "2026-03-09T15:48:24.116Z",
"dateUpdated": "2026-06-01T16:11:44.450Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46212 (GCVE-0-2026-46212)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: bla: prevent use-after-free when deleting claims
When batadv_bla_del_backbone_claims() removes all claims for a backbone, it
does this by dropping the link entry in the hash list. This list entry
itself was one of the references which need to be dropped at the same time
via batadv_claim_put().
But the batadv_claim_put() must not be done before the last access to the
claim object in this function. Otherwise the claim might be freed already
by the batadv_claim_release() function before the list entry was dropped.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 Version: 23721387c409087fd3b97e274f34d3ddc0970b74 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/bridge_loop_avoidance.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1d4b241482d9025c537afb3c7c8419c72c0e0c82",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "a1a99837bb6169cfb9187abaa2005e8f12079426",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "b88c865dcf6e9f20bfe66a360d4b62941ef769b8",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "368449e467d5f1e2c2e987bf2bd57000ba75e10b",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "6c5dc6d68e6ba7f0224a757a39ed52fcdb54d472",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "00155f336a5e8b1006d2ca9ae7ad8fc4a44bb401",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "0cc9847c64cb6e61118bc78c9187c8209a7197fa",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
},
{
"lessThan": "4ae1709a314060a196981b344610d023ea841e57",
"status": "affected",
"version": "23721387c409087fd3b97e274f34d3ddc0970b74",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/bridge_loop_avoidance.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: bla: prevent use-after-free when deleting claims\n\nWhen batadv_bla_del_backbone_claims() removes all claims for a backbone, it\ndoes this by dropping the link entry in the hash list. This list entry\nitself was one of the references which need to be dropped at the same time\nvia batadv_claim_put().\n\nBut the batadv_claim_put() must not be done before the last access to the\nclaim object in this function. Otherwise the claim might be freed already\nby the batadv_claim_release() function before the list entry was dropped."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - batman-adv is a layer-2 mesh protocol where all nodes share one logical L2 broadcast domain; the malicious BLA ANNOUNCE claim frame must be injected by a node on the same shared LAN/mesh segment, not from an arbitrary remote network.\nAC:L - The attacker reliably triggers the path by sending an ANNOUNCE claim frame with a deliberately mismatched CRC, and the put-before-delete UAF executes deterministically when the hash holds the last reference (the normal case); no attacker-uncontrollable condition is required.\nPR:N - BLA frame processing happens automatically on received claim frames with no authentication and no privileges on the victim node; BLA is enabled by default.\nUI:N - The crafted claim frame is processed automatically by the receive/forward path with no victim interaction required.\nS:U - The use-after-free corrupts kernel heap memory within the kernel\u0027s own security authority; no crossing of a security boundary such as VM/IOMMU.\nC:H - Use-after-free of the claim object can give an attacker control over freed-object contents, enabling disclosure of kernel memory.\nI:H - Use-after-free is leverageable via heap spraying into arbitrary-write primitives and control-flow corruption of kernel structures.\nA:H - The use-after-free readily causes kernel oops/panic, crashing the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:32.814Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1d4b241482d9025c537afb3c7c8419c72c0e0c82"
},
{
"url": "https://git.kernel.org/stable/c/a1a99837bb6169cfb9187abaa2005e8f12079426"
},
{
"url": "https://git.kernel.org/stable/c/b88c865dcf6e9f20bfe66a360d4b62941ef769b8"
},
{
"url": "https://git.kernel.org/stable/c/368449e467d5f1e2c2e987bf2bd57000ba75e10b"
},
{
"url": "https://git.kernel.org/stable/c/6c5dc6d68e6ba7f0224a757a39ed52fcdb54d472"
},
{
"url": "https://git.kernel.org/stable/c/00155f336a5e8b1006d2ca9ae7ad8fc4a44bb401"
},
{
"url": "https://git.kernel.org/stable/c/0cc9847c64cb6e61118bc78c9187c8209a7197fa"
},
{
"url": "https://git.kernel.org/stable/c/4ae1709a314060a196981b344610d023ea841e57"
}
],
"title": "batman-adv: bla: prevent use-after-free when deleting claims",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46212",
"datePublished": "2026-05-28T09:40:29.712Z",
"dateReserved": "2026-05-13T15:03:33.105Z",
"dateUpdated": "2026-08-05T12:30:32.814Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45888 (GCVE-0-2026-45888)
Vulnerability from cvelistv5
Published
2026-05-27 12:16
Modified
2026-05-27 12:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
md/raid1: fix memory leak in raid1_run()
raid1_run() calls setup_conf() which registers a thread via
md_register_thread(). If raid1_set_limits() fails, the previously
registered thread is not unregistered, resulting in a memory leak
of the md_thread structure and the thread resource itself.
Add md_unregister_thread() to the error path to properly cleanup
the thread, which aligns with the error handling logic of other paths
in this function.
Compile tested only. Issue found using a prototype static analysis tool
and code review.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/raid1.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c94fd6e8a71efd047ff36930e840f3c25679e136",
"status": "affected",
"version": "97894f7d3c2966164516a8a5109674763d3a55e1",
"versionType": "git"
},
{
"lessThan": "ec10e3dc93994b87adf7c759a4639fe34013989a",
"status": "affected",
"version": "97894f7d3c2966164516a8a5109674763d3a55e1",
"versionType": "git"
},
{
"lessThan": "b37588b0282a2b3cdda9db1d53712745ce66dea0",
"status": "affected",
"version": "97894f7d3c2966164516a8a5109674763d3a55e1",
"versionType": "git"
},
{
"lessThan": "6abc7d5dcf0ee0f85e16e41c87fbd06231f28753",
"status": "affected",
"version": "97894f7d3c2966164516a8a5109674763d3a55e1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/raid1.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1: fix memory leak in raid1_run()\n\nraid1_run() calls setup_conf() which registers a thread via\nmd_register_thread(). If raid1_set_limits() fails, the previously\nregistered thread is not unregistered, resulting in a memory leak\nof the md_thread structure and the thread resource itself.\n\nAdd md_unregister_thread() to the error path to properly cleanup\nthe thread, which aligns with the error handling logic of other paths\nin this function.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:16:59.751Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c94fd6e8a71efd047ff36930e840f3c25679e136"
},
{
"url": "https://git.kernel.org/stable/c/ec10e3dc93994b87adf7c759a4639fe34013989a"
},
{
"url": "https://git.kernel.org/stable/c/b37588b0282a2b3cdda9db1d53712745ce66dea0"
},
{
"url": "https://git.kernel.org/stable/c/6abc7d5dcf0ee0f85e16e41c87fbd06231f28753"
}
],
"title": "md/raid1: fix memory leak in raid1_run()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45888",
"datePublished": "2026-05-27T12:16:59.751Z",
"dateReserved": "2026-05-13T15:03:33.082Z",
"dateUpdated": "2026-05-27T12:16:59.751Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46111 (GCVE-0-2026-46111)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-08-19 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_conn: fix potential UAF in create_big_sync
Add hci_conn_valid() check in create_big_sync() to detect stale
connections before proceeding with BIG creation. Handle the
resulting -ECANCELED in create_big_complete() and re-validate the
connection under hci_dev_lock() before dereferencing, matching the
pattern used by create_le_conn_complete() and create_pa_complete().
Keep the hci_conn object alive across the async boundary by taking
a reference via hci_conn_get() when queueing create_big_sync(), and
dropping it in the completion callback. The refcount and the lock
are complementary: the refcount keeps the object allocated, while
hci_dev_lock() serializes hci_conn_hash_del()'s list_del_rcu() on
hdev->conn_hash, as required by hci_conn_del().
hci_conn_put() is called outside hci_dev_unlock() so the final put
(which resolves to kfree() via bt_link_release) does not run under
hdev->lock, though the release path would be safe either way.
Without this, create_big_complete() would unconditionally
dereference the conn pointer on error, causing a use-after-free
via hci_connect_cfm() and hci_conn_del().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: eca0ae4aea66914515e5e3098ea051b518ee5316 Version: eca0ae4aea66914515e5e3098ea051b518ee5316 Version: eca0ae4aea66914515e5e3098ea051b518ee5316 Version: eca0ae4aea66914515e5e3098ea051b518ee5316 Version: eca0ae4aea66914515e5e3098ea051b518ee5316 Version: eca0ae4aea66914515e5e3098ea051b518ee5316 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d41093723e47255d7d74df86e2736711c1b8486e",
"status": "affected",
"version": "eca0ae4aea66914515e5e3098ea051b518ee5316",
"versionType": "git"
},
{
"lessThan": "6823f730bf195fc296d9edd09e2ca94bc1ff5584",
"status": "affected",
"version": "eca0ae4aea66914515e5e3098ea051b518ee5316",
"versionType": "git"
},
{
"lessThan": "1750a2df0eab61dc421a7afae74abdd239a44b85",
"status": "affected",
"version": "eca0ae4aea66914515e5e3098ea051b518ee5316",
"versionType": "git"
},
{
"lessThan": "dc34f8d8240f25dd137dc2758ebbcc75e3779142",
"status": "affected",
"version": "eca0ae4aea66914515e5e3098ea051b518ee5316",
"versionType": "git"
},
{
"lessThan": "f8eaf92c57ad99358dd372580d5ff87623343a72",
"status": "affected",
"version": "eca0ae4aea66914515e5e3098ea051b518ee5316",
"versionType": "git"
},
{
"lessThan": "0beddb0c380bed5f5b8e61ddbe14635bb73d0b41",
"status": "affected",
"version": "eca0ae4aea66914515e5e3098ea051b518ee5316",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_conn.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: fix potential UAF in create_big_sync\n\nAdd hci_conn_valid() check in create_big_sync() to detect stale\nconnections before proceeding with BIG creation. Handle the\nresulting -ECANCELED in create_big_complete() and re-validate the\nconnection under hci_dev_lock() before dereferencing, matching the\npattern used by create_le_conn_complete() and create_pa_complete().\n\nKeep the hci_conn object alive across the async boundary by taking\na reference via hci_conn_get() when queueing create_big_sync(), and\ndropping it in the completion callback. The refcount and the lock\nare complementary: the refcount keeps the object allocated, while\nhci_dev_lock() serializes hci_conn_hash_del()\u0027s list_del_rcu() on\nhdev-\u003econn_hash, as required by hci_conn_del().\n\nhci_conn_put() is called outside hci_dev_unlock() so the final put\n(which resolves to kfree() via bt_link_release) does not run under\nhdev-\u003elock, though the release path would be safe either way.\n\nWithout this, create_big_complete() would unconditionally\ndereference the conn pointer on error, causing a use-after-free\nvia hci_connect_cfm() and hci_conn_del()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached only through a local ISO socket connect() syscall (BTPROTO_ISO \u2192 iso_connect_bis \u2192 hci_connect_bis); BIG broadcast setup is locally initiated and requires no Bluetooth peer or over-the-air frame, so the attacker needs local system access.\nAC:L - This is a use-after-free where the attacker controls both sides of the race \u2014 initiating the async create_big work via connect() and freeing the conn (e.g., closing the socket) \u2014 and can retry at will, so the condition is within attacker control.\nPR:L - Creating and connecting an ISO socket requires no capability check (iso_sock_create/bt_sock_create perform none), so any unprivileged local user can reach the path on systems where the ISO/BIS feature is enabled.\nUI:N - The attacker performs all steps (open socket, connect, race a teardown); no victim interaction is required.\nS:U - The use-after-free is contained within the kernel\u0027s own memory/security authority and does not cross into another security boundary such as a VM or IOMMU domain.\nC:H - A UAF of the hci_conn object gives the attacker control over the freed object\u0027s contents, enabling kernel-memory disclosure (e.g., leaking pointers/data placed in the reclaimed allocation).\nI:H - The freed hci_conn is dereferenced and written via hci_connect_cfm() and hci_conn_del() (including list_del_rcu on conn_hash), so heap grooming of the freed slab yields an arbitrary-write/control-flow primitive.\nA:H - Dereferencing and deleting a freed hci_conn reliably causes memory corruption leading to a kernel oops/panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:01.615Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d41093723e47255d7d74df86e2736711c1b8486e"
},
{
"url": "https://git.kernel.org/stable/c/6823f730bf195fc296d9edd09e2ca94bc1ff5584"
},
{
"url": "https://git.kernel.org/stable/c/1750a2df0eab61dc421a7afae74abdd239a44b85"
},
{
"url": "https://git.kernel.org/stable/c/dc34f8d8240f25dd137dc2758ebbcc75e3779142"
},
{
"url": "https://git.kernel.org/stable/c/f8eaf92c57ad99358dd372580d5ff87623343a72"
},
{
"url": "https://git.kernel.org/stable/c/0beddb0c380bed5f5b8e61ddbe14635bb73d0b41"
}
],
"title": "Bluetooth: hci_conn: fix potential UAF in create_big_sync",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46111",
"datePublished": "2026-05-28T09:35:19.970Z",
"dateReserved": "2026-05-13T15:03:33.098Z",
"dateUpdated": "2026-08-19T16:28:01.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43340 (GCVE-0-2026-43340)
Vulnerability from cvelistv5
Published
2026-05-08 13:37
Modified
2026-05-11 22:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
comedi: Reinit dev->spinlock between attachments to low-level drivers
`struct comedi_device` is the main controlling structure for a COMEDI
device created by the COMEDI subsystem. It contains a member `spinlock`
containing a spin-lock that is initialized by the COMEDI subsystem, but
is reserved for use by a low-level driver attached to the COMEDI device
(at least since commit 25436dc9d84f ("Staging: comedi: remove RT
code")).
Some COMEDI devices (those created on initialization of the COMEDI
subsystem when the "comedi.comedi_num_legacy_minors" parameter is
non-zero) can be attached to different low-level drivers over their
lifetime using the `COMEDI_DEVCONFIG` ioctl command. This can result in
inconsistent lock states being reported when there is a mismatch in the
spin-lock locking levels used by each low-level driver to which the
COMEDI device has been attached. Fix it by reinitializing
`dev->spinlock` before calling the low-level driver's `attach` function
pointer if `CONFIG_LOCKDEP` is enabled.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ed9eccbe8970f6eedc1b978c157caf1251a896d4 Version: ed9eccbe8970f6eedc1b978c157caf1251a896d4 Version: ed9eccbe8970f6eedc1b978c157caf1251a896d4 Version: ed9eccbe8970f6eedc1b978c157caf1251a896d4 Version: ed9eccbe8970f6eedc1b978c157caf1251a896d4 Version: ed9eccbe8970f6eedc1b978c157caf1251a896d4 Version: ed9eccbe8970f6eedc1b978c157caf1251a896d4 Version: ed9eccbe8970f6eedc1b978c157caf1251a896d4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/comedi/drivers.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3181c34b415c5464be9d34bff3e43ef63b747039",
"status": "affected",
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"versionType": "git"
},
{
"lessThan": "2b1f49e4fdff3ef0f8e9158bbb5b149e06287560",
"status": "affected",
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"versionType": "git"
},
{
"lessThan": "4d5ffe524903a30e2e0da7d16841a56bec2de55c",
"status": "affected",
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"versionType": "git"
},
{
"lessThan": "c01bcc67a9a692d65508ebd480405b5e77d562b7",
"status": "affected",
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"versionType": "git"
},
{
"lessThan": "430291d8f3884f57ae0057049b0ca291453e29e1",
"status": "affected",
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"versionType": "git"
},
{
"lessThan": "b89c026227712c367950bbae055a5b31073d3b30",
"status": "affected",
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"versionType": "git"
},
{
"lessThan": "83134a7a176ce5b4b19b6edecf4360e8d98d1a5a",
"status": "affected",
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"versionType": "git"
},
{
"lessThan": "4b9a9a6d71e3e252032f959fb3895a33acb5865c",
"status": "affected",
"version": "ed9eccbe8970f6eedc1b978c157caf1251a896d4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/comedi/drivers.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncomedi: Reinit dev-\u003espinlock between attachments to low-level drivers\n\n`struct comedi_device` is the main controlling structure for a COMEDI\ndevice created by the COMEDI subsystem. It contains a member `spinlock`\ncontaining a spin-lock that is initialized by the COMEDI subsystem, but\nis reserved for use by a low-level driver attached to the COMEDI device\n(at least since commit 25436dc9d84f (\"Staging: comedi: remove RT\ncode\")).\n\nSome COMEDI devices (those created on initialization of the COMEDI\nsubsystem when the \"comedi.comedi_num_legacy_minors\" parameter is\nnon-zero) can be attached to different low-level drivers over their\nlifetime using the `COMEDI_DEVCONFIG` ioctl command. This can result in\ninconsistent lock states being reported when there is a mismatch in the\nspin-lock locking levels used by each low-level driver to which the\nCOMEDI device has been attached. Fix it by reinitializing\n`dev-\u003espinlock` before calling the low-level driver\u0027s `attach` function\npointer if `CONFIG_LOCKDEP` is enabled."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:22:40.639Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3181c34b415c5464be9d34bff3e43ef63b747039"
},
{
"url": "https://git.kernel.org/stable/c/2b1f49e4fdff3ef0f8e9158bbb5b149e06287560"
},
{
"url": "https://git.kernel.org/stable/c/4d5ffe524903a30e2e0da7d16841a56bec2de55c"
},
{
"url": "https://git.kernel.org/stable/c/c01bcc67a9a692d65508ebd480405b5e77d562b7"
},
{
"url": "https://git.kernel.org/stable/c/430291d8f3884f57ae0057049b0ca291453e29e1"
},
{
"url": "https://git.kernel.org/stable/c/b89c026227712c367950bbae055a5b31073d3b30"
},
{
"url": "https://git.kernel.org/stable/c/83134a7a176ce5b4b19b6edecf4360e8d98d1a5a"
},
{
"url": "https://git.kernel.org/stable/c/4b9a9a6d71e3e252032f959fb3895a33acb5865c"
}
],
"title": "comedi: Reinit dev-\u003espinlock between attachments to low-level drivers",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43340",
"datePublished": "2026-05-08T13:37:18.580Z",
"dateReserved": "2026-05-01T14:12:56.003Z",
"dateUpdated": "2026-05-11T22:22:40.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46276 (GCVE-0-2026-46276)
Vulnerability from cvelistv5
Published
2026-06-08 15:41
Modified
2026-06-14 18:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix zero-size GDS range init on RDNA4
RDNA4 (GFX 12) hardware removes the GDS, GWS, and OA on-chip memory
resources. The gfx_v12_0 initialisation code correctly leaves
adev->gds.gds_size, adev->gds.gws_size, and adev->gds.oa_size at
zero to reflect this.
amdgpu_ttm_init() unconditionally calls amdgpu_ttm_init_on_chip() for
each of these resources regardless of size. When the size is zero,
amdgpu_ttm_init_on_chip() forwards the call to ttm_range_man_init(),
which calls drm_mm_init(mm, 0, 0). drm_mm_init() immediately fires
DRM_MM_BUG_ON(start + size <= start) -- trivially true when size is
zero -- crashing the kernel during modprobe of amdgpu on an RX 9070 XT.
Guard against this by returning 0 early from
amdgpu_ttm_init_on_chip() when size_in_page is zero. This skips TTM
resource manager registration for hardware resources that are absent,
without affecting any other GPU type.
DRM_MM_BUG_ON() only asserts if CONFIG_DRM_DEBUG_MM is enabled in
the kernel config. This is apparently rarely enabled as these chips
have been in the market for over a year and this issue was only reported
now.
Oops-Analysis: http://oops.fenrus.org/reports/bugzilla.korg/221376/report.html
(cherry picked from commit 5719ce5865279cad4fd5f01011fe037168503f2d)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c832c346cdf9022872655be621880e0f66f4135d Version: c832c346cdf9022872655be621880e0f66f4135d Version: c832c346cdf9022872655be621880e0f66f4135d Version: c832c346cdf9022872655be621880e0f66f4135d Version: c832c346cdf9022872655be621880e0f66f4135d Version: c832c346cdf9022872655be621880e0f66f4135d Version: c832c346cdf9022872655be621880e0f66f4135d Version: c832c346cdf9022872655be621880e0f66f4135d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1f5d33e7b0a9a2a140f46e22fb52eede323c5946",
"status": "affected",
"version": "c832c346cdf9022872655be621880e0f66f4135d",
"versionType": "git"
},
{
"lessThan": "9bc925759c05feae7dfa9570e77131d54729c8ea",
"status": "affected",
"version": "c832c346cdf9022872655be621880e0f66f4135d",
"versionType": "git"
},
{
"lessThan": "36f9602fb22ede69fcc8b422be0cf8105bf655ad",
"status": "affected",
"version": "c832c346cdf9022872655be621880e0f66f4135d",
"versionType": "git"
},
{
"lessThan": "be0376affcafa0bbb371bb501579a825eae32281",
"status": "affected",
"version": "c832c346cdf9022872655be621880e0f66f4135d",
"versionType": "git"
},
{
"lessThan": "0e21db1a77967bc15df662efdca8ea8a61d124ea",
"status": "affected",
"version": "c832c346cdf9022872655be621880e0f66f4135d",
"versionType": "git"
},
{
"lessThan": "30c000a49094ec568c9b51b7421f7a4a3f0b0298",
"status": "affected",
"version": "c832c346cdf9022872655be621880e0f66f4135d",
"versionType": "git"
},
{
"lessThan": "3e26c76891ab99fa173e9c501119fbb5c9f4600f",
"status": "affected",
"version": "c832c346cdf9022872655be621880e0f66f4135d",
"versionType": "git"
},
{
"lessThan": "095a8b0ad3c3b5cdc3850d961adb8a8f735220bb",
"status": "affected",
"version": "c832c346cdf9022872655be621880e0f66f4135d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix zero-size GDS range init on RDNA4\n\nRDNA4 (GFX 12) hardware removes the GDS, GWS, and OA on-chip memory\nresources. The gfx_v12_0 initialisation code correctly leaves\nadev-\u003egds.gds_size, adev-\u003egds.gws_size, and adev-\u003egds.oa_size at\nzero to reflect this.\n\namdgpu_ttm_init() unconditionally calls amdgpu_ttm_init_on_chip() for\neach of these resources regardless of size. When the size is zero,\namdgpu_ttm_init_on_chip() forwards the call to ttm_range_man_init(),\nwhich calls drm_mm_init(mm, 0, 0). drm_mm_init() immediately fires\nDRM_MM_BUG_ON(start + size \u003c= start) -- trivially true when size is\nzero -- crashing the kernel during modprobe of amdgpu on an RX 9070 XT.\n\nGuard against this by returning 0 early from\namdgpu_ttm_init_on_chip() when size_in_page is zero. This skips TTM\nresource manager registration for hardware resources that are absent,\nwithout affecting any other GPU type.\n\nDRM_MM_BUG_ON() only asserts if CONFIG_DRM_DEBUG_MM is enabled in\nthe kernel config. This is apparently rarely enabled as these chips\nhave been in the market for over a year and this issue was only reported\nnow.\n\nOops-Analysis: http://oops.fenrus.org/reports/bugzilla.korg/221376/report.html\n(cherry picked from commit 5719ce5865279cad4fd5f01011fe037168503f2d)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:05:43.582Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1f5d33e7b0a9a2a140f46e22fb52eede323c5946"
},
{
"url": "https://git.kernel.org/stable/c/9bc925759c05feae7dfa9570e77131d54729c8ea"
},
{
"url": "https://git.kernel.org/stable/c/36f9602fb22ede69fcc8b422be0cf8105bf655ad"
},
{
"url": "https://git.kernel.org/stable/c/be0376affcafa0bbb371bb501579a825eae32281"
},
{
"url": "https://git.kernel.org/stable/c/0e21db1a77967bc15df662efdca8ea8a61d124ea"
},
{
"url": "https://git.kernel.org/stable/c/30c000a49094ec568c9b51b7421f7a4a3f0b0298"
},
{
"url": "https://git.kernel.org/stable/c/3e26c76891ab99fa173e9c501119fbb5c9f4600f"
},
{
"url": "https://git.kernel.org/stable/c/095a8b0ad3c3b5cdc3850d961adb8a8f735220bb"
}
],
"title": "drm/amdgpu: fix zero-size GDS range init on RDNA4",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46276",
"datePublished": "2026-06-08T15:41:18.672Z",
"dateReserved": "2026-05-13T15:03:33.109Z",
"dateUpdated": "2026-06-14T18:05:43.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46093 (GCVE-0-2026-46093)
Vulnerability from cvelistv5
Published
2026-05-27 12:58
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/vmalloc: take vmap_purge_lock in shrinker
decay_va_pool_node() can be invoked concurrently from two paths:
__purge_vmap_area_lazy() when pools are being purged, and the shrinker via
vmap_node_shrink_scan().
However, decay_va_pool_node() is not safe to run concurrently, and the
shrinker path currently lacks serialization, leading to races and possible
leaks.
Protect decay_va_pool_node() by taking vmap_purge_lock in the shrinker
path to ensure serialization with purge users.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/vmalloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c15ff206ba78820bf2873d0c668a882e99f4b631",
"status": "affected",
"version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
"versionType": "git"
},
{
"lessThan": "687ccdf582169cd680aeaf24cc953807c4cd4345",
"status": "affected",
"version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
"versionType": "git"
},
{
"lessThan": "12f2341b4c235d5593a433abac201c1c6725787f",
"status": "affected",
"version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
"versionType": "git"
},
{
"lessThan": "ec05f51f1e65bce95528543eb73fda56fd201d94",
"status": "affected",
"version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/vmalloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: take vmap_purge_lock in shrinker\n\ndecay_va_pool_node() can be invoked concurrently from two paths:\n__purge_vmap_area_lazy() when pools are being purged, and the shrinker via\nvmap_node_shrink_scan().\n\nHowever, decay_va_pool_node() is not safe to run concurrently, and the\nshrinker path currently lacks serialization, leading to races and possible\nleaks.\n\nProtect decay_va_pool_node() by taking vmap_purge_lock in the shrinker\npath to ensure serialization with purge users."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable race is in core MM internals (vmap pool decay) reached only via local memory-management activity \u2014 inducing vmalloc/vfree churn (purge path) and memory pressure (shrinker path). No network-delivered data reaches the vulnerable function.\nAC:L - An unprivileged attacker controls both sides: one thread forces direct reclaim (shrinker\u2192decay) while another drives vmalloc/vfree churn past the lazy-free threshold (purge\u2192decay), and both can loop indefinitely to repeatedly attempt and win the narrow race.\nPR:L - Any unprivileged local process can allocate/free memory and induce reclaim; no capabilities or root are required to drive either racing path.\nUI:N - The race is triggered entirely by the attacker\u0027s own memory activity; no victim action is needed.\nS:U - The corruption stays within the kernel\u0027s own memory-management structures and does not cross into another security authority (no VM/IOMMU boundary escape).\nC:H - The data race corrupts the vmap pool linked list and free-area tree metadata; per kernel guidance, allocator memory corruption can be leveraged to read freed/adjacent kernel memory.\nI:H - Concurrent unserialized list_replace_init plus double-merge of vmap_area objects into the global free tree corrupts kernel free-list/tree state, a write/corruption primitive over allocator metadata.\nA:H - Corrupted lists and inconsistent len accounting (and the documented leaks) cause kernel crashes/oops and resource exhaustion when the corrupted pool is subsequently traversed or reused."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:35.424Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c15ff206ba78820bf2873d0c668a882e99f4b631"
},
{
"url": "https://git.kernel.org/stable/c/687ccdf582169cd680aeaf24cc953807c4cd4345"
},
{
"url": "https://git.kernel.org/stable/c/12f2341b4c235d5593a433abac201c1c6725787f"
},
{
"url": "https://git.kernel.org/stable/c/ec05f51f1e65bce95528543eb73fda56fd201d94"
}
],
"title": "mm/vmalloc: take vmap_purge_lock in shrinker",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46093",
"datePublished": "2026-05-27T12:58:43.458Z",
"dateReserved": "2026-05-13T15:03:33.097Z",
"dateUpdated": "2026-08-05T12:29:35.424Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46249 (GCVE-0-2026-46249)
Vulnerability from cvelistv5
Published
2026-06-03 15:49
Modified
2026-06-03 15:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: Fix PF driver crash with kexec kernel booting
During a kexec reboot the hardware is not power-cycled, so AF state from
the old kernel can persist into the new kernel. When AF and PF drivers
are built as modules, the PF driver may probe before AF reinitializes
the hardware.
The PF driver treats the RVUM block revision as an indication that AF
initialization is complete. If this value is left uncleared at shutdown,
PF may incorrectly assume AF is ready and access stale hardware state,
leading to a crash.
Clear the RVUM block revision during AF shutdown to avoid PF
mis-detecting AF readiness after kexec.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 54494aa5d1e68945dc79feb7c8461cd382e11d8a Version: 54494aa5d1e68945dc79feb7c8461cd382e11d8a Version: 54494aa5d1e68945dc79feb7c8461cd382e11d8a Version: 54494aa5d1e68945dc79feb7c8461cd382e11d8a Version: 54494aa5d1e68945dc79feb7c8461cd382e11d8a Version: 54494aa5d1e68945dc79feb7c8461cd382e11d8a Version: 54494aa5d1e68945dc79feb7c8461cd382e11d8a Version: 54494aa5d1e68945dc79feb7c8461cd382e11d8a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/octeontx2/af/rvu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b7605b9301abc18fbbf2b0e23fdd281fc768955d",
"status": "affected",
"version": "54494aa5d1e68945dc79feb7c8461cd382e11d8a",
"versionType": "git"
},
{
"lessThan": "9769a09afda20a006b528b9e723effcae45965b2",
"status": "affected",
"version": "54494aa5d1e68945dc79feb7c8461cd382e11d8a",
"versionType": "git"
},
{
"lessThan": "57821d1436ba1c6a6973aa32d54166fdec35558c",
"status": "affected",
"version": "54494aa5d1e68945dc79feb7c8461cd382e11d8a",
"versionType": "git"
},
{
"lessThan": "8b5ed7c5417b7013d35b6f2507dab739013ba1a9",
"status": "affected",
"version": "54494aa5d1e68945dc79feb7c8461cd382e11d8a",
"versionType": "git"
},
{
"lessThan": "7d56ba306e93d04696718963fb4cda2883ee7585",
"status": "affected",
"version": "54494aa5d1e68945dc79feb7c8461cd382e11d8a",
"versionType": "git"
},
{
"lessThan": "9c3398e5b3a914b74276d44ab54c49123b89c61a",
"status": "affected",
"version": "54494aa5d1e68945dc79feb7c8461cd382e11d8a",
"versionType": "git"
},
{
"lessThan": "1370736836a18b5e0cd74bcc9cffe11d21f1fe79",
"status": "affected",
"version": "54494aa5d1e68945dc79feb7c8461cd382e11d8a",
"versionType": "git"
},
{
"lessThan": "2d2d574309e3ae84ee794869a5da8b4c38753a94",
"status": "affected",
"version": "54494aa5d1e68945dc79feb7c8461cd382e11d8a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/octeontx2/af/rvu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: Fix PF driver crash with kexec kernel booting\n\nDuring a kexec reboot the hardware is not power-cycled, so AF state from\nthe old kernel can persist into the new kernel. When AF and PF drivers\nare built as modules, the PF driver may probe before AF reinitializes\nthe hardware.\n\nThe PF driver treats the RVUM block revision as an indication that AF\ninitialization is complete. If this value is left uncleared at shutdown,\nPF may incorrectly assume AF is ready and access stale hardware state,\nleading to a crash.\n\nClear the RVUM block revision during AF shutdown to avoid PF\nmis-detecting AF readiness after kexec."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T15:49:45.252Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b7605b9301abc18fbbf2b0e23fdd281fc768955d"
},
{
"url": "https://git.kernel.org/stable/c/9769a09afda20a006b528b9e723effcae45965b2"
},
{
"url": "https://git.kernel.org/stable/c/57821d1436ba1c6a6973aa32d54166fdec35558c"
},
{
"url": "https://git.kernel.org/stable/c/8b5ed7c5417b7013d35b6f2507dab739013ba1a9"
},
{
"url": "https://git.kernel.org/stable/c/7d56ba306e93d04696718963fb4cda2883ee7585"
},
{
"url": "https://git.kernel.org/stable/c/9c3398e5b3a914b74276d44ab54c49123b89c61a"
},
{
"url": "https://git.kernel.org/stable/c/1370736836a18b5e0cd74bcc9cffe11d21f1fe79"
},
{
"url": "https://git.kernel.org/stable/c/2d2d574309e3ae84ee794869a5da8b4c38753a94"
}
],
"title": "octeontx2-af: Fix PF driver crash with kexec kernel booting",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46249",
"datePublished": "2026-06-03T15:49:45.252Z",
"dateReserved": "2026-05-13T15:03:33.107Z",
"dateUpdated": "2026-06-03T15:49:45.252Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46150 (GCVE-0-2026-46150)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fanotify: fix false positive on permission events
fsnotify_get_mark_safe() may return false for a mark on an unrelated group,
which results in bypassing the permission check.
Fix by skipping over detached marks that are not in the current group.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: abc77577a669f424c5d0c185b9994f2621c52aa4 Version: abc77577a669f424c5d0c185b9994f2621c52aa4 Version: abc77577a669f424c5d0c185b9994f2621c52aa4 Version: abc77577a669f424c5d0c185b9994f2621c52aa4 Version: abc77577a669f424c5d0c185b9994f2621c52aa4 Version: abc77577a669f424c5d0c185b9994f2621c52aa4 Version: abc77577a669f424c5d0c185b9994f2621c52aa4 Version: abc77577a669f424c5d0c185b9994f2621c52aa4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/notify/fsnotify.c",
"fs/notify/mark.c",
"include/linux/fsnotify_backend.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a24765332e129c1916d5a6615418b75599b8fcdc",
"status": "affected",
"version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
"versionType": "git"
},
{
"lessThan": "4a7611ad653785fcdea5ff5f4441e2b7d05b7f11",
"status": "affected",
"version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
"versionType": "git"
},
{
"lessThan": "04bb66be92f48ed13c3faf1139d892df228789bc",
"status": "affected",
"version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
"versionType": "git"
},
{
"lessThan": "895ebbedf88318607c24acc0f591c74b165e1d0a",
"status": "affected",
"version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
"versionType": "git"
},
{
"lessThan": "f130790f1acc8399f32652846c875a251efd040f",
"status": "affected",
"version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
"versionType": "git"
},
{
"lessThan": "7baa02b0ae9d17ec5f08836d8ea88ce1927d0678",
"status": "affected",
"version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
"versionType": "git"
},
{
"lessThan": "b7b24b28c8cd55844cab908f4f39dded638d5538",
"status": "affected",
"version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
"versionType": "git"
},
{
"lessThan": "7746e3bd4cc19b5092e00d32d676e329bfcb6900",
"status": "affected",
"version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/notify/fsnotify.c",
"fs/notify/mark.c",
"include/linux/fsnotify_backend.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfanotify: fix false positive on permission events\n\nfsnotify_get_mark_safe() may return false for a mark on an unrelated group,\nwhich results in bypassing the permission check.\n\nFix by skipping over detached marks that are not in the current group."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code runs in the context of a local file operation (open/read/exec) that triggers the fanotify permission event; the attacker bypasses the control by performing local file ops plus churning a local inotify watch. The fully-controllable, reliable attack is local (a remote file-server scenario would lose attacker control of the race).\nAC:L - The attacker controls both sides of the race \u2014 the lifecycle of the unrelated (unprivileged inotify) mark and the retried file operation \u2014 and each open() is a fresh permission event, so with unlimited retries the bypass is reliably reachable.\nPR:L - Exploitation only needs an unprivileged local account: creating an inotify watch on the parent directory and opening/executing the target file require no capabilities (the privileged CAP_SYS_ADMIN fanotify group is the victim control, not the attacker).\nUI:N - The attacker performs all actions (inotify churn plus repeated file access) with no interaction from any other user.\nS:U - The flaw and its impact are both mediated entirely within the kernel\u0027s own access-control path; no boundary to a separately-managed security authority (VM, IOMMU) is crossed.\nC:H - Bypassing FAN_ACCESS_PERM/FAN_OPEN_PERM lets read access to files the policy (AV/sandbox/EDR) would deny proceed; via targeted retries the attacker can force disclosure of chosen protected files, approaching total loss of confidentiality of protected resources.\nI:H - Bypassing FAN_OPEN_PERM/FAN_OPEN_EXEC_PERM lets writes to protected files and execution of binaries the policy would block proceed, allowing modification of protected resources and execution of disallowed code.\nA:N - The bug is fail-open (it only allows operations that should be blocked); it causes no crash, hang, or resource exhaustion, so availability is unaffected."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:03.577Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a24765332e129c1916d5a6615418b75599b8fcdc"
},
{
"url": "https://git.kernel.org/stable/c/4a7611ad653785fcdea5ff5f4441e2b7d05b7f11"
},
{
"url": "https://git.kernel.org/stable/c/04bb66be92f48ed13c3faf1139d892df228789bc"
},
{
"url": "https://git.kernel.org/stable/c/895ebbedf88318607c24acc0f591c74b165e1d0a"
},
{
"url": "https://git.kernel.org/stable/c/f130790f1acc8399f32652846c875a251efd040f"
},
{
"url": "https://git.kernel.org/stable/c/7baa02b0ae9d17ec5f08836d8ea88ce1927d0678"
},
{
"url": "https://git.kernel.org/stable/c/b7b24b28c8cd55844cab908f4f39dded638d5538"
},
{
"url": "https://git.kernel.org/stable/c/7746e3bd4cc19b5092e00d32d676e329bfcb6900"
}
],
"title": "fanotify: fix false positive on permission events",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46150",
"datePublished": "2026-05-28T09:36:06.494Z",
"dateReserved": "2026-05-13T15:03:33.101Z",
"dateUpdated": "2026-08-05T12:30:03.577Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43320 (GCVE-0-2026-43320)
Vulnerability from cvelistv5
Published
2026-05-08 13:26
Modified
2026-05-23 16:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix dsc eDP issue
[why]
Need to add function hook check before use
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3766a840e093d30e1a2522f650d8a6ac892a8719 Version: 3766a840e093d30e1a2522f650d8a6ac892a8719 Version: 3766a840e093d30e1a2522f650d8a6ac892a8719 Version: 3766a840e093d30e1a2522f650d8a6ac892a8719 Version: c9a3c3e2bffe43304fcda9190d17f6b327e538b4 Version: 9437d60dd00f3caa15e71f84dd5eb3404b141372 Version: 6.10.13 ≤ Version: 6.11.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "11718976c53a258c4d107aa05d68773379d0006f",
"status": "affected",
"version": "3766a840e093d30e1a2522f650d8a6ac892a8719",
"versionType": "git"
},
{
"lessThan": "c10fe9471f3aa352bb9d9329d0b25e28e0672243",
"status": "affected",
"version": "3766a840e093d30e1a2522f650d8a6ac892a8719",
"versionType": "git"
},
{
"lessThan": "0481be9f12d8324789ccebf1e5fd0704b6e3fc99",
"status": "affected",
"version": "3766a840e093d30e1a2522f650d8a6ac892a8719",
"versionType": "git"
},
{
"lessThan": "878a4b73c11111ff5f820730f59a7f8c6fd59374",
"status": "affected",
"version": "3766a840e093d30e1a2522f650d8a6ac892a8719",
"versionType": "git"
},
{
"status": "affected",
"version": "c9a3c3e2bffe43304fcda9190d17f6b327e538b4",
"versionType": "git"
},
{
"status": "affected",
"version": "9437d60dd00f3caa15e71f84dd5eb3404b141372",
"versionType": "git"
},
{
"lessThan": "6.11",
"status": "affected",
"version": "6.10.13",
"versionType": "semver"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix dsc eDP issue\n\n[why]\nNeed to add function hook check before use"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:06:41.400Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/11718976c53a258c4d107aa05d68773379d0006f"
},
{
"url": "https://git.kernel.org/stable/c/c10fe9471f3aa352bb9d9329d0b25e28e0672243"
},
{
"url": "https://git.kernel.org/stable/c/0481be9f12d8324789ccebf1e5fd0704b6e3fc99"
},
{
"url": "https://git.kernel.org/stable/c/878a4b73c11111ff5f820730f59a7f8c6fd59374"
}
],
"title": "drm/amd/display: Fix dsc eDP issue",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43320",
"datePublished": "2026-05-08T13:26:14.930Z",
"dateReserved": "2026-05-01T14:12:56.001Z",
"dateUpdated": "2026-05-23T16:06:41.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46136 (GCVE-0-2026-46136)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-06-14 17:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7921: fix a potential clc buffer length underflow
The buf_len is used to limit the iterations for retrieving the country
power setting and may underflow under certain conditions due to changes
in the power table in CLC.
This underflow leads to an almost infinite loop or an invalid power
setting resulting in driver initialization failure.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0c9318d49e501a5d50b02bd91a4813bde2353488 Version: 15173a1697236793e9e900b82fece6f99d41b2a7 Version: fa6ad88e023ddfa6c5dcdb466d159e89f451e305 Version: fa6ad88e023ddfa6c5dcdb466d159e89f451e305 Version: fa6ad88e023ddfa6c5dcdb466d159e89f451e305 Version: fa6ad88e023ddfa6c5dcdb466d159e89f451e305 Version: 5c8cac512844ad593d31258e215908014381bee2 Version: 6.1.75 ≤ Version: 6.6.14 ≤ Version: 6.7.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7921/mcu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2a79b1a492bcfa725383b6580cd93a6862308c85",
"status": "affected",
"version": "0c9318d49e501a5d50b02bd91a4813bde2353488",
"versionType": "git"
},
{
"lessThan": "e451c325b000b9a0081fd93bc6d103d6943d4b55",
"status": "affected",
"version": "15173a1697236793e9e900b82fece6f99d41b2a7",
"versionType": "git"
},
{
"lessThan": "90cc573fd2f46ddbc2c329e7814b5ba3deb7b939",
"status": "affected",
"version": "fa6ad88e023ddfa6c5dcdb466d159e89f451e305",
"versionType": "git"
},
{
"lessThan": "0aa63d33742b805d1a218d18d12b983cce4b2f7b",
"status": "affected",
"version": "fa6ad88e023ddfa6c5dcdb466d159e89f451e305",
"versionType": "git"
},
{
"lessThan": "a0111847f0b4f6023f6dd320114697514e024ba3",
"status": "affected",
"version": "fa6ad88e023ddfa6c5dcdb466d159e89f451e305",
"versionType": "git"
},
{
"lessThan": "5373f8b19e568b5c217832b9bbef165bd2b2df14",
"status": "affected",
"version": "fa6ad88e023ddfa6c5dcdb466d159e89f451e305",
"versionType": "git"
},
{
"status": "affected",
"version": "5c8cac512844ad593d31258e215908014381bee2",
"versionType": "git"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.75",
"versionType": "semver"
},
{
"lessThan": "6.6.140",
"status": "affected",
"version": "6.6.14",
"versionType": "semver"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7921/mcu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7921: fix a potential clc buffer length underflow\n\nThe buf_len is used to limit the iterations for retrieving the country\npower setting and may underflow under certain conditions due to changes\nin the power table in CLC.\n\nThis underflow leads to an almost infinite loop or an invalid power\nsetting resulting in driver initialization failure."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:57:08.679Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2a79b1a492bcfa725383b6580cd93a6862308c85"
},
{
"url": "https://git.kernel.org/stable/c/e451c325b000b9a0081fd93bc6d103d6943d4b55"
},
{
"url": "https://git.kernel.org/stable/c/90cc573fd2f46ddbc2c329e7814b5ba3deb7b939"
},
{
"url": "https://git.kernel.org/stable/c/0aa63d33742b805d1a218d18d12b983cce4b2f7b"
},
{
"url": "https://git.kernel.org/stable/c/a0111847f0b4f6023f6dd320114697514e024ba3"
},
{
"url": "https://git.kernel.org/stable/c/5373f8b19e568b5c217832b9bbef165bd2b2df14"
}
],
"title": "wifi: mt76: mt7921: fix a potential clc buffer length underflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46136",
"datePublished": "2026-05-28T09:35:52.004Z",
"dateReserved": "2026-05-13T15:03:33.099Z",
"dateUpdated": "2026-06-14T17:57:08.679Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53253 (GCVE-0-2026-53253)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: bnep: reject short frames before parsing
A BNEP peer can send a short BNEP SDU. bnep_rx_frame() reads the
packet type byte immediately and, for control packets, reads the control
opcode and setup UUID-size byte before proving that those bytes are
present. bnep_rx_control() also dereferences the control opcode without
rejecting an empty control payload.
Use skb_pull_data() for the fixed fields in bnep_rx_frame() so a NULL
return gates each dereference. Split the control handler so the frame
path can pass an opcode that has already been pulled, and keep the
byte-buffer wrapper for extension control payloads.
For BNEP_SETUP_CONN_REQ, name the UUID-size byte before pulling the
setup payload. struct bnep_setup_conn_req carries destination and source
service UUIDs after that byte, each uuid_size bytes, so the parser now
documents that tuple explicitly instead of leaving the pull length as an
opaque multiplication.
Validation reproduced this kernel report:
KASAN slab-out-of-bounds in bnep_rx_frame.isra.0+0x130c/0x1790
The buggy address belongs to the object at ffff88800c0f7908 which belongs
to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes to the right of allocated 1-byte
region [ffff88800c0f7908, ffff88800c0f7909)
Read of size 1
Call trace:
dump_stack_lvl+0xb3/0x140 (?:?)
print_address_description+0x57/0x3a0 (?:?)
bnep_rx_frame+0x130c/0x1790 (net/bluetooth/bnep/core.c:306)
print_report+0xb9/0x2b0 (?:?)
__virt_addr_valid+0x1ba/0x3a0 (?:?)
srso_alias_return_thunk+0x5/0xfbef5 (?:?)
kasan_addr_to_slab+0x21/0x60 (?:?)
kasan_report+0xe0/0x110 (?:?)
process_one_work+0xfce/0x17e0 (kernel/workqueue.c:3200)
worker_thread+0x65c/0xe40 (?:?)
__kthread_parkme+0x184/0x230 (?:?)
kthread+0x35e/0x470 (?:?)
_raw_spin_unlock_irq+0x28/0x50 (?:?)
ret_from_fork+0x586/0x870 (?:?)
__switch_to+0x74f/0xdc0 (?:?)
ret_from_fork_asm+0x1a/0x30 (?:?)
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/bnep/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0ef2ea86c82b2615902d085cd5a586fe9f58994f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2b83afb19293e4de700edae306115f18966dc4f9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "691f14b6a48b637655755134f1e551c7c6fedc2e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d76dec1a37122bc16d83d059c08c0512ea8de909",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c893e17d2809ec9c4b3f1cdd5847cecbc27a311b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "be837cd09897e9e6e1958174501d467bdcbcc2bc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6770d3a8acdf9151769180cc3710346c4cfbe6f0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/bnep/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bnep: reject short frames before parsing\n\nA BNEP peer can send a short BNEP SDU. bnep_rx_frame() reads the\npacket type byte immediately and, for control packets, reads the control\nopcode and setup UUID-size byte before proving that those bytes are\npresent. bnep_rx_control() also dereferences the control opcode without\nrejecting an empty control payload.\n\nUse skb_pull_data() for the fixed fields in bnep_rx_frame() so a NULL\nreturn gates each dereference. Split the control handler so the frame\npath can pass an opcode that has already been pulled, and keep the\nbyte-buffer wrapper for extension control payloads.\n\nFor BNEP_SETUP_CONN_REQ, name the UUID-size byte before pulling the\nsetup payload. struct bnep_setup_conn_req carries destination and source\nservice UUIDs after that byte, each uuid_size bytes, so the parser now\ndocuments that tuple explicitly instead of leaving the pull length as an\nopaque multiplication.\n\nValidation reproduced this kernel report:\nKASAN slab-out-of-bounds in bnep_rx_frame.isra.0+0x130c/0x1790\nThe buggy address belongs to the object at ffff88800c0f7908 which belongs\nto the cache kmalloc-8 of size 8\nThe buggy address is located 0 bytes to the right of allocated 1-byte\nregion [ffff88800c0f7908, ffff88800c0f7909)\nRead of size 1\nCall trace:\n dump_stack_lvl+0xb3/0x140 (?:?)\n print_address_description+0x57/0x3a0 (?:?)\n bnep_rx_frame+0x130c/0x1790 (net/bluetooth/bnep/core.c:306)\n print_report+0xb9/0x2b0 (?:?)\n __virt_addr_valid+0x1ba/0x3a0 (?:?)\n srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n kasan_addr_to_slab+0x21/0x60 (?:?)\n kasan_report+0xe0/0x110 (?:?)\n process_one_work+0xfce/0x17e0 (kernel/workqueue.c:3200)\n worker_thread+0x65c/0xe40 (?:?)\n __kthread_parkme+0x184/0x230 (?:?)\n kthread+0x35e/0x470 (?:?)\n _raw_spin_unlock_irq+0x28/0x50 (?:?)\n ret_from_fork+0x586/0x870 (?:?)\n __switch_to+0x74f/0xdc0 (?:?)\n ret_from_fork_asm+0x1a/0x30 (?:?)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - Bluetooth BNEP traffic is delivered by an adjacent Bluetooth/L2CAP peer over the PAN channel. The vulnerable parser is reached from received Bluetooth packets, not from an Internet-routable network path.\nAC:L - A peer can trigger the bug with a deliberately short BNEP SDU such as a one-byte control frame or truncated setup request. No race, heap grooming, or victim state beyond an established BNEP channel is required to reach the invalid read.\nPR:N - The attacker is the remote Bluetooth BNEP peer sending payload bytes after the channel exists and needs no privileges on the target system. The local CAP_NET_ADMIN check only applies to the trusted userspace component that creates the BNEP session.\nUI:N - Once a BNEP/PAN service or connection is active, the malicious peer can send the malformed SDU without further victim action. No file opening, mount, or interactive operation is needed for the vulnerable receive path.\nS:U - The impact is within the target kernel/Bluetooth networking stack security authority. There is no VM, IOMMU, or separate sandbox boundary crossed.\nC:L - The bug is a fixed-field out-of-bounds read of one-byte BNEP type/opcode/UUID-size fields, with at most limited adjacent heap-byte exposure. It is not an arbitrary kernel memory read primitive.\nI:N - The vulnerable paths perform out-of-bounds reads before validation but do not write past bounds or corrupt attacker-chosen kernel structures. No credible integrity impact follows from the parsed short-frame bug itself.\nA:H - The fix commit reproduces a KASAN slab-out-of-bounds report in bnep_rx_frame from attacker-controlled short frames. Repeated adjacent peer-triggered malformed frames can crash or panic affected/hardened kernels, causing denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:34.736Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ef2ea86c82b2615902d085cd5a586fe9f58994f"
},
{
"url": "https://git.kernel.org/stable/c/2b83afb19293e4de700edae306115f18966dc4f9"
},
{
"url": "https://git.kernel.org/stable/c/691f14b6a48b637655755134f1e551c7c6fedc2e"
},
{
"url": "https://git.kernel.org/stable/c/d76dec1a37122bc16d83d059c08c0512ea8de909"
},
{
"url": "https://git.kernel.org/stable/c/c893e17d2809ec9c4b3f1cdd5847cecbc27a311b"
},
{
"url": "https://git.kernel.org/stable/c/be837cd09897e9e6e1958174501d467bdcbcc2bc"
},
{
"url": "https://git.kernel.org/stable/c/6770d3a8acdf9151769180cc3710346c4cfbe6f0"
}
],
"title": "Bluetooth: bnep: reject short frames before parsing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53253",
"datePublished": "2026-06-25T08:39:44.612Z",
"dateReserved": "2026-06-09T07:44:35.394Z",
"dateUpdated": "2026-08-05T12:34:34.736Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43233 (GCVE-0-2026-43233)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
In decode_choice(), the boundary check before get_len() uses the
variable `len`, which is still 0 from its initialization at the top of
the function:
unsigned int type, ext, len = 0;
...
if (ext || (son->attr & OPEN)) {
BYTE_ALIGN(bs);
if (nf_h323_error_boundary(bs, len, 0)) /* len is 0 here */
return H323_ERROR_BOUND;
len = get_len(bs); /* OOB read */
When the bitstream is exactly consumed (bs->cur == bs->end), the check
nf_h323_error_boundary(bs, 0, 0) evaluates to (bs->cur + 0 > bs->end),
which is false. The subsequent get_len() call then dereferences
*bs->cur++, reading 1 byte past the end of the buffer. If that byte
has bit 7 set, get_len() reads a second byte as well.
This can be triggered remotely by sending a crafted Q.931 SETUP message
with a User-User Information Element containing exactly 2 bytes of
PER-encoded data ({0x08, 0x00}) to port 1720 through a firewall with
the nf_conntrack_h323 helper active. The decoder fully consumes the
PER buffer before reaching this code path, resulting in a 1-2 byte
heap-buffer-overflow read confirmed by AddressSanitizer.
Fix this by checking for 2 bytes (the maximum that get_len() may read)
instead of the uninitialized `len`. This matches the pattern used at
every other get_len() call site in the same file, where the caller
checks for 2 bytes of available data before calling get_len().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa Version: ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa Version: ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa Version: ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa Version: ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa Version: ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa Version: ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa Version: ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_h323_asn1.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041",
"status": "affected",
"version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
"versionType": "git"
},
{
"lessThan": "2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a",
"status": "affected",
"version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
"versionType": "git"
},
{
"lessThan": "81f2fc5b0d0cf4696146f00f837596d10b92dead",
"status": "affected",
"version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
"versionType": "git"
},
{
"lessThan": "7ef82863d42261817a6394c6c881bd6757a70f16",
"status": "affected",
"version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
"versionType": "git"
},
{
"lessThan": "53d32735d77ab56cc3fc7bd53a7d099418f19be1",
"status": "affected",
"version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
"versionType": "git"
},
{
"lessThan": "f0a83d0a4b7c127d32ac06d607a9214937716129",
"status": "affected",
"version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
"versionType": "git"
},
{
"lessThan": "35f1943d242e1b9f0b6e91c0c93bfb293a9f8224",
"status": "affected",
"version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
"versionType": "git"
},
{
"lessThan": "baed0d9ba91d4f390da12d5039128ee897253d60",
"status": "affected",
"version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_h323_asn1.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: fix OOB read in decode_choice()\n\nIn decode_choice(), the boundary check before get_len() uses the\nvariable `len`, which is still 0 from its initialization at the top of\nthe function:\n\n unsigned int type, ext, len = 0;\n ...\n if (ext || (son-\u003eattr \u0026 OPEN)) {\n BYTE_ALIGN(bs);\n if (nf_h323_error_boundary(bs, len, 0)) /* len is 0 here */\n return H323_ERROR_BOUND;\n len = get_len(bs); /* OOB read */\n\nWhen the bitstream is exactly consumed (bs-\u003ecur == bs-\u003eend), the check\nnf_h323_error_boundary(bs, 0, 0) evaluates to (bs-\u003ecur + 0 \u003e bs-\u003eend),\nwhich is false. The subsequent get_len() call then dereferences\n*bs-\u003ecur++, reading 1 byte past the end of the buffer. If that byte\nhas bit 7 set, get_len() reads a second byte as well.\n\nThis can be triggered remotely by sending a crafted Q.931 SETUP message\nwith a User-User Information Element containing exactly 2 bytes of\nPER-encoded data ({0x08, 0x00}) to port 1720 through a firewall with\nthe nf_conntrack_h323 helper active. The decoder fully consumes the\nPER buffer before reaching this code path, resulting in a 1-2 byte\nheap-buffer-overflow read confirmed by AddressSanitizer.\n\nFix this by checking for 2 bytes (the maximum that get_len() may read)\ninstead of the uninitialized `len`. This matches the pattern used at\nevery other get_len() call site in the same file, where the caller\nchecks for 2 bytes of available data before calling get_len()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable H.323 conntrack Q.931 helper processes TCP/1720 network traffic, and the fix explicitly documents remote triggering with a crafted Q.931 SETUP User-User IE through a firewall with the helper active.\nAC:L - The trigger is a deterministic malformed PER buffer of exact length; no race, heap grooming, or victim-controlled timing is required beyond the helper being active.\nPR:N - The attacker only sends network packets to a system/firewall where the H.323 helper is configured; the Q.931 parsing path has no authentication or attacker privilege check.\nUI:N - No victim user action is needed once the helper is active; packet receipt alone drives conntrack into the decoder.\nS:U - The impact remains within the kernel/network filtering security authority and does not cross a VM, IOMMU, or other separate security boundary.\nC:L - The bug performs a strictly bounded 1-2 byte out-of-bounds heap read via get_len(), so any confidentiality impact is limited rather than arbitrary memory disclosure.\nI:N - The vulnerable operation is read-only, and the subsequent bounds check returns an error; there is no out-of-bounds write or structure corruption.\nA:H - The remotely triggerable kernel heap out-of-bounds read is reachable repeatedly from packet processing and can cause sanitizer/oops/panic-style kernel failure on affected deployments."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:46.159Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041"
},
{
"url": "https://git.kernel.org/stable/c/2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a"
},
{
"url": "https://git.kernel.org/stable/c/81f2fc5b0d0cf4696146f00f837596d10b92dead"
},
{
"url": "https://git.kernel.org/stable/c/7ef82863d42261817a6394c6c881bd6757a70f16"
},
{
"url": "https://git.kernel.org/stable/c/53d32735d77ab56cc3fc7bd53a7d099418f19be1"
},
{
"url": "https://git.kernel.org/stable/c/f0a83d0a4b7c127d32ac06d607a9214937716129"
},
{
"url": "https://git.kernel.org/stable/c/35f1943d242e1b9f0b6e91c0c93bfb293a9f8224"
},
{
"url": "https://git.kernel.org/stable/c/baed0d9ba91d4f390da12d5039128ee897253d60"
}
],
"title": "netfilter: nf_conntrack_h323: fix OOB read in decode_choice()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43233",
"datePublished": "2026-05-06T11:28:29.565Z",
"dateReserved": "2026-05-01T14:12:55.995Z",
"dateUpdated": "2026-08-05T12:26:46.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43085 (GCVE-0-2026-43085)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-06-01 16:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
When batching multiple NFLOG messages (inst->qlen > 1), __nfulnl_send()
appends an NLMSG_DONE terminator with sizeof(struct nfgenmsg) payload via
nlmsg_put(), but never initializes the nfgenmsg bytes. The nlmsg_put()
helper only zeroes alignment padding after the payload, not the payload
itself, so four bytes of stale kernel heap data are leaked to userspace
in the NLMSG_DONE message body.
Use nfnl_msg_put() to build the NLMSG_DONE terminator, which initializes
the nfgenmsg payload via nfnl_fill_hdr(), consistent with how
__build_packet_message() already constructs NFULNL_MSG_PACKET headers.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 Version: 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 Version: 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 Version: 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 Version: 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 Version: 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 Version: 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 Version: 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nfnetlink_log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "296f18e1c3a87c915a92ed27832d5040a22d1072",
"status": "affected",
"version": "29c5d4afba51c71cfeadd3f74f3c42e064483fb0",
"versionType": "git"
},
{
"lessThan": "9e2182865de781c41ab16b7985e9d26dcefea867",
"status": "affected",
"version": "29c5d4afba51c71cfeadd3f74f3c42e064483fb0",
"versionType": "git"
},
{
"lessThan": "57cc509d82b46150a11dcecc8b25eaa177eda34d",
"status": "affected",
"version": "29c5d4afba51c71cfeadd3f74f3c42e064483fb0",
"versionType": "git"
},
{
"lessThan": "368c22aea490f6f50df831b4f9e3623787686c5b",
"status": "affected",
"version": "29c5d4afba51c71cfeadd3f74f3c42e064483fb0",
"versionType": "git"
},
{
"lessThan": "d1399632ba255d2e02c757af5d9f5d9279ce168c",
"status": "affected",
"version": "29c5d4afba51c71cfeadd3f74f3c42e064483fb0",
"versionType": "git"
},
{
"lessThan": "d552bcfca323d175664d7444989b04f55666978a",
"status": "affected",
"version": "29c5d4afba51c71cfeadd3f74f3c42e064483fb0",
"versionType": "git"
},
{
"lessThan": "15d209bccf9273b4a8b4e579ba0e92d065b6ec8c",
"status": "affected",
"version": "29c5d4afba51c71cfeadd3f74f3c42e064483fb0",
"versionType": "git"
},
{
"lessThan": "1f3083aec8836213da441270cdb1ab612dd82cf4",
"status": "affected",
"version": "29c5d4afba51c71cfeadd3f74f3c42e064483fb0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nfnetlink_log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.23"
},
{
"lessThan": "2.6.23",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "2.6.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator\n\nWhen batching multiple NFLOG messages (inst-\u003eqlen \u003e 1), __nfulnl_send()\nappends an NLMSG_DONE terminator with sizeof(struct nfgenmsg) payload via\nnlmsg_put(), but never initializes the nfgenmsg bytes. The nlmsg_put()\nhelper only zeroes alignment padding after the payload, not the payload\nitself, so four bytes of stale kernel heap data are leaked to userspace\nin the NLMSG_DONE message body.\n\nUse nfnl_msg_put() to build the NLMSG_DONE terminator, which initializes\nthe nfgenmsg payload via nfnl_fill_hdr(), consistent with how\n__build_packet_message() already constructs NFULNL_MSG_PACKET headers."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T16:14:26.215Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/296f18e1c3a87c915a92ed27832d5040a22d1072"
},
{
"url": "https://git.kernel.org/stable/c/9e2182865de781c41ab16b7985e9d26dcefea867"
},
{
"url": "https://git.kernel.org/stable/c/57cc509d82b46150a11dcecc8b25eaa177eda34d"
},
{
"url": "https://git.kernel.org/stable/c/368c22aea490f6f50df831b4f9e3623787686c5b"
},
{
"url": "https://git.kernel.org/stable/c/d1399632ba255d2e02c757af5d9f5d9279ce168c"
},
{
"url": "https://git.kernel.org/stable/c/d552bcfca323d175664d7444989b04f55666978a"
},
{
"url": "https://git.kernel.org/stable/c/15d209bccf9273b4a8b4e579ba0e92d065b6ec8c"
},
{
"url": "https://git.kernel.org/stable/c/1f3083aec8836213da441270cdb1ab612dd82cf4"
}
],
"title": "netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43085",
"datePublished": "2026-05-06T07:40:19.915Z",
"dateReserved": "2026-05-01T14:12:55.983Z",
"dateUpdated": "2026-06-01T16:14:26.215Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31549 (GCVE-0-2026-31549)
Vulnerability from cvelistv5
Published
2026-04-24 14:33
Modified
2026-05-11 22:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: cp2615: fix serial string NULL-deref at probe
The cp2615 driver uses the USB device serial string as the i2c adapter
name but does not make sure that the string exists.
Verify that the device has a serial number before accessing it to avoid
triggering a NULL-pointer dereference (e.g. with malicious devices).
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4a7695429eade517b07ea72f9ec366130e81a076 Version: 4a7695429eade517b07ea72f9ec366130e81a076 Version: 4a7695429eade517b07ea72f9ec366130e81a076 Version: 4a7695429eade517b07ea72f9ec366130e81a076 Version: 4a7695429eade517b07ea72f9ec366130e81a076 Version: 4a7695429eade517b07ea72f9ec366130e81a076 Version: 4a7695429eade517b07ea72f9ec366130e81a076 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-cp2615.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e68c267787778bcdf3d91b06f794faaba7f0d1d1",
"status": "affected",
"version": "4a7695429eade517b07ea72f9ec366130e81a076",
"versionType": "git"
},
{
"lessThan": "4a22af879172336370ae3e81e7f65fb2f69472ee",
"status": "affected",
"version": "4a7695429eade517b07ea72f9ec366130e81a076",
"versionType": "git"
},
{
"lessThan": "69aece634a7eebafd9a596e5494d52facf6f26ec",
"status": "affected",
"version": "4a7695429eade517b07ea72f9ec366130e81a076",
"versionType": "git"
},
{
"lessThan": "13ccf9b106bba121728f1625c4375a1bd8f5c5a3",
"status": "affected",
"version": "4a7695429eade517b07ea72f9ec366130e81a076",
"versionType": "git"
},
{
"lessThan": "a9778298f47036866ea15eeb17242e8a4612580f",
"status": "affected",
"version": "4a7695429eade517b07ea72f9ec366130e81a076",
"versionType": "git"
},
{
"lessThan": "efe996bcfe50c2dcc6cf65c574285713b722ced7",
"status": "affected",
"version": "4a7695429eade517b07ea72f9ec366130e81a076",
"versionType": "git"
},
{
"lessThan": "aa79f996eb41e95aed85a1bd7f56bcd6a3842008",
"status": "affected",
"version": "4a7695429eade517b07ea72f9ec366130e81a076",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-cp2615.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: cp2615: fix serial string NULL-deref at probe\n\nThe cp2615 driver uses the USB device serial string as the i2c adapter\nname but does not make sure that the string exists.\n\nVerify that the device has a serial number before accessing it to avoid\ntriggering a NULL-pointer dereference (e.g. with malicious devices)."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:10:55.565Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e68c267787778bcdf3d91b06f794faaba7f0d1d1"
},
{
"url": "https://git.kernel.org/stable/c/4a22af879172336370ae3e81e7f65fb2f69472ee"
},
{
"url": "https://git.kernel.org/stable/c/69aece634a7eebafd9a596e5494d52facf6f26ec"
},
{
"url": "https://git.kernel.org/stable/c/13ccf9b106bba121728f1625c4375a1bd8f5c5a3"
},
{
"url": "https://git.kernel.org/stable/c/a9778298f47036866ea15eeb17242e8a4612580f"
},
{
"url": "https://git.kernel.org/stable/c/efe996bcfe50c2dcc6cf65c574285713b722ced7"
},
{
"url": "https://git.kernel.org/stable/c/aa79f996eb41e95aed85a1bd7f56bcd6a3842008"
}
],
"title": "i2c: cp2615: fix serial string NULL-deref at probe",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31549",
"datePublished": "2026-04-24T14:33:16.814Z",
"dateReserved": "2026-03-09T15:48:24.115Z",
"dateUpdated": "2026-05-11T22:10:55.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46050 (GCVE-0-2026-46050)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-06-14 17:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
md/raid10: fix deadlock with check operation and nowait requests
When an array check is running it will raise the barrier at which point
normal requests will become blocked and increment the nr_pending value to
signal there is work pending inside of wait_barrier(). NOWAIT requests
do not block and so will return immediately with an error, and additionally
do not increment nr_pending in wait_barrier(). Upstream change commit
43806c3d5b9b ("raid10: cleanup memleak at raid10_make_request") added a
call to raid_end_bio_io() to fix a memory leak when NOWAIT requests hit
this condition. raid_end_bio_io() eventually calls allow_barrier() and
it will unconditionally do an atomic_dec_and_test(&conf->nr_pending) even
though the corresponding increment on nr_pending didn't happen in the
NOWAIT case.
This can be easily seen by starting a check operation while an application
is doing nowait IO on the same array. This results in a deadlocked state
due to nr_pending value underflowing and so the md resync thread gets stuck
waiting for nr_pending to == 0.
Output of r10conf state of the array when we hit this condition:
crash> struct r10conf
barrier = 1,
nr_pending = {
counter = -41
},
nr_waiting = 15,
nr_queued = 0,
Example of md_sync thread stuck waiting on raise_barrier() and other
requests stuck in wait_barrier():
md1_resync
[<0>] raise_barrier+0xce/0x1c0
[<0>] raid10_sync_request+0x1ca/0x1ed0
[<0>] md_do_sync+0x779/0x1110
[<0>] md_thread+0x90/0x160
[<0>] kthread+0xbe/0xf0
[<0>] ret_from_fork+0x34/0x50
[<0>] ret_from_fork_asm+0x1a/0x30
kworker/u1040:2+flush-253:4
[<0>] wait_barrier+0x1de/0x220
[<0>] regular_request_wait+0x30/0x180
[<0>] raid10_make_request+0x261/0x1000
[<0>] md_handle_request+0x13b/0x230
[<0>] __submit_bio+0x107/0x1f0
[<0>] submit_bio_noacct_nocheck+0x16f/0x390
[<0>] ext4_io_submit+0x24/0x40
[<0>] ext4_do_writepages+0x254/0xc80
[<0>] ext4_writepages+0x84/0x120
[<0>] do_writepages+0x7a/0x260
[<0>] __writeback_single_inode+0x3d/0x300
[<0>] writeback_sb_inodes+0x1dd/0x470
[<0>] __writeback_inodes_wb+0x4c/0xe0
[<0>] wb_writeback+0x18b/0x2d0
[<0>] wb_workfn+0x2a1/0x400
[<0>] process_one_work+0x149/0x330
[<0>] worker_thread+0x2d2/0x410
[<0>] kthread+0xbe/0xf0
[<0>] ret_from_fork+0x34/0x50
[<0>] ret_from_fork_asm+0x1a/0x30
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 10c6021a609deb95f23f0cc2f89aa9d4bffb14c7 Version: 9af149ca9d0dab6e59e813519d309eff62499864 Version: 8fc3d7b23d139e3cbc944c15d99b3cdbed797d2d Version: 2941155d9a5ae098b480d551f3a5f8605d4f9af5 Version: 43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24 Version: 43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24 Version: 43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24 Version: ed7bcd9f617e4107ac0813c516e72e6b8f6029bd Version: 5.15.189 ≤ Version: 6.1.146 ≤ Version: 6.6.99 ≤ Version: 6.12.39 ≤ Version: 6.15.7 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/raid10.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2249983d971e6839b36284e6610390b2c217dfa1",
"status": "affected",
"version": "10c6021a609deb95f23f0cc2f89aa9d4bffb14c7",
"versionType": "git"
},
{
"lessThan": "ae356d5eb1331d678985799f893e436314834a87",
"status": "affected",
"version": "9af149ca9d0dab6e59e813519d309eff62499864",
"versionType": "git"
},
{
"lessThan": "965d6162dd88cc7cc193cf7f5bfc132d8bbf0523",
"status": "affected",
"version": "8fc3d7b23d139e3cbc944c15d99b3cdbed797d2d",
"versionType": "git"
},
{
"lessThan": "42fe37c90184cd1568838b84b488934c3671c963",
"status": "affected",
"version": "2941155d9a5ae098b480d551f3a5f8605d4f9af5",
"versionType": "git"
},
{
"lessThan": "cac2106bb9a2180b288079b49ed626414fb5bc45",
"status": "affected",
"version": "43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24",
"versionType": "git"
},
{
"lessThan": "1cdff2937c618f81058422bbdc4974a3e7ec9379",
"status": "affected",
"version": "43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24",
"versionType": "git"
},
{
"lessThan": "7d96f3120a7fb7210d21b520c5b6f495da6ba436",
"status": "affected",
"version": "43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24",
"versionType": "git"
},
{
"status": "affected",
"version": "ed7bcd9f617e4107ac0813c516e72e6b8f6029bd",
"versionType": "git"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.189",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.146",
"versionType": "semver"
},
{
"lessThan": "6.6.140",
"status": "affected",
"version": "6.6.99",
"versionType": "semver"
},
{
"lessThan": "6.12.86",
"status": "affected",
"version": "6.12.39",
"versionType": "semver"
},
{
"lessThan": "6.16",
"status": "affected",
"version": "6.15.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/raid10.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.189",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.146",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.6.99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "6.12.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix deadlock with check operation and nowait requests\n\nWhen an array check is running it will raise the barrier at which point\nnormal requests will become blocked and increment the nr_pending value to\nsignal there is work pending inside of wait_barrier(). NOWAIT requests\ndo not block and so will return immediately with an error, and additionally\ndo not increment nr_pending in wait_barrier(). Upstream change commit\n43806c3d5b9b (\"raid10: cleanup memleak at raid10_make_request\") added a\ncall to raid_end_bio_io() to fix a memory leak when NOWAIT requests hit\nthis condition. raid_end_bio_io() eventually calls allow_barrier() and\nit will unconditionally do an atomic_dec_and_test(\u0026conf-\u003enr_pending) even\nthough the corresponding increment on nr_pending didn\u0027t happen in the\nNOWAIT case.\n\nThis can be easily seen by starting a check operation while an application\nis doing nowait IO on the same array. This results in a deadlocked state\ndue to nr_pending value underflowing and so the md resync thread gets stuck\nwaiting for nr_pending to == 0.\n\nOutput of r10conf state of the array when we hit this condition:\n\ncrash\u003e struct r10conf\n\tbarrier = 1,\n nr_pending = {\n counter = -41\n },\n nr_waiting = 15,\n nr_queued = 0,\n\nExample of md_sync thread stuck waiting on raise_barrier() and other\nrequests stuck in wait_barrier():\n\nmd1_resync\n[\u003c0\u003e] raise_barrier+0xce/0x1c0\n[\u003c0\u003e] raid10_sync_request+0x1ca/0x1ed0\n[\u003c0\u003e] md_do_sync+0x779/0x1110\n[\u003c0\u003e] md_thread+0x90/0x160\n[\u003c0\u003e] kthread+0xbe/0xf0\n[\u003c0\u003e] ret_from_fork+0x34/0x50\n[\u003c0\u003e] ret_from_fork_asm+0x1a/0x30\n\nkworker/u1040:2+flush-253:4\n[\u003c0\u003e] wait_barrier+0x1de/0x220\n[\u003c0\u003e] regular_request_wait+0x30/0x180\n[\u003c0\u003e] raid10_make_request+0x261/0x1000\n[\u003c0\u003e] md_handle_request+0x13b/0x230\n[\u003c0\u003e] __submit_bio+0x107/0x1f0\n[\u003c0\u003e] submit_bio_noacct_nocheck+0x16f/0x390\n[\u003c0\u003e] ext4_io_submit+0x24/0x40\n[\u003c0\u003e] ext4_do_writepages+0x254/0xc80\n[\u003c0\u003e] ext4_writepages+0x84/0x120\n[\u003c0\u003e] do_writepages+0x7a/0x260\n[\u003c0\u003e] __writeback_single_inode+0x3d/0x300\n[\u003c0\u003e] writeback_sb_inodes+0x1dd/0x470\n[\u003c0\u003e] __writeback_inodes_wb+0x4c/0xe0\n[\u003c0\u003e] wb_writeback+0x18b/0x2d0\n[\u003c0\u003e] wb_workfn+0x2a1/0x400\n[\u003c0\u003e] process_one_work+0x149/0x330\n[\u003c0\u003e] worker_thread+0x2d2/0x410\n[\u003c0\u003e] kthread+0xbe/0xf0\n[\u003c0\u003e] ret_from_fork+0x34/0x50\n[\u003c0\u003e] ret_from_fork_asm+0x1a/0x30"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:50:41.899Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2249983d971e6839b36284e6610390b2c217dfa1"
},
{
"url": "https://git.kernel.org/stable/c/ae356d5eb1331d678985799f893e436314834a87"
},
{
"url": "https://git.kernel.org/stable/c/965d6162dd88cc7cc193cf7f5bfc132d8bbf0523"
},
{
"url": "https://git.kernel.org/stable/c/42fe37c90184cd1568838b84b488934c3671c963"
},
{
"url": "https://git.kernel.org/stable/c/cac2106bb9a2180b288079b49ed626414fb5bc45"
},
{
"url": "https://git.kernel.org/stable/c/1cdff2937c618f81058422bbdc4974a3e7ec9379"
},
{
"url": "https://git.kernel.org/stable/c/7d96f3120a7fb7210d21b520c5b6f495da6ba436"
}
],
"title": "md/raid10: fix deadlock with check operation and nowait requests",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46050",
"datePublished": "2026-05-27T12:57:06.732Z",
"dateReserved": "2026-05-13T15:03:33.094Z",
"dateUpdated": "2026-06-14T17:50:41.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46285 (GCVE-0-2026-46285)
Vulnerability from cvelistv5
Published
2026-06-08 15:41
Modified
2026-06-14 18:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mtd: docg3: fix use-after-free in docg3_release()
In docg3_release(), the docg3 pointer is obtained from
cascade->floors[0]->priv before the loop that calls
doc_release_device() on each floor. doc_release_device() frees the
docg3 struct via kfree(docg3) at line 1881. After the loop,
docg3->cascade->bch dereferences the already-freed pointer.
Fix this by accessing cascade->bch directly, which is equivalent
since docg3->cascade points back to the same cascade struct, and
is already available as a local variable. This also removes the
now-unused docg3 local variable.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c8ae3f744ddca0da164bcacee42d1d4b6fe7027d Version: c8ae3f744ddca0da164bcacee42d1d4b6fe7027d Version: c8ae3f744ddca0da164bcacee42d1d4b6fe7027d Version: c8ae3f744ddca0da164bcacee42d1d4b6fe7027d Version: c8ae3f744ddca0da164bcacee42d1d4b6fe7027d Version: c8ae3f744ddca0da164bcacee42d1d4b6fe7027d Version: c8ae3f744ddca0da164bcacee42d1d4b6fe7027d Version: c8ae3f744ddca0da164bcacee42d1d4b6fe7027d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mtd/devices/docg3.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8408655ec8344511667b61d8257dc59c80ee3391",
"status": "affected",
"version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d",
"versionType": "git"
},
{
"lessThan": "f5d2ed4ed47d3906e2495a3537a48b127f497a17",
"status": "affected",
"version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d",
"versionType": "git"
},
{
"lessThan": "2bf706fe7831b319f23a85b9728f961cfed40c3e",
"status": "affected",
"version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d",
"versionType": "git"
},
{
"lessThan": "d26f8c361f751c188b7ebaf8189aa0258968fd98",
"status": "affected",
"version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d",
"versionType": "git"
},
{
"lessThan": "16f6588a3b7a2a20d10ad9b766be74c60ba347cc",
"status": "affected",
"version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d",
"versionType": "git"
},
{
"lessThan": "d89044889ecd11b0c2f86663597246e9bdd25679",
"status": "affected",
"version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d",
"versionType": "git"
},
{
"lessThan": "d49628d63d4e6bbc8a1621afb88e5fc901611bee",
"status": "affected",
"version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d",
"versionType": "git"
},
{
"lessThan": "ca19808bc6fac7e29420d8508df569b346b3e339",
"status": "affected",
"version": "c8ae3f744ddca0da164bcacee42d1d4b6fe7027d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mtd/devices/docg3.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: docg3: fix use-after-free in docg3_release()\n\nIn docg3_release(), the docg3 pointer is obtained from\ncascade-\u003efloors[0]-\u003epriv before the loop that calls\ndoc_release_device() on each floor. doc_release_device() frees the\ndocg3 struct via kfree(docg3) at line 1881. After the loop,\ndocg3-\u003ecascade-\u003ebch dereferences the already-freed pointer.\n\nFix this by accessing cascade-\u003ebch directly, which is equivalent\nsince docg3-\u003ecascade points back to the same cascade struct, and\nis already available as a local variable. This also removes the\nnow-unused docg3 local variable."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:06:23.744Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8408655ec8344511667b61d8257dc59c80ee3391"
},
{
"url": "https://git.kernel.org/stable/c/f5d2ed4ed47d3906e2495a3537a48b127f497a17"
},
{
"url": "https://git.kernel.org/stable/c/2bf706fe7831b319f23a85b9728f961cfed40c3e"
},
{
"url": "https://git.kernel.org/stable/c/d26f8c361f751c188b7ebaf8189aa0258968fd98"
},
{
"url": "https://git.kernel.org/stable/c/16f6588a3b7a2a20d10ad9b766be74c60ba347cc"
},
{
"url": "https://git.kernel.org/stable/c/d89044889ecd11b0c2f86663597246e9bdd25679"
},
{
"url": "https://git.kernel.org/stable/c/d49628d63d4e6bbc8a1621afb88e5fc901611bee"
},
{
"url": "https://git.kernel.org/stable/c/ca19808bc6fac7e29420d8508df569b346b3e339"
}
],
"title": "mtd: docg3: fix use-after-free in docg3_release()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46285",
"datePublished": "2026-06-08T15:41:28.566Z",
"dateReserved": "2026-05-13T15:03:33.110Z",
"dateUpdated": "2026-06-14T18:06:23.744Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43257 (GCVE-0-2026-43257)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: cx88: Add missing unmap in snd_cx88_hw_params()
In error path, add cx88_alsa_dma_unmap() to release
resource acquired by cx88_alsa_dma_map().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b2c75abde0debfb824f72845c3ed77d4b66798a0 Version: b2c75abde0debfb824f72845c3ed77d4b66798a0 Version: b2c75abde0debfb824f72845c3ed77d4b66798a0 Version: b2c75abde0debfb824f72845c3ed77d4b66798a0 Version: b2c75abde0debfb824f72845c3ed77d4b66798a0 Version: b2c75abde0debfb824f72845c3ed77d4b66798a0 Version: b2c75abde0debfb824f72845c3ed77d4b66798a0 Version: b2c75abde0debfb824f72845c3ed77d4b66798a0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/cx88/cx88-alsa.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f0d7f735eba963742009b0706e19dd0bed91537a",
"status": "affected",
"version": "b2c75abde0debfb824f72845c3ed77d4b66798a0",
"versionType": "git"
},
{
"lessThan": "dc911fccc6e08ef46a66b2a42a764252b001ee3c",
"status": "affected",
"version": "b2c75abde0debfb824f72845c3ed77d4b66798a0",
"versionType": "git"
},
{
"lessThan": "24f3dabeb97bd0bec8c1c926c97e3eb6a8129225",
"status": "affected",
"version": "b2c75abde0debfb824f72845c3ed77d4b66798a0",
"versionType": "git"
},
{
"lessThan": "10ab64f8efc2f479293dce929fde326c285fc96f",
"status": "affected",
"version": "b2c75abde0debfb824f72845c3ed77d4b66798a0",
"versionType": "git"
},
{
"lessThan": "e3fb15aadfc8643203bbdf97ace0396e4586fa64",
"status": "affected",
"version": "b2c75abde0debfb824f72845c3ed77d4b66798a0",
"versionType": "git"
},
{
"lessThan": "1ce8c2a8f050a23240553c8bae628ac623f9dbc1",
"status": "affected",
"version": "b2c75abde0debfb824f72845c3ed77d4b66798a0",
"versionType": "git"
},
{
"lessThan": "3baefeeb7b85e1e34eebef399ffa312be7179e30",
"status": "affected",
"version": "b2c75abde0debfb824f72845c3ed77d4b66798a0",
"versionType": "git"
},
{
"lessThan": "dbc527d980f7ba8559de38f8c1e4158c71a78915",
"status": "affected",
"version": "b2c75abde0debfb824f72845c3ed77d4b66798a0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/cx88/cx88-alsa.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx88: Add missing unmap in snd_cx88_hw_params()\n\nIn error path, add cx88_alsa_dma_unmap() to release\nresource acquired by cx88_alsa_dma_map()."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:21:03.247Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f0d7f735eba963742009b0706e19dd0bed91537a"
},
{
"url": "https://git.kernel.org/stable/c/dc911fccc6e08ef46a66b2a42a764252b001ee3c"
},
{
"url": "https://git.kernel.org/stable/c/24f3dabeb97bd0bec8c1c926c97e3eb6a8129225"
},
{
"url": "https://git.kernel.org/stable/c/10ab64f8efc2f479293dce929fde326c285fc96f"
},
{
"url": "https://git.kernel.org/stable/c/e3fb15aadfc8643203bbdf97ace0396e4586fa64"
},
{
"url": "https://git.kernel.org/stable/c/1ce8c2a8f050a23240553c8bae628ac623f9dbc1"
},
{
"url": "https://git.kernel.org/stable/c/3baefeeb7b85e1e34eebef399ffa312be7179e30"
},
{
"url": "https://git.kernel.org/stable/c/dbc527d980f7ba8559de38f8c1e4158c71a78915"
}
],
"title": "media: cx88: Add missing unmap in snd_cx88_hw_params()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43257",
"datePublished": "2026-05-06T11:28:45.872Z",
"dateReserved": "2026-05-01T14:12:55.996Z",
"dateUpdated": "2026-05-11T22:21:03.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53215 (GCVE-0-2026-53215)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: mvpp2: refill RX buffers before XDP or skb use
The RX error path returns the current descriptor buffer to the hardware
BM pool. That is only valid while the driver still owns the buffer.
mvpp2_rx_refill() can fail after the current buffer has been handed to
XDP or attached to an skb. In those cases mvpp2_run_xdp() may have
recycled, redirected, or queued the page for XDP_TX, and an skb free also
retires the data buffer. Returning such a buffer to BM lets hardware DMA
into memory that is no longer owned by the RX ring.
Refill the BM pool before handing the current buffer to XDP or to the
skb. If the allocation fails there, drop the packet and return the
still-owned current buffer to BM, preserving the pool depth. Once the
refill succeeds, later local drops retire/free the current buffer instead
of returning it to BM.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 07dd0a7aae7f72af7cec18909581c2bb570edddc Version: 07dd0a7aae7f72af7cec18909581c2bb570edddc Version: 07dd0a7aae7f72af7cec18909581c2bb570edddc Version: 07dd0a7aae7f72af7cec18909581c2bb570edddc Version: 07dd0a7aae7f72af7cec18909581c2bb570edddc Version: 07dd0a7aae7f72af7cec18909581c2bb570edddc Version: 07dd0a7aae7f72af7cec18909581c2bb570edddc Version: 95a936364f2685e9e040c6b179b553604d96de22 Version: fba2cf348d9eb50b2049a73cc09313dab6d293f1 Version: 5.7.15 ≤ Version: 5.8.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a88b3293b556f4d8fba11db9a8061a6b0d3b69e6",
"status": "affected",
"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
"versionType": "git"
},
{
"lessThan": "a03cdcedb2cbcc42551dc3e4746929e93c5352d5",
"status": "affected",
"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
"versionType": "git"
},
{
"lessThan": "580f92f27cb8724bcc4be98ee89890eab524a2ae",
"status": "affected",
"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
"versionType": "git"
},
{
"lessThan": "d0c8c4fbd22d260fe28530260656c5fb3c20ce84",
"status": "affected",
"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
"versionType": "git"
},
{
"lessThan": "8a2126c5afe89f8ceeb60a3afb9f075b736194cd",
"status": "affected",
"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
"versionType": "git"
},
{
"lessThan": "02e1b5c4d3b4c658b72c145427cded1bba613fc1",
"status": "affected",
"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
"versionType": "git"
},
{
"lessThan": "5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6",
"status": "affected",
"version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
"versionType": "git"
},
{
"status": "affected",
"version": "95a936364f2685e9e040c6b179b553604d96de22",
"versionType": "git"
},
{
"status": "affected",
"version": "fba2cf348d9eb50b2049a73cc09313dab6d293f1",
"versionType": "git"
},
{
"lessThan": "5.8",
"status": "affected",
"version": "5.7.15",
"versionType": "semver"
},
{
"lessThan": "5.9",
"status": "affected",
"version": "5.8.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.7.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.8.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: refill RX buffers before XDP or skb use\n\nThe RX error path returns the current descriptor buffer to the hardware\nBM pool. That is only valid while the driver still owns the buffer.\n\nmvpp2_rx_refill() can fail after the current buffer has been handed to\nXDP or attached to an skb. In those cases mvpp2_run_xdp() may have\nrecycled, redirected, or queued the page for XDP_TX, and an skb free also\nretires the data buffer. Returning such a buffer to BM lets hardware DMA\ninto memory that is no longer owned by the RX ring.\n\nRefill the BM pool before handing the current buffer to XDP or to the\nskb. If the allocation fails there, drop the packet and return the\nstill-owned current buffer to BM, preserving the pool depth. Once the\nrefill succeeds, later local drops retire/free the current buffer instead\nof returning it to BM."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable `mvpp2_rx()` path is reached by packets received on the network interface, including remotely routed traffic to an internet-facing mvpp2-based system.\nAC:L - Triggering requires RX traffic and refill allocation failure, which a high-rate remote packet stream can plausibly induce through RX pressure; no attacker-uncontrolled race or authentication state is required.\nPR:N - No privileges are needed to send packets to the interface, and the normal skb receive path is affected without requiring XDP setup or local administrative actions.\nUI:N - Exploitation is driven by network packet reception and does not require any victim user action.\nS:U - The corruption occurs within the host kernel/driver memory management domain and does not inherently cross a VM, IOMMU, or separate security authority boundary.\nC:H - The bug lets hardware DMA attacker-controlled packet data into memory no longer owned by the RX ring, creating a kernel memory corruption primitive that can be leveraged for disclosure.\nI:H - Returning a freed or retired buffer to the hardware BM pool can produce attacker-controlled DMA writes into reused kernel memory, supporting arbitrary corruption or code execution.\nA:H - The same memory corruption can crash or panic the kernel, and it can be repeatedly triggered with network traffic under RX/refill pressure."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:11.464Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a88b3293b556f4d8fba11db9a8061a6b0d3b69e6"
},
{
"url": "https://git.kernel.org/stable/c/a03cdcedb2cbcc42551dc3e4746929e93c5352d5"
},
{
"url": "https://git.kernel.org/stable/c/580f92f27cb8724bcc4be98ee89890eab524a2ae"
},
{
"url": "https://git.kernel.org/stable/c/d0c8c4fbd22d260fe28530260656c5fb3c20ce84"
},
{
"url": "https://git.kernel.org/stable/c/8a2126c5afe89f8ceeb60a3afb9f075b736194cd"
},
{
"url": "https://git.kernel.org/stable/c/02e1b5c4d3b4c658b72c145427cded1bba613fc1"
},
{
"url": "https://git.kernel.org/stable/c/5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6"
}
],
"title": "net: mvpp2: refill RX buffers before XDP or skb use",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53215",
"datePublished": "2026-06-25T08:39:18.875Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-08-05T12:34:11.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71314 (GCVE-0-2025-71314)
Vulnerability from cvelistv5
Published
2026-06-03 15:49
Modified
2026-06-03 15:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: Recover from panthor_gpu_flush_caches() failures
We have seen a few cases where the whole memory subsystem is blocked
and flush operations never complete. When that happens, we want to:
- schedule a reset, so we can recover from this situation
- in the reset path, we need to reset the pending_reqs so we can send
new commands after the reset
- if more panthor_gpu_flush_caches() operations are queued after
the timeout, we skip them and return -EIO directly to avoid needless
waits (the memory block won't miraculously work again)
Note that we drop the WARN_ON()s because these hangs can be triggered
with buggy GPU jobs created by the UMD, and there's no way we can
prevent it. We do keep the error messages though.
v2:
- New patch
v3:
- Collect R-b
- Explicitly mention the fact we dropped the WARN_ON()s in the commit
message
v4:
- No changes
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panthor/panthor_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8ec4f1b14a6147db07d6e51aa1d6bcc799649847",
"status": "affected",
"version": "5cd894e258c4b0b92b9b475309cea244e590d194",
"versionType": "git"
},
{
"lessThan": "57753f2c64c033a21a7400b3a2192db1cd6c890e",
"status": "affected",
"version": "5cd894e258c4b0b92b9b475309cea244e590d194",
"versionType": "git"
},
{
"lessThan": "2c899c6026fc9d39286735b30c4d8550d4ea075b",
"status": "affected",
"version": "5cd894e258c4b0b92b9b475309cea244e590d194",
"versionType": "git"
},
{
"lessThan": "3c0a60195b37af83bbbaf223cd3a78945bace49e",
"status": "affected",
"version": "5cd894e258c4b0b92b9b475309cea244e590d194",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panthor/panthor_gpu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Recover from panthor_gpu_flush_caches() failures\n\nWe have seen a few cases where the whole memory subsystem is blocked\nand flush operations never complete. When that happens, we want to:\n\n- schedule a reset, so we can recover from this situation\n- in the reset path, we need to reset the pending_reqs so we can send\n new commands after the reset\n- if more panthor_gpu_flush_caches() operations are queued after\n the timeout, we skip them and return -EIO directly to avoid needless\n waits (the memory block won\u0027t miraculously work again)\n\nNote that we drop the WARN_ON()s because these hangs can be triggered\nwith buggy GPU jobs created by the UMD, and there\u0027s no way we can\nprevent it. We do keep the error messages though.\n\nv2:\n- New patch\n\nv3:\n- Collect R-b\n- Explicitly mention the fact we dropped the WARN_ON()s in the commit\n message\n\nv4:\n- No changes"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T15:49:39.523Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8ec4f1b14a6147db07d6e51aa1d6bcc799649847"
},
{
"url": "https://git.kernel.org/stable/c/57753f2c64c033a21a7400b3a2192db1cd6c890e"
},
{
"url": "https://git.kernel.org/stable/c/2c899c6026fc9d39286735b30c4d8550d4ea075b"
},
{
"url": "https://git.kernel.org/stable/c/3c0a60195b37af83bbbaf223cd3a78945bace49e"
}
],
"title": "drm/panthor: Recover from panthor_gpu_flush_caches() failures",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-71314",
"datePublished": "2026-06-03T15:49:39.523Z",
"dateReserved": "2026-05-27T12:23:27.414Z",
"dateUpdated": "2026-06-03T15:49:39.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52908 (GCVE-0-2026-52908)
Vulnerability from cvelistv5
Published
2026-06-19 14:00
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA: During rereg_mr ensure that REREG_ACCESS is compatible
If IB_MR_REREG_ACCESS changes from RO to RW then the umem has to be
re-evaluated to ensure it is properly pinned as RW. Since the umem is
hidden inside each driver's mr struct add a ib_umem_check_rereg() function
that each driver has to call before processing IB_MR_REREG_ACCESS.
mlx4 has to retain its duplicate ib_access_writable check because it
implements IB_MR_REREG_ACCESS | IB_MR_REREG_TRANS by changing both items
in place sequentially while the MR is live, so it will continue to not
support this combination.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/umem.c",
"drivers/infiniband/hw/hns/hns_roce_mr.c",
"drivers/infiniband/hw/irdma/verbs.c",
"drivers/infiniband/hw/mlx4/mr.c",
"drivers/infiniband/hw/mlx5/mr.c",
"drivers/infiniband/sw/rxe/rxe_verbs.c",
"include/rdma/ib_umem.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "09dc18894148381d3bfc550083b1236043870dce",
"status": "affected",
"version": "b40656aa7d559adc1fe689396dc58b92a9a27286",
"versionType": "git"
},
{
"lessThan": "eba5df21eda0fe7418efbea2f799f8ea1b8ca94c",
"status": "affected",
"version": "b40656aa7d559adc1fe689396dc58b92a9a27286",
"versionType": "git"
},
{
"lessThan": "2904e985a2917b5dac65df82733065e78a65fc9d",
"status": "affected",
"version": "b40656aa7d559adc1fe689396dc58b92a9a27286",
"versionType": "git"
},
{
"lessThan": "50334a05a950840b39a1ce3d2a173b4183db9b3e",
"status": "affected",
"version": "b40656aa7d559adc1fe689396dc58b92a9a27286",
"versionType": "git"
},
{
"lessThan": "badad6fad60def1b9805559dd81dbab3d97b82aa",
"status": "affected",
"version": "b40656aa7d559adc1fe689396dc58b92a9a27286",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/umem.c",
"drivers/infiniband/hw/hns/hns_roce_mr.c",
"drivers/infiniband/hw/irdma/verbs.c",
"drivers/infiniband/hw/mlx4/mr.c",
"drivers/infiniband/hw/mlx5/mr.c",
"drivers/infiniband/sw/rxe/rxe_verbs.c",
"include/rdma/ib_umem.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA: During rereg_mr ensure that REREG_ACCESS is compatible\n\nIf IB_MR_REREG_ACCESS changes from RO to RW then the umem has to be\nre-evaluated to ensure it is properly pinned as RW. Since the umem is\nhidden inside each driver\u0027s mr struct add a ib_umem_check_rereg() function\nthat each driver has to call before processing IB_MR_REREG_ACCESS.\n\nmlx4 has to retain its duplicate ib_access_writable check because it\nimplements IB_MR_REREG_ACCESS | IB_MR_REREG_TRANS by changing both items\nin place sequentially while the MR is live, so it will continue to not\nsupport this combination."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local RDMA uverbs write/ioctl operations on /dev/infiniband/uverbs*, not by unauthenticated network packets. Remote RDMA traffic may perform the final write only after a local process has created and reregistered the MR.\nAC:L - The trigger is a deterministic sequence: register an MR read-only, reregister it with writable access without changing translation, then use the writable MR. There is no race or attacker-uncontrolled timing requirement.\nPR:L - A basic local user can open the uverbs device when an RDMA device is exposed and create the required context, PD, and MR; the path has no CAP_SYS_ADMIN or CAP_NET_ADMIN gate. Resource limits may constrain size but do not make the attack require administrator privileges.\nUI:N - No victim action is required after the attacker has local execution and access to the RDMA uverbs device. The attacker drives the registration, reregistration, and write operations directly.\nS:U - The impact remains within the kernel/host security authority and is a local privilege escalation or host integrity violation. It does not inherently cross a VM, hypervisor, or IOMMU security boundary.\nC:H - The stale read-only pin can be converted into a writable RDMA mapping, enabling modification of read-only/COW or page-cache backed memory in a Dirty-COW-like way. A plausible privileged-code-execution path through corrupted executable page cache yields full confidentiality impact.\nI:H - The bug creates an unauthorized write primitive to pages that were not pinned with FOLL_WRITE and should not be writable. This can corrupt read-only user mappings or shared page-cache contents, making high integrity impact defensible.\nA:H - The same unauthorized write primitive can corrupt executable/library page cache or process memory and crash privileged services or destabilize the system. With plausible root code execution, high availability impact is also defensible."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:31.552Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/09dc18894148381d3bfc550083b1236043870dce"
},
{
"url": "https://git.kernel.org/stable/c/eba5df21eda0fe7418efbea2f799f8ea1b8ca94c"
},
{
"url": "https://git.kernel.org/stable/c/2904e985a2917b5dac65df82733065e78a65fc9d"
},
{
"url": "https://git.kernel.org/stable/c/50334a05a950840b39a1ce3d2a173b4183db9b3e"
},
{
"url": "https://git.kernel.org/stable/c/badad6fad60def1b9805559dd81dbab3d97b82aa"
}
],
"title": "RDMA: During rereg_mr ensure that REREG_ACCESS is compatible",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52908",
"datePublished": "2026-06-19T14:00:35.971Z",
"dateReserved": "2026-06-09T07:44:35.366Z",
"dateUpdated": "2026-08-05T12:31:31.552Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43491 (GCVE-0-2026-43491)
Vulnerability from cvelistv5
Published
2026-05-19 10:44
Modified
2026-08-19 16:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: qrtr: ns: Limit the maximum server registration per node
Current code does no bound checking on the number of servers added per
node. A malicious client can flood NEW_SERVER messages and exhaust memory.
Fix this issue by limiting the maximum number of server registrations to
256 per node. If the NEW_SERVER message is received for an old port, then
don't restrict it as it will get replaced. While at it, also rate limit
the error messages in the failure path of qrtr_ns_worker().
Note that the limit of 256 is chosen based on the current platform
requirements. If requirement changes in the future, this limit can be
increased.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0c2204a4ad710d95d348ea006f14ba926e842ffd Version: 0c2204a4ad710d95d348ea006f14ba926e842ffd Version: 0c2204a4ad710d95d348ea006f14ba926e842ffd Version: 0c2204a4ad710d95d348ea006f14ba926e842ffd Version: 0c2204a4ad710d95d348ea006f14ba926e842ffd Version: 0c2204a4ad710d95d348ea006f14ba926e842ffd Version: 0c2204a4ad710d95d348ea006f14ba926e842ffd Version: 0c2204a4ad710d95d348ea006f14ba926e842ffd |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/qrtr/ns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b48fc702b20233b809f01053232c3cd5083c97b4",
"status": "affected",
"version": "0c2204a4ad710d95d348ea006f14ba926e842ffd",
"versionType": "git"
},
{
"lessThan": "991c431077b19176d3fe3bb54054c063776a8cdc",
"status": "affected",
"version": "0c2204a4ad710d95d348ea006f14ba926e842ffd",
"versionType": "git"
},
{
"lessThan": "94914731ca0b99899dceadd80d2df00584a688ca",
"status": "affected",
"version": "0c2204a4ad710d95d348ea006f14ba926e842ffd",
"versionType": "git"
},
{
"lessThan": "e6f6cd501fb54060940a6eb3f4103eeb5e426ae7",
"status": "affected",
"version": "0c2204a4ad710d95d348ea006f14ba926e842ffd",
"versionType": "git"
},
{
"lessThan": "3efaad55cad1ded429e3a873bfece389058a526b",
"status": "affected",
"version": "0c2204a4ad710d95d348ea006f14ba926e842ffd",
"versionType": "git"
},
{
"lessThan": "35fb4a0c077c5d1049c2628b769e0a1b1e65df0d",
"status": "affected",
"version": "0c2204a4ad710d95d348ea006f14ba926e842ffd",
"versionType": "git"
},
{
"lessThan": "868202aa2adae427060a42d5bd663b4d782ec02c",
"status": "affected",
"version": "0c2204a4ad710d95d348ea006f14ba926e842ffd",
"versionType": "git"
},
{
"lessThan": "d5ee2ff98322337951c56398e79d51815acbf955",
"status": "affected",
"version": "0c2204a4ad710d95d348ea006f14ba926e842ffd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/qrtr/ns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: ns: Limit the maximum server registration per node\n\nCurrent code does no bound checking on the number of servers added per\nnode. A malicious client can flood NEW_SERVER messages and exhaust memory.\n\nFix this issue by limiting the maximum number of server registrations to\n256 per node. If the NEW_SERVER message is received for an old port, then\ndon\u0027t restrict it as it will get replaced. While at it, also rate limit\nthe error messages in the failure path of qrtr_ns_worker().\n\nNote that the limit of 256 is chosen based on the current platform\nrequirements. If requirement changes in the future, this limit can be\nincreased."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:27:59.057Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b48fc702b20233b809f01053232c3cd5083c97b4"
},
{
"url": "https://git.kernel.org/stable/c/991c431077b19176d3fe3bb54054c063776a8cdc"
},
{
"url": "https://git.kernel.org/stable/c/94914731ca0b99899dceadd80d2df00584a688ca"
},
{
"url": "https://git.kernel.org/stable/c/e6f6cd501fb54060940a6eb3f4103eeb5e426ae7"
},
{
"url": "https://git.kernel.org/stable/c/3efaad55cad1ded429e3a873bfece389058a526b"
},
{
"url": "https://git.kernel.org/stable/c/35fb4a0c077c5d1049c2628b769e0a1b1e65df0d"
},
{
"url": "https://git.kernel.org/stable/c/868202aa2adae427060a42d5bd663b4d782ec02c"
},
{
"url": "https://git.kernel.org/stable/c/d5ee2ff98322337951c56398e79d51815acbf955"
}
],
"title": "net: qrtr: ns: Limit the maximum server registration per node",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43491",
"datePublished": "2026-05-19T10:44:23.832Z",
"dateReserved": "2026-05-01T14:12:56.013Z",
"dateUpdated": "2026-08-19T16:27:59.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46009 (GCVE-0-2026-46009)
Vulnerability from cvelistv5
Published
2026-05-27 12:56
Modified
2026-06-14 17:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown
epf_ntb_epc_destroy() duplicates the teardown that the caller is
supposed to do later. This leads to an oops when .allow_link fails or
when .drop_link is performed. Remove the helper.
Also drop pci_epc_put(). EPC device refcounting is tied to configfs EPC
group lifetime, and pci_epc_put() in the .drop_link path is sufficient.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8b821cf761503b80d0bd052f932adfe1bc1a0088 Version: 8b821cf761503b80d0bd052f932adfe1bc1a0088 Version: 8b821cf761503b80d0bd052f932adfe1bc1a0088 Version: 8b821cf761503b80d0bd052f932adfe1bc1a0088 Version: 8b821cf761503b80d0bd052f932adfe1bc1a0088 Version: 8b821cf761503b80d0bd052f932adfe1bc1a0088 Version: 8b821cf761503b80d0bd052f932adfe1bc1a0088 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/endpoint/functions/pci-epf-ntb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c3029721b84f59e790285ad27544ed5d3cb0f2a6",
"status": "affected",
"version": "8b821cf761503b80d0bd052f932adfe1bc1a0088",
"versionType": "git"
},
{
"lessThan": "c72f6a7ea638f95c486a5cfd86e567b646027687",
"status": "affected",
"version": "8b821cf761503b80d0bd052f932adfe1bc1a0088",
"versionType": "git"
},
{
"lessThan": "72099f015d3c77bf2eb703d1aab113bd7a60915a",
"status": "affected",
"version": "8b821cf761503b80d0bd052f932adfe1bc1a0088",
"versionType": "git"
},
{
"lessThan": "756ca5e7ed22d9045bb4de4c981f9149278d5cd3",
"status": "affected",
"version": "8b821cf761503b80d0bd052f932adfe1bc1a0088",
"versionType": "git"
},
{
"lessThan": "65fc57c8b8f0b31be62be291cb1bb01755cec85d",
"status": "affected",
"version": "8b821cf761503b80d0bd052f932adfe1bc1a0088",
"versionType": "git"
},
{
"lessThan": "e813c95e4c8edd31599081e6356e20ada30e266d",
"status": "affected",
"version": "8b821cf761503b80d0bd052f932adfe1bc1a0088",
"versionType": "git"
},
{
"lessThan": "3446beddba450c8d6f9aca2f028712ac527fead3",
"status": "affected",
"version": "8b821cf761503b80d0bd052f932adfe1bc1a0088",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/endpoint/functions/pci-epf-ntb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown\n\nepf_ntb_epc_destroy() duplicates the teardown that the caller is\nsupposed to do later. This leads to an oops when .allow_link fails or\nwhen .drop_link is performed. Remove the helper.\n\nAlso drop pci_epc_put(). EPC device refcounting is tied to configfs EPC\ngroup lifetime, and pci_epc_put() in the .drop_link path is sufficient."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:47:44.154Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c3029721b84f59e790285ad27544ed5d3cb0f2a6"
},
{
"url": "https://git.kernel.org/stable/c/c72f6a7ea638f95c486a5cfd86e567b646027687"
},
{
"url": "https://git.kernel.org/stable/c/72099f015d3c77bf2eb703d1aab113bd7a60915a"
},
{
"url": "https://git.kernel.org/stable/c/756ca5e7ed22d9045bb4de4c981f9149278d5cd3"
},
{
"url": "https://git.kernel.org/stable/c/65fc57c8b8f0b31be62be291cb1bb01755cec85d"
},
{
"url": "https://git.kernel.org/stable/c/e813c95e4c8edd31599081e6356e20ada30e266d"
},
{
"url": "https://git.kernel.org/stable/c/3446beddba450c8d6f9aca2f028712ac527fead3"
}
],
"title": "PCI: endpoint: pci-epf-ntb: Remove duplicate resource teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46009",
"datePublished": "2026-05-27T12:56:09.581Z",
"dateReserved": "2026-05-13T15:03:33.092Z",
"dateUpdated": "2026-06-14T17:47:44.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53246 (GCVE-0-2026-53246)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
When a listening SCTP server processes a COOKIE_ECHO chunk, the cached
peer INIT chunk embedded after the cookie is parsed and its parameters
are later walked by sctp_process_init() using sctp_walk_params().
However, the chunk header length of this cached INIT chunk was not
validated against the remaining buffer in the COOKIE_ECHO payload. If
the length field is inflated, the parameter walk can run beyond the
actual received data, leading to out-of-bounds reads and potential
memory corruption during later parameter handling (e.g. STATE_COOKIE
processing and kmemdup() copies).
Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT
chunk length does not exceed the available data in the COOKIE_ECHO
buffer before it is used.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cc272185c9a9a4b7febc2de52eeaa3d00f19091e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "edccbf3d63b0a3362bc916ea72edacc1e1ca456a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0861615c28de668669d748ef4eb913ea9262d13b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate cached peer INIT chunk length in COOKIE_ECHO processing\n\nWhen a listening SCTP server processes a COOKIE_ECHO chunk, the cached\npeer INIT chunk embedded after the cookie is parsed and its parameters\nare later walked by sctp_process_init() using sctp_walk_params().\n\nHowever, the chunk header length of this cached INIT chunk was not\nvalidated against the remaining buffer in the COOKIE_ECHO payload. If\nthe length field is inflated, the parameter walk can run beyond the\nactual received data, leading to out-of-bounds reads and potential\nmemory corruption during later parameter handling (e.g. STATE_COOKIE\nprocessing and kmemdup() copies).\n\nAdd a bounds check in sctp_unpack_cookie() to ensure the cached INIT\nchunk length does not exceed the available data in the COOKIE_ECHO\nbuffer before it is used."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable COOKIE_ECHO processing is reached by remote SCTP packets delivered through the IPv4/IPv6 SCTP protocol handlers to a listening SCTP endpoint.\nAC:L - In a deployment with SCTP cookie HMAC disabled, the attacker can obtain a cookie through the normal INIT/INIT_ACK exchange, modify the cached INIT length, and send the forged COOKIE_ECHO without races or conditions outside attacker control.\nPR:N - The path is pre-authentication network protocol handling for a listening SCTP server; no local account or SCTP authentication is required when cookie HMAC is disabled.\nUI:N - Exploitation only requires sending SCTP handshake packets to the target listener and does not require victim user action.\nS:U - The impact is within the Linux kernel/network stack security authority and does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The inflated cached INIT length drives out-of-bounds parameter walking and attacker-sized kmemdup() reads beyond the received skb, which can expose kernel memory.\nI:H - The bug is kernel memory-safety corruption during nested parameter handling, and the higher-severity choice is appropriate because attacker-controlled parsing and copies beyond the valid buffer can corrupt kernel association state and plausibly support stronger primitives.\nA:H - The out-of-bounds reads and large attacker-controlled copies can trigger kernel faults, KASAN splats, allocation failure paths, or repeated remote crashes of SCTP processing."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:30.435Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cc272185c9a9a4b7febc2de52eeaa3d00f19091e"
},
{
"url": "https://git.kernel.org/stable/c/edccbf3d63b0a3362bc916ea72edacc1e1ca456a"
},
{
"url": "https://git.kernel.org/stable/c/0861615c28de668669d748ef4eb913ea9262d13b"
}
],
"title": "sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53246",
"datePublished": "2026-06-25T08:39:39.896Z",
"dateReserved": "2026-06-09T07:44:35.394Z",
"dateUpdated": "2026-08-05T12:34:30.435Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53249 (GCVE-0-2026-53249)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options
This patch restricts setting Loose Source and Record Route (LSRR)
and Strict Source and Record Route (SSRR) IP options to users
with CAP_NET_RAW capability.
This prevents unprivileged applications from forcing packets to route
through attacker-controlled nodes to leak TCP ISN and possibly other
protocol information.
While LSRR and SSRR are commonly filtered in many network environments,
they may still be supported and forwarded along some network paths.
RFC 7126 (Recommendations on Filtering of IPv4 Packets Containing
IPv4 Options) recommend to drop these options in 4.3 and 4.4.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/ip_options.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4cd6e9ed49347d3a2fdaaf07e32fb524756dddc2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2a87c3e8f03ce655ed0ef500d64d5fd924ec3691",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "89343ff12b3178fc236fe531a3603e7c97c68278",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8ff85dbabbbfb05e86e6cde31d91ac5782179d4d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "00e8845fe3428c69e980dce5071cb3da1d8f7578",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a4f3fd6516920988c47ba8d19714985c40c816a1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "28f5ad1b4055405eb1616e603fe511ba5e3725e7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "d3915a1f5a4bc0ac911032903c3c6ab8df9fcc7c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/ip_options.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: restrict IPOPT_SSRR and IPOPT_LSRR options\n\nThis patch restricts setting Loose Source and Record Route (LSRR)\nand Strict Source and Record Route (SSRR) IP options to users\nwith CAP_NET_RAW capability.\n\nThis prevents unprivileged applications from forcing packets to route\nthrough attacker-controlled nodes to leak TCP ISN and possibly other\nprotocol information.\n\nWhile LSRR and SSRR are commonly filtered in many network environments,\nthey may still be supported and forwarded along some network paths.\n\nRFC 7126 (Recommendations on Filtering of IPv4 Packets Containing\nIPv4 Options) recommend to drop these options in 4.3 and 4.4."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:41.971Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4cd6e9ed49347d3a2fdaaf07e32fb524756dddc2"
},
{
"url": "https://git.kernel.org/stable/c/2a87c3e8f03ce655ed0ef500d64d5fd924ec3691"
},
{
"url": "https://git.kernel.org/stable/c/89343ff12b3178fc236fe531a3603e7c97c68278"
},
{
"url": "https://git.kernel.org/stable/c/8ff85dbabbbfb05e86e6cde31d91ac5782179d4d"
},
{
"url": "https://git.kernel.org/stable/c/00e8845fe3428c69e980dce5071cb3da1d8f7578"
},
{
"url": "https://git.kernel.org/stable/c/a4f3fd6516920988c47ba8d19714985c40c816a1"
},
{
"url": "https://git.kernel.org/stable/c/28f5ad1b4055405eb1616e603fe511ba5e3725e7"
},
{
"url": "https://git.kernel.org/stable/c/d3915a1f5a4bc0ac911032903c3c6ab8df9fcc7c"
}
],
"title": "ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53249",
"datePublished": "2026-06-25T08:39:41.971Z",
"dateReserved": "2026-06-09T07:44:35.394Z",
"dateUpdated": "2026-06-25T08:39:41.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31440 (GCVE-0-2026-31440)
Vulnerability from cvelistv5
Published
2026-04-22 13:53
Modified
2026-05-17 15:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: Fix leaking event log memory
During the device remove process, the device is reset, causing the
configuration registers to go back to their default state, which is
zero. As the driver is checking if the event log support was enabled
before deallocating, it will fail if a reset happened before.
Do not check if the support was enabled, the check for 'idxd->evl'
being valid (only allocated if the HW capability is available) is
enough.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/idxd/device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "695b491dc3f20365fd5821f22e25dbe3c1c20cbc",
"status": "affected",
"version": "244da66cda359227d80ccb41dbcb99da40eae186",
"versionType": "git"
},
{
"lessThan": "d94f9b0ba28a205caf95902ee88b42bdb8af83d0",
"status": "affected",
"version": "244da66cda359227d80ccb41dbcb99da40eae186",
"versionType": "git"
},
{
"lessThan": "facd0012708e942fc12890708738aebde497564e",
"status": "affected",
"version": "244da66cda359227d80ccb41dbcb99da40eae186",
"versionType": "git"
},
{
"lessThan": "9dfa00967e6ef43a9dd0887fe5c3a721a39da92e",
"status": "affected",
"version": "244da66cda359227d80ccb41dbcb99da40eae186",
"versionType": "git"
},
{
"lessThan": "ee66bc29578391c9b48523dc9119af67bd5c7c0f",
"status": "affected",
"version": "244da66cda359227d80ccb41dbcb99da40eae186",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/idxd/device.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix leaking event log memory\n\nDuring the device remove process, the device is reset, causing the\nconfiguration registers to go back to their default state, which is\nzero. As the driver is checking if the event log support was enabled\nbefore deallocating, it will fail if a reset happened before.\n\nDo not check if the support was enabled, the check for \u0027idxd-\u003eevl\u0027\nbeing valid (only allocated if the HW capability is available) is\nenough."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T15:21:26.990Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/695b491dc3f20365fd5821f22e25dbe3c1c20cbc"
},
{
"url": "https://git.kernel.org/stable/c/d94f9b0ba28a205caf95902ee88b42bdb8af83d0"
},
{
"url": "https://git.kernel.org/stable/c/facd0012708e942fc12890708738aebde497564e"
},
{
"url": "https://git.kernel.org/stable/c/9dfa00967e6ef43a9dd0887fe5c3a721a39da92e"
},
{
"url": "https://git.kernel.org/stable/c/ee66bc29578391c9b48523dc9119af67bd5c7c0f"
}
],
"title": "dmaengine: idxd: Fix leaking event log memory",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31440",
"datePublished": "2026-04-22T13:53:38.388Z",
"dateReserved": "2026-03-09T15:48:24.090Z",
"dateUpdated": "2026-05-17T15:21:26.990Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46185 (GCVE-0-2026-46185)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb/client: fix out-of-bounds read in symlink_data()
Since smb2_check_message() returns success without length validation for
the symlink error response, in symlink_data() it is possible for
iov->iov_len to be smaller than sizeof(struct smb2_err_rsp). If the buffer
only contains the base SMB2 header (64 bytes), accessing
err->ErrorContextCount (at offset 66) or err->ByteCount later in
symlink_data() will cause an out-of-bounds read.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 76894f3e2f71177747b8b4763fb180e800279585 Version: 76894f3e2f71177747b8b4763fb180e800279585 Version: 76894f3e2f71177747b8b4763fb180e800279585 Version: 76894f3e2f71177747b8b4763fb180e800279585 Version: 76894f3e2f71177747b8b4763fb180e800279585 Version: 76894f3e2f71177747b8b4763fb180e800279585 Version: 2d046892a493d9760c35fdaefc3017f27f91b621 Version: 6.0.16 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2be11faf79e49fb8250a181ff0b4d2b2f084af83",
"status": "affected",
"version": "76894f3e2f71177747b8b4763fb180e800279585",
"versionType": "git"
},
{
"lessThan": "ef6495d4df6e7af8f3de67e65150881c880f696c",
"status": "affected",
"version": "76894f3e2f71177747b8b4763fb180e800279585",
"versionType": "git"
},
{
"lessThan": "15dc0a4de743a1aaa7b859b3aea79f08c695396c",
"status": "affected",
"version": "76894f3e2f71177747b8b4763fb180e800279585",
"versionType": "git"
},
{
"lessThan": "b8c8a704f0bc133deb171f6aeb6f3a684203e212",
"status": "affected",
"version": "76894f3e2f71177747b8b4763fb180e800279585",
"versionType": "git"
},
{
"lessThan": "b9561402489d41149f63e001a74384863b7b30a6",
"status": "affected",
"version": "76894f3e2f71177747b8b4763fb180e800279585",
"versionType": "git"
},
{
"lessThan": "d62b8d236fab503c6fec1d3e9a38bea71feaca20",
"status": "affected",
"version": "76894f3e2f71177747b8b4763fb180e800279585",
"versionType": "git"
},
{
"status": "affected",
"version": "2d046892a493d9760c35fdaefc3017f27f91b621",
"versionType": "git"
},
{
"lessThan": "6.1",
"status": "affected",
"version": "6.0.16",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smb2misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: fix out-of-bounds read in symlink_data()\n\nSince smb2_check_message() returns success without length validation for\nthe symlink error response, in symlink_data() it is possible for\niov-\u003eiov_len to be smaller than sizeof(struct smb2_err_rsp). If the buffer\nonly contains the base SMB2 header (64 bytes), accessing\nerr-\u003eErrorContextCount (at offset 66) or err-\u003eByteCount later in\nsymlink_data() will cause an out-of-bounds read."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerability is in the SMB *client*, triggered by a crafted symlink error response from a remote (malicious, compromised, or MITM) SMB server over TCP/445; it processes attacker-controlled data from a remote network peer.\nAC:L - A malicious server can deterministically return a CREATE response with STATUS_STOPPED_ON_SYMLINK and len \u003c calc_len (e.g., only the 64-byte base header), reliably reaching symlink_data() with no race or attacker-uncontrolled condition.\nPR:N - The attacker is the remote SMB server; it requires no credentials or privileges on the victim client to send the malformed response, which is parsed during normal open/error handling.\nUI:N - Once a share is mounted (e.g., persistent fstab/autofs mount to a compromised or MITM\u0027d server), routine file access makes the server return the crafted symlink error with no additional victim action required per exploit.\nS:U - The out-of-bounds read stays within the client kernel\u0027s own memory and security authority; no privilege or sandbox boundary is crossed.\nC:H - An out-of-bounds read of adjacent kernel heap memory; in this same symlink-parse path (cf. CVE-2026-31613) OOB bytes are UTF-16-decoded into the symlink target and returned to userspace via readlink(2).\nI:N - The flaw is purely an out-of-bounds read of the error response buffer; it does not modify kernel memory.\nA:H - Reading past the message bounds can dereference invalid/unmapped memory and oops the client kernel, causing a denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:18.630Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2be11faf79e49fb8250a181ff0b4d2b2f084af83"
},
{
"url": "https://git.kernel.org/stable/c/ef6495d4df6e7af8f3de67e65150881c880f696c"
},
{
"url": "https://git.kernel.org/stable/c/15dc0a4de743a1aaa7b859b3aea79f08c695396c"
},
{
"url": "https://git.kernel.org/stable/c/b8c8a704f0bc133deb171f6aeb6f3a684203e212"
},
{
"url": "https://git.kernel.org/stable/c/b9561402489d41149f63e001a74384863b7b30a6"
},
{
"url": "https://git.kernel.org/stable/c/d62b8d236fab503c6fec1d3e9a38bea71feaca20"
}
],
"title": "smb/client: fix out-of-bounds read in symlink_data()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46185",
"datePublished": "2026-05-28T09:36:39.318Z",
"dateReserved": "2026-05-13T15:03:33.103Z",
"dateUpdated": "2026-08-05T12:30:18.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43220 (GCVE-0-2026-43220)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-17 15:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: serialize sequence allocation under concurrent TLB invalidations
With concurrent TLB invalidations, completion wait randomly gets timed out
because cmd_sem_val was incremented outside the IOMMU spinlock, allowing
CMD_COMPL_WAIT commands to be queued out of sequence and breaking the
ordering assumption in wait_on_sem().
Move the cmd_sem_val increment under iommu->lock so completion sequence
allocation is serialized with command queuing.
And remove the unnecessary return.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/amd/amd_iommu_types.h",
"drivers/iommu/amd/init.c",
"drivers/iommu/amd/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d51bf43193b1e95dc4e34e540dc76e19def2ae5a",
"status": "affected",
"version": "f2f65b28d802a667119147444ec2ae33eebf9a58",
"versionType": "git"
},
{
"lessThan": "fca7aa0264ae99e5ff287d0ced5af0b82b121c4f",
"status": "affected",
"version": "715c263119fd1b918a9fcbd8a36ea5b604a46324",
"versionType": "git"
},
{
"lessThan": "5000ce7fcb31067566a1a1a2e5b5bbff93625242",
"status": "affected",
"version": "e15768e68820142077bbca402d8e902f64ade1b0",
"versionType": "git"
},
{
"lessThan": "48caa7542a795c9679ec1bd1bc2592e05a7369a4",
"status": "affected",
"version": "496269d12072ecb219826485bdbec70c92a8eef5",
"versionType": "git"
},
{
"lessThan": "9e249c48412828e807afddc21527eb734dc9bd3d",
"status": "affected",
"version": "d2a0cac10597068567d336e85fa3cbdbe8ca62bf",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/amd/amd_iommu_types.h",
"drivers/iommu/amd/init.c",
"drivers/iommu/amd/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.6.140",
"status": "affected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThan": "6.12.88",
"status": "affected",
"version": "6.12.75",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.6.128",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.12.75",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: serialize sequence allocation under concurrent TLB invalidations\n\nWith concurrent TLB invalidations, completion wait randomly gets timed out\nbecause cmd_sem_val was incremented outside the IOMMU spinlock, allowing\nCMD_COMPL_WAIT commands to be queued out of sequence and breaking the\nordering assumption in wait_on_sem().\nMove the cmd_sem_val increment under iommu-\u003elock so completion sequence\nallocation is serialized with command queuing.\nAnd remove the unnecessary return."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-17T15:21:38.711Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d51bf43193b1e95dc4e34e540dc76e19def2ae5a"
},
{
"url": "https://git.kernel.org/stable/c/fca7aa0264ae99e5ff287d0ced5af0b82b121c4f"
},
{
"url": "https://git.kernel.org/stable/c/5000ce7fcb31067566a1a1a2e5b5bbff93625242"
},
{
"url": "https://git.kernel.org/stable/c/48caa7542a795c9679ec1bd1bc2592e05a7369a4"
},
{
"url": "https://git.kernel.org/stable/c/9e249c48412828e807afddc21527eb734dc9bd3d"
}
],
"title": "iommu/amd: serialize sequence allocation under concurrent TLB invalidations",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43220",
"datePublished": "2026-05-06T11:28:20.905Z",
"dateReserved": "2026-05-01T14:12:55.994Z",
"dateUpdated": "2026-05-17T15:21:38.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46214 (GCVE-0-2026-46214)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-06-14 18:03
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: fix accept queue count leak on transport mismatch
virtio_transport_recv_listen() calls sk_acceptq_added() before
vsock_assign_transport(). If vsock_assign_transport() fails or
selects a different transport, the error path returns without
calling sk_acceptq_removed(), permanently incrementing
sk_ack_backlog.
After approximately backlog+1 such failures, sk_acceptq_is_full()
returns true, causing the listener to reject all new connections.
Fix by moving sk_acceptq_added() to after the transport validation,
matching the pattern used by vmci_transport and hyperv_transport.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a Version: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a Version: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a Version: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a Version: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a Version: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a Version: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a Version: c0cfa2d8a788fcf45df5bf4070ab2474c88d543a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/virtio_transport_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2ea5d2c79edcc99c7dbe0bb7518f5e1ee2a2391f",
"status": "affected",
"version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
"versionType": "git"
},
{
"lessThan": "fd51e810affa38d735d04261e673b2a5fe9c8665",
"status": "affected",
"version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
"versionType": "git"
},
{
"lessThan": "f66c7904fb6f0e420a654bc90909e64a25d00896",
"status": "affected",
"version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
"versionType": "git"
},
{
"lessThan": "65c484726e74013a2ec7ba67a34d87760ae8f390",
"status": "affected",
"version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
"versionType": "git"
},
{
"lessThan": "29371f3cc83e2a92265b4768014a30b80234112f",
"status": "affected",
"version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
"versionType": "git"
},
{
"lessThan": "e9edf9893cf26d060705c910a9b62d8cc96ed56a",
"status": "affected",
"version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
"versionType": "git"
},
{
"lessThan": "6d3275fc4ed968938e1d556c344798046776668d",
"status": "affected",
"version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
"versionType": "git"
},
{
"lessThan": "52bcb57a4e8a0865a76c587c2451906342ae1b2d",
"status": "affected",
"version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/virtio_transport_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: fix accept queue count leak on transport mismatch\n\nvirtio_transport_recv_listen() calls sk_acceptq_added() before\nvsock_assign_transport(). If vsock_assign_transport() fails or\nselects a different transport, the error path returns without\ncalling sk_acceptq_removed(), permanently incrementing\nsk_ack_backlog.\n\nAfter approximately backlog+1 such failures, sk_acceptq_is_full()\nreturns true, causing the listener to reject all new connections.\n\nFix by moving sk_acceptq_added() to after the transport validation,\nmatching the pattern used by vmci_transport and hyperv_transport."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:03:15.809Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2ea5d2c79edcc99c7dbe0bb7518f5e1ee2a2391f"
},
{
"url": "https://git.kernel.org/stable/c/fd51e810affa38d735d04261e673b2a5fe9c8665"
},
{
"url": "https://git.kernel.org/stable/c/f66c7904fb6f0e420a654bc90909e64a25d00896"
},
{
"url": "https://git.kernel.org/stable/c/65c484726e74013a2ec7ba67a34d87760ae8f390"
},
{
"url": "https://git.kernel.org/stable/c/29371f3cc83e2a92265b4768014a30b80234112f"
},
{
"url": "https://git.kernel.org/stable/c/e9edf9893cf26d060705c910a9b62d8cc96ed56a"
},
{
"url": "https://git.kernel.org/stable/c/6d3275fc4ed968938e1d556c344798046776668d"
},
{
"url": "https://git.kernel.org/stable/c/52bcb57a4e8a0865a76c587c2451906342ae1b2d"
}
],
"title": "vsock/virtio: fix accept queue count leak on transport mismatch",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46214",
"datePublished": "2026-05-28T09:40:31.245Z",
"dateReserved": "2026-05-13T15:03:33.105Z",
"dateUpdated": "2026-06-14T18:03:15.809Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46024 (GCVE-0-2026-46024)
Vulnerability from cvelistv5
Published
2026-05-27 12:56
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()
If a message of type CEPH_MSG_AUTH_REPLY contains a zero value for both
protocol and result, this is currently not treated as an error. In case
of ac->negotiating == true and ac->protocol > 0, this leads to setting
ac->protocol = 0 and ac->ops = NULL. Thereafter, the check for
ac->protocol != protocol returns false, and init_protocol() is not
called. Subsequently, ac->ops->handle_reply() is called, which leads to
a null pointer dereference, because ac->ops is still NULL.
This patch changes the check for ac->protocol != protocol to
!ac->protocol, as this also includes the case when the protocol was set
to zero in the message. This causes the message to be treated as
containing a bad auth protocol.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9ded62c302c0342efdb5eda3bf6e75720caad0df",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "f101271fcf55d7eacfefd610b51ec65f46ba8118",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "4b2738b93edad661178340239de657d876b73d3d",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "927e4bd5692f2a4901808822981fb2c8d4456548",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "016bc663657366d386993f63eb31072eb45a2b77",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "8f2be7285941a33a9f72579a23b96392f83c758e",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "5199c125d25aeae8615c4fc31652cc0fe624338e",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/auth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()\n\nIf a message of type CEPH_MSG_AUTH_REPLY contains a zero value for both\nprotocol and result, this is currently not treated as an error. In case\nof ac-\u003enegotiating == true and ac-\u003eprotocol \u003e 0, this leads to setting\nac-\u003eprotocol = 0 and ac-\u003eops = NULL. Thereafter, the check for\nac-\u003eprotocol != protocol returns false, and init_protocol() is not\ncalled. Subsequently, ac-\u003eops-\u003ehandle_reply() is called, which leads to\na null pointer dereference, because ac-\u003eops is still NULL.\n\nThis patch changes the check for ac-\u003eprotocol != protocol to\n!ac-\u003eprotocol, as this also includes the case when the protocol was set\nto zero in the message. This causes the message to be treated as\ncontaining a bad auth protocol."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code processes a CEPH_MSG_AUTH_REPLY received from a remote Ceph monitor over TCP; the libceph client reaches monitors across routed networks, so the attacker (rogue monitor or MITM) operates remotely.\nAC:L - The attacker fully controls the reply message contents and sends protocol=0/result=0 during the negotiation it controls; the crash is deterministic with no race or unobservable memory-layout dependency.\nPR:N - The crafted reply is processed during the authentication handshake before the monitor\u0027s identity is verified, and a remote server/MITM needs no privileges on the victim client.\nUI:N - Once a CephFS/RBD client is connected, monitor connections and reconnections (and the negotiation state) occur automatically, so no user action is required at attack time.\nS:U - The crash occurs within the kernel itself with no crossing of a security boundary into another authority such as a hypervisor or other VM.\nC:N - A NULL pointer dereference yields no information disclosure; no attacker-controlled memory is read or leaked.\nI:N - The NULL dereference does not modify any kernel data and provides no write primitive.\nA:H - Dereferencing the NULL ac-\u003eops triggers a kernel oops/panic, crashing the system \u2014 a remote denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:11.187Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9ded62c302c0342efdb5eda3bf6e75720caad0df"
},
{
"url": "https://git.kernel.org/stable/c/f101271fcf55d7eacfefd610b51ec65f46ba8118"
},
{
"url": "https://git.kernel.org/stable/c/4b2738b93edad661178340239de657d876b73d3d"
},
{
"url": "https://git.kernel.org/stable/c/927e4bd5692f2a4901808822981fb2c8d4456548"
},
{
"url": "https://git.kernel.org/stable/c/016bc663657366d386993f63eb31072eb45a2b77"
},
{
"url": "https://git.kernel.org/stable/c/8f2be7285941a33a9f72579a23b96392f83c758e"
},
{
"url": "https://git.kernel.org/stable/c/5199c125d25aeae8615c4fc31652cc0fe624338e"
}
],
"title": "libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46024",
"datePublished": "2026-05-27T12:56:29.932Z",
"dateReserved": "2026-05-13T15:03:33.093Z",
"dateUpdated": "2026-08-05T12:29:11.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43183 (GCVE-0-2026-43183)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: cx25821: Fix a resource leak in cx25821_dev_setup()
Add release_mem_region() if ioremap() fails to release the memory
region obtained by cx25821_get_resources().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 02b20b0b4cde011f7ad6b5363fb88b93f7ad4e5b Version: 02b20b0b4cde011f7ad6b5363fb88b93f7ad4e5b Version: 02b20b0b4cde011f7ad6b5363fb88b93f7ad4e5b Version: 02b20b0b4cde011f7ad6b5363fb88b93f7ad4e5b Version: 02b20b0b4cde011f7ad6b5363fb88b93f7ad4e5b Version: 02b20b0b4cde011f7ad6b5363fb88b93f7ad4e5b Version: 02b20b0b4cde011f7ad6b5363fb88b93f7ad4e5b Version: 02b20b0b4cde011f7ad6b5363fb88b93f7ad4e5b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/cx25821/cx25821-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9f1c926248bde95a77ca104ab525467470607836",
"status": "affected",
"version": "02b20b0b4cde011f7ad6b5363fb88b93f7ad4e5b",
"versionType": "git"
},
{
"lessThan": "071bfc6e723aabbbf08f0d439fb913cd01eb8de2",
"status": "affected",
"version": "02b20b0b4cde011f7ad6b5363fb88b93f7ad4e5b",
"versionType": "git"
},
{
"lessThan": "f7759eb6738ee9fc296f6ab1705c6809947976f3",
"status": "affected",
"version": "02b20b0b4cde011f7ad6b5363fb88b93f7ad4e5b",
"versionType": "git"
},
{
"lessThan": "4010e596d23cda6de65acb14f7fd4ce8289f1d49",
"status": "affected",
"version": "02b20b0b4cde011f7ad6b5363fb88b93f7ad4e5b",
"versionType": "git"
},
{
"lessThan": "e220ec4c4596d634685b8a08d79ad876a720b466",
"status": "affected",
"version": "02b20b0b4cde011f7ad6b5363fb88b93f7ad4e5b",
"versionType": "git"
},
{
"lessThan": "b7210170b10e2d17f7a4f6b9d39cc092442db860",
"status": "affected",
"version": "02b20b0b4cde011f7ad6b5363fb88b93f7ad4e5b",
"versionType": "git"
},
{
"lessThan": "80ce3797dc99dae4ce8b939626b891c9eb85139f",
"status": "affected",
"version": "02b20b0b4cde011f7ad6b5363fb88b93f7ad4e5b",
"versionType": "git"
},
{
"lessThan": "68cd8ac994cac38a305200f638b30e13c690753b",
"status": "affected",
"version": "02b20b0b4cde011f7ad6b5363fb88b93f7ad4e5b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/pci/cx25821/cx25821-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.32"
},
{
"lessThan": "2.6.32",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cx25821: Fix a resource leak in cx25821_dev_setup()\n\nAdd release_mem_region() if ioremap() fails to release the memory\nregion obtained by cx25821_get_resources()."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:19:27.248Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9f1c926248bde95a77ca104ab525467470607836"
},
{
"url": "https://git.kernel.org/stable/c/071bfc6e723aabbbf08f0d439fb913cd01eb8de2"
},
{
"url": "https://git.kernel.org/stable/c/f7759eb6738ee9fc296f6ab1705c6809947976f3"
},
{
"url": "https://git.kernel.org/stable/c/4010e596d23cda6de65acb14f7fd4ce8289f1d49"
},
{
"url": "https://git.kernel.org/stable/c/e220ec4c4596d634685b8a08d79ad876a720b466"
},
{
"url": "https://git.kernel.org/stable/c/b7210170b10e2d17f7a4f6b9d39cc092442db860"
},
{
"url": "https://git.kernel.org/stable/c/80ce3797dc99dae4ce8b939626b891c9eb85139f"
},
{
"url": "https://git.kernel.org/stable/c/68cd8ac994cac38a305200f638b30e13c690753b"
}
],
"title": "media: cx25821: Fix a resource leak in cx25821_dev_setup()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43183",
"datePublished": "2026-05-06T11:27:54.977Z",
"dateReserved": "2026-05-01T14:12:55.991Z",
"dateUpdated": "2026-05-11T22:19:27.248Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53103 (GCVE-0-2026-53103)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync
roc_abort_sync() can deadlock with roc_work(). roc_work() holds
dev->mt76.mutex, while cancel_work_sync() waits for roc_work()
to finish. If the caller already owns the same mutex, both
sides block and no progress is possible.
This deadlock can occur during station removal when
mt76_sta_state() -> mt76_sta_remove() ->
mt7925_mac_sta_remove_link() -> mt7925_mac_link_sta_remove() ->
mt7925_roc_abort_sync() invokes cancel_work_sync() while
roc_work() is still running and holding dev->mt76.mutex.
This avoids the mutex deadlock and preserves exactly-once
work ownership.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7925/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "153bcba36c87a1ba555b57b6c49028d5812f895b",
"status": "affected",
"version": "45064d19fd3af6aeb0887b35b5564927980cf150",
"versionType": "git"
},
{
"lessThan": "2d8e0053bca29143ace51e08c980ff076844a4b0",
"status": "affected",
"version": "45064d19fd3af6aeb0887b35b5564927980cf150",
"versionType": "git"
},
{
"lessThan": "dd08ca3f092f4185ece69ce2a835c23198b1628a",
"status": "affected",
"version": "45064d19fd3af6aeb0887b35b5564927980cf150",
"versionType": "git"
},
{
"status": "affected",
"version": "978d1756b3ae1b857826eb7ed8181f3c5180dce9",
"versionType": "git"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7925/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync\n\nroc_abort_sync() can deadlock with roc_work(). roc_work() holds\ndev-\u003emt76.mutex, while cancel_work_sync() waits for roc_work()\nto finish. If the caller already owns the same mutex, both\nsides block and no progress is possible.\n\nThis deadlock can occur during station removal when\nmt76_sta_state() -\u003e mt76_sta_remove() -\u003e\nmt7925_mac_sta_remove_link() -\u003e mt7925_mac_link_sta_remove() -\u003e\nmt7925_roc_abort_sync() invokes cancel_work_sync() while\nroc_work() is still running and holding dev-\u003emt76.mutex.\n\nThis avoids the mutex deadlock and preserves exactly-once\nwork ownership."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:39.184Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/153bcba36c87a1ba555b57b6c49028d5812f895b"
},
{
"url": "https://git.kernel.org/stable/c/2d8e0053bca29143ace51e08c980ff076844a4b0"
},
{
"url": "https://git.kernel.org/stable/c/dd08ca3f092f4185ece69ce2a835c23198b1628a"
}
],
"title": "wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53103",
"datePublished": "2026-06-24T16:30:39.184Z",
"dateReserved": "2026-06-09T07:44:35.385Z",
"dateUpdated": "2026-06-24T16:30:39.184Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43456 (GCVE-0-2026-43456)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bonding: fix type confusion in bond_setup_by_slave()
kernel BUG at net/core/skbuff.c:2306!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306
RSP: 0018:ffffc90004aff760 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e
RDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900
RBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000
R10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780
R13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0
Call Trace:
<TASK>
ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900
dev_hard_header include/linux/netdevice.h:3439 [inline]
packet_snd net/packet/af_packet.c:3028 [inline]
packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0xa54/0xc30 net/socket.c:2592
___sys_sendmsg+0x190/0x1e0 net/socket.c:2646
__sys_sendmsg+0x170/0x220 net/socket.c:2678
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe1a0e6c1a9
When a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,
bond_setup_by_slave() directly copies the slave's header_ops to the
bond device:
bond_dev->header_ops = slave_dev->header_ops;
This causes a type confusion when dev_hard_header() is later called
on the bond device. Functions like ipgre_header(), ip6gre_header(),all use
netdev_priv(dev) to access their device-specific private data. When
called with the bond device, netdev_priv() returns the bond's private
data (struct bonding) instead of the expected type (e.g. struct
ip_tunnel), leading to garbage values being read and kernel crashes.
Fix this by introducing bond_header_ops with wrapper functions that
delegate to the active slave's header_ops using the slave's own
device. This ensures netdev_priv() in the slave's header functions
always receives the correct device.
The fix is placed in the bonding driver rather than individual device
drivers, as the root cause is bond blindly inheriting header_ops from
the slave without considering that these callbacks expect a specific
netdev_priv() layout.
The type confusion can be observed by adding a printk in
ipgre_header() and running the following commands:
ip link add dummy0 type dummy
ip addr add 10.0.0.1/24 dev dummy0
ip link set dummy0 up
ip link add gre1 type gre local 10.0.0.1
ip link add bond1 type bond mode active-backup
ip link set gre1 master bond1
ip link set gre1 up
ip link set bond1 up
ip addr add fe80::1/64 dev bond1
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5d0fb9806ab6cf2c3cfba0e1b8c701da65e25af8",
"status": "affected",
"version": "1284cd3a2b740d0118458d2ea470a1e5bc19b187",
"versionType": "git"
},
{
"lessThan": "9baf26a91565b7bb2b1d9f99aaf884a2b28c2f6d",
"status": "affected",
"version": "1284cd3a2b740d0118458d2ea470a1e5bc19b187",
"versionType": "git"
},
{
"lessThan": "6ac890f1d60ac3707ee8dae15a67d9a833e49956",
"status": "affected",
"version": "1284cd3a2b740d0118458d2ea470a1e5bc19b187",
"versionType": "git"
},
{
"lessThan": "95597d11dc8bddb2b9a051c9232000bfbb5e43ba",
"status": "affected",
"version": "1284cd3a2b740d0118458d2ea470a1e5bc19b187",
"versionType": "git"
},
{
"lessThan": "950803f7254721c1c15858fbbfae3deaaeeecb11",
"status": "affected",
"version": "1284cd3a2b740d0118458d2ea470a1e5bc19b187",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: fix type confusion in bond_setup_by_slave()\n\nkernel BUG at net/core/skbuff.c:2306!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306\nRSP: 0018:ffffc90004aff760 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e\nRDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900\nRBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000\nR10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780\nR13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900\n dev_hard_header include/linux/netdevice.h:3439 [inline]\n packet_snd net/packet/af_packet.c:3028 [inline]\n packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592\n ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646\n __sys_sendmsg+0x170/0x220 net/socket.c:2678\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fe1a0e6c1a9\n\nWhen a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,\nbond_setup_by_slave() directly copies the slave\u0027s header_ops to the\nbond device:\n\n bond_dev-\u003eheader_ops = slave_dev-\u003eheader_ops;\n\nThis causes a type confusion when dev_hard_header() is later called\non the bond device. Functions like ipgre_header(), ip6gre_header(),all use\nnetdev_priv(dev) to access their device-specific private data. When\ncalled with the bond device, netdev_priv() returns the bond\u0027s private\ndata (struct bonding) instead of the expected type (e.g. struct\nip_tunnel), leading to garbage values being read and kernel crashes.\n\nFix this by introducing bond_header_ops with wrapper functions that\ndelegate to the active slave\u0027s header_ops using the slave\u0027s own\ndevice. This ensures netdev_priv() in the slave\u0027s header functions\nalways receives the correct device.\n\nThe fix is placed in the bonding driver rather than individual device\ndrivers, as the root cause is bond blindly inheriting header_ops from\nthe slave without considering that these callbacks expect a specific\nnetdev_priv() layout.\n\nThe type confusion can be observed by adding a printk in\nipgre_header() and running the following commands:\n\n ip link add dummy0 type dummy\n ip addr add 10.0.0.1/24 dev dummy0\n ip link set dummy0 up\n ip link add gre1 type gre local 10.0.0.1\n ip link add bond1 type bond mode active-backup\n ip link set gre1 master bond1\n ip link set gre1 up\n ip link set bond1 up\n ip addr add fe80::1/64 dev bond1"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local rtnetlink/AF_PACKET operations: creating/enslaving a non-Ethernet slave to a bond and then causing `dev_hard_header()` on the bond device. Remote packets are not sufficient without the vulnerable local device configuration.\nAC:L - No race or special external timing is required; the attacker can deterministically create the bond/GRE setup and trigger the confused header callback. Required modules/configuration are common and autoloadable through rtnetlink in normal deployments.\nPR:L - The setup requires `CAP_NET_ADMIN` and the AF_PACKET trigger requires `CAP_NET_RAW`, but both are obtainable by an unprivileged local user inside a user/network namespace. Therefore this is low privilege rather than real init-namespace root only.\nUI:N - Exploitation does not require a victim user to perform an action. The attacker can perform the setup and trigger locally.\nS:U - The impact is within the kernel security authority on the same system. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug is kernel type confusion where bonding private data is interpreted as another device\u0027s private structure, and the confused callback can read kernel data using the wrong layout. Following the required higher-severity rule for type confusion, confidentiality impact is High.\nI:H - The confused header callback uses bogus private-data fields to construct and push protocol headers into an skb, making this a kernel memory/type confusion condition rather than a pure NULL dereference. Type confusion is scored as High integrity impact.\nA:H - The reported failure is a kernel BUG/oops in `pskb_expand_head()` reachable through the confused `ipgre_header()` call. This provides a reliable local kernel crash/DoS."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:03.247Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5d0fb9806ab6cf2c3cfba0e1b8c701da65e25af8"
},
{
"url": "https://git.kernel.org/stable/c/9baf26a91565b7bb2b1d9f99aaf884a2b28c2f6d"
},
{
"url": "https://git.kernel.org/stable/c/6ac890f1d60ac3707ee8dae15a67d9a833e49956"
},
{
"url": "https://git.kernel.org/stable/c/95597d11dc8bddb2b9a051c9232000bfbb5e43ba"
},
{
"url": "https://git.kernel.org/stable/c/950803f7254721c1c15858fbbfae3deaaeeecb11"
}
],
"title": "bonding: fix type confusion in bond_setup_by_slave()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43456",
"datePublished": "2026-05-08T14:22:20.036Z",
"dateReserved": "2026-05-01T14:12:56.010Z",
"dateUpdated": "2026-08-05T12:28:03.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53178 (GCVE-0-2026-53178)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
Add guards to ensure ie_length is large enough before subtracting
fixed IE offsets to prevent unsigned integer underflow.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "542d65a6dbd9733baab96313c9fe76a76e93f484",
"status": "affected",
"version": "d3fcee1b78a533c256077f1300dd236801397cf7",
"versionType": "git"
},
{
"lessThan": "88e994c57a79f62d5338231d8d37ee8dd98baffe",
"status": "affected",
"version": "d3fcee1b78a533c256077f1300dd236801397cf7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction\n\nAdd guards to ensure ie_length is large enough before subtracting\nfixed IE offsets to prevent unsigned integer underflow."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable rtl8723bs path processes 802.11 beacon/probe response information from nearby WiFi radios during scan/join/roam handling, so the attacker must be within wireless range rather than on an IP network.\nAC:L - An attacker can craft and transmit malformed management-frame data and trigger repeated scan/join candidate processing; no race or hard-to-control memory layout condition is required to reach the vulnerable IE walker.\nPR:N - The over-the-air management frames are processed before any WiFi authentication with the attacker-controlled AP/BSS, so no local or authenticated privileges are required.\nUI:N - Once the interface is scanning or attempting WPS/join/roam, the driver processes received management frames without a per-attack victim action.\nS:U - The impact is within the kernel/driver security authority and does not cross a hypervisor, IOMMU, or separate security scope boundary.\nC:H - The WPS path can underflow the IE length and pass a huge unsigned bound to `rtw_get_wps_ie`, causing an unbounded out-of-bounds kernel memory read.\nI:N - The affected calls only scan/compare IE bytes and do not copy attacker data into an out-of-bounds destination or provide an apparent write primitive.\nA:H - The out-of-bounds kernel read can fault or otherwise destabilize the kernel driver, making a kernel crash/oops a plausible outcome."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:46.813Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/542d65a6dbd9733baab96313c9fe76a76e93f484"
},
{
"url": "https://git.kernel.org/stable/c/88e994c57a79f62d5338231d8d37ee8dd98baffe"
}
],
"title": "staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53178",
"datePublished": "2026-06-25T08:38:54.018Z",
"dateReserved": "2026-06-09T07:44:35.389Z",
"dateUpdated": "2026-08-05T12:33:46.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43300 (GCVE-0-2026-43300)
Vulnerability from cvelistv5
Published
2026-05-08 13:11
Modified
2026-05-11 22:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove()
In jdi_panel_dsi_remove(), jdi is explicitly checked, indicating that it
may be NULL:
if (!jdi)
mipi_dsi_detach(dsi);
However, when jdi is NULL, the function does not return and continues by
calling jdi_panel_disable():
err = jdi_panel_disable(&jdi->base);
Inside jdi_panel_disable(), jdi is dereferenced unconditionally, which can
lead to a NULL-pointer dereference:
struct jdi_panel *jdi = to_panel_jdi(panel);
backlight_disable(jdi->backlight);
To prevent such a potential NULL-pointer dereference, return early from
jdi_panel_dsi_remove() when jdi is NULL.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ec2f37bbb733cdd7ed7d04171fca728a532414d5",
"status": "affected",
"version": "25205087df1ffe06ccea9302944ed1f77dc68c6f",
"versionType": "git"
},
{
"lessThan": "2f5427d8726b22b807beec248d7d6bf88e291e0b",
"status": "affected",
"version": "25205087df1ffe06ccea9302944ed1f77dc68c6f",
"versionType": "git"
},
{
"lessThan": "83ce0085fabf757b039322928188ad78e962d609",
"status": "affected",
"version": "25205087df1ffe06ccea9302944ed1f77dc68c6f",
"versionType": "git"
},
{
"lessThan": "95eed73b871111123a8b1d31cb1fce7e902e49ea",
"status": "affected",
"version": "25205087df1ffe06ccea9302944ed1f77dc68c6f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panel/panel-jdi-lpm102a188a.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove()\n\nIn jdi_panel_dsi_remove(), jdi is explicitly checked, indicating that it\nmay be NULL:\n\n if (!jdi)\n mipi_dsi_detach(dsi);\n\nHowever, when jdi is NULL, the function does not return and continues by\ncalling jdi_panel_disable():\n\n err = jdi_panel_disable(\u0026jdi-\u003ebase);\n\nInside jdi_panel_disable(), jdi is dereferenced unconditionally, which can\nlead to a NULL-pointer dereference:\n\n struct jdi_panel *jdi = to_panel_jdi(panel);\n backlight_disable(jdi-\u003ebacklight);\n\nTo prevent such a potential NULL-pointer dereference, return early from\njdi_panel_dsi_remove() when jdi is NULL."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:21:53.416Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ec2f37bbb733cdd7ed7d04171fca728a532414d5"
},
{
"url": "https://git.kernel.org/stable/c/2f5427d8726b22b807beec248d7d6bf88e291e0b"
},
{
"url": "https://git.kernel.org/stable/c/83ce0085fabf757b039322928188ad78e962d609"
},
{
"url": "https://git.kernel.org/stable/c/95eed73b871111123a8b1d31cb1fce7e902e49ea"
}
],
"title": "drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43300",
"datePublished": "2026-05-08T13:11:21.530Z",
"dateReserved": "2026-05-01T14:12:56.000Z",
"dateUpdated": "2026-05-11T22:21:53.416Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53224 (GCVE-0-2026-53224)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate embedded INIT chunk and address list lengths in cookie
sctp_unpack_cookie() only checked that the embedded INIT chunk length
did not exceed the remaining cookie payload, but did not ensure that the
INIT chunk is large enough to contain a complete INIT header.
A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose
length field is smaller than sizeof(struct sctp_init_chunk). Later,
sctp_process_init() accesses INIT parameters unconditionally, which may
lead to out-of-bounds reads.
In addition, raw_addr_list_len is not fully validated against the
remaining cookie payload. When cookie authentication is disabled, an
attacker can supply an oversized raw_addr_list_len and cause
sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The
address parser also lacks sufficient bounds checks for parameter headers
and lengths, allowing malformed address parameters to trigger
out-of-bounds reads.
Fix this by:
- requiring the embedded INIT chunk length to be at least sizeof(struct
sctp_init_chunk);
- validating that the INIT chunk and raw address list together fit
within the cookie payload;
- verifying sufficient data exists for each address parameter header and
payload before parsing it.
Note that sctp_verify_init() must be called after sctp_unpack_cookie()
and before sctp_process_init() when cookie authentication is disabled.
This will be addressed in a separate patch.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/bind_addr.c",
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7560afb8cddafd829e709d7ea09230e45a825557",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "512a9bb77c04ac9927648ea58af617e472be96e6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6f4c80a2a7e6d06753b89a578b710a2499a5e62b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/bind_addr.c",
"net/sctp/sm_make_chunk.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate embedded INIT chunk and address list lengths in cookie\n\nsctp_unpack_cookie() only checked that the embedded INIT chunk length\ndid not exceed the remaining cookie payload, but did not ensure that the\nINIT chunk is large enough to contain a complete INIT header.\n\nA malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose\nlength field is smaller than sizeof(struct sctp_init_chunk). Later,\nsctp_process_init() accesses INIT parameters unconditionally, which may\nlead to out-of-bounds reads.\n\nIn addition, raw_addr_list_len is not fully validated against the\nremaining cookie payload. When cookie authentication is disabled, an\nattacker can supply an oversized raw_addr_list_len and cause\nsctp_raw_to_bind_addrs() to read beyond the end of the cookie. The\naddress parser also lacks sufficient bounds checks for parameter headers\nand lengths, allowing malformed address parameters to trigger\nout-of-bounds reads.\n\nFix this by:\n\n- requiring the embedded INIT chunk length to be at least sizeof(struct\n sctp_init_chunk);\n- validating that the INIT chunk and raw address list together fit\n within the cookie payload;\n- verifying sufficient data exists for each address parameter header and\n payload before parsing it.\n\nNote that sctp_verify_init() must be called after sctp_unpack_cookie()\nand before sctp_process_init() when cookie authentication is disabled.\nThis will be addressed in a separate patch."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - An unauthenticated remote SCTP peer can reach the vulnerable COOKIE_ECHO processing path by sending SCTP packets to a listening SCTP endpoint. In deployments with cookie HMAC disabled, the attacker can obtain and modify the state cookie over the network.\nAC:L - The bug is triggered with a malformed COOKIE_ECHO and attacker-controlled embedded INIT/address-list lengths; no race or hard-to-control timing condition is required. The no-cookie-auth deployment condition is a reasonable supported SCTP configuration.\nPR:N - No credentials or local privileges are needed to send SCTP INIT/COOKIE_ECHO traffic to a listening service. The vulnerable parsing occurs before any application authentication.\nUI:N - Exploitation only requires sending network packets to the target SCTP endpoint. No victim user action is required.\nS:U - The impact is within the kernel/network stack security authority of the target system. It does not cross a separate boundary such as guest-to-host or IOMMU isolation.\nC:H - The malformed lengths can drive out-of-bounds kernel reads beyond the COOKIE_ECHO payload, including attacker-controlled oversized address-list parsing. Because the read is not strictly bounded to a few bytes and related SCTP COOKIE_ECHO bugs demonstrate kernel memory leakage potential, confidentiality impact is High.\nI:N - The investigated fix addresses out-of-bounds reads and missing length validation, not an out-of-bounds write or direct arbitrary memory modification primitive. I did not find a defensible direct integrity impact from this bug alone.\nA:H - The attacker-controlled out-of-bounds reads can walk beyond the skb/cookie buffer and fault or trigger KASAN/oops conditions. A remotely triggerable kernel crash is High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:16.814Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7560afb8cddafd829e709d7ea09230e45a825557"
},
{
"url": "https://git.kernel.org/stable/c/512a9bb77c04ac9927648ea58af617e472be96e6"
},
{
"url": "https://git.kernel.org/stable/c/6f4c80a2a7e6d06753b89a578b710a2499a5e62b"
}
],
"title": "sctp: validate embedded INIT chunk and address list lengths in cookie",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53224",
"datePublished": "2026-06-25T08:39:25.254Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-08-05T12:34:16.814Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45981 (GCVE-0-2026-45981)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-06-01 16:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
`css_alloc_subchannel()` calls `device_initialize()` before setting up
the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails,
the error path frees the subchannel structure directly, bypassing
the device model reference counting.
Once `device_initialize()` has been called, the embedded struct device
must be released via `put_device()`, allowing the release callback to
free the container structure.
Fix the error path by dropping the initial device reference with
`put_device()` instead of calling `kfree()` directly.
This ensures correct device lifetime handling and avoids potential
use-after-free or double-free issues.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/cio/css.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "abb6e07f46a740cda4f07d1b561ae4eaa7a1df42",
"status": "affected",
"version": "e5dcf0025d7af58f525590ac86ac27cb44714e8d",
"versionType": "git"
},
{
"lessThan": "f96c5ccf95ae5f27218c1ce2d6a3ad2d3e105424",
"status": "affected",
"version": "e5dcf0025d7af58f525590ac86ac27cb44714e8d",
"versionType": "git"
},
{
"lessThan": "6715560527e343a387e4a0d2e6c401748e89fa55",
"status": "affected",
"version": "e5dcf0025d7af58f525590ac86ac27cb44714e8d",
"versionType": "git"
},
{
"lessThan": "c35cfbb5341ba05ad1b4476ffc3c21cc3ff8f603",
"status": "affected",
"version": "e5dcf0025d7af58f525590ac86ac27cb44714e8d",
"versionType": "git"
},
{
"lessThan": "f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7",
"status": "affected",
"version": "e5dcf0025d7af58f525590ac86ac27cb44714e8d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/cio/css.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/cio: Fix device lifecycle handling in css_alloc_subchannel()\n\n`css_alloc_subchannel()` calls `device_initialize()` before setting up\nthe DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails,\nthe error path frees the subchannel structure directly, bypassing\nthe device model reference counting.\n\nOnce `device_initialize()` has been called, the embedded struct device\nmust be released via `put_device()`, allowing the release callback to\nfree the container structure.\n\nFix the error path by dropping the initial device reference with\n`put_device()` instead of calling `kfree()` directly.\n\nThis ensures correct device lifetime handling and avoids potential\nuse-after-free or double-free issues."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T16:16:41.646Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/abb6e07f46a740cda4f07d1b561ae4eaa7a1df42"
},
{
"url": "https://git.kernel.org/stable/c/f96c5ccf95ae5f27218c1ce2d6a3ad2d3e105424"
},
{
"url": "https://git.kernel.org/stable/c/6715560527e343a387e4a0d2e6c401748e89fa55"
},
{
"url": "https://git.kernel.org/stable/c/c35cfbb5341ba05ad1b4476ffc3c21cc3ff8f603"
},
{
"url": "https://git.kernel.org/stable/c/f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7"
}
],
"title": "s390/cio: Fix device lifecycle handling in css_alloc_subchannel()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45981",
"datePublished": "2026-05-27T12:18:39.923Z",
"dateReserved": "2026-05-13T15:03:33.090Z",
"dateUpdated": "2026-06-01T16:16:41.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53037 (GCVE-0-2026-53037)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: usbhid: fix deadlock in hid_post_reset()
You can build a USB device that includes a HID component
and a storage or UAS component. The components can be reset
only together. That means that hid_pre_reset() and hid_post_reset()
are in the block IO error handling. Hence no memory allocation
used in them may do block IO because the IO can deadlock
on the mutex held while resetting a device and calling the
interface drivers.
Use GFP_NOIO for all allocations in them.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: dc3c78e43469063c5bf4b744214508f94c4129f9 Version: dc3c78e43469063c5bf4b744214508f94c4129f9 Version: dc3c78e43469063c5bf4b744214508f94c4129f9 Version: dc3c78e43469063c5bf4b744214508f94c4129f9 Version: dc3c78e43469063c5bf4b744214508f94c4129f9 Version: dc3c78e43469063c5bf4b744214508f94c4129f9 Version: dc3c78e43469063c5bf4b744214508f94c4129f9 Version: dc3c78e43469063c5bf4b744214508f94c4129f9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/usbhid/hid-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "56d318ef8766f0deb08517fd8f3007256ea7997d",
"status": "affected",
"version": "dc3c78e43469063c5bf4b744214508f94c4129f9",
"versionType": "git"
},
{
"lessThan": "90550af0aad5e75110073c501e4fb42fca20ff80",
"status": "affected",
"version": "dc3c78e43469063c5bf4b744214508f94c4129f9",
"versionType": "git"
},
{
"lessThan": "eeceb6f4dd42065fdda3a526a93d08b8fb90fb69",
"status": "affected",
"version": "dc3c78e43469063c5bf4b744214508f94c4129f9",
"versionType": "git"
},
{
"lessThan": "ad4505d2ab3aaac6498f17649608e70e80034bf2",
"status": "affected",
"version": "dc3c78e43469063c5bf4b744214508f94c4129f9",
"versionType": "git"
},
{
"lessThan": "4e900465296ce9fb12ed47dc77389b8dde95bfe0",
"status": "affected",
"version": "dc3c78e43469063c5bf4b744214508f94c4129f9",
"versionType": "git"
},
{
"lessThan": "c7abd0e6c87441e99c759d40eb6fe589634e3041",
"status": "affected",
"version": "dc3c78e43469063c5bf4b744214508f94c4129f9",
"versionType": "git"
},
{
"lessThan": "b3d16611d7cd78e9d5c6baa19b61b7caf9f1ab5e",
"status": "affected",
"version": "dc3c78e43469063c5bf4b744214508f94c4129f9",
"versionType": "git"
},
{
"lessThan": "8df2c1b47ee3cd50fd454f75c7a7e2ae8a6adf72",
"status": "affected",
"version": "dc3c78e43469063c5bf4b744214508f94c4129f9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/usbhid/hid-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: usbhid: fix deadlock in hid_post_reset()\n\nYou can build a USB device that includes a HID component\nand a storage or UAS component. The components can be reset\nonly together. That means that hid_pre_reset() and hid_post_reset()\nare in the block IO error handling. Hence no memory allocation\nused in them may do block IO because the IO can deadlock\non the mutex held while resetting a device and calling the\ninterface drivers.\nUse GFP_NOIO for all allocations in them."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:44.311Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/56d318ef8766f0deb08517fd8f3007256ea7997d"
},
{
"url": "https://git.kernel.org/stable/c/90550af0aad5e75110073c501e4fb42fca20ff80"
},
{
"url": "https://git.kernel.org/stable/c/eeceb6f4dd42065fdda3a526a93d08b8fb90fb69"
},
{
"url": "https://git.kernel.org/stable/c/ad4505d2ab3aaac6498f17649608e70e80034bf2"
},
{
"url": "https://git.kernel.org/stable/c/4e900465296ce9fb12ed47dc77389b8dde95bfe0"
},
{
"url": "https://git.kernel.org/stable/c/c7abd0e6c87441e99c759d40eb6fe589634e3041"
},
{
"url": "https://git.kernel.org/stable/c/b3d16611d7cd78e9d5c6baa19b61b7caf9f1ab5e"
},
{
"url": "https://git.kernel.org/stable/c/8df2c1b47ee3cd50fd454f75c7a7e2ae8a6adf72"
}
],
"title": "HID: usbhid: fix deadlock in hid_post_reset()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53037",
"datePublished": "2026-06-24T16:29:44.311Z",
"dateReserved": "2026-06-09T07:44:35.380Z",
"dateUpdated": "2026-06-24T16:29:44.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46099 (GCVE-0-2026-46099)
Vulnerability from cvelistv5
Published
2026-05-27 12:59
Modified
2026-08-26 12:04
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
seg6_input_core() and rpl_input() call ip6_route_input() which sets a
NOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking
dst_hold() unconditionally.
On PREEMPT_RT, ksoftirqd is preemptible and a higher-priority task can
release the underlying pcpu_rt between the lookup and the caching
through a concurrent FIB lookup on a shared nexthop.
Simplified race sequence:
ksoftirqd/X higher-prio task (same CPU X)
----------- --------------------------------
seg6_input_core(,skb)/rpl_input(skb)
dst_cache_get()
-> miss
ip6_route_input(skb)
-> ip6_pol_route(,skb,flags)
[RT6_LOOKUP_F_DST_NOREF in flags]
-> FIB lookup resolves fib6_nh
[nhid=N route]
-> rt6_make_pcpu_route()
[creates pcpu_rt, refcount=1]
pcpu_rt->sernum = fib6_sernum
[fib6_sernum=W]
-> cmpxchg(fib6_nh.rt6i_pcpu,
NULL, pcpu_rt)
[slot was empty, store succeeds]
-> skb_dst_set_noref(skb, dst)
[dst is pcpu_rt, refcount still 1]
rt_genid_bump_ipv6()
-> bumps fib6_sernum
[fib6_sernum from W to Z]
ip6_route_output()
-> ip6_pol_route()
-> FIB lookup resolves fib6_nh
[nhid=N]
-> rt6_get_pcpu_route()
pcpu_rt->sernum != fib6_sernum
[W <> Z, stale]
-> prev = xchg(rt6i_pcpu, NULL)
-> dst_release(prev)
[prev is pcpu_rt,
refcount 1->0, dead]
dst = skb_dst(skb)
[dst is the dead pcpu_rt]
dst_cache_set_ip6(dst)
-> dst_hold() on dead dst
-> WARN / use-after-free
For the race to occur, ksoftirqd must be preemptible (PREEMPT_RT without
PREEMPT_RT_NEEDS_BH_LOCK) and a concurrent task must be able to release
the pcpu_rt. Shared nexthop objects provide such a path, as two routes
pointing to the same nhid share the same fib6_nh and its rt6i_pcpu
entry.
Fix seg6_input_core() and rpl_input() by calling skb_dst_force() after
ip6_route_input() to force the NOREF dst into a refcounted one before
caching.
The output path is not affected as ip6_route_output() already returns a
refcounted dst.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: af4a2209b1344939eaac11f269c261d347cbc3ee Version: af4a2209b1344939eaac11f269c261d347cbc3ee Version: af4a2209b1344939eaac11f269c261d347cbc3ee Version: af4a2209b1344939eaac11f269c261d347cbc3ee Version: af4a2209b1344939eaac11f269c261d347cbc3ee Version: af4a2209b1344939eaac11f269c261d347cbc3ee Version: af4a2209b1344939eaac11f269c261d347cbc3ee |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.39.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.188.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.188.1.rt14.473.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s IPv6 networking implementation, specifically within the `seg6` and `rpl` lwtunnels. A race condition can occur when handling destination cache entries, where a `NOREF` (no reference) destination object is used after it has been freed. This use-after-free vulnerability can lead to system instability or a denial of service (DoS) on systems configured with `PREEMPT_RT` (Preemptible Real-Time) kernel."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-911",
"description": "Improper Update of Reference Count",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T12:04:58.201Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-46099"
},
{
"name": "RHBZ#2481972",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481972"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46099.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:45114"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59662"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:59663"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:45114: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:59662: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:59663: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-27T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-27T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/rpl_iptunnel.c",
"net/ipv6/seg6_iptunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "51fef5a7c4d160839199e941929456ba21ddf73c",
"status": "affected",
"version": "af4a2209b1344939eaac11f269c261d347cbc3ee",
"versionType": "git"
},
{
"lessThan": "b258b849a580285a1692e782ebc902b44c884a71",
"status": "affected",
"version": "af4a2209b1344939eaac11f269c261d347cbc3ee",
"versionType": "git"
},
{
"lessThan": "6bd17925bd6866027a6555db17905b9fc073d38d",
"status": "affected",
"version": "af4a2209b1344939eaac11f269c261d347cbc3ee",
"versionType": "git"
},
{
"lessThan": "52f9db67f8f35f436366cf4980b4f0a2583d0ef0",
"status": "affected",
"version": "af4a2209b1344939eaac11f269c261d347cbc3ee",
"versionType": "git"
},
{
"lessThan": "b778b6d095421619c331fd2d7751143cd5387103",
"status": "affected",
"version": "af4a2209b1344939eaac11f269c261d347cbc3ee",
"versionType": "git"
},
{
"lessThan": "9dd5481f960e337b81d7dfe429529495c1c481c0",
"status": "affected",
"version": "af4a2209b1344939eaac11f269c261d347cbc3ee",
"versionType": "git"
},
{
"lessThan": "f9c52a6ba9780bd27e0bf4c044fd91c13c778b6e",
"status": "affected",
"version": "af4a2209b1344939eaac11f269c261d347cbc3ee",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/rpl_iptunnel.c",
"net/ipv6/seg6_iptunnel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels\n\nseg6_input_core() and rpl_input() call ip6_route_input() which sets a\nNOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking\ndst_hold() unconditionally.\nOn PREEMPT_RT, ksoftirqd is preemptible and a higher-priority task can\nrelease the underlying pcpu_rt between the lookup and the caching\nthrough a concurrent FIB lookup on a shared nexthop.\nSimplified race sequence:\n\n ksoftirqd/X higher-prio task (same CPU X)\n ----------- --------------------------------\n seg6_input_core(,skb)/rpl_input(skb)\n dst_cache_get()\n -\u003e miss\n ip6_route_input(skb)\n -\u003e ip6_pol_route(,skb,flags)\n [RT6_LOOKUP_F_DST_NOREF in flags]\n -\u003e FIB lookup resolves fib6_nh\n [nhid=N route]\n -\u003e rt6_make_pcpu_route()\n [creates pcpu_rt, refcount=1]\n pcpu_rt-\u003esernum = fib6_sernum\n [fib6_sernum=W]\n -\u003e cmpxchg(fib6_nh.rt6i_pcpu,\n NULL, pcpu_rt)\n [slot was empty, store succeeds]\n -\u003e skb_dst_set_noref(skb, dst)\n [dst is pcpu_rt, refcount still 1]\n\n rt_genid_bump_ipv6()\n -\u003e bumps fib6_sernum\n [fib6_sernum from W to Z]\n ip6_route_output()\n -\u003e ip6_pol_route()\n -\u003e FIB lookup resolves fib6_nh\n [nhid=N]\n -\u003e rt6_get_pcpu_route()\n pcpu_rt-\u003esernum != fib6_sernum\n [W \u003c\u003e Z, stale]\n -\u003e prev = xchg(rt6i_pcpu, NULL)\n -\u003e dst_release(prev)\n [prev is pcpu_rt,\n refcount 1-\u003e0, dead]\n\n dst = skb_dst(skb)\n [dst is the dead pcpu_rt]\n dst_cache_set_ip6(dst)\n -\u003e dst_hold() on dead dst\n -\u003e WARN / use-after-free\n\nFor the race to occur, ksoftirqd must be preemptible (PREEMPT_RT without\nPREEMPT_RT_NEEDS_BH_LOCK) and a concurrent task must be able to release\nthe pcpu_rt. Shared nexthop objects provide such a path, as two routes\npointing to the same nhid share the same fib6_nh and its rt6i_pcpu\nentry.\n\nFix seg6_input_core() and rpl_input() by calling skb_dst_force() after\nip6_route_input() to force the NOREF dst into a refcounted one before\ncaching.\nThe output path is not affected as ip6_route_output() already returns a\nrefcounted dst."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The seg6/RPL lwtunnel input handlers run on the IPv6 packet receive/forward path (lwtunnel_input \u2192 seg6_input/rpl_input); a remote attacker sending IPv6 packets matching a configured SRv6/RPL-encap route reaches the vulnerable code.\nAC:H - The UAF manifests only on PREEMPT_RT kernels built without PREEMPT_RT_NEEDS_BH_LOCK (a rare, non-default configuration) and additionally requires winning a tight race against a higher-priority task\u0027s concurrent FIB lookup plus a sernum bump on a shared nexthop \u2014 conditions outside the attacker\u0027s control.\nPR:N - The triggering packets require no privileges; the SRv6/RPL route configuration is an environmental precondition (CAP_NET_ADMIN to set up), not a privilege the network attacker must hold.\nUI:N - The bug is triggered purely by inbound packet processing in softirq context; no victim interaction is needed.\nS:U - The use-after-free is confined to kernel route/dst objects within the kernel\u0027s own security authority; no boundary (VM/IOMMU) is crossed.\nC:H - The freed rt6_info/dst object is read back (rt6_get_cookie/dst dereferences) and can be reallocated with attacker-influenced heap content, enabling kernel memory disclosure.\nI:H - A use-after-free on a route object allows heap-spray reallocation and write/control primitives via the dangling dst that is subsequently used for routing decisions.\nA:H - dst_hold() on the dead object triggers a WARN and the use-after-free of a freed route can cause an oops/panic, crashing the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:36.501Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/51fef5a7c4d160839199e941929456ba21ddf73c"
},
{
"url": "https://git.kernel.org/stable/c/b258b849a580285a1692e782ebc902b44c884a71"
},
{
"url": "https://git.kernel.org/stable/c/6bd17925bd6866027a6555db17905b9fc073d38d"
},
{
"url": "https://git.kernel.org/stable/c/52f9db67f8f35f436366cf4980b4f0a2583d0ef0"
},
{
"url": "https://git.kernel.org/stable/c/b778b6d095421619c331fd2d7751143cd5387103"
},
{
"url": "https://git.kernel.org/stable/c/9dd5481f960e337b81d7dfe429529495c1c481c0"
},
{
"url": "https://git.kernel.org/stable/c/f9c52a6ba9780bd27e0bf4c044fd91c13c778b6e"
}
],
"title": "net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46099",
"datePublished": "2026-05-27T12:59:04.628Z",
"dateReserved": "2026-05-13T15:03:33.097Z",
"dateUpdated": "2026-08-26T12:04:58.201Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53274 (GCVE-0-2026-53274)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
A logic flaw in __smc_setsockopt() allows a local unprivileged user to
cause a Denial of Service (DoS) by holding the socket lock indefinitely.
The function __smc_setsockopt() calls copy_from_sockptr() while holding
lock_sock(sk). By passing a userfaultfd-monitored memory page (or
FUSE-backed memory on systems where unprivileged userfaultfd is disabled)
as the optval, an attacker can halt execution during the copy operation,
keeping the lock held.
Combined with asynchronous tear-down operations like shutdown(), this
exhausts the kernel wq (kworkers) and triggers the hung task watchdog.
[ 240.123456] INFO: task kworker/u8:2 blocked for more than 120 seconds.
[ 240.123489] Call Trace:
[ 240.123501] smc_shutdown+...
[ 240.123512] lock_sock_nested+...
This patch moves the user-space copy outside the lock_sock() critical
section to prevent the issue.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a6a6fe27bab48f0d09a64b051e7bde432fcae081 Version: a6a6fe27bab48f0d09a64b051e7bde432fcae081 Version: a6a6fe27bab48f0d09a64b051e7bde432fcae081 Version: a6a6fe27bab48f0d09a64b051e7bde432fcae081 Version: a6a6fe27bab48f0d09a64b051e7bde432fcae081 Version: a6a6fe27bab48f0d09a64b051e7bde432fcae081 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/smc/af_smc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "35a22117839602bb52283de08894c5a7dde92420",
"status": "affected",
"version": "a6a6fe27bab48f0d09a64b051e7bde432fcae081",
"versionType": "git"
},
{
"lessThan": "5d27d2ffe487df89ce28fda0410eafa05dbe03a0",
"status": "affected",
"version": "a6a6fe27bab48f0d09a64b051e7bde432fcae081",
"versionType": "git"
},
{
"lessThan": "89f6fbe0033c942cb790ffd53ca93a45eeaf1c91",
"status": "affected",
"version": "a6a6fe27bab48f0d09a64b051e7bde432fcae081",
"versionType": "git"
},
{
"lessThan": "dcd90f42a33e4220385f27b515183d0c91b2fc4a",
"status": "affected",
"version": "a6a6fe27bab48f0d09a64b051e7bde432fcae081",
"versionType": "git"
},
{
"lessThan": "94d286fa5eedc550d42bcb9c85416af8f77736ff",
"status": "affected",
"version": "a6a6fe27bab48f0d09a64b051e7bde432fcae081",
"versionType": "git"
},
{
"lessThan": "a3fdd924d88c30b9f488636ce0e4696012cf5511",
"status": "affected",
"version": "a6a6fe27bab48f0d09a64b051e7bde432fcae081",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/smc/af_smc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS\n\nA logic flaw in __smc_setsockopt() allows a local unprivileged user to\ncause a Denial of Service (DoS) by holding the socket lock indefinitely.\n\nThe function __smc_setsockopt() calls copy_from_sockptr() while holding\nlock_sock(sk). By passing a userfaultfd-monitored memory page (or\nFUSE-backed memory on systems where unprivileged userfaultfd is disabled)\nas the optval, an attacker can halt execution during the copy operation,\nkeeping the lock held.\n\nCombined with asynchronous tear-down operations like shutdown(), this\nexhausts the kernel wq (kworkers) and triggers the hung task watchdog.\n\n[ 240.123456] INFO: task kworker/u8:2 blocked for more than 120 seconds.\n[ 240.123489] Call Trace:\n[ 240.123501] smc_shutdown+...\n[ 240.123512] lock_sock_nested+...\n\nThis patch moves the user-space copy outside the lock_sock() critical\nsection to prevent the issue."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:58.478Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/35a22117839602bb52283de08894c5a7dde92420"
},
{
"url": "https://git.kernel.org/stable/c/5d27d2ffe487df89ce28fda0410eafa05dbe03a0"
},
{
"url": "https://git.kernel.org/stable/c/89f6fbe0033c942cb790ffd53ca93a45eeaf1c91"
},
{
"url": "https://git.kernel.org/stable/c/dcd90f42a33e4220385f27b515183d0c91b2fc4a"
},
{
"url": "https://git.kernel.org/stable/c/94d286fa5eedc550d42bcb9c85416af8f77736ff"
},
{
"url": "https://git.kernel.org/stable/c/a3fdd924d88c30b9f488636ce0e4696012cf5511"
}
],
"title": "net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53274",
"datePublished": "2026-06-25T08:39:58.478Z",
"dateReserved": "2026-06-09T07:44:35.395Z",
"dateUpdated": "2026-06-25T08:39:58.478Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46065 (GCVE-0-2026-46065)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
Hold state of deferred I/O in struct fb_deferred_io_state. Allocate an
instance as part of initializing deferred I/O and remove it only after
the final mapping has been closed. If the fb_info and the contained
deferred I/O meanwhile goes away, clear struct fb_deferred_io_state.info
to invalidate the mapping. Any access will then result in a SIGBUS
signal.
Fixes a long-standing problem, where a device hot-unplug happens while
user space still has an active mapping of the graphics memory. The hot-
unplug frees the instance of struct fb_info. Accessing the memory will
operate on undefined state.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 60b59beafba875aef6d378078bce0baf2287ae14 Version: 60b59beafba875aef6d378078bce0baf2287ae14 Version: 60b59beafba875aef6d378078bce0baf2287ae14 Version: 60b59beafba875aef6d378078bce0baf2287ae14 Version: 60b59beafba875aef6d378078bce0baf2287ae14 Version: 60b59beafba875aef6d378078bce0baf2287ae14 Version: 60b59beafba875aef6d378078bce0baf2287ae14 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fb_defio.c",
"include/linux/fb.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4aab89603b637a2e441b38808c4f6fe7d1184df6",
"status": "affected",
"version": "60b59beafba875aef6d378078bce0baf2287ae14",
"versionType": "git"
},
{
"lessThan": "4fda0d6b45faad44926dd3e4f55f118d899b2e27",
"status": "affected",
"version": "60b59beafba875aef6d378078bce0baf2287ae14",
"versionType": "git"
},
{
"lessThan": "2a40f8bc9bb713329f1c35ffc199ee961a7135b0",
"status": "affected",
"version": "60b59beafba875aef6d378078bce0baf2287ae14",
"versionType": "git"
},
{
"lessThan": "2b53d3a52e8e5403a4f4fb57ac6cad3fd2cb1066",
"status": "affected",
"version": "60b59beafba875aef6d378078bce0baf2287ae14",
"versionType": "git"
},
{
"lessThan": "25c2b77bc463f29ee71a54b883548baf9386a0db",
"status": "affected",
"version": "60b59beafba875aef6d378078bce0baf2287ae14",
"versionType": "git"
},
{
"lessThan": "a0aafb421dd15e935d81543152617f2742cefa70",
"status": "affected",
"version": "60b59beafba875aef6d378078bce0baf2287ae14",
"versionType": "git"
},
{
"lessThan": "9ded47ad003f09a94b6a710b5c47f4aa5ceb7429",
"status": "affected",
"version": "60b59beafba875aef6d378078bce0baf2287ae14",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fb_defio.c",
"include/linux/fb.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.22"
},
{
"lessThan": "2.6.22",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info\n\nHold state of deferred I/O in struct fb_deferred_io_state. Allocate an\ninstance as part of initializing deferred I/O and remove it only after\nthe final mapping has been closed. If the fb_info and the contained\ndeferred I/O meanwhile goes away, clear struct fb_deferred_io_state.info\nto invalidate the mapping. Any access will then result in a SIGBUS\nsignal.\n\nFixes a long-standing problem, where a device hot-unplug happens while\nuser space still has an active mapping of the graphics memory. The hot-\nunplug frees the instance of struct fb_info. Accessing the memory will\noperate on undefined state."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable fault handlers are reached by mmap\u0027ing /dev/fbN and accessing the mapping \u2014 a local operation requiring no network. Device removal (the precondition) can be non-physical (VM host-driven removal, sysfs unbind, module unload), so Local is the most severe defensible vector over Physical.\nAC:L - Once the device is removed while a mapping is active, any access deterministically hits the freed defio state/video pages \u2014 no race must be won to trigger it. In a kiosk/embedded scenario with a removable display the attacker controls both the mapping and the removal, and heap reclaim is attacker-influenced.\nPR:L - Exploitation requires only a local user with access to the framebuffer device, which is granted to the logged-in/console user, video-group members, Android apps, and is often world-accessible on embedded/kiosk systems. No root or init-namespace privilege is needed.\nUI:N - The attacker performs all steps themselves \u2014 map the framebuffer, cause/await removal, then access the mapping \u2014 with no separate victim action required.\nS:U - The use-after-free corrupts kernel memory within the same security authority; even in the VM-framebuffer case the impact stays inside the guest kernel and does not cross into the hypervisor.\nC:H - The fault handler returns freed-and-reclaimed video pages and the freed pagerefs array to userspace, allowing disclosure of arbitrary reallocated kernel/user memory \u2014 a use-after-free read primitive.\nI:H - The write-fault path writes a page pointer and offset into the kvfree\u0027d pagerefs array and exposes freed/reallocated pages for writing, giving a use-after-free write primitive usable for control-flow hijacking via heap spraying.\nA:H - Accessing the mapping after teardown uses a destroyed mutex, freed pagerefs, and hits BUG_ON(!info-\u003efbdefio-\u003emapping), reliably causing an oops/panic; any use-after-free crashes the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:27.785Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4aab89603b637a2e441b38808c4f6fe7d1184df6"
},
{
"url": "https://git.kernel.org/stable/c/4fda0d6b45faad44926dd3e4f55f118d899b2e27"
},
{
"url": "https://git.kernel.org/stable/c/2a40f8bc9bb713329f1c35ffc199ee961a7135b0"
},
{
"url": "https://git.kernel.org/stable/c/2b53d3a52e8e5403a4f4fb57ac6cad3fd2cb1066"
},
{
"url": "https://git.kernel.org/stable/c/25c2b77bc463f29ee71a54b883548baf9386a0db"
},
{
"url": "https://git.kernel.org/stable/c/a0aafb421dd15e935d81543152617f2742cefa70"
},
{
"url": "https://git.kernel.org/stable/c/9ded47ad003f09a94b6a710b5c47f4aa5ceb7429"
}
],
"title": "fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46065",
"datePublished": "2026-05-27T12:57:32.968Z",
"dateReserved": "2026-05-13T15:03:33.095Z",
"dateUpdated": "2026-08-05T12:29:27.785Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53156 (GCVE-0-2026-53156)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-06-25 08:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmem: core: fix use-after-free bugs in error paths
Fix several instances of error paths in which we call
__nvmem_device_put() - which may end up freeing the underlying memory
and other resources - and then keep on using the nvmem structure. Always
put the reference to the nvmem device as the last step before returning
the error code.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvmem/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e0d38bf47a72da2f02c9fa6f752cd66d977cd7f7",
"status": "affected",
"version": "e888d445ac33a5b0288d670ecd970908b13f07cd",
"versionType": "git"
},
{
"lessThan": "cb85ef5a227b3662b88f4d849a1aad43bfe7f5ae",
"status": "affected",
"version": "e888d445ac33a5b0288d670ecd970908b13f07cd",
"versionType": "git"
},
{
"lessThan": "40e2a459c0dd1333b2343831480a0ad80dc07614",
"status": "affected",
"version": "e888d445ac33a5b0288d670ecd970908b13f07cd",
"versionType": "git"
},
{
"lessThan": "5b6b6fc491899d583eaa75344e094796ae9b530b",
"status": "affected",
"version": "e888d445ac33a5b0288d670ecd970908b13f07cd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvmem/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmem: core: fix use-after-free bugs in error paths\n\nFix several instances of error paths in which we call\n__nvmem_device_put() - which may end up freeing the underlying memory\nand other resources - and then keep on using the nvmem structure. Always\nput the reference to the nvmem device as the last step before returning\nthe error code."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:38:39.495Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e0d38bf47a72da2f02c9fa6f752cd66d977cd7f7"
},
{
"url": "https://git.kernel.org/stable/c/cb85ef5a227b3662b88f4d849a1aad43bfe7f5ae"
},
{
"url": "https://git.kernel.org/stable/c/40e2a459c0dd1333b2343831480a0ad80dc07614"
},
{
"url": "https://git.kernel.org/stable/c/5b6b6fc491899d583eaa75344e094796ae9b530b"
}
],
"title": "nvmem: core: fix use-after-free bugs in error paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53156",
"datePublished": "2026-06-25T08:38:39.495Z",
"dateReserved": "2026-06-09T07:44:35.388Z",
"dateUpdated": "2026-06-25T08:38:39.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31523 (GCVE-0-2026-31523)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-05-11 22:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: ensure we're polling a polled queue
A user can change the polled queue count at run time. There's a brief
window during a reset where a hipri task may try to poll that queue
before the block layer has updated the queue maps, which would race with
the now interrupt driven queue and may cause double completions.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4b04cc6a8f86c4842314def22332de1f15de8523 Version: 4b04cc6a8f86c4842314def22332de1f15de8523 Version: 4b04cc6a8f86c4842314def22332de1f15de8523 Version: 4b04cc6a8f86c4842314def22332de1f15de8523 Version: 4b04cc6a8f86c4842314def22332de1f15de8523 Version: 4b04cc6a8f86c4842314def22332de1f15de8523 Version: 4b04cc6a8f86c4842314def22332de1f15de8523 Version: 4b04cc6a8f86c4842314def22332de1f15de8523 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "965e2c943f065122f14282a88d70a8a92e12a4da",
"status": "affected",
"version": "4b04cc6a8f86c4842314def22332de1f15de8523",
"versionType": "git"
},
{
"lessThan": "ba167d5982e2eb6ff9356d409eca592ce99555da",
"status": "affected",
"version": "4b04cc6a8f86c4842314def22332de1f15de8523",
"versionType": "git"
},
{
"lessThan": "0685dd9cb855ab77fcf3577b4702ba1d6df1c98d",
"status": "affected",
"version": "4b04cc6a8f86c4842314def22332de1f15de8523",
"versionType": "git"
},
{
"lessThan": "6f12734c4b619f923a4df0b1a46b8098b187d324",
"status": "affected",
"version": "4b04cc6a8f86c4842314def22332de1f15de8523",
"versionType": "git"
},
{
"lessThan": "acbc72dd1a09df53cafcf577259f4678be6afd6d",
"status": "affected",
"version": "4b04cc6a8f86c4842314def22332de1f15de8523",
"versionType": "git"
},
{
"lessThan": "b96c7b25eb1b748f3e3b1832ebf028b0b223d7e3",
"status": "affected",
"version": "4b04cc6a8f86c4842314def22332de1f15de8523",
"versionType": "git"
},
{
"lessThan": "b222680ba55e018426c4535067a008f1d81a5d21",
"status": "affected",
"version": "4b04cc6a8f86c4842314def22332de1f15de8523",
"versionType": "git"
},
{
"lessThan": "166e31d7dbf6aa44829b98aa446bda5c9580f12a",
"status": "affected",
"version": "4b04cc6a8f86c4842314def22332de1f15de8523",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/host/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: ensure we\u0027re polling a polled queue\n\nA user can change the polled queue count at run time. There\u0027s a brief\nwindow during a reset where a hipri task may try to poll that queue\nbefore the block layer has updated the queue maps, which would race with\nthe now interrupt driven queue and may cause double completions."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:10:26.646Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/965e2c943f065122f14282a88d70a8a92e12a4da"
},
{
"url": "https://git.kernel.org/stable/c/ba167d5982e2eb6ff9356d409eca592ce99555da"
},
{
"url": "https://git.kernel.org/stable/c/0685dd9cb855ab77fcf3577b4702ba1d6df1c98d"
},
{
"url": "https://git.kernel.org/stable/c/6f12734c4b619f923a4df0b1a46b8098b187d324"
},
{
"url": "https://git.kernel.org/stable/c/acbc72dd1a09df53cafcf577259f4678be6afd6d"
},
{
"url": "https://git.kernel.org/stable/c/b96c7b25eb1b748f3e3b1832ebf028b0b223d7e3"
},
{
"url": "https://git.kernel.org/stable/c/b222680ba55e018426c4535067a008f1d81a5d21"
},
{
"url": "https://git.kernel.org/stable/c/166e31d7dbf6aa44829b98aa446bda5c9580f12a"
}
],
"title": "nvme-pci: ensure we\u0027re polling a polled queue",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31523",
"datePublished": "2026-04-22T13:54:37.568Z",
"dateReserved": "2026-03-09T15:48:24.110Z",
"dateUpdated": "2026-05-11T22:10:26.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46307 (GCVE-0-2026-46307)
Vulnerability from cvelistv5
Published
2026-06-08 15:46
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath5k: do not access array OOB
Vincent reports:
> The ath5k driver seems to do an array-index-out-of-bounds access as
> shown by the UBSAN kernel message:
> UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20
> index 4 is out of range for type 'ieee80211_tx_rate [4]'
> ...
> Call Trace:
> <TASK>
> dump_stack_lvl+0x5d/0x80
> ubsan_epilogue+0x5/0x2b
> __ubsan_handle_out_of_bounds.cold+0x46/0x4b
> ath5k_tasklet_tx+0x4e0/0x560 [ath5k]
> tasklet_action_common+0xb5/0x1c0
It is real. 'ts->ts_final_idx' can be 3 on 5212, so:
info->status.rates[ts->ts_final_idx + 1].idx = -1;
with the array defined as:
struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];
while the size is:
#define IEEE80211_TX_MAX_RATES 4
is indeed bogus.
Set this 'idx = -1' sentinel only if the array index is less than the
array size. As mac80211 will not look at rates beyond the size
(IEEE80211_TX_MAX_RATES).
Note: The effect of the OOB write is negligible. It just overwrites the
next member of info->status, i.e. ack_signal.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6d7b97b23e114c8fbb825e6721164d228c1af3fc Version: 6d7b97b23e114c8fbb825e6721164d228c1af3fc Version: 6d7b97b23e114c8fbb825e6721164d228c1af3fc Version: 6d7b97b23e114c8fbb825e6721164d228c1af3fc Version: 6d7b97b23e114c8fbb825e6721164d228c1af3fc Version: 6d7b97b23e114c8fbb825e6721164d228c1af3fc Version: 6d7b97b23e114c8fbb825e6721164d228c1af3fc Version: 6d7b97b23e114c8fbb825e6721164d228c1af3fc |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath5k/base.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ecb1c163166759dec004c1fdb9709b8a5992fc8e",
"status": "affected",
"version": "6d7b97b23e114c8fbb825e6721164d228c1af3fc",
"versionType": "git"
},
{
"lessThan": "9dd6aae4bc7bfa11088d928670a3315eae542769",
"status": "affected",
"version": "6d7b97b23e114c8fbb825e6721164d228c1af3fc",
"versionType": "git"
},
{
"lessThan": "744c19e266b0d2628c5951439195dcef27eadacf",
"status": "affected",
"version": "6d7b97b23e114c8fbb825e6721164d228c1af3fc",
"versionType": "git"
},
{
"lessThan": "83226c71af53fb9b3cad40cb9a9a79f36d68c020",
"status": "affected",
"version": "6d7b97b23e114c8fbb825e6721164d228c1af3fc",
"versionType": "git"
},
{
"lessThan": "d6869537013b1f21b292342752d97868b79b5934",
"status": "affected",
"version": "6d7b97b23e114c8fbb825e6721164d228c1af3fc",
"versionType": "git"
},
{
"lessThan": "e9f1081bc775146156def0dbc821b92f35d56afb",
"status": "affected",
"version": "6d7b97b23e114c8fbb825e6721164d228c1af3fc",
"versionType": "git"
},
{
"lessThan": "568173ad9bd0b46cc6cd937dea8791e9b5eefa57",
"status": "affected",
"version": "6d7b97b23e114c8fbb825e6721164d228c1af3fc",
"versionType": "git"
},
{
"lessThan": "d748603f12baff112caa3ab7d39f50100f010dbd",
"status": "affected",
"version": "6d7b97b23e114c8fbb825e6721164d228c1af3fc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath5k/base.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath5k: do not access array OOB\n\nVincent reports:\n\u003e The ath5k driver seems to do an array-index-out-of-bounds access as\n\u003e shown by the UBSAN kernel message:\n\u003e UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20\n\u003e index 4 is out of range for type \u0027ieee80211_tx_rate [4]\u0027\n\u003e ...\n\u003e Call Trace:\n\u003e \u003cTASK\u003e\n\u003e dump_stack_lvl+0x5d/0x80\n\u003e ubsan_epilogue+0x5/0x2b\n\u003e __ubsan_handle_out_of_bounds.cold+0x46/0x4b\n\u003e ath5k_tasklet_tx+0x4e0/0x560 [ath5k]\n\u003e tasklet_action_common+0xb5/0x1c0\n\nIt is real. \u0027ts-\u003ets_final_idx\u0027 can be 3 on 5212, so:\n info-\u003estatus.rates[ts-\u003ets_final_idx + 1].idx = -1;\nwith the array defined as:\n struct ieee80211_tx_rate rates[IEEE80211_TX_MAX_RATES];\nwhile the size is:\n #define IEEE80211_TX_MAX_RATES 4\nis indeed bogus.\n\nSet this \u0027idx = -1\u0027 sentinel only if the array index is less than the\narray size. As mac80211 will not look at rates beyond the size\n(IEEE80211_TX_MAX_RATES).\n\nNote: The effect of the OOB write is negligible. It just overwrites the\nnext member of info-\u003estatus, i.e. ack_signal."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The flaw fires on AR5212 TX completion in the ath5k driver when multi-rate retry exhausts to series index 3; an adjacent WiFi attacker can induce victim transmissions and RF/rate conditions that reach this path without remote Internet routing.\nAC:L - Once AR5212 hardware with ath5k is present, reaching `ts_final_idx == 3` is normal MRR behavior under poor link quality, and an attacker can reliably force that state through sustained WiFi traffic and interference rather than depending on uncontrollable timing or layout.\nPR:N - Exploitation requires no privileges on the victim host; an adjacent WiFi peer can trigger victim TX completions through standard 802.11 interaction (association, data frames, deauth/retry pressure) without local shell or capability-bearing access.\nUI:N - No victim user action such as mounting a filesystem or opening a file is required; the bug is hit automatically during routine wireless transmit completion handling.\nS:U - Impact is confined to kernel wireless driver TX-status metadata on the same host and does not cross VM, container, or IOMMU security boundaries.\nC:H - The out-of-bounds write corrupts kernel memory in `ieee80211_tx_info.status` (clobbering `ack_signal`), and any OOB kernel memory corruption is treated as enabling information disclosure through corrupted status data fed back into mac80211.\nI:H - The vulnerability is an out-of-bounds write (`rates[ts_final_idx + 1].idx = -1` with `ts_final_idx == 3`) that modifies adjacent kernel metadata beyond the allocated `rates[4]` array.\nA:L - The corruption primarily perturbs TX status/rate-control state rather than reliably panicking production kernels, but can degrade wireless availability through corrupted ACK signal and rate-reporting used by mac80211/minstrel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:09.813Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ecb1c163166759dec004c1fdb9709b8a5992fc8e"
},
{
"url": "https://git.kernel.org/stable/c/9dd6aae4bc7bfa11088d928670a3315eae542769"
},
{
"url": "https://git.kernel.org/stable/c/744c19e266b0d2628c5951439195dcef27eadacf"
},
{
"url": "https://git.kernel.org/stable/c/83226c71af53fb9b3cad40cb9a9a79f36d68c020"
},
{
"url": "https://git.kernel.org/stable/c/d6869537013b1f21b292342752d97868b79b5934"
},
{
"url": "https://git.kernel.org/stable/c/e9f1081bc775146156def0dbc821b92f35d56afb"
},
{
"url": "https://git.kernel.org/stable/c/568173ad9bd0b46cc6cd937dea8791e9b5eefa57"
},
{
"url": "https://git.kernel.org/stable/c/d748603f12baff112caa3ab7d39f50100f010dbd"
}
],
"title": "wifi: ath5k: do not access array OOB",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46307",
"datePublished": "2026-06-08T15:46:35.059Z",
"dateReserved": "2026-05-13T15:03:33.111Z",
"dateUpdated": "2026-08-05T12:31:09.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46119 (GCVE-0-2026-46119)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: Fix slab-out-of-bounds access in auth message processing
If a (potentially corrupted) message of type CEPH_MSG_AUTH_REPLY
contains a positive value in its result field, it is treated as an
error code by ceph_handle_auth_reply() and returned to
handle_auth_reply(). Thereafter, an attempt is made to send the
preallocated message of type CEPH_MSG_AUTH, where the returned value is
interpreted as the size of the front segment to send. If the result
value in the message is greater than the size of the memory buffer
allocated for the front segment, an out-of-bounds access occurs, and
the content of the memory region beyond this buffer is sent out.
This patch fixes the issue by treating only negative values in the
result field as errors. Positive values are therefore treated as success
in the same way as a zero value. Additionally, a BUG_ON is added to
__send_prepared_auth_request() comparing the len parameter to
front_alloc_len to prevent sending the message if it exceeds the bounds
of the allocation and to make it easier to catch any logic flaws leading
to this.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc Version: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/auth.c",
"net/ceph/mon_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c2374b92c729d0388a538b3cde7b3e3b5e55ef39",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "38fdf04c602d52c42c67fc1617211492753b7e8b",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "2ae0afd98432536562fa8261538ae795446f0589",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "408e85ee708b6aa03eeb0220ffa0915f4d407181",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "b7df9fbd4869fdfe09a3f501ffd228486521e062",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "8517b6c8d2c759918ba0058cb6c7e14d59643202",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
},
{
"lessThan": "1c439de70b1c3eb3c6bffa8245c16b9fc318f114",
"status": "affected",
"version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/auth.c",
"net/ceph/mon_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Fix slab-out-of-bounds access in auth message processing\n\nIf a (potentially corrupted) message of type CEPH_MSG_AUTH_REPLY\ncontains a positive value in its result field, it is treated as an\nerror code by ceph_handle_auth_reply() and returned to\nhandle_auth_reply(). Thereafter, an attempt is made to send the\npreallocated message of type CEPH_MSG_AUTH, where the returned value is\ninterpreted as the size of the front segment to send. If the result\nvalue in the message is greater than the size of the memory buffer\nallocated for the front segment, an out-of-bounds access occurs, and\nthe content of the memory region beyond this buffer is sent out.\n\nThis patch fixes the issue by treating only negative values in the\nresult field as errors. Positive values are therefore treated as success\nin the same way as a zero value. Additionally, a BUG_ON is added to\n__send_prepared_auth_request() comparing the len parameter to\nfront_alloc_len to prevent sending the message if it exceeds the bounds\nof the allocation and to make it easier to catch any logic flaws leading\nto this."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in libceph\u0027s in-kernel Ceph client (CephFS/RBD), triggered by processing a CEPH_MSG_AUTH_REPLY received over TCP from a Ceph monitor; a malicious monitor or network MITM supplies the malicious data, making it remotely exploitable.\nAC:L - The attacker fully controls the s32 `result` field in the reply and can reliably set it above 4096; no race or specific uncontrollable memory layout is required to trigger the out-of-bounds read.\nPR:N - The vulnerable code runs during the msgr1 auth handshake, before the peer is authenticated and over an unencrypted channel, so a malicious/MITM monitor needs no credentials on the victim system.\nUI:N - Once a Ceph mount/RBD map exists, the client connects and re-authenticates to monitors automatically (including on connection faults), so no per-exploit victim action is required.\nS:U - The out-of-bounds read and resulting crash occur entirely within the kernel\u0027s own security authority with no crossing of a security boundary.\nC:H - Kernel heap memory beyond the 4096-byte front buffer (up to ~2GB) is read and transmitted over the network to the attacker, an unbounded information disclosure that can leak pointers, keys, and other message data.\nI:N - The attacker-controlled value only sets a length field used to read and send data; no kernel memory is written or corrupted and there is no control-flow hijack primitive.\nA:H - Setting `result` to a large positive value makes the send path read past mapped memory, causing a kernel oops/crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:50.601Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c2374b92c729d0388a538b3cde7b3e3b5e55ef39"
},
{
"url": "https://git.kernel.org/stable/c/38fdf04c602d52c42c67fc1617211492753b7e8b"
},
{
"url": "https://git.kernel.org/stable/c/2ae0afd98432536562fa8261538ae795446f0589"
},
{
"url": "https://git.kernel.org/stable/c/408e85ee708b6aa03eeb0220ffa0915f4d407181"
},
{
"url": "https://git.kernel.org/stable/c/b7df9fbd4869fdfe09a3f501ffd228486521e062"
},
{
"url": "https://git.kernel.org/stable/c/8517b6c8d2c759918ba0058cb6c7e14d59643202"
},
{
"url": "https://git.kernel.org/stable/c/1c439de70b1c3eb3c6bffa8245c16b9fc318f114"
}
],
"title": "libceph: Fix slab-out-of-bounds access in auth message processing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46119",
"datePublished": "2026-05-28T09:35:34.543Z",
"dateReserved": "2026-05-13T15:03:33.098Z",
"dateUpdated": "2026-08-05T12:29:50.601Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31466 (GCVE-0-2026-31466)
Vulnerability from cvelistv5
Published
2026-04-22 13:53
Modified
2026-07-14 12:47
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
On arm64 server, we found folio that get from migration entry isn't locked
in softleaf_to_folio(). This issue triggers when mTHP splitting and
zap_nonpresent_ptes() races, and the root cause is lack of memory barrier
in softleaf_to_folio(). The race is as follows:
CPU0 CPU1
deferred_split_scan() zap_nonpresent_ptes()
lock folio
split_folio()
unmap_folio()
change ptes to migration entries
__split_folio_to_order() softleaf_to_folio()
set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry))
smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio))
prep_compound_page() for tail pages
In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages
are visible before the tail page becomes non-compound. smp_wmb() should
be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a
result, if zap_nonpresent_ptes() accesses migration entry that stores tail
pfn, softleaf_to_folio() may see the updated compound_head of tail page
before page->flags.
This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio()
because of the race between folio split and zap_nonpresent_ptes()
leading to a folio incorrectly undergoing modification without a folio
lock being held.
This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further
swapops predicates"), which in merged in v6.19-rc1.
To fix it, add missing smp_rmb() if the softleaf entry is migration entry
in softleaf_to_folio() and softleaf_to_page().
[tujinjiang@huawei.com: update function name and comments]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e9b61f19858a5d6c42ce2298cf138279375d0d9b Version: e9b61f19858a5d6c42ce2298cf138279375d0d9b Version: e9b61f19858a5d6c42ce2298cf138279375d0d9b Version: e9b61f19858a5d6c42ce2298cf138279375d0d9b Version: e9b61f19858a5d6c42ce2298cf138279375d0d9b Version: e9b61f19858a5d6c42ce2298cf138279375d0d9b Version: e9b61f19858a5d6c42ce2298cf138279375d0d9b Version: e9b61f19858a5d6c42ce2298cf138279375d0d9b |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:47:58.674Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/leafops.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "426ee10711586617da869c8bb798214965337617",
"status": "affected",
"version": "e9b61f19858a5d6c42ce2298cf138279375d0d9b",
"versionType": "git"
},
{
"lessThan": "f1acf5887c2bbaf998dc3fe32c72b7a8b84a3ddd",
"status": "affected",
"version": "e9b61f19858a5d6c42ce2298cf138279375d0d9b",
"versionType": "git"
},
{
"lessThan": "722cfaf6b31d31123439e67b5deac6b1261a3dea",
"status": "affected",
"version": "e9b61f19858a5d6c42ce2298cf138279375d0d9b",
"versionType": "git"
},
{
"lessThan": "7ddcf4a245c1c5a91fdd9698757e3d95179ffe41",
"status": "affected",
"version": "e9b61f19858a5d6c42ce2298cf138279375d0d9b",
"versionType": "git"
},
{
"lessThan": "b8c49ad888892ad7b77062b9c102b799a3e9b4f8",
"status": "affected",
"version": "e9b61f19858a5d6c42ce2298cf138279375d0d9b",
"versionType": "git"
},
{
"lessThan": "7ad1997b9bc8032603df8f091761114479285769",
"status": "affected",
"version": "e9b61f19858a5d6c42ce2298cf138279375d0d9b",
"versionType": "git"
},
{
"lessThan": "8bfb8414e9f2ce6f5f2f0e3d0da52f2d132128e7",
"status": "affected",
"version": "e9b61f19858a5d6c42ce2298cf138279375d0d9b",
"versionType": "git"
},
{
"lessThan": "4c5e7f0fcd592801c9cc18f29f80fbee84eb8669",
"status": "affected",
"version": "e9b61f19858a5d6c42ce2298cf138279375d0d9b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/leafops.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: fix folio isn\u0027t locked in softleaf_to_folio()\n\nOn arm64 server, we found folio that get from migration entry isn\u0027t locked\nin softleaf_to_folio(). This issue triggers when mTHP splitting and\nzap_nonpresent_ptes() races, and the root cause is lack of memory barrier\nin softleaf_to_folio(). The race is as follows:\n\n\tCPU0 CPU1\n\ndeferred_split_scan() zap_nonpresent_ptes()\n lock folio\n split_folio()\n unmap_folio()\n change ptes to migration entries\n __split_folio_to_order() softleaf_to_folio()\n set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry))\n smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio))\n prep_compound_page() for tail pages\n\nIn __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages\nare visible before the tail page becomes non-compound. smp_wmb() should\nbe paired with smp_rmb() in softleaf_to_folio(), which is missed. As a\nresult, if zap_nonpresent_ptes() accesses migration entry that stores tail\npfn, softleaf_to_folio() may see the updated compound_head of tail page\nbefore page-\u003eflags.\n\nThis issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio()\nbecause of the race between folio split and zap_nonpresent_ptes()\nleading to a folio incorrectly undergoing modification without a folio\nlock being held.\n\nThis is a BUG_ON() before commit 93976a20345b (\"mm: eliminate further\nswapops predicates\"), which in merged in v6.19-rc1.\n\nTo fix it, add missing smp_rmb() if the softleaf entry is migration entry\nin softleaf_to_folio() and softleaf_to_page().\n\n[tujinjiang@huawei.com: update function name and comments]"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:09:16.806Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/426ee10711586617da869c8bb798214965337617"
},
{
"url": "https://git.kernel.org/stable/c/f1acf5887c2bbaf998dc3fe32c72b7a8b84a3ddd"
},
{
"url": "https://git.kernel.org/stable/c/722cfaf6b31d31123439e67b5deac6b1261a3dea"
},
{
"url": "https://git.kernel.org/stable/c/7ddcf4a245c1c5a91fdd9698757e3d95179ffe41"
},
{
"url": "https://git.kernel.org/stable/c/b8c49ad888892ad7b77062b9c102b799a3e9b4f8"
},
{
"url": "https://git.kernel.org/stable/c/7ad1997b9bc8032603df8f091761114479285769"
},
{
"url": "https://git.kernel.org/stable/c/8bfb8414e9f2ce6f5f2f0e3d0da52f2d132128e7"
},
{
"url": "https://git.kernel.org/stable/c/4c5e7f0fcd592801c9cc18f29f80fbee84eb8669"
}
],
"title": "mm/huge_memory: fix folio isn\u0027t locked in softleaf_to_folio()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31466",
"datePublished": "2026-04-22T13:53:56.259Z",
"dateReserved": "2026-03-09T15:48:24.097Z",
"dateUpdated": "2026-07-14T12:47:58.674Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53056 (GCVE-0-2026-53056)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/msm/dpu: fix mismatch between power and frequency
During DPU runtime suspend, calling dev_pm_opp_set_rate(dev, 0) drops
the MMCX rail to MIN_SVS while the core clock frequency remains at its
original (highest) rate. When runtime resume re-enables the clock, this
may result in a mismatch between the rail voltage and the clock rate.
For example, in the DPU bind path, the sequence could be:
cpu0: dev_sync_state -> rpmhpd_sync_state
cpu1: dpu_kms_hw_init
timeline 0 ------------------------------------------------> t
After rpmhpd_sync_state, the voltage performance is no longer guaranteed
to stay at the highest level. During dpu_kms_hw_init, calling
dev_pm_opp_set_rate(dev, 0) drops the voltage, causing the MMCX rail to
fall to MIN_SVS while the core clock is still at its maximum frequency.
When the power is re-enabled, only the clock is enabled, leading to a
situation where the MMCX rail is at MIN_SVS but the core clock is at its
highest rate. In this state, the rail cannot sustain the clock rate,
which may cause instability or system crash.
Remove the call to dev_pm_opp_set_rate(dev, 0) from dpu_runtime_suspend
to ensure the correct vote is restored when DPU resumes.
Patchwork: https://patchwork.freedesktop.org/patch/710077/
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b0530eb1191307e9038d75e5c83973a396137681 Version: b0530eb1191307e9038d75e5c83973a396137681 Version: b0530eb1191307e9038d75e5c83973a396137681 Version: b0530eb1191307e9038d75e5c83973a396137681 Version: b0530eb1191307e9038d75e5c83973a396137681 Version: b0530eb1191307e9038d75e5c83973a396137681 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1181a7028d37e0b1e720a36125a03f5db97e3d27",
"status": "affected",
"version": "b0530eb1191307e9038d75e5c83973a396137681",
"versionType": "git"
},
{
"lessThan": "9830999c9e065c1813ec5435bfe4eab98ee54a87",
"status": "affected",
"version": "b0530eb1191307e9038d75e5c83973a396137681",
"versionType": "git"
},
{
"lessThan": "c5735c7d0eef7a5240f9c1c66e44ba52a1be58d6",
"status": "affected",
"version": "b0530eb1191307e9038d75e5c83973a396137681",
"versionType": "git"
},
{
"lessThan": "0f7dd5839cfabaf9c007fb718ec66e907a473c93",
"status": "affected",
"version": "b0530eb1191307e9038d75e5c83973a396137681",
"versionType": "git"
},
{
"lessThan": "0ccf4f27b4652570b5de3de02a89a86435559de9",
"status": "affected",
"version": "b0530eb1191307e9038d75e5c83973a396137681",
"versionType": "git"
},
{
"lessThan": "bc1dccc518cc5ab5140fba06c27e7188e0ed342b",
"status": "affected",
"version": "b0530eb1191307e9038d75e5c83973a396137681",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm/dpu: fix mismatch between power and frequency\n\nDuring DPU runtime suspend, calling dev_pm_opp_set_rate(dev, 0) drops\nthe MMCX rail to MIN_SVS while the core clock frequency remains at its\noriginal (highest) rate. When runtime resume re-enables the clock, this\nmay result in a mismatch between the rail voltage and the clock rate.\n\nFor example, in the DPU bind path, the sequence could be:\n cpu0: dev_sync_state -\u003e rpmhpd_sync_state\n cpu1: dpu_kms_hw_init\ntimeline 0 ------------------------------------------------\u003e t\n\nAfter rpmhpd_sync_state, the voltage performance is no longer guaranteed\nto stay at the highest level. During dpu_kms_hw_init, calling\ndev_pm_opp_set_rate(dev, 0) drops the voltage, causing the MMCX rail to\nfall to MIN_SVS while the core clock is still at its maximum frequency.\nWhen the power is re-enabled, only the clock is enabled, leading to a\nsituation where the MMCX rail is at MIN_SVS but the core clock is at its\nhighest rate. In this state, the rail cannot sustain the clock rate,\nwhich may cause instability or system crash.\n\nRemove the call to dev_pm_opp_set_rate(dev, 0) from dpu_runtime_suspend\nto ensure the correct vote is restored when DPU resumes.\n\nPatchwork: https://patchwork.freedesktop.org/patch/710077/"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:01.694Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1181a7028d37e0b1e720a36125a03f5db97e3d27"
},
{
"url": "https://git.kernel.org/stable/c/9830999c9e065c1813ec5435bfe4eab98ee54a87"
},
{
"url": "https://git.kernel.org/stable/c/c5735c7d0eef7a5240f9c1c66e44ba52a1be58d6"
},
{
"url": "https://git.kernel.org/stable/c/0f7dd5839cfabaf9c007fb718ec66e907a473c93"
},
{
"url": "https://git.kernel.org/stable/c/0ccf4f27b4652570b5de3de02a89a86435559de9"
},
{
"url": "https://git.kernel.org/stable/c/bc1dccc518cc5ab5140fba06c27e7188e0ed342b"
}
],
"title": "drm/msm/dpu: fix mismatch between power and frequency",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53056",
"datePublished": "2026-06-24T16:30:01.694Z",
"dateReserved": "2026-06-09T07:44:35.381Z",
"dateUpdated": "2026-06-24T16:30:01.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43028 (GCVE-0-2026-43028)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: x_tables: ensure names are nul-terminated
Reject names that lack a \0 character before feeding them
to functions that expect c-strings.
Fixes tag is the most recent commit that needs this change.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c38c4597e4bf3e99860eac98211748e1ecb0e139 Version: c38c4597e4bf3e99860eac98211748e1ecb0e139 Version: c38c4597e4bf3e99860eac98211748e1ecb0e139 Version: c38c4597e4bf3e99860eac98211748e1ecb0e139 Version: c38c4597e4bf3e99860eac98211748e1ecb0e139 Version: c38c4597e4bf3e99860eac98211748e1ecb0e139 Version: c38c4597e4bf3e99860eac98211748e1ecb0e139 Version: c38c4597e4bf3e99860eac98211748e1ecb0e139 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:49:04.403Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_cgroup.c",
"net/netfilter/xt_rateest.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bcac50ea0a29d430eedc5ac87b215393b567baa9",
"status": "affected",
"version": "c38c4597e4bf3e99860eac98211748e1ecb0e139",
"versionType": "git"
},
{
"lessThan": "ea01c1b219f5a11c66918abaa6f052e5a74041d6",
"status": "affected",
"version": "c38c4597e4bf3e99860eac98211748e1ecb0e139",
"versionType": "git"
},
{
"lessThan": "aa6cd4a8863391e0a64f62d8922cb0af732a2cf2",
"status": "affected",
"version": "c38c4597e4bf3e99860eac98211748e1ecb0e139",
"versionType": "git"
},
{
"lessThan": "c2d4a3abb15ca14716c6d8b9ffcbcd7c63626af4",
"status": "affected",
"version": "c38c4597e4bf3e99860eac98211748e1ecb0e139",
"versionType": "git"
},
{
"lessThan": "673bbd36cba21d10a10f0932f479df7468e26fbb",
"status": "affected",
"version": "c38c4597e4bf3e99860eac98211748e1ecb0e139",
"versionType": "git"
},
{
"lessThan": "f419bdc205894750f4d3ec042bc87a1b9cde1351",
"status": "affected",
"version": "c38c4597e4bf3e99860eac98211748e1ecb0e139",
"versionType": "git"
},
{
"lessThan": "73124608172890306b85f2206d8b3cac20e324f1",
"status": "affected",
"version": "c38c4597e4bf3e99860eac98211748e1ecb0e139",
"versionType": "git"
},
{
"lessThan": "a958a4f90ddd7de0800b33ca9d7b886b7d40f74e",
"status": "affected",
"version": "c38c4597e4bf3e99860eac98211748e1ecb0e139",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_cgroup.c",
"net/netfilter/xt_rateest.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: x_tables: ensure names are nul-terminated\n\nReject names that lack a \\0 character before feeding them\nto functions that expect c-strings.\n\nFixes tag is the most recent commit that needs this change."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable x_tables match validation is reached by local rule creation paths such as iptables setsockopt table replacement or nft_compat netlink rule creation, not by received network packets.\nAC:L - A local attacker can deterministically submit a crafted match blob with a non-NUL-terminated cgroup path or rateest name; no race or victim state is required.\nPR:L - The path requires CAP_NET_ADMIN in the target network namespace, but netfilter administration is reachable by an unprivileged user through user and network namespaces on systems allowing unprivileged user namespaces.\nUI:N - After obtaining the local namespace privileges, the attacker directly invokes the rule insertion path without any victim action.\nS:U - The issue affects kernel netfilter processing within the same host kernel security authority and does not cross a VM, hypervisor, or separate security scope boundary.\nC:H - The bug feeds attacker-controlled fixed-size fields lacking a NUL terminator into C-string consumers, and affected kernels can read past the intended match field into adjacent kernel memory until a NUL is found. Because this out-of-bounds read is not strictly bounded to only a few bytes across affected versions, confidentiality is scored High.\nI:N - The investigated paths show an out-of-bounds read/string validation failure during rule validation, with no write primitive or control-flow modification identified.\nA:H - The unterminated C-string scan can run beyond the allocated rule data and fault or oops the kernel, producing a local denial of service that can be triggered repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:21.789Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bcac50ea0a29d430eedc5ac87b215393b567baa9"
},
{
"url": "https://git.kernel.org/stable/c/ea01c1b219f5a11c66918abaa6f052e5a74041d6"
},
{
"url": "https://git.kernel.org/stable/c/aa6cd4a8863391e0a64f62d8922cb0af732a2cf2"
},
{
"url": "https://git.kernel.org/stable/c/c2d4a3abb15ca14716c6d8b9ffcbcd7c63626af4"
},
{
"url": "https://git.kernel.org/stable/c/673bbd36cba21d10a10f0932f479df7468e26fbb"
},
{
"url": "https://git.kernel.org/stable/c/f419bdc205894750f4d3ec042bc87a1b9cde1351"
},
{
"url": "https://git.kernel.org/stable/c/73124608172890306b85f2206d8b3cac20e324f1"
},
{
"url": "https://git.kernel.org/stable/c/a958a4f90ddd7de0800b33ca9d7b886b7d40f74e"
}
],
"title": "netfilter: x_tables: ensure names are nul-terminated",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43028",
"datePublished": "2026-05-01T14:15:29.192Z",
"dateReserved": "2026-05-01T14:12:55.976Z",
"dateUpdated": "2026-08-05T12:25:21.789Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52936 (GCVE-0-2026-52936)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-06-24 07:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: jitterentropy - replace long-held spinlock with mutex
jent_kcapi_random() serializes the shared jitterentropy state, but it
currently holds a spinlock across the jent_read_entropy() call. That
path performs expensive jitter collection and SHA3 conditioning, so
parallel readers can trigger stalls as contending waiters spin for
the same lock.
To prevent non-preemptible lock hold, replace rng->jent_lock with a
mutex so contended readers sleep instead of spinning on a shared lock
held across expensive entropy generation.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/jitterentropy-kcapi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "18216b8ab6904753eaf31baf453cb02ecd202ba4",
"status": "affected",
"version": "bb5530e4082446aac3a3d69780cd4dbfa4520013",
"versionType": "git"
},
{
"lessThan": "4c03e6eb98443dc4d6d422a9780034a5b75376b4",
"status": "affected",
"version": "bb5530e4082446aac3a3d69780cd4dbfa4520013",
"versionType": "git"
},
{
"lessThan": "ff734dbd9e2432601a6dcd167cfb0bf8a36d1880",
"status": "affected",
"version": "bb5530e4082446aac3a3d69780cd4dbfa4520013",
"versionType": "git"
},
{
"lessThan": "ec427dc5286da1ed08f2d510e2147a7581b0cb02",
"status": "affected",
"version": "bb5530e4082446aac3a3d69780cd4dbfa4520013",
"versionType": "git"
},
{
"lessThan": "01d798e9feb30212952d4e992801ba6bd6a82351",
"status": "affected",
"version": "bb5530e4082446aac3a3d69780cd4dbfa4520013",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/jitterentropy-kcapi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: jitterentropy - replace long-held spinlock with mutex\n\njent_kcapi_random() serializes the shared jitterentropy state, but it\ncurrently holds a spinlock across the jent_read_entropy() call. That\npath performs expensive jitter collection and SHA3 conditioning, so\nparallel readers can trigger stalls as contending waiters spin for\nthe same lock.\n\nTo prevent non-preemptible lock hold, replace rng-\u003ejent_lock with a\nmutex so contended readers sleep instead of spinning on a shared lock\nheld across expensive entropy generation."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T07:14:26.649Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/18216b8ab6904753eaf31baf453cb02ecd202ba4"
},
{
"url": "https://git.kernel.org/stable/c/4c03e6eb98443dc4d6d422a9780034a5b75376b4"
},
{
"url": "https://git.kernel.org/stable/c/ff734dbd9e2432601a6dcd167cfb0bf8a36d1880"
},
{
"url": "https://git.kernel.org/stable/c/ec427dc5286da1ed08f2d510e2147a7581b0cb02"
},
{
"url": "https://git.kernel.org/stable/c/01d798e9feb30212952d4e992801ba6bd6a82351"
}
],
"title": "crypto: jitterentropy - replace long-held spinlock with mutex",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52936",
"datePublished": "2026-06-24T07:14:26.649Z",
"dateReserved": "2026-06-09T07:44:35.370Z",
"dateUpdated": "2026-06-24T07:14:26.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46165 (GCVE-0-2026-46165)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-06-14 17:59
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: vport: fix self-deadlock on release of tunnel ports
vports are used concurrently and protected by RCU, so netdev_put()
must happen after the RCU grace period. So, either in an RCU call or
after the synchronize_net(). The rtnl_delete_link() must happen under
RTNL and so can't be executed in RCU context. Calling synchronize_net()
while holding RTNL is not a good idea for performance and system
stability under load in general, so calling netdev_put() in RCU call
is the right solution here.
However,
when the device is deleted, rtnl_unlock() will call netdev_run_todo()
and block until all the references are gone. In the current code this
means that we never reach the call_rcu() and the vport is never freed
and the reference is never released, causing a self-deadlock on device
removal.
Fix that by moving the rcu_call() before the rtnl_unlock(), so the
scheduled RCU callback will be executed when synchronize_net() is
called from the rtnl_unlock()->netdev_run_todo() while the RTNL itself
is already released.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9d56aced21fb9c104e8a3f3be9b21fbafe448ffc Version: 42f0d3d81209654c08ffdde5a34b9b92d2645896 Version: bbe7bd722bfaea36aab3da6cc60fb4a05c644643 Version: 98b726ab5e2a4811e27c28e4d041f75bba147eab Version: 6931d21f87bc6d657f145798fad0bf077b82486c Version: 6931d21f87bc6d657f145798fad0bf077b82486c Version: b8c56a3fc5d879c0928f207a756b0f067f06c6a8 Version: 6.1.168 ≤ Version: 6.6.131 ≤ Version: 6.12.80 ≤ Version: 6.18.21 ≤ Version: 6.19.11 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/vport-netdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8ae6c15fc473c9ad03b0173330cce9a092c76154",
"status": "affected",
"version": "9d56aced21fb9c104e8a3f3be9b21fbafe448ffc",
"versionType": "git"
},
{
"lessThan": "c741433f6c8dcdecd1d9549d89053761fd1ea413",
"status": "affected",
"version": "42f0d3d81209654c08ffdde5a34b9b92d2645896",
"versionType": "git"
},
{
"lessThan": "6522d59fb7de55ce0f0f285d962243ddffebb01f",
"status": "affected",
"version": "bbe7bd722bfaea36aab3da6cc60fb4a05c644643",
"versionType": "git"
},
{
"lessThan": "3df75fff46b1517eb479d8e6b8e3500763715dd0",
"status": "affected",
"version": "98b726ab5e2a4811e27c28e4d041f75bba147eab",
"versionType": "git"
},
{
"lessThan": "366c482965c673565ecb8bcfb15d5548f13a6a10",
"status": "affected",
"version": "6931d21f87bc6d657f145798fad0bf077b82486c",
"versionType": "git"
},
{
"lessThan": "aa69918bd418e700309fdd08509dba324fb24296",
"status": "affected",
"version": "6931d21f87bc6d657f145798fad0bf077b82486c",
"versionType": "git"
},
{
"status": "affected",
"version": "b8c56a3fc5d879c0928f207a756b0f067f06c6a8",
"versionType": "git"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThan": "6.6.140",
"status": "affected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThan": "6.12.88",
"status": "affected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThan": "6.18.30",
"status": "affected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThan": "6.20",
"status": "affected",
"version": "6.19.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/vport-netdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.0"
},
{
"lessThan": "7.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.168",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.6.131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.12.80",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.18.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: vport: fix self-deadlock on release of tunnel ports\n\nvports are used concurrently and protected by RCU, so netdev_put()\nmust happen after the RCU grace period. So, either in an RCU call or\nafter the synchronize_net(). The rtnl_delete_link() must happen under\nRTNL and so can\u0027t be executed in RCU context. Calling synchronize_net()\nwhile holding RTNL is not a good idea for performance and system\nstability under load in general, so calling netdev_put() in RCU call\nis the right solution here.\n\nHowever,\nwhen the device is deleted, rtnl_unlock() will call netdev_run_todo()\nand block until all the references are gone. In the current code this\nmeans that we never reach the call_rcu() and the vport is never freed\nand the reference is never released, causing a self-deadlock on device\nremoval.\n\nFix that by moving the rcu_call() before the rtnl_unlock(), so the\nscheduled RCU callback will be executed when synchronize_net() is\ncalled from the rtnl_unlock()-\u003enetdev_run_todo() while the RTNL itself\nis already released."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:59:29.913Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8ae6c15fc473c9ad03b0173330cce9a092c76154"
},
{
"url": "https://git.kernel.org/stable/c/c741433f6c8dcdecd1d9549d89053761fd1ea413"
},
{
"url": "https://git.kernel.org/stable/c/6522d59fb7de55ce0f0f285d962243ddffebb01f"
},
{
"url": "https://git.kernel.org/stable/c/3df75fff46b1517eb479d8e6b8e3500763715dd0"
},
{
"url": "https://git.kernel.org/stable/c/366c482965c673565ecb8bcfb15d5548f13a6a10"
},
{
"url": "https://git.kernel.org/stable/c/aa69918bd418e700309fdd08509dba324fb24296"
}
],
"title": "openvswitch: vport: fix self-deadlock on release of tunnel ports",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46165",
"datePublished": "2026-05-28T09:36:20.855Z",
"dateReserved": "2026-05-13T15:03:33.102Z",
"dateUpdated": "2026-06-14T17:59:29.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43412 (GCVE-0-2026-43412)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-05-11 22:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start
During ADSP stop and start, the kernel crashes due to the order in which
ASoC components are removed.
On ADSP stop, the q6apm-audio .remove callback unloads topology and removes
PCM runtimes during ASoC teardown. This deletes the RTDs that contain the
q6apm DAI components before their removal pass runs, leaving those
components still linked to the card and causing crashes on the next rebind.
Fix this by ensuring that all dependent (child) components are removed
first, and the q6apm component is removed last.
[ 48.105720] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0
[ 48.114763] Mem abort info:
[ 48.117650] ESR = 0x0000000096000004
[ 48.121526] EC = 0x25: DABT (current EL), IL = 32 bits
[ 48.127010] SET = 0, FnV = 0
[ 48.130172] EA = 0, S1PTW = 0
[ 48.133415] FSC = 0x04: level 0 translation fault
[ 48.138446] Data abort info:
[ 48.141422] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[ 48.147079] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 48.152354] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 48.157859] user pgtable: 4k pages, 48-bit VAs, pgdp=00000001173cf000
[ 48.164517] [00000000000000d0] pgd=0000000000000000, p4d=0000000000000000
[ 48.171530] Internal error: Oops: 0000000096000004 [#1] SMP
[ 48.177348] Modules linked in: q6prm_clocks q6apm_lpass_dais q6apm_dai snd_q6dsp_common q6prm snd_q6apm 8021q garp mrp stp llc snd_soc_hdmi_codec apr pdr_interface phy_qcom_edp fastrpc qcom_pd_mapper rpmsg_ctrl qrtr_smd rpmsg_char qcom_pdr_msg qcom_iris v4l2_mem2mem videobuf2_dma_contig ath11k_pci msm ubwc_config at24 ath11k videobuf2_memops mac80211 ocmem videobuf2_v4l2 libarc4 drm_gpuvm mhi qrtr videodev drm_exec snd_soc_sc8280xp gpu_sched videobuf2_common nvmem_qcom_spmi_sdam snd_soc_qcom_sdw drm_dp_aux_bus qcom_q6v5_pas qcom_spmi_temp_alarm snd_soc_qcom_common rtc_pm8xxx qcom_pon drm_display_helper cec qcom_pil_info qcom_stats soundwire_bus drm_client_lib mc dispcc0_sa8775p videocc_sa8775p qcom_q6v5 camcc_sa8775p snd_soc_dmic phy_qcom_sgmii_eth snd_soc_max98357a i2c_qcom_geni snd_soc_core dwmac_qcom_ethqos llcc_qcom icc_bwmon qcom_sysmon snd_compress qcom_refgen_regulator coresight_stm stmmac_platform snd_pcm_dmaengine qcom_common coresight_tmc stmmac coresight_replicator qcom_glink_smem coresight_cti stm_core
[ 48.177444] coresight_funnel snd_pcm ufs_qcom phy_qcom_qmp_usb gpi phy_qcom_snps_femto_v2 coresight phy_qcom_qmp_ufs qcom_wdt gpucc_sa8775p pcs_xpcs mdt_loader qcom_ice icc_osm_l3 qmi_helpers snd_timer snd soundcore display_connector qcom_rng nvmem_reboot_mode drm_kms_helper phy_qcom_qmp_pcie sha256 cfg80211 rfkill socinfo fuse drm backlight ipv6
[ 48.301059] CPU: 2 UID: 0 PID: 293 Comm: kworker/u32:2 Not tainted 6.19.0-rc6-dirty #10 PREEMPT
[ 48.310081] Hardware name: Qualcomm Technologies, Inc. Lemans EVK (DT)
[ 48.316782] Workqueue: pdr_notifier_wq pdr_notifier_work [pdr_interface]
[ 48.323672] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 48.330825] pc : mutex_lock+0xc/0x54
[ 48.334514] lr : soc_dapm_shutdown_dapm+0x44/0x174 [snd_soc_core]
[ 48.340794] sp : ffff800084ddb7b0
[ 48.344207] x29: ffff800084ddb7b0 x28: ffff00009cd9cf30 x27: ffff00009cd9cc00
[ 48.351544] x26: ffff000099610190 x25: ffffa31d2f19c810 x24: ffffa31d2f185098
[ 48.358869] x23: ffff800084ddb7f8 x22: 0000000000000000 x21: 00000000000000d0
[ 48.366198] x20: ffff00009ba6c338 x19: ffff00009ba6c338 x18: 00000000ffffffff
[ 48.373528] x17: 000000040044ffff x16: ffffa31d4ae6dca8 x15: 072007740775076f
[ 48.380853] x14: 0765076d07690774 x13: 00313a323a656369 x12: 767265733a637673
[ 48.388182] x11: 00000000000003f9 x10: ffffa31d4c7dea98 x9 : 0000000000000001
[ 48.395519] x8 : ffff00009a2aadc0 x7 : 0000000000000003 x6 : 0000000000000000
[ 48.402854] x5 : 0000000000000
---truncated---
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5477518b8a0e8a45239646acd80c9bafc4401522 Version: 5477518b8a0e8a45239646acd80c9bafc4401522 Version: 5477518b8a0e8a45239646acd80c9bafc4401522 Version: 5477518b8a0e8a45239646acd80c9bafc4401522 Version: 5477518b8a0e8a45239646acd80c9bafc4401522 Version: 5477518b8a0e8a45239646acd80c9bafc4401522 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/qcom/qdsp6/q6apm-dai.c",
"sound/soc/qcom/qdsp6/q6apm-lpass-dais.c",
"sound/soc/qcom/qdsp6/q6apm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "94bda21adb2a51f69366b847b4d80dfe50bd9fb9",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
},
{
"lessThan": "a8e9cab16771b15160465783507496dc83742d8e",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
},
{
"lessThan": "0da170b9e600da6930cfb8352e4cc036db3b6159",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
},
{
"lessThan": "22b05abb17e3c6ef45035141fe3d26f815ff9d30",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
},
{
"lessThan": "897f32cab7945f4662a50b3841ba31c6c3204876",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
},
{
"lessThan": "d6db827b430bdcca3976cebca7bd69cca03cde2c",
"status": "affected",
"version": "5477518b8a0e8a45239646acd80c9bafc4401522",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/qcom/qdsp6/q6apm-dai.c",
"sound/soc/qcom/qdsp6/q6apm-lpass-dais.c",
"sound/soc/qcom/qdsp6/q6apm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start\n\nDuring ADSP stop and start, the kernel crashes due to the order in which\nASoC components are removed.\n\nOn ADSP stop, the q6apm-audio .remove callback unloads topology and removes\nPCM runtimes during ASoC teardown. This deletes the RTDs that contain the\nq6apm DAI components before their removal pass runs, leaving those\ncomponents still linked to the card and causing crashes on the next rebind.\n\nFix this by ensuring that all dependent (child) components are removed\nfirst, and the q6apm component is removed last.\n\n[ 48.105720] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0\n[ 48.114763] Mem abort info:\n[ 48.117650] ESR = 0x0000000096000004\n[ 48.121526] EC = 0x25: DABT (current EL), IL = 32 bits\n[ 48.127010] SET = 0, FnV = 0\n[ 48.130172] EA = 0, S1PTW = 0\n[ 48.133415] FSC = 0x04: level 0 translation fault\n[ 48.138446] Data abort info:\n[ 48.141422] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[ 48.147079] CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[ 48.152354] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[ 48.157859] user pgtable: 4k pages, 48-bit VAs, pgdp=00000001173cf000\n[ 48.164517] [00000000000000d0] pgd=0000000000000000, p4d=0000000000000000\n[ 48.171530] Internal error: Oops: 0000000096000004 [#1] SMP\n[ 48.177348] Modules linked in: q6prm_clocks q6apm_lpass_dais q6apm_dai snd_q6dsp_common q6prm snd_q6apm 8021q garp mrp stp llc snd_soc_hdmi_codec apr pdr_interface phy_qcom_edp fastrpc qcom_pd_mapper rpmsg_ctrl qrtr_smd rpmsg_char qcom_pdr_msg qcom_iris v4l2_mem2mem videobuf2_dma_contig ath11k_pci msm ubwc_config at24 ath11k videobuf2_memops mac80211 ocmem videobuf2_v4l2 libarc4 drm_gpuvm mhi qrtr videodev drm_exec snd_soc_sc8280xp gpu_sched videobuf2_common nvmem_qcom_spmi_sdam snd_soc_qcom_sdw drm_dp_aux_bus qcom_q6v5_pas qcom_spmi_temp_alarm snd_soc_qcom_common rtc_pm8xxx qcom_pon drm_display_helper cec qcom_pil_info qcom_stats soundwire_bus drm_client_lib mc dispcc0_sa8775p videocc_sa8775p qcom_q6v5 camcc_sa8775p snd_soc_dmic phy_qcom_sgmii_eth snd_soc_max98357a i2c_qcom_geni snd_soc_core dwmac_qcom_ethqos llcc_qcom icc_bwmon qcom_sysmon snd_compress qcom_refgen_regulator coresight_stm stmmac_platform snd_pcm_dmaengine qcom_common coresight_tmc stmmac coresight_replicator qcom_glink_smem coresight_cti stm_core\n[ 48.177444] coresight_funnel snd_pcm ufs_qcom phy_qcom_qmp_usb gpi phy_qcom_snps_femto_v2 coresight phy_qcom_qmp_ufs qcom_wdt gpucc_sa8775p pcs_xpcs mdt_loader qcom_ice icc_osm_l3 qmi_helpers snd_timer snd soundcore display_connector qcom_rng nvmem_reboot_mode drm_kms_helper phy_qcom_qmp_pcie sha256 cfg80211 rfkill socinfo fuse drm backlight ipv6\n[ 48.301059] CPU: 2 UID: 0 PID: 293 Comm: kworker/u32:2 Not tainted 6.19.0-rc6-dirty #10 PREEMPT\n[ 48.310081] Hardware name: Qualcomm Technologies, Inc. Lemans EVK (DT)\n[ 48.316782] Workqueue: pdr_notifier_wq pdr_notifier_work [pdr_interface]\n[ 48.323672] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 48.330825] pc : mutex_lock+0xc/0x54\n[ 48.334514] lr : soc_dapm_shutdown_dapm+0x44/0x174 [snd_soc_core]\n[ 48.340794] sp : ffff800084ddb7b0\n[ 48.344207] x29: ffff800084ddb7b0 x28: ffff00009cd9cf30 x27: ffff00009cd9cc00\n[ 48.351544] x26: ffff000099610190 x25: ffffa31d2f19c810 x24: ffffa31d2f185098\n[ 48.358869] x23: ffff800084ddb7f8 x22: 0000000000000000 x21: 00000000000000d0\n[ 48.366198] x20: ffff00009ba6c338 x19: ffff00009ba6c338 x18: 00000000ffffffff\n[ 48.373528] x17: 000000040044ffff x16: ffffa31d4ae6dca8 x15: 072007740775076f\n[ 48.380853] x14: 0765076d07690774 x13: 00313a323a656369 x12: 767265733a637673\n[ 48.388182] x11: 00000000000003f9 x10: ffffa31d4c7dea98 x9 : 0000000000000001\n[ 48.395519] x8 : ffff00009a2aadc0 x7 : 0000000000000003 x6 : 0000000000000000\n[ 48.402854] x5 : 0000000000000\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:05.456Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/94bda21adb2a51f69366b847b4d80dfe50bd9fb9"
},
{
"url": "https://git.kernel.org/stable/c/a8e9cab16771b15160465783507496dc83742d8e"
},
{
"url": "https://git.kernel.org/stable/c/0da170b9e600da6930cfb8352e4cc036db3b6159"
},
{
"url": "https://git.kernel.org/stable/c/22b05abb17e3c6ef45035141fe3d26f815ff9d30"
},
{
"url": "https://git.kernel.org/stable/c/897f32cab7945f4662a50b3841ba31c6c3204876"
},
{
"url": "https://git.kernel.org/stable/c/d6db827b430bdcca3976cebca7bd69cca03cde2c"
}
],
"title": "ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43412",
"datePublished": "2026-05-08T14:21:50.187Z",
"dateReserved": "2026-05-01T14:12:56.008Z",
"dateUpdated": "2026-05-11T22:24:05.456Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43038 (GCVE-0-2026-43038)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-08-20 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
Sashiko AI-review observed:
In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet
where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2
and passed to icmp6_send(), it uses IP6CB(skb2).
IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso
offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm
at offset 18.
If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao
would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called
and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO).
This would scan the inner, attacker-controlled IPv6 packet starting at that
offset, potentially returning a fake TLV without checking if the remaining
packet length can hold the full 18-byte struct ipv6_destopt_hao.
Could mip6_addr_swap() then perform a 16-byte swap that extends past the end
of the packet data into skb_shared_info?
Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and
ip6ip6_err() to prevent this?
This patch implements the first suggestion.
I am not sure if ip6ip6_err() needs to be changed.
A separate patch would be better anyway.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ca15a078bd907df5fc1c009477869c5cbde3b753 Version: ca15a078bd907df5fc1c009477869c5cbde3b753 Version: ca15a078bd907df5fc1c009477869c5cbde3b753 Version: ca15a078bd907df5fc1c009477869c5cbde3b753 Version: ca15a078bd907df5fc1c009477869c5cbde3b753 Version: ca15a078bd907df5fc1c009477869c5cbde3b753 Version: ca15a078bd907df5fc1c009477869c5cbde3b753 Version: ca15a078bd907df5fc1c009477869c5cbde3b753 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.28.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.77.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.132.1.rt7.473.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.132.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.194.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.194.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.195.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.195.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.145.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.145.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.19.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.174.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.174.1.rt14.459.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:9.2"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.129.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:9.4"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.119.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus:9.6"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s IPv6 ICMP error generation. A remote attacker could send a specially crafted IPv4 ICMP error packet with a Common Internet Protocol Security Option (CIPSO) IP option. This could lead to incorrect handling of packet control block data when generating an IPv6 ICMP error, potentially causing an out-of-bounds memory access. This memory corruption could result in information disclosure or a denial of service."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T12:31:52.712Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-43038"
},
{
"name": "RHBZ#2464397",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464397"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43038.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24343"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30129"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22940"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23237"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23224"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30848"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55618"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25121"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55762"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26535"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25533"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22964"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55761"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55837"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:56224"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:56225"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:55763"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25120"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22900"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:24343: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:30129: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:22940: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:23237: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:23224: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:30848: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:55618: Red Hat Enterprise Linux BaseOS (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:25121: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:55762: Red Hat Enterprise Linux BaseOS (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:26535: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:25533: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:22964: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:55761: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:55837: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:56224: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:56225: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:55763: Red Hat Enterprise Linux BaseOS (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:25120: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:22900: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-01T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-01T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: ipv6: icmp: clear skb2-\u003ecb[] in ip6_err_gen_icmpv6_unreach()",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
},
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:49:10.146Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/icmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c438ba010171b70bad22fc18b1d5bdc3627476e8",
"status": "affected",
"version": "ca15a078bd907df5fc1c009477869c5cbde3b753",
"versionType": "git"
},
{
"lessThan": "0452b6526b2f54b2413b9cb4ff1ea2ac542c99c7",
"status": "affected",
"version": "ca15a078bd907df5fc1c009477869c5cbde3b753",
"versionType": "git"
},
{
"lessThan": "a4437faf135da293d16fcc4cc607316742bd0ebb",
"status": "affected",
"version": "ca15a078bd907df5fc1c009477869c5cbde3b753",
"versionType": "git"
},
{
"lessThan": "3d5127d998de617b130aae96b138dba22ac6a8a7",
"status": "affected",
"version": "ca15a078bd907df5fc1c009477869c5cbde3b753",
"versionType": "git"
},
{
"lessThan": "e41953e7d118e2702bcb217879c173d9d1d3cd4e",
"status": "affected",
"version": "ca15a078bd907df5fc1c009477869c5cbde3b753",
"versionType": "git"
},
{
"lessThan": "a2edbb6393972a02114b6003953a5cef3104fada",
"status": "affected",
"version": "ca15a078bd907df5fc1c009477869c5cbde3b753",
"versionType": "git"
},
{
"lessThan": "1ceeebd5bd6d855b17a5df625109bfe29129d7cf",
"status": "affected",
"version": "ca15a078bd907df5fc1c009477869c5cbde3b753",
"versionType": "git"
},
{
"lessThan": "86ab3e55673a7a49a841838776f1ab18d23a67b5",
"status": "affected",
"version": "ca15a078bd907df5fc1c009477869c5cbde3b753",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/icmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: icmp: clear skb2-\u003ecb[] in ip6_err_gen_icmpv6_unreach()\n\nSashiko AI-review observed:\n\n In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet\n where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2\n and passed to icmp6_send(), it uses IP6CB(skb2).\n\n IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso\n offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm\n at offset 18.\n\n If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao\n would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called\n and uses ipv6_find_tlv(skb, opt-\u003edsthao, IPV6_TLV_HAO).\n\n This would scan the inner, attacker-controlled IPv6 packet starting at that\n offset, potentially returning a fake TLV without checking if the remaining\n packet length can hold the full 18-byte struct ipv6_destopt_hao.\n\n Could mip6_addr_swap() then perform a 16-byte swap that extends past the end\n of the packet data into skb_shared_info?\n\n Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and\n ip6ip6_err() to prevent this?\n\nThis patch implements the first suggestion.\n\nI am not sure if ip6ip6_err() needs to be changed.\nA separate patch would be better anyway."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - An unauthenticated remote attacker can send crafted IPv4 ICMP error packets with IPv4 options to an affected IPv6-over-IPv4/SIT or IPv6 GRE tunnel endpoint. The vulnerable path is reached through normal network packet receive and ICMP error dispatch, not through a local syscall.\nAC:L - Given an affected deployment with the tunnel path and IPv6 MIP6 support present, the attacker controls the ICMP payload, IPv4 CIPSO option placement, inner IPv6 layout, and fake HAO/TLV contents. There is no race or condition outside the attacker\u0027s control needed to trigger the stale skb control-buffer interpretation.\nPR:N - The target-side code is reachable by receiving network packets and performs no authentication or privilege check before dispatching the ICMP error to the tunnel error handler. Any needed packet crafting privileges are on the attacker\u0027s own system, not privileges on the vulnerable target.\nUI:N - No victim user action is required. The vulnerable code runs during kernel processing of received network packets.\nS:U - The impact is within the vulnerable kernel\u0027s own security authority. This is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The malformed HAO handling can perform a 16-byte swap that reads beyond packet data into skb_shared_info or adjacent skb metadata. As a network-reachable memory corruption primitive, this is defensibly high confidentiality impact.\nI:H - The same swap writes 16 attacker-controlled bytes from the IPv6 source address beyond packet data into skb_shared_info or adjacent skb metadata. This is an out-of-bounds write with potential for kernel heap/control-flow exploitation.\nA:H - Corrupting skb_shared_info fields such as fragment counters or pointers can readily crash or destabilize the kernel. A remote attacker can repeat crafted packets to cause denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:28.341Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c438ba010171b70bad22fc18b1d5bdc3627476e8"
},
{
"url": "https://git.kernel.org/stable/c/0452b6526b2f54b2413b9cb4ff1ea2ac542c99c7"
},
{
"url": "https://git.kernel.org/stable/c/a4437faf135da293d16fcc4cc607316742bd0ebb"
},
{
"url": "https://git.kernel.org/stable/c/3d5127d998de617b130aae96b138dba22ac6a8a7"
},
{
"url": "https://git.kernel.org/stable/c/e41953e7d118e2702bcb217879c173d9d1d3cd4e"
},
{
"url": "https://git.kernel.org/stable/c/a2edbb6393972a02114b6003953a5cef3104fada"
},
{
"url": "https://git.kernel.org/stable/c/1ceeebd5bd6d855b17a5df625109bfe29129d7cf"
},
{
"url": "https://git.kernel.org/stable/c/86ab3e55673a7a49a841838776f1ab18d23a67b5"
}
],
"title": "ipv6: icmp: clear skb2-\u003ecb[] in ip6_err_gen_icmpv6_unreach()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43038",
"datePublished": "2026-05-01T14:15:35.986Z",
"dateReserved": "2026-05-01T14:12:55.978Z",
"dateUpdated": "2026-08-20T12:31:52.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46005 (GCVE-0-2026-46005)
Vulnerability from cvelistv5
Published
2026-05-27 12:56
Modified
2026-06-19 11:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: fix a resource leak in xfs_alloc_buftarg()
In the error path, call fs_put_dax() to drop the DAX
device reference.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6f643c57d57c56d4677bc05f1fca2ef3f249797c Version: 6f643c57d57c56d4677bc05f1fca2ef3f249797c Version: 6f643c57d57c56d4677bc05f1fca2ef3f249797c Version: 6f643c57d57c56d4677bc05f1fca2ef3f249797c Version: 6f643c57d57c56d4677bc05f1fca2ef3f249797c Version: 6f643c57d57c56d4677bc05f1fca2ef3f249797c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_buf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ed2d6442e61169e565727ba15c4f6a0cb5ce16df",
"status": "affected",
"version": "6f643c57d57c56d4677bc05f1fca2ef3f249797c",
"versionType": "git"
},
{
"lessThan": "82fb9da6477d08bdab954dc7bc081a41f2f9cae6",
"status": "affected",
"version": "6f643c57d57c56d4677bc05f1fca2ef3f249797c",
"versionType": "git"
},
{
"lessThan": "28a6c132b8c6e5eeefa889c4fb43d65b12989d48",
"status": "affected",
"version": "6f643c57d57c56d4677bc05f1fca2ef3f249797c",
"versionType": "git"
},
{
"lessThan": "5c293a1e1ef0f838772d20ae8afae4cbd87cd3f9",
"status": "affected",
"version": "6f643c57d57c56d4677bc05f1fca2ef3f249797c",
"versionType": "git"
},
{
"lessThan": "5804cb507233ed767a83ac70527b2f6c4566ec75",
"status": "affected",
"version": "6f643c57d57c56d4677bc05f1fca2ef3f249797c",
"versionType": "git"
},
{
"lessThan": "29a7b2614357393b176ef06ba5bc3ff5afc8df69",
"status": "affected",
"version": "6f643c57d57c56d4677bc05f1fca2ef3f249797c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_buf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fix a resource leak in xfs_alloc_buftarg()\n\nIn the error path, call fs_put_dax() to drop the DAX\ndevice reference."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-19T11:58:58.503Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ed2d6442e61169e565727ba15c4f6a0cb5ce16df"
},
{
"url": "https://git.kernel.org/stable/c/82fb9da6477d08bdab954dc7bc081a41f2f9cae6"
},
{
"url": "https://git.kernel.org/stable/c/28a6c132b8c6e5eeefa889c4fb43d65b12989d48"
},
{
"url": "https://git.kernel.org/stable/c/5c293a1e1ef0f838772d20ae8afae4cbd87cd3f9"
},
{
"url": "https://git.kernel.org/stable/c/5804cb507233ed767a83ac70527b2f6c4566ec75"
},
{
"url": "https://git.kernel.org/stable/c/29a7b2614357393b176ef06ba5bc3ff5afc8df69"
}
],
"title": "xfs: fix a resource leak in xfs_alloc_buftarg()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46005",
"datePublished": "2026-05-27T12:56:03.201Z",
"dateReserved": "2026-05-13T15:03:33.091Z",
"dateUpdated": "2026-06-19T11:58:58.503Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53268 (GCVE-0-2026-53268)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack_irc: fix possible out-of-bounds read
When parsing fails after we've matched the command string we
should bail out instead of trying to match a different command.
This helper should be deprecated, given prevalence of TLS I doubt it has
any relevance in 2026.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 869f37d8e48f3911eb70f38a994feaa8f8380008 Version: 869f37d8e48f3911eb70f38a994feaa8f8380008 Version: 869f37d8e48f3911eb70f38a994feaa8f8380008 Version: 869f37d8e48f3911eb70f38a994feaa8f8380008 Version: 869f37d8e48f3911eb70f38a994feaa8f8380008 Version: 869f37d8e48f3911eb70f38a994feaa8f8380008 Version: 869f37d8e48f3911eb70f38a994feaa8f8380008 Version: 869f37d8e48f3911eb70f38a994feaa8f8380008 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_irc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4cdda7f868f48e2f81579371584fdbdce37df2c8",
"status": "affected",
"version": "869f37d8e48f3911eb70f38a994feaa8f8380008",
"versionType": "git"
},
{
"lessThan": "8a1d6e40dedfe1068aee094d851bd69e289c9fd6",
"status": "affected",
"version": "869f37d8e48f3911eb70f38a994feaa8f8380008",
"versionType": "git"
},
{
"lessThan": "0afc802160af0df61ed374fdb97fb34cfe5cdf2f",
"status": "affected",
"version": "869f37d8e48f3911eb70f38a994feaa8f8380008",
"versionType": "git"
},
{
"lessThan": "7c34f91305292083253df6a9f6c8ede02d4ccaea",
"status": "affected",
"version": "869f37d8e48f3911eb70f38a994feaa8f8380008",
"versionType": "git"
},
{
"lessThan": "ddddd8271359961e403d11c90c9ba9fc38914f7e",
"status": "affected",
"version": "869f37d8e48f3911eb70f38a994feaa8f8380008",
"versionType": "git"
},
{
"lessThan": "9e5da2379f968a3ea5a6e38921ab6201576466dc",
"status": "affected",
"version": "869f37d8e48f3911eb70f38a994feaa8f8380008",
"versionType": "git"
},
{
"lessThan": "573810f61bcd6b6815e2ff53bbdd2b9c9d747176",
"status": "affected",
"version": "869f37d8e48f3911eb70f38a994feaa8f8380008",
"versionType": "git"
},
{
"lessThan": "66eba0ffce3b7e11449946b4cbbef8ea36112f56",
"status": "affected",
"version": "869f37d8e48f3911eb70f38a994feaa8f8380008",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_conntrack_irc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.20"
},
{
"lessThan": "2.6.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: conntrack_irc: fix possible out-of-bounds read\n\nWhen parsing fails after we\u0027ve matched the command string we\nshould bail out instead of trying to match a different command.\n\nThis helper should be deprecated, given prevalence of TLS I doubt it has\nany relevance in 2026."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable IRC conntrack helper parses attacker-controlled TCP payloads on network flows when the helper is attached, such as an IRC-exposed host or firewall/NAT deployment. A remote peer can establish the TCP flow and send the crafted IRC/CTCP DCC text that reaches `help()`.\nAC:L - Once the helper is enabled/assigned, triggering is deterministic packet parsing with attacker-controlled payload bytes and no race or hard-to-shape kernel state. The established-flow requirement is attacker-controlled by completing a normal TCP handshake.\nPR:N - The network attacker does not need local credentials or authenticated IRC privileges to send payload on a tracked TCP connection. Helper configuration requires administrative privileges, but that is deployment state, not attacker privilege.\nUI:N - No victim user action is needed after the vulnerable helper is active on the network path. The attacker only sends network traffic.\nS:U - The impact is within the kernel/netfilter security authority of the affected system. There is no VM, IOMMU, or separate security-scope boundary crossed.\nC:L - This is an out-of-bounds read from the IRC payload buffer/parser state, but the overread is constrained by short command comparisons and parser checks rather than an arbitrary kernel memory read primitive. Under the higher-severity tie-break rule, limited confidentiality impact is appropriate for the possible stale/adjacent-byte exposure.\nI:N - The bug is a read-side parser bounds error and does not write attacker-controlled data to kernel memory or provide a direct modification primitive. Any conntrack expectation changes require passing the helper\u0027s normal DCC validation path and are not arbitrary integrity compromise.\nA:H - The malformed payload can drive `memcmp()`/parser reads beyond the valid copied payload window, and with large/nonlinear packets this can go past the helper\u0027s guard byte and plausibly fault/oops in kernel context. The packet can be resent repeatedly for denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:45.538Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4cdda7f868f48e2f81579371584fdbdce37df2c8"
},
{
"url": "https://git.kernel.org/stable/c/8a1d6e40dedfe1068aee094d851bd69e289c9fd6"
},
{
"url": "https://git.kernel.org/stable/c/0afc802160af0df61ed374fdb97fb34cfe5cdf2f"
},
{
"url": "https://git.kernel.org/stable/c/7c34f91305292083253df6a9f6c8ede02d4ccaea"
},
{
"url": "https://git.kernel.org/stable/c/ddddd8271359961e403d11c90c9ba9fc38914f7e"
},
{
"url": "https://git.kernel.org/stable/c/9e5da2379f968a3ea5a6e38921ab6201576466dc"
},
{
"url": "https://git.kernel.org/stable/c/573810f61bcd6b6815e2ff53bbdd2b9c9d747176"
},
{
"url": "https://git.kernel.org/stable/c/66eba0ffce3b7e11449946b4cbbef8ea36112f56"
}
],
"title": "netfilter: conntrack_irc: fix possible out-of-bounds read",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53268",
"datePublished": "2026-06-25T08:39:54.511Z",
"dateReserved": "2026-06-09T07:44:35.395Z",
"dateUpdated": "2026-08-05T12:34:45.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46131 (GCVE-0-2026-46131)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-06-14 17:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: check for nEPT/nNPT in slow flush hypercalls
Checking is_guest_mode(vcpu) is incorrect, because translate_nested_gpa()
is only valid if an L2 guest is running *with nested EPT/NPT enabled*.
Instead use the same condition as translate_nested_gpa() itself.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/hyperv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "971f17f5d91045404e3914029ea57c3da90179a4",
"status": "affected",
"version": "aee738236dca0d0870789138ec494e15d6303566",
"versionType": "git"
},
{
"lessThan": "45fc766bc756ff1d66f8ca026a9c4f7f764adfae",
"status": "affected",
"version": "aee738236dca0d0870789138ec494e15d6303566",
"versionType": "git"
},
{
"lessThan": "d6f4e217d663ede5becc2fd6cb612c749677387b",
"status": "affected",
"version": "aee738236dca0d0870789138ec494e15d6303566",
"versionType": "git"
},
{
"lessThan": "4c7f8436b19a2a3acc0cb6b6e3becd6796ae5c57",
"status": "affected",
"version": "aee738236dca0d0870789138ec494e15d6303566",
"versionType": "git"
},
{
"lessThan": "464af6fc2b1dcc74005b7f58ee3812b17777efee",
"status": "affected",
"version": "aee738236dca0d0870789138ec494e15d6303566",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/hyperv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: check for nEPT/nNPT in slow flush hypercalls\n\nChecking is_guest_mode(vcpu) is incorrect, because translate_nested_gpa()\nis only valid if an L2 guest is running *with nested EPT/NPT enabled*.\nInstead use the same condition as translate_nested_gpa() itself."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:56:46.141Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/971f17f5d91045404e3914029ea57c3da90179a4"
},
{
"url": "https://git.kernel.org/stable/c/45fc766bc756ff1d66f8ca026a9c4f7f764adfae"
},
{
"url": "https://git.kernel.org/stable/c/d6f4e217d663ede5becc2fd6cb612c749677387b"
},
{
"url": "https://git.kernel.org/stable/c/4c7f8436b19a2a3acc0cb6b6e3becd6796ae5c57"
},
{
"url": "https://git.kernel.org/stable/c/464af6fc2b1dcc74005b7f58ee3812b17777efee"
}
],
"title": "KVM: x86: check for nEPT/nNPT in slow flush hypercalls",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46131",
"datePublished": "2026-05-28T09:35:46.220Z",
"dateReserved": "2026-05-13T15:03:33.099Z",
"dateUpdated": "2026-06-14T17:56:46.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46274 (GCVE-0-2026-46274)
Vulnerability from cvelistv5
Published
2026-06-08 14:30
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
io-wq: check that the predecessor is hashed in io_wq_remove_pending()
io_wq_remove_pending() needs to fix up wq->hash_tail[] if the cancelled
work was the tail of its hash bucket. When doing this, it checks whether
the preceding entry in acct->work_list has the same hash value, but
never checks that the predecessor is hashed at all. io_get_work_hash()
is simply atomic_read(&work->flags) >> IO_WQ_HASH_SHIFT, and the hash
bits are never set for non-hashed work, so it returns 0. Thus, when a
hashed bucket-0 work is cancelled while a non-hashed work is its list
predecessor, the check spuriously passes and a pointer to the non-hashed
io_kiocb is stored in wq->hash_tail[0].
Because non-hashed work is dequeued via the fast path in
io_get_next_work(), which never touches hash_tail[], the stale pointer
is never cleared. Therefore, after the non-hashed io_kiocb completes and
is freed back to req_cachep, wq->hash_tail[0] is a dangling pointer. The
io_wq is per-task (tctx->io_wq) and survives ring open/close, so the
dangling pointer persists for the lifetime of the task; the next hashed
bucket-0 enqueue dereferences it in io_wq_insert_work() and
wq_list_add_after() writes through freed memory.
Add the missing io_wq_is_hashed() check so a non-hashed predecessor
never inherits a hash_tail[] slot.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 204361a77f4018627addd4a06877448f088ddfc0 Version: 204361a77f4018627addd4a06877448f088ddfc0 Version: 204361a77f4018627addd4a06877448f088ddfc0 Version: 204361a77f4018627addd4a06877448f088ddfc0 Version: 204361a77f4018627addd4a06877448f088ddfc0 Version: 13f35a2c0fd5c6a4fcd8903542b053bcc914fcf5 Version: 5.8.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"io_uring/io-wq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d6bda9df0c0a3080804181464d5c0f4d78a4e769",
"status": "affected",
"version": "204361a77f4018627addd4a06877448f088ddfc0",
"versionType": "git"
},
{
"lessThan": "5a20ebf0c81b61f5ea3b1b529c100cad69b9f603",
"status": "affected",
"version": "204361a77f4018627addd4a06877448f088ddfc0",
"versionType": "git"
},
{
"lessThan": "252c5051dba9c709b6a72f2866f93e5e618b3f06",
"status": "affected",
"version": "204361a77f4018627addd4a06877448f088ddfc0",
"versionType": "git"
},
{
"lessThan": "d376c131af7c7739a87ff037ed2fdb67c2542c8a",
"status": "affected",
"version": "204361a77f4018627addd4a06877448f088ddfc0",
"versionType": "git"
},
{
"lessThan": "d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc",
"status": "affected",
"version": "204361a77f4018627addd4a06877448f088ddfc0",
"versionType": "git"
},
{
"status": "affected",
"version": "13f35a2c0fd5c6a4fcd8903542b053bcc914fcf5",
"versionType": "git"
},
{
"lessThan": "5.9",
"status": "affected",
"version": "5.8.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"io_uring/io-wq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.8.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio-wq: check that the predecessor is hashed in io_wq_remove_pending()\n\nio_wq_remove_pending() needs to fix up wq-\u003ehash_tail[] if the cancelled\nwork was the tail of its hash bucket. When doing this, it checks whether\nthe preceding entry in acct-\u003ework_list has the same hash value, but\nnever checks that the predecessor is hashed at all. io_get_work_hash()\nis simply atomic_read(\u0026work-\u003eflags) \u003e\u003e IO_WQ_HASH_SHIFT, and the hash\nbits are never set for non-hashed work, so it returns 0. Thus, when a\nhashed bucket-0 work is cancelled while a non-hashed work is its list\npredecessor, the check spuriously passes and a pointer to the non-hashed\nio_kiocb is stored in wq-\u003ehash_tail[0].\n\nBecause non-hashed work is dequeued via the fast path in\nio_get_next_work(), which never touches hash_tail[], the stale pointer\nis never cleared. Therefore, after the non-hashed io_kiocb completes and\nis freed back to req_cachep, wq-\u003ehash_tail[0] is a dangling pointer. The\nio_wq is per-task (tctx-\u003eio_wq) and survives ring open/close, so the\ndangling pointer persists for the lifetime of the task; the next hashed\nbucket-0 enqueue dereferences it in io_wq_insert_work() and\nwq_list_add_after() writes through freed memory.\n\nAdd the missing io_wq_is_hashed() check so a non-hashed predecessor\nnever inherits a hash_tail[] slot."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through io_uring syscalls (io_uring_setup/io_uring_enter) that enqueue and cancel async io-wq work; there is no network, adjacent-radio, or physical-device entry path to io_wq_remove_pending().\nAC:L - An attacker fully controls the trigger sequence\u2014queue a non-hashed async request, queue a hashed bucket-0 request behind it, cancel the hashed pending work, let the non-hashed work complete, then enqueue another hashed bucket-0 request\u2014with no dependence on uncontrollable timing or rare kernel configuration.\nPR:L - Any unprivileged local user who can invoke io_uring (default when kernel.io_uring_disabled=0) can drive the cancel/enqueue sequence; no real-root or special capability beyond normal local process access is required.\nUI:N - Exploitation requires only the attacker\u0027s own io_uring submissions and cancellations; no victim user action such as opening files or mounting filesystems is needed beyond what the attacker initiates.\nS:U - The flaw corrupts kernel heap memory within the same kernel security domain to escalate from local user to kernel privileges; it does not inherently cross a VM/host or IOMMU boundary on its own.\nC:H - The stale hash_tail pointer is a use-after-free of a freed io_kiocb slab object; subsequent dereferences in io_wq_insert_work() read freed memory and UAF heap corruption is routinely weaponizable for arbitrary kernel memory disclosure.\nI:H - io_wq_insert_work() calls wq_list_add_after(), which writes attacker-influenced list pointers through the freed io_kiocb\u0027s list.next field, providing a controlled heap write primitive suitable for further memory corruption or code execution.\nA:H - Dereferencing and writing through the dangling hash_tail pointer can cause kernel oops/panic from invalid slab access, and successful heap corruption can crash or hang the system even before full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:57.842Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d6bda9df0c0a3080804181464d5c0f4d78a4e769"
},
{
"url": "https://git.kernel.org/stable/c/5a20ebf0c81b61f5ea3b1b529c100cad69b9f603"
},
{
"url": "https://git.kernel.org/stable/c/252c5051dba9c709b6a72f2866f93e5e618b3f06"
},
{
"url": "https://git.kernel.org/stable/c/d376c131af7c7739a87ff037ed2fdb67c2542c8a"
},
{
"url": "https://git.kernel.org/stable/c/d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc"
}
],
"title": "io-wq: check that the predecessor is hashed in io_wq_remove_pending()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46274",
"datePublished": "2026-06-08T14:30:53.323Z",
"dateReserved": "2026-05-13T15:03:33.109Z",
"dateUpdated": "2026-08-05T12:30:57.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46321 (GCVE-0-2026-46321)
Vulnerability from cvelistv5
Published
2026-06-09 12:11
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tun: free page on short-frame rejection in tun_xdp_one()
tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without
freeing the page that vhost_net_build_xdp() allocated for it.
tun_sendmsg() discards that -EINVAL and still returns total_len, so
vhost_tx_batch() takes the success path and never frees the page; each
short frame in a batch leaks one page-frag chunk.
A local process that can open /dev/net/tun and /dev/vhost-net can hit
this path: it attaches a tun/tap device as the vhost-net backend and
feeds TX descriptors whose length minus the virtio-net header is below
ETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a
tight submission loop exhausts host memory and triggers an OOM panic.
Free the page before returning -EINVAL, matching the XDP-program error
path in the same function.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6100e0237204890269e3f934acfc50d35fd6f319 Version: 589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2 Version: ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146 Version: d5ad89b7d01ed4e66fd04734fc63d6e78536692a Version: 049584807f1d797fc3078b68035450a9769eb5c3 Version: 049584807f1d797fc3078b68035450a9769eb5c3 Version: 049584807f1d797fc3078b68035450a9769eb5c3 Version: 049584807f1d797fc3078b68035450a9769eb5c3 Version: 32b0aaba5dbc85816898167d9b5d45a22eae82e9 Version: a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb Version: 8418f55302fa1d2eeb73e16e345167e545c598a5 Version: 5.10.223 ≤ Version: 5.15.164 ≤ Version: 6.1.102 ≤ Version: 6.6.43 ≤ Version: 5.4.281 ≤ Version: 6.9.12 ≤ Version: 6.10.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/tun.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0a6f46a9332ad6958992d64d3b3a81a80b2ca940",
"status": "affected",
"version": "6100e0237204890269e3f934acfc50d35fd6f319",
"versionType": "git"
},
{
"lessThan": "0e8211fcf9426f5adddf32516ba0f400ceb9544d",
"status": "affected",
"version": "589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2",
"versionType": "git"
},
{
"lessThan": "e915445942af6dcea628bf66d6241641201a0c41",
"status": "affected",
"version": "ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146",
"versionType": "git"
},
{
"lessThan": "5b34f9e4fe2f203724a6e893d6df0316b9670057",
"status": "affected",
"version": "d5ad89b7d01ed4e66fd04734fc63d6e78536692a",
"versionType": "git"
},
{
"lessThan": "69863ff2720a0e9871f1a5710f2a33a94217fee0",
"status": "affected",
"version": "049584807f1d797fc3078b68035450a9769eb5c3",
"versionType": "git"
},
{
"lessThan": "37a1c268c2c8090bf4dc552d732bd23ba36f8eb0",
"status": "affected",
"version": "049584807f1d797fc3078b68035450a9769eb5c3",
"versionType": "git"
},
{
"lessThan": "98c67be9eb9de72465a071949e84a3cdb8fab5a3",
"status": "affected",
"version": "049584807f1d797fc3078b68035450a9769eb5c3",
"versionType": "git"
},
{
"lessThan": "f4feb1e20058e407cb00f45aff47f5b7e19a6bbf",
"status": "affected",
"version": "049584807f1d797fc3078b68035450a9769eb5c3",
"versionType": "git"
},
{
"status": "affected",
"version": "32b0aaba5dbc85816898167d9b5d45a22eae82e9",
"versionType": "git"
},
{
"status": "affected",
"version": "a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb",
"versionType": "git"
},
{
"status": "affected",
"version": "8418f55302fa1d2eeb73e16e345167e545c598a5",
"versionType": "git"
},
{
"lessThan": "5.10.259",
"status": "affected",
"version": "5.10.223",
"versionType": "semver"
},
{
"lessThan": "5.15.210",
"status": "affected",
"version": "5.15.164",
"versionType": "semver"
},
{
"lessThan": "6.1.176",
"status": "affected",
"version": "6.1.102",
"versionType": "semver"
},
{
"lessThan": "6.6.143",
"status": "affected",
"version": "6.6.43",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.281",
"versionType": "semver"
},
{
"lessThan": "6.10",
"status": "affected",
"version": "6.9.12",
"versionType": "semver"
},
{
"lessThan": "6.11",
"status": "affected",
"version": "6.10.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/tun.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.10.223",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.15.164",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "6.1.102",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.6.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.281",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.10.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntun: free page on short-frame rejection in tun_xdp_one()\n\ntun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without\nfreeing the page that vhost_net_build_xdp() allocated for it.\ntun_sendmsg() discards that -EINVAL and still returns total_len, so\nvhost_tx_batch() takes the success path and never frees the page; each\nshort frame in a batch leaks one page-frag chunk.\n\nA local process that can open /dev/net/tun and /dev/vhost-net can hit\nthis path: it attaches a tun/tap device as the vhost-net backend and\nfeeds TX descriptors whose length minus the virtio-net header is below\nETH_HLEN. Each kick leaks the page-frag chunks for that batch, and a\ntight submission loop exhausts host memory and triggers an OOM panic.\nFree the page before returning -EINVAL, matching the XDP-program error\npath in the same function."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The flaw is reached via local host interfaces (/dev/net/tun and /dev/vhost-net ioctls/sendmsg) or from a KVM guest through virtio-net TX descriptors processed by vhost-net, not via remote network packets to the host stack.\nAC:L - An attacker reliably triggers the leak by repeatedly submitting TX frames whose length minus the virtio-net header is below ETH_HLEN; no races or attacker-uncontrollable layout conditions are required.\nPR:N - A malicious KVM guest on a host using vhost-net with a tun/tap backend needs no host privileges\u2014only the ability to craft short virtio-net TX descriptors\u2014while a direct host attacker can also obtain CAP_NET_ADMIN via unprivileged user namespaces.\nUI:N - Exploitation requires no victim interaction beyond normal VM or namespace operation; the attacker drives the vhost TX path directly in a tight loop.\nS:C - In the highest-impact cloud/KVM deployment, an unprivileged guest VM crosses the hypervisor security boundary to exhaust host kernel memory and panic the host, affecting resources outside the guest\u0027s security scope.\nC:N - The bug is a page-fragment memory leak with no out-of-bounds access, use-after-free, or information disclosure; freed pages are simply never returned to the allocator.\nI:N - No kernel memory corruption or data modification occurs; the only effect is unbounded consumption of page-frags leading to denial of service.\nA:H - Sustained submission of short batched frames leaks one page-frag per frame, exhausts host memory, and can trigger an OOM kernel panic as described in the fix commit."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:16.239Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0a6f46a9332ad6958992d64d3b3a81a80b2ca940"
},
{
"url": "https://git.kernel.org/stable/c/0e8211fcf9426f5adddf32516ba0f400ceb9544d"
},
{
"url": "https://git.kernel.org/stable/c/e915445942af6dcea628bf66d6241641201a0c41"
},
{
"url": "https://git.kernel.org/stable/c/5b34f9e4fe2f203724a6e893d6df0316b9670057"
},
{
"url": "https://git.kernel.org/stable/c/69863ff2720a0e9871f1a5710f2a33a94217fee0"
},
{
"url": "https://git.kernel.org/stable/c/37a1c268c2c8090bf4dc552d732bd23ba36f8eb0"
},
{
"url": "https://git.kernel.org/stable/c/98c67be9eb9de72465a071949e84a3cdb8fab5a3"
},
{
"url": "https://git.kernel.org/stable/c/f4feb1e20058e407cb00f45aff47f5b7e19a6bbf"
}
],
"title": "tun: free page on short-frame rejection in tun_xdp_one()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46321",
"datePublished": "2026-06-09T12:11:13.872Z",
"dateReserved": "2026-05-13T15:03:33.112Z",
"dateUpdated": "2026-08-05T12:31:16.239Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53086 (GCVE-0-2026-53086)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: bcmgenet: fix racing timeout handler
The bcmgenet_timeout handler tries to take down all tx queues when
a single queue times out. This is over zealous and causes many race
conditions with queues that are still chugging along. Instead lets
only restart the timed out queue.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 13ea657806cf73b379a0109f7042182f47c351a7 Version: 13ea657806cf73b379a0109f7042182f47c351a7 Version: 13ea657806cf73b379a0109f7042182f47c351a7 Version: 13ea657806cf73b379a0109f7042182f47c351a7 Version: 13ea657806cf73b379a0109f7042182f47c351a7 Version: 13ea657806cf73b379a0109f7042182f47c351a7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/genet/bcmgenet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e85b0c0a12e967930044608311471b665baa315c",
"status": "affected",
"version": "13ea657806cf73b379a0109f7042182f47c351a7",
"versionType": "git"
},
{
"lessThan": "e8206538cbaf4f4068e99a4cb1138690a1e00499",
"status": "affected",
"version": "13ea657806cf73b379a0109f7042182f47c351a7",
"versionType": "git"
},
{
"lessThan": "681fdfe823b4f1036ed50b58b8838c7917ea389c",
"status": "affected",
"version": "13ea657806cf73b379a0109f7042182f47c351a7",
"versionType": "git"
},
{
"lessThan": "c270e2bec3e55a716d25c35341091339457ac883",
"status": "affected",
"version": "13ea657806cf73b379a0109f7042182f47c351a7",
"versionType": "git"
},
{
"lessThan": "7ce1c26aac3b318886a57425f64b522da7389153",
"status": "affected",
"version": "13ea657806cf73b379a0109f7042182f47c351a7",
"versionType": "git"
},
{
"lessThan": "5393b2b5bee2ac51a0043dc7f4ac3475f053d08d",
"status": "affected",
"version": "13ea657806cf73b379a0109f7042182f47c351a7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/genet/bcmgenet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: fix racing timeout handler\n\nThe bcmgenet_timeout handler tries to take down all tx queues when\na single queue times out. This is over zealous and causes many race\nconditions with queues that are still chugging along. Instead lets\nonly restart the timed out queue."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable path is the Ethernet TX path and `ndo_tx_timeout` recovery for a network interface; a remote peer can cause the affected host or router to transmit traffic through bcmgenet without local code execution. In an internet-facing or routed embedded deployment, this is reachable via network traffic.\nAC:L - The race is between timeout recovery on one TX queue and other active TX queues, and an attacker can plausibly create sustained concurrent traffic to exercise multiple queues and keep the race repeatable. No special memory layout or victim interaction is required beyond traffic-induced queue activity.\nPR:N - No kernel privilege check gates the watchdog timeout handler once the interface is up. A remote unauthenticated peer can trigger outbound responses or forwarded traffic in a reasonable deployment.\nUI:N - Exploitation does not require a user to open a file, mount anything, or take an interactive action. The vulnerable recovery runs asynchronously from normal network transmission and watchdog handling.\nS:U - The impact remains within the same host kernel and network device security authority. This is not a VM escape, IOMMU boundary bypass, or cross-scope sandbox escape.\nC:H - The old handler reclaimed and freed in-flight SKBs/descriptors for queues that could still be transmitting, creating a DMA/use-after-free condition. Freed or reused kernel memory could plausibly be transmitted or otherwise exposed, so confidentiality is high.\nI:H - Freeing and reusing active TX control blocks while hardware still owns them is UAF-style memory corruption of kernel driver/DMA state. Under the required conservative scoring, this is treated as potentially enabling high-integrity impact rather than mere packet loss.\nA:H - The race can corrupt TX ring accounting/state, trigger repeated TX watchdog failures, DMA/IOMMU faults, hangs, or kernel crashes. This is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:14.446Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e85b0c0a12e967930044608311471b665baa315c"
},
{
"url": "https://git.kernel.org/stable/c/e8206538cbaf4f4068e99a4cb1138690a1e00499"
},
{
"url": "https://git.kernel.org/stable/c/681fdfe823b4f1036ed50b58b8838c7917ea389c"
},
{
"url": "https://git.kernel.org/stable/c/c270e2bec3e55a716d25c35341091339457ac883"
},
{
"url": "https://git.kernel.org/stable/c/7ce1c26aac3b318886a57425f64b522da7389153"
},
{
"url": "https://git.kernel.org/stable/c/5393b2b5bee2ac51a0043dc7f4ac3475f053d08d"
}
],
"title": "net: bcmgenet: fix racing timeout handler",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53086",
"datePublished": "2026-06-24T16:30:26.111Z",
"dateReserved": "2026-06-09T07:44:35.384Z",
"dateUpdated": "2026-08-05T12:33:14.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31627 (GCVE-0-2026-31627)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-08-05 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: s3c24xx: check the size of the SMBUS message before using it
The first byte of an i2c SMBUS message is the size, and it should be
verified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX
before processing it.
This is the same logic that was added in commit a6e04f05ce0b ("i2c:
tegra: check msg length in SMBUS block read") to the i2c tegra driver.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 85747311ecb6167c989093c64a13807366fdd3a9 Version: 85747311ecb6167c989093c64a13807366fdd3a9 Version: 85747311ecb6167c989093c64a13807366fdd3a9 Version: 85747311ecb6167c989093c64a13807366fdd3a9 Version: 85747311ecb6167c989093c64a13807366fdd3a9 Version: 85747311ecb6167c989093c64a13807366fdd3a9 Version: 85747311ecb6167c989093c64a13807366fdd3a9 Version: 85747311ecb6167c989093c64a13807366fdd3a9 Version: 85747311ecb6167c989093c64a13807366fdd3a9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-s3c2410.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fd1650da24ed54c716aa9b69e9bbd8a662e492da",
"status": "affected",
"version": "85747311ecb6167c989093c64a13807366fdd3a9",
"versionType": "git"
},
{
"lessThan": "8f756a5964396da0fc9e0db33253a5b85dbbcbb6",
"status": "affected",
"version": "85747311ecb6167c989093c64a13807366fdd3a9",
"versionType": "git"
},
{
"lessThan": "2d262da4bca6fab96e2e709feb95b31b0a9a03a7",
"status": "affected",
"version": "85747311ecb6167c989093c64a13807366fdd3a9",
"versionType": "git"
},
{
"lessThan": "fa00738ab30b07db1a43b9c85fc56b8cc3b7d197",
"status": "affected",
"version": "85747311ecb6167c989093c64a13807366fdd3a9",
"versionType": "git"
},
{
"lessThan": "d87d5620125a03b1eadbd5df39748215d3db7ddb",
"status": "affected",
"version": "85747311ecb6167c989093c64a13807366fdd3a9",
"versionType": "git"
},
{
"lessThan": "377fae22a137b6b89f3f32399a58c52cf2325416",
"status": "affected",
"version": "85747311ecb6167c989093c64a13807366fdd3a9",
"versionType": "git"
},
{
"lessThan": "71b3c316b22c555d2769126a92b1244b15a9750d",
"status": "affected",
"version": "85747311ecb6167c989093c64a13807366fdd3a9",
"versionType": "git"
},
{
"lessThan": "aaaaec39ddbcd06770dca7f1adebc3b1242ebe7b",
"status": "affected",
"version": "85747311ecb6167c989093c64a13807366fdd3a9",
"versionType": "git"
},
{
"lessThan": "c0128c7157d639a931353ea344fb44aad6d6e17a",
"status": "affected",
"version": "85747311ecb6167c989093c64a13807366fdd3a9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/busses/i2c-s3c2410.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: s3c24xx: check the size of the SMBUS message before using it\n\nThe first byte of an i2c SMBUS message is the size, and it should be\nverified to ensure that it is in the range of 0..I2C_SMBUS_BLOCK_MAX\nbefore processing it.\n\nThis is the same logic that was added in commit a6e04f05ce0b (\"i2c:\ntegra: check msg length in SMBUS block read\") to the i2c tegra driver."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reachable from local userspace through `/dev/i2c-*` ioctls (`I2C_SMBUS` or `I2C_RDWR`) into the s3c24xx adapter transfer routine. The malformed length byte is supplied by the selected I2C/SMBus slave during that local transaction.\nAC:L - Once an attacker can issue a block read to an attacker-controlled or malicious SMBus slave, returning a zero or greater-than-32 first byte deterministically reaches the bug. There is no race or condition outside the attacker\u0027s control in the vulnerable length handling.\nPR:L - The kernel path has no capability check; the attacker only needs local access to the relevant i2c-dev character device, commonly granted via device permissions or an i2c-like group. This is not a real init-namespace root requirement.\nUI:N - No victim action is needed after the attacker has access to the bus interface and target slave response. The attacker can initiate the SMBus block read directly.\nS:U - The corruption occurs in kernel memory within the same kernel security authority. It does not cross a hypervisor, IOMMU, or other separate security scope boundary.\nC:H - An oversized device-supplied SMBus length makes the driver read and store beyond the allocated SMBus buffer, and raw i2c-dev paths can also copy back using the inflated length. This can disclose adjacent kernel memory.\nI:H - The slave controls bytes written past the end of the kernel SMBus buffer, creating an out-of-bounds kernel memory write. Such memory corruption is defensibly exploitable for arbitrary corruption or control-flow impact.\nA:H - The out-of-bounds kernel write can corrupt heap or stack state and reliably cause an oops, panic, or hang. Repeated local triggering can deny service to the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:23:54.379Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fd1650da24ed54c716aa9b69e9bbd8a662e492da"
},
{
"url": "https://git.kernel.org/stable/c/8f756a5964396da0fc9e0db33253a5b85dbbcbb6"
},
{
"url": "https://git.kernel.org/stable/c/2d262da4bca6fab96e2e709feb95b31b0a9a03a7"
},
{
"url": "https://git.kernel.org/stable/c/fa00738ab30b07db1a43b9c85fc56b8cc3b7d197"
},
{
"url": "https://git.kernel.org/stable/c/d87d5620125a03b1eadbd5df39748215d3db7ddb"
},
{
"url": "https://git.kernel.org/stable/c/377fae22a137b6b89f3f32399a58c52cf2325416"
},
{
"url": "https://git.kernel.org/stable/c/71b3c316b22c555d2769126a92b1244b15a9750d"
},
{
"url": "https://git.kernel.org/stable/c/aaaaec39ddbcd06770dca7f1adebc3b1242ebe7b"
},
{
"url": "https://git.kernel.org/stable/c/c0128c7157d639a931353ea344fb44aad6d6e17a"
}
],
"title": "i2c: s3c24xx: check the size of the SMBUS message before using it",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31627",
"datePublished": "2026-04-24T14:42:48.342Z",
"dateReserved": "2026-03-09T15:48:24.124Z",
"dateUpdated": "2026-08-05T12:23:54.379Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31720 (GCVE-0-2026-31720)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-05-11 22:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_uac1_legacy: validate control request size
f_audio_complete() copies req->length bytes into a 4-byte stack
variable:
u32 data = 0;
memcpy(&data, req->buf, req->length);
req->length is derived from the host-controlled USB request path,
which can lead to a stack out-of-bounds write.
Validate req->actual against the expected payload size for the
supported control selectors and decode only the expected amount
of data.
This avoids copying a host-influenced length into a fixed-size
stack object.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c6994e6f067cf0fc4c6cca3d164018b1150916f8 Version: c6994e6f067cf0fc4c6cca3d164018b1150916f8 Version: c6994e6f067cf0fc4c6cca3d164018b1150916f8 Version: c6994e6f067cf0fc4c6cca3d164018b1150916f8 Version: c6994e6f067cf0fc4c6cca3d164018b1150916f8 Version: c6994e6f067cf0fc4c6cca3d164018b1150916f8 Version: c6994e6f067cf0fc4c6cca3d164018b1150916f8 Version: c6994e6f067cf0fc4c6cca3d164018b1150916f8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_uac1_legacy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "557d1d4e862eccd0b74cc377b66de3e1e8d49605",
"status": "affected",
"version": "c6994e6f067cf0fc4c6cca3d164018b1150916f8",
"versionType": "git"
},
{
"lessThan": "21b11e8581285c6f10ef43d05df349d445f24273",
"status": "affected",
"version": "c6994e6f067cf0fc4c6cca3d164018b1150916f8",
"versionType": "git"
},
{
"lessThan": "0d41772d98dcaf6c17e875b7d0ea0154ae1191ee",
"status": "affected",
"version": "c6994e6f067cf0fc4c6cca3d164018b1150916f8",
"versionType": "git"
},
{
"lessThan": "c6da4fed7537aec19880c24f6c3a95065adb1406",
"status": "affected",
"version": "c6994e6f067cf0fc4c6cca3d164018b1150916f8",
"versionType": "git"
},
{
"lessThan": "be2d32f0c3fe333d14c0a9ca90328dacbc3e06b8",
"status": "affected",
"version": "c6994e6f067cf0fc4c6cca3d164018b1150916f8",
"versionType": "git"
},
{
"lessThan": "8e5eb1d6e6a3d7bbea9c92132d0cda5793176426",
"status": "affected",
"version": "c6994e6f067cf0fc4c6cca3d164018b1150916f8",
"versionType": "git"
},
{
"lessThan": "26304d124e7f0383f8fe1168b5801a0ac7e16b1c",
"status": "affected",
"version": "c6994e6f067cf0fc4c6cca3d164018b1150916f8",
"versionType": "git"
},
{
"lessThan": "6e0e34d85cd46ceb37d16054e97a373a32770f6c",
"status": "affected",
"version": "c6994e6f067cf0fc4c6cca3d164018b1150916f8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/f_uac1_legacy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_uac1_legacy: validate control request size\n\nf_audio_complete() copies req-\u003elength bytes into a 4-byte stack\nvariable:\n\n u32 data = 0;\n memcpy(\u0026data, req-\u003ebuf, req-\u003elength);\n\nreq-\u003elength is derived from the host-controlled USB request path,\nwhich can lead to a stack out-of-bounds write.\n\nValidate req-\u003eactual against the expected payload size for the\nsupported control selectors and decode only the expected amount\nof data.\n\nThis avoids copying a host-influenced length into a fixed-size\nstack object."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:14:27.286Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/557d1d4e862eccd0b74cc377b66de3e1e8d49605"
},
{
"url": "https://git.kernel.org/stable/c/21b11e8581285c6f10ef43d05df349d445f24273"
},
{
"url": "https://git.kernel.org/stable/c/0d41772d98dcaf6c17e875b7d0ea0154ae1191ee"
},
{
"url": "https://git.kernel.org/stable/c/c6da4fed7537aec19880c24f6c3a95065adb1406"
},
{
"url": "https://git.kernel.org/stable/c/be2d32f0c3fe333d14c0a9ca90328dacbc3e06b8"
},
{
"url": "https://git.kernel.org/stable/c/8e5eb1d6e6a3d7bbea9c92132d0cda5793176426"
},
{
"url": "https://git.kernel.org/stable/c/26304d124e7f0383f8fe1168b5801a0ac7e16b1c"
},
{
"url": "https://git.kernel.org/stable/c/6e0e34d85cd46ceb37d16054e97a373a32770f6c"
}
],
"title": "usb: gadget: f_uac1_legacy: validate control request size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31720",
"datePublished": "2026-05-01T14:14:22.832Z",
"dateReserved": "2026-03-09T15:48:24.134Z",
"dateUpdated": "2026-05-11T22:14:27.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46046 (GCVE-0-2026-46046)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-06-14 17:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
The commit c8e008b60492 ("ext4: ignore xattrs past end")
introduced a refcount leak in when block_csum is false.
ext4_xattr_inode_dec_ref_all() calls ext4_get_inode_loc() to
get iloc.bh, but never releases it with brelse().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 76c365fa7e2a8bb85f0190cdb4b8cdc99b2fdce3 Version: f737418b6de31c962c7192777ee4018906975383 Version: cf9291a3449b04688b81e32621e88de8f4314b54 Version: 362a90cecd36e8a5c415966d0b75b04a0270e4dd Version: eb59cc31b6ea076021d14b04e7faab1636b87d0e Version: c8e008b60492cf6fd31ef127aea6d02fd3d314cd Version: c8e008b60492cf6fd31ef127aea6d02fd3d314cd Version: c8e008b60492cf6fd31ef127aea6d02fd3d314cd Version: 6aff941cb0f7d0c897c3698ad2e30672709135e3 Version: 3bc6317033f365ce578eb6039445fb66162722fd Version: 836e625b03a666cf93ff5be328c8cb30336db872 Version: 5.10.237 ≤ Version: 5.15.181 ≤ Version: 6.1.135 ≤ Version: 6.6.88 ≤ Version: 6.12.24 ≤ Version: 5.4.293 ≤ Version: 6.13.12 ≤ Version: 6.14.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/xattr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dd98a5603a212ea9c96c6982ccdbcc748fdb9a56",
"status": "affected",
"version": "76c365fa7e2a8bb85f0190cdb4b8cdc99b2fdce3",
"versionType": "git"
},
{
"lessThan": "153ab2c52355fbebcae622db8e7b506492c73a29",
"status": "affected",
"version": "f737418b6de31c962c7192777ee4018906975383",
"versionType": "git"
},
{
"lessThan": "b706d00206a9e82362a9633efbd8b5775650169b",
"status": "affected",
"version": "cf9291a3449b04688b81e32621e88de8f4314b54",
"versionType": "git"
},
{
"lessThan": "1bc1107a3a403a6d440673ed6666f7b07ef868a8",
"status": "affected",
"version": "362a90cecd36e8a5c415966d0b75b04a0270e4dd",
"versionType": "git"
},
{
"lessThan": "097227f1ffe1a85bc3c359f81c71e3d40e06e920",
"status": "affected",
"version": "eb59cc31b6ea076021d14b04e7faab1636b87d0e",
"versionType": "git"
},
{
"lessThan": "1e6b0a69bf2c9c819255c7566e4355536d81d9cf",
"status": "affected",
"version": "c8e008b60492cf6fd31ef127aea6d02fd3d314cd",
"versionType": "git"
},
{
"lessThan": "f072906688933bf47fabbaf63560be03357c8298",
"status": "affected",
"version": "c8e008b60492cf6fd31ef127aea6d02fd3d314cd",
"versionType": "git"
},
{
"lessThan": "77d059519382bd66283e6a4e83ee186e87e7708f",
"status": "affected",
"version": "c8e008b60492cf6fd31ef127aea6d02fd3d314cd",
"versionType": "git"
},
{
"status": "affected",
"version": "6aff941cb0f7d0c897c3698ad2e30672709135e3",
"versionType": "git"
},
{
"status": "affected",
"version": "3bc6317033f365ce578eb6039445fb66162722fd",
"versionType": "git"
},
{
"status": "affected",
"version": "836e625b03a666cf93ff5be328c8cb30336db872",
"versionType": "git"
},
{
"lessThan": "5.10.258",
"status": "affected",
"version": "5.10.237",
"versionType": "semver"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.181",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.135",
"versionType": "semver"
},
{
"lessThan": "6.6.140",
"status": "affected",
"version": "6.6.88",
"versionType": "semver"
},
{
"lessThan": "6.12.86",
"status": "affected",
"version": "6.12.24",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.293",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.12",
"versionType": "semver"
},
{
"lessThan": "6.15",
"status": "affected",
"version": "6.14.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/xattr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10.237",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.181",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.135",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.6.88",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "6.12.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.293",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.14.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()\n\nThe commit c8e008b60492 (\"ext4: ignore xattrs past end\")\nintroduced a refcount leak in when block_csum is false.\n\next4_xattr_inode_dec_ref_all() calls ext4_get_inode_loc() to\nget iloc.bh, but never releases it with brelse()."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:50:25.177Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dd98a5603a212ea9c96c6982ccdbcc748fdb9a56"
},
{
"url": "https://git.kernel.org/stable/c/153ab2c52355fbebcae622db8e7b506492c73a29"
},
{
"url": "https://git.kernel.org/stable/c/b706d00206a9e82362a9633efbd8b5775650169b"
},
{
"url": "https://git.kernel.org/stable/c/1bc1107a3a403a6d440673ed6666f7b07ef868a8"
},
{
"url": "https://git.kernel.org/stable/c/097227f1ffe1a85bc3c359f81c71e3d40e06e920"
},
{
"url": "https://git.kernel.org/stable/c/1e6b0a69bf2c9c819255c7566e4355536d81d9cf"
},
{
"url": "https://git.kernel.org/stable/c/f072906688933bf47fabbaf63560be03357c8298"
},
{
"url": "https://git.kernel.org/stable/c/77d059519382bd66283e6a4e83ee186e87e7708f"
}
],
"title": "ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46046",
"datePublished": "2026-05-27T12:57:02.610Z",
"dateReserved": "2026-05-13T15:03:33.094Z",
"dateUpdated": "2026-06-14T17:50:25.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53366 (GCVE-0-2026-53366)
Vulnerability from cvelistv5
Published
2026-07-16 05:13
Modified
2026-08-17 04:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: account for fraggap on the paged allocation path
In __ip_append_data(), when the paged-allocation branch is taken,
alloclen and pagedlen are computed as
alloclen = fragheaderlen + transhdrlen;
pagedlen = datalen - transhdrlen;
datalen already includes fraggap, but the fraggap bytes carried over
from the previous skb are copied into the new skb's linear area at
offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The
linear area is therefore undersized by fraggap bytes while pagedlen is
overstated by the same amount.
The non-paged branch sets alloclen to fraglen, which already accounts
for fraggap because datalen does. Bring the paged branch in line by
adding fraggap to alloclen and subtracting it from pagedlen.
After this adjustment, copy no longer collapses to -fraggap on the
paged path, so remove the stale comment describing that old arithmetic.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8eb77cc73977d88787b37c92831b1c242e035396 Version: 8eb77cc73977d88787b37c92831b1c242e035396 Version: 8eb77cc73977d88787b37c92831b1c242e035396 Version: 8eb77cc73977d88787b37c92831b1c242e035396 Version: 8eb77cc73977d88787b37c92831b1c242e035396 Version: 8eb77cc73977d88787b37c92831b1c242e035396 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/ip_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5c6375bced6147ec2e460ee3b653f4860d5ecdc2",
"status": "affected",
"version": "8eb77cc73977d88787b37c92831b1c242e035396",
"versionType": "git"
},
{
"lessThan": "ce494707a9c07f27c219ca67f3e138061f53d9b3",
"status": "affected",
"version": "8eb77cc73977d88787b37c92831b1c242e035396",
"versionType": "git"
},
{
"lessThan": "a9c24eda24bd15f432e37824e6fc440977cb241c",
"status": "affected",
"version": "8eb77cc73977d88787b37c92831b1c242e035396",
"versionType": "git"
},
{
"lessThan": "77798d7be6ef71e72fb6fc8a2901bf74ebc9706f",
"status": "affected",
"version": "8eb77cc73977d88787b37c92831b1c242e035396",
"versionType": "git"
},
{
"lessThan": "c04d9ece23deb9e26c19f9ca215e98b3295aa1bb",
"status": "affected",
"version": "8eb77cc73977d88787b37c92831b1c242e035396",
"versionType": "git"
},
{
"lessThan": "eca856950f7cb1a221e02b99d758409f2c5cec42",
"status": "affected",
"version": "8eb77cc73977d88787b37c92831b1c242e035396",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/ip_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: account for fraggap on the paged allocation path\n\nIn __ip_append_data(), when the paged-allocation branch is taken,\nalloclen and pagedlen are computed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap, but the fraggap bytes carried over\nfrom the previous skb are copied into the new skb\u0027s linear area at\noffset transhdrlen by the subsequent skb_copy_and_csum_bits(). The\nlinear area is therefore undersized by fraggap bytes while pagedlen is\noverstated by the same amount.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached while a local process constructs outgoing IPv4 UDP/raw/ping datagrams through sendmsg/splice/sendfile-style socket paths. I did not find a defensible received-packet or unauthenticated remote path that supplies the required cork/MSG_MORE-style fraggap conditions.\nAC:L - The attacker can choose UDP socket options/flags, payload sizes, corking/MSG_MORE behavior, and splice/zerocopy-style paged sends to reach the fraggap paged-allocation path. There is no race or external timing condition required.\nPR:L - A normal unprivileged local user can create IPv4 UDP sockets and use UDP_CORK/MSG_MORE/splice or related paged send paths; raw sockets are CAP_NET_RAW-gated but are not needed for the strongest local trigger. This is therefore basic local user privilege, not real administrator privilege.\nUI:N - No victim interaction is required once the attacker can run the local send/splice sequence. The vulnerable skb construction happens synchronously in the attacker-driven socket send path.\nS:U - The impact is within the same kernel security authority as the vulnerable IPv4 networking code. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug under-allocates/accounting for the linear skb area and can copy attacker-controlled fraggap bytes past skb-\u003eend into trailing skb_shared_info metadata. Kernel memory corruption of this kind is reasonably capable of being developed into information disclosure, so the higher severity confidentiality value is appropriate.\nI:H - The copied fraggap bytes corrupt kernel skb metadata past the intended buffer boundary. This is an out-of-bounds write in kernel heap/networking structures and is scored as high integrity impact.\nA:H - The corrupted skb metadata can crash or destabilize the kernel networking stack, and related negative-copy accounting can also produce severe send-path failure behavior. Kernel crash or oops potential is high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:30.453Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5c6375bced6147ec2e460ee3b653f4860d5ecdc2"
},
{
"url": "https://git.kernel.org/stable/c/ce494707a9c07f27c219ca67f3e138061f53d9b3"
},
{
"url": "https://git.kernel.org/stable/c/a9c24eda24bd15f432e37824e6fc440977cb241c"
},
{
"url": "https://git.kernel.org/stable/c/77798d7be6ef71e72fb6fc8a2901bf74ebc9706f"
},
{
"url": "https://git.kernel.org/stable/c/c04d9ece23deb9e26c19f9ca215e98b3295aa1bb"
},
{
"url": "https://git.kernel.org/stable/c/eca856950f7cb1a221e02b99d758409f2c5cec42"
}
],
"title": "ipv4: account for fraggap on the paged allocation path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53366",
"datePublished": "2026-07-16T05:13:40.893Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-08-17T04:50:30.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46052 (GCVE-0-2026-46052)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ceph: only d_add() negative dentries when they are unhashed
Ceph can call d_add(dentry, NULL) on a negative dentry that is already
present in the primary dcache hash.
In the current VFS that is not safe. d_add() goes through __d_add()
to __d_rehash(), which unconditionally reinserts dentry->d_hash into
the hlist_bl bucket. If the dentry is already hashed, reinserting the
same node can corrupt the bucket, including creating a self-loop.
Once that happens, __d_lookup() can spin forever in the hlist_bl walk,
typically looping only on the d_name.hash mismatch check and
eventually triggering RCU stall reports like this one:
rcu: INFO: rcu_sched self-detected stall on CPU
rcu: 87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829
rcu: (t=2101 jiffies g=79058445 q=698988 ncpus=192)
CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE
Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023
RIP: 0010:__d_lookup+0x46/0xb0
Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db <74> 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f
RSP: 0018:ff745a70c8253898 EFLAGS: 00000282
RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966
RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0
RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89
R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0
R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f
FS: 00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0
PKRU: 55555554
Call Trace:
<TASK>
lookup_fast+0x9f/0x100
walk_component+0x1f/0x150
link_path_walk+0x20e/0x3d0
path_lookupat+0x68/0x180
filename_lookup+0xdc/0x1e0
vfs_statx+0x6c/0x140
vfs_fstatat+0x67/0xa0
__do_sys_newfstatat+0x24/0x60
do_syscall_64+0x6a/0x230
entry_SYSCALL_64_after_hwframe+0x76/0x7e
This is reachable with reused cached negative dentries. A Ceph lookup
or atomic_open can be handed a negative dentry that is already hashed,
and fs/ceph/dir.c then hits one of two paths that incorrectly assume
"negative" also means "unhashed":
- ceph_finish_lookup():
MDS reply is -ENOENT with no trace
-> d_add(dentry, NULL)
- ceph_lookup():
local ENOENT fast path for a complete directory with shared caps
-> d_add(dentry, NULL)
Both paths can therefore re-add an already-hashed negative dentry.
Ceph already uses the correct pattern elsewhere: ceph_fill_trace() only
calls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn)
is true.
Fix both fs/ceph/dir.c sites the same way: only call d_add() for a
negative dentry when it is actually unhashed. If the negative dentry
is already hashed, leave it in place and reuse it as-is.
This preserves the existing behavior for unhashed dentries while
avoiding d_hash list corruption for reused hashed negatives.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2817b000b02c5f0c05af67c01fb2684e1381d6ef Version: 2817b000b02c5f0c05af67c01fb2684e1381d6ef Version: 2817b000b02c5f0c05af67c01fb2684e1381d6ef Version: 2817b000b02c5f0c05af67c01fb2684e1381d6ef Version: 2817b000b02c5f0c05af67c01fb2684e1381d6ef Version: 2817b000b02c5f0c05af67c01fb2684e1381d6ef Version: 2817b000b02c5f0c05af67c01fb2684e1381d6ef Version: 2817b000b02c5f0c05af67c01fb2684e1381d6ef |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ceph/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4147ae08824cc8b65d2b2018f79d416af2937108",
"status": "affected",
"version": "2817b000b02c5f0c05af67c01fb2684e1381d6ef",
"versionType": "git"
},
{
"lessThan": "73b47a1f06dee5e61b00dee5227d75d3f1f6d977",
"status": "affected",
"version": "2817b000b02c5f0c05af67c01fb2684e1381d6ef",
"versionType": "git"
},
{
"lessThan": "79ffcbeac6bc1dc1bcdb0434acf250f6215ec111",
"status": "affected",
"version": "2817b000b02c5f0c05af67c01fb2684e1381d6ef",
"versionType": "git"
},
{
"lessThan": "83ce43a21bb7df8dd52228afdd918d2d058eefde",
"status": "affected",
"version": "2817b000b02c5f0c05af67c01fb2684e1381d6ef",
"versionType": "git"
},
{
"lessThan": "4179cc390dacebc87079419ec92f86f3dc46294d",
"status": "affected",
"version": "2817b000b02c5f0c05af67c01fb2684e1381d6ef",
"versionType": "git"
},
{
"lessThan": "b91e535f208c48a5e7464f1aa38338a30e7912df",
"status": "affected",
"version": "2817b000b02c5f0c05af67c01fb2684e1381d6ef",
"versionType": "git"
},
{
"lessThan": "2010cb06b9df7d3c816c78358c566bdacbdf38ff",
"status": "affected",
"version": "2817b000b02c5f0c05af67c01fb2684e1381d6ef",
"versionType": "git"
},
{
"lessThan": "803447f93d75ab6e40c85e6d12b5630d281d70d6",
"status": "affected",
"version": "2817b000b02c5f0c05af67c01fb2684e1381d6ef",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ceph/dir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: only d_add() negative dentries when they are unhashed\n\nCeph can call d_add(dentry, NULL) on a negative dentry that is already\npresent in the primary dcache hash.\n\nIn the current VFS that is not safe. d_add() goes through __d_add()\nto __d_rehash(), which unconditionally reinserts dentry-\u003ed_hash into\nthe hlist_bl bucket. If the dentry is already hashed, reinserting the\nsame node can corrupt the bucket, including creating a self-loop.\nOnce that happens, __d_lookup() can spin forever in the hlist_bl walk,\ntypically looping only on the d_name.hash mismatch check and\neventually triggering RCU stall reports like this one:\n\n rcu: INFO: rcu_sched self-detected stall on CPU\n rcu: 87-....: (2100 ticks this GP) idle=3a4c/1/0x4000000000000000 softirq=25003319/25003319 fqs=829\n rcu: (t=2101 jiffies g=79058445 q=698988 ncpus=192)\n CPU: 87 UID: 2952868916 PID: 3933303 Comm: php-cgi8.3 Not tainted 6.18.17-i1-amd #950 NONE\n Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.6 09/22/2023\n RIP: 0010:__d_lookup+0x46/0xb0\n Code: c1 e8 07 48 8d 04 c2 48 8b 00 49 89 fc 49 89 f5 48 89 c3 48 83 e3 fe 48 83 f8 01 77 0f eb 2d 0f 1f 44 00 00 48 8b 1b 48 85 db \u003c74\u003e 20 39 6b 18 75 f3 48 8d 7b 78 e8 ba 85 d0 00 4c 39 63 10 74 1f\n RSP: 0018:ff745a70c8253898 EFLAGS: 00000282\n RAX: ff26e470054cb208 RBX: ff26e470054cb208 RCX: 000000006e958966\n RDX: ff26e48267340000 RSI: ff745a70c82539b0 RDI: ff26e458f74655c0\n RBP: 000000006e958966 R08: 0000000000000180 R09: 9cd08d909b919a89\n R10: ff26e458f74655c0 R11: 0000000000000000 R12: ff26e458f74655c0\n R13: ff745a70c82539b0 R14: d0d0d0d0d0d0d0d0 R15: 2f2f2f2f2f2f2f2f\n FS: 00007f5770896980(0000) GS:ff26e482c5d88000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f5764de50c0 CR3: 000000a72abb5001 CR4: 0000000000771ef0\n PKRU: 55555554\n Call Trace:\n \u003cTASK\u003e\n lookup_fast+0x9f/0x100\n walk_component+0x1f/0x150\n link_path_walk+0x20e/0x3d0\n path_lookupat+0x68/0x180\n filename_lookup+0xdc/0x1e0\n vfs_statx+0x6c/0x140\n vfs_fstatat+0x67/0xa0\n __do_sys_newfstatat+0x24/0x60\n do_syscall_64+0x6a/0x230\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThis is reachable with reused cached negative dentries. A Ceph lookup\nor atomic_open can be handed a negative dentry that is already hashed,\nand fs/ceph/dir.c then hits one of two paths that incorrectly assume\n\"negative\" also means \"unhashed\":\n\n - ceph_finish_lookup():\n MDS reply is -ENOENT with no trace\n -\u003e d_add(dentry, NULL)\n\n - ceph_lookup():\n local ENOENT fast path for a complete directory with shared caps\n -\u003e d_add(dentry, NULL)\n\nBoth paths can therefore re-add an already-hashed negative dentry.\n\nCeph already uses the correct pattern elsewhere: ceph_fill_trace() only\ncalls d_add(dn, NULL) for a negative null-dentry reply when d_unhashed(dn)\nis true.\n\nFix both fs/ceph/dir.c sites the same way: only call d_add() for a\nnegative dentry when it is actually unhashed. If the negative dentry\nis already hashed, leave it in place and reuse it as-is.\n\nThis preserves the existing behavior for unhashed dentries while\navoiding d_hash list corruption for reused hashed negatives."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Ceph is a network filesystem client; the vulnerable `ceph_finish_lookup()` path is driven directly by remote MDS reply data (-ENOENT with no trace), so a malicious/compromised MDS or on-path attacker injecting crafted replies can drive the buggy `d_add()` on a hashed negative dentry. Processing remote-peer data places this at Network.\nAC:L - The corruption arose naturally in production from an ordinary `newfstatat`, showing the precondition (a reused already-hashed negative dentry) is reliably reachable; an attacker controlling MDS replies/lease grants can deterministically set up the cached negative dentry and re-lookup with no race outside their control.\nPR:N - A network attacker who controls or impersonates the MDS (or MITMs the unauthenticated msgr path) needs no privileges or credentials on the victim client to feed the -ENOENT-no-trace replies that trigger the vulnerable code.\nUI:N - On an established Ceph mount, path lookups/stats occur continuously as part of normal operation, so no specific victim action is required at exploit time.\nS:U - The corruption and resulting hang are entirely within the kernel\u0027s own dcache; no security boundary (VM, IOMMU, sandbox) is crossed.\nC:N - The bug creates a self-referential cycle in an hlist_bl hash bucket and leaks no memory contents; there is no out-of-bounds or use-after-free read primitive.\nI:N - The only state altered is an internal dcache list pointer forming a loop; this provides no attacker-controllable write primitive and modifies no user or security-relevant data.\nA:H - `__d_lookup()` spins forever on the corrupted bucket, producing RCU stalls and a hung/softlocked CPU \u2014 a kernel-level denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:20.131Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4147ae08824cc8b65d2b2018f79d416af2937108"
},
{
"url": "https://git.kernel.org/stable/c/73b47a1f06dee5e61b00dee5227d75d3f1f6d977"
},
{
"url": "https://git.kernel.org/stable/c/79ffcbeac6bc1dc1bcdb0434acf250f6215ec111"
},
{
"url": "https://git.kernel.org/stable/c/83ce43a21bb7df8dd52228afdd918d2d058eefde"
},
{
"url": "https://git.kernel.org/stable/c/4179cc390dacebc87079419ec92f86f3dc46294d"
},
{
"url": "https://git.kernel.org/stable/c/b91e535f208c48a5e7464f1aa38338a30e7912df"
},
{
"url": "https://git.kernel.org/stable/c/2010cb06b9df7d3c816c78358c566bdacbdf38ff"
},
{
"url": "https://git.kernel.org/stable/c/803447f93d75ab6e40c85e6d12b5630d281d70d6"
}
],
"title": "ceph: only d_add() negative dentries when they are unhashed",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46052",
"datePublished": "2026-05-27T12:57:10.777Z",
"dateReserved": "2026-05-13T15:03:33.094Z",
"dateUpdated": "2026-08-05T12:29:20.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53176 (GCVE-0-2026-53176)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done()
computes the login request payload length as wc->byte_len minus
ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int.
A remote iSER initiator can post a login Send work request carrying
fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows
and login_req_len becomes negative.
isert_rx_login_req() then reads that negative length back into a signed
int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the
min() is signed it keeps the negative value; the value is then passed as
the memcpy() length and sign-extended to a multi-gigabyte size_t. The
copy into the 8192-byte login->req_buf runs far out of bounds and
faults, crashing the target node. The login phase precedes iSCSI
authentication, so no credentials are required to reach this path.
Reject any login PDU shorter than ISER_HEADERS_LEN before the
subtraction, mirroring the existing early return on a failed work
completion, so login_req_len can never go negative. The upper bound was
already safe: a posted login buffer cannot deliver more than
ISER_RX_PAYLOAD_SIZE, so the difference stays at or below
MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing
lower bound needs to be added.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b8d26b3be8b33682cf163274ed07479a70554633 Version: b8d26b3be8b33682cf163274ed07479a70554633 Version: b8d26b3be8b33682cf163274ed07479a70554633 Version: b8d26b3be8b33682cf163274ed07479a70554633 Version: b8d26b3be8b33682cf163274ed07479a70554633 Version: b8d26b3be8b33682cf163274ed07479a70554633 Version: b8d26b3be8b33682cf163274ed07479a70554633 Version: b8d26b3be8b33682cf163274ed07479a70554633 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Internet Small Computer System Interface (iSCSI) Extensions for Remote Direct Memory Access (RDMA) (iSER) module. A remote attacker can send a specially crafted login request with a payload shorter than expected, leading to an integer underflow. This underflow causes a negative length to be used in a memory copy operation, resulting in an out-of-bounds write that crashes the system. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-839",
"description": "Numeric Range Comparison Without Minimum Check",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:44:41.443Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53176"
},
{
"name": "RHBZ#2492741",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492741"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53176.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, prevent module ib_isert from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/isert/ib_isert.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "75ee6e4aa096aa9e7b2dd5c8ff98356e30aceefb",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "e8a013c0c3ca2f6708341a56612a3f6d6921620a",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "bd22740d7f14cb1c0289444cfd2c8d2938667c1d",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "c1234229399f4af12c553b1b0ffd978eeba65548",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "c5584e089b5af7b3bf8bd5e8ca0560cbf32b0a47",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "df422fd273c96c2ee5beb80fc21adc8c70c29260",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "1ca40b243277c9e88be5e00bd3e083f71aefb93e",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
},
{
"lessThan": "29e7b925ae6df64894e82ab6419994dc25580a8a",
"status": "affected",
"version": "b8d26b3be8b33682cf163274ed07479a70554633",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/ulp/isert/ib_isert.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN\n\nIn drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done()\ncomputes the login request payload length as wc-\u003ebyte_len minus\nISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int.\nA remote iSER initiator can post a login Send work request carrying\nfewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows\nand login_req_len becomes negative.\n\nisert_rx_login_req() then reads that negative length back into a signed\nint, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the\nmin() is signed it keeps the negative value; the value is then passed as\nthe memcpy() length and sign-extended to a multi-gigabyte size_t. The\ncopy into the 8192-byte login-\u003ereq_buf runs far out of bounds and\nfaults, crashing the target node. The login phase precedes iSCSI\nauthentication, so no credentials are required to reach this path.\n\nReject any login PDU shorter than ISER_HEADERS_LEN before the\nsubtraction, mirroring the existing early return on a failed work\ncompletion, so login_req_len can never go negative. The upper bound was\nalready safe: a posted login buffer cannot deliver more than\nISER_RX_PAYLOAD_SIZE, so the difference stays at or below\nMAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing\nlower bound needs to be added."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is reached by a remote iSER initiator over an RDMA/iSER target portal using RDMA CM and posted Send login PDUs. This is network protocol input to a kernel storage target service.\nAC:L - The attacker only needs to establish an iSER connection and send a login PDU shorter than ISER_HEADERS_LEN. No race or condition outside the attacker\u0027s control is required.\nPR:N - The vulnerable memcpy occurs during iSCSI login processing before CHAP/authentication, initiator ACL checks, and normal session authorization complete. No credentials are required.\nUI:N - Exploitation is triggered solely by attacker-sent network/RDMA traffic to the exposed target portal. No victim user action is required.\nS:U - The impact is within the kernel and target host security authority. There is no VM, IOMMU, or other cross-scope boundary involved.\nC:H - The signed underflow drives an out-of-bounds kernel memcpy that reads far beyond the receive buffer. As kernel memory corruption with an out-of-bounds read component, high confidentiality impact is the higher defensible choice.\nI:H - The same oversized memcpy writes far beyond the 8192-byte login request buffer into adjacent kernel memory. This is an out-of-bounds write and may be exploitable for kernel memory corruption, so integrity impact is high.\nA:H - The commit and code path show the huge memcpy faults and crashes the iSER target node. A remote unauthenticated attacker can repeatedly trigger kernel oops/panic-level denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:45.742Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/75ee6e4aa096aa9e7b2dd5c8ff98356e30aceefb"
},
{
"url": "https://git.kernel.org/stable/c/e8a013c0c3ca2f6708341a56612a3f6d6921620a"
},
{
"url": "https://git.kernel.org/stable/c/bd22740d7f14cb1c0289444cfd2c8d2938667c1d"
},
{
"url": "https://git.kernel.org/stable/c/c1234229399f4af12c553b1b0ffd978eeba65548"
},
{
"url": "https://git.kernel.org/stable/c/c5584e089b5af7b3bf8bd5e8ca0560cbf32b0a47"
},
{
"url": "https://git.kernel.org/stable/c/df422fd273c96c2ee5beb80fc21adc8c70c29260"
},
{
"url": "https://git.kernel.org/stable/c/1ca40b243277c9e88be5e00bd3e083f71aefb93e"
},
{
"url": "https://git.kernel.org/stable/c/29e7b925ae6df64894e82ab6419994dc25580a8a"
}
],
"title": "IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53176",
"datePublished": "2026-06-25T08:38:52.693Z",
"dateReserved": "2026-06-09T07:44:35.389Z",
"dateUpdated": "2026-08-05T12:33:45.742Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52951 (GCVE-0-2026-52951)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/dma-buf: handle empty bo and UAF races
There look to be some nasty races here when triggering the
invalidate_mappings hook:
1) We do xe_bo_alloc() followed by the attach, before the actual full bo
init step in xe_dma_buf_init_obj(). However the bo is visible on the
attachments list after the attach. This is bad since exporter driver,
say amdgpu, can at any time call back into our invalidate_mappings hook,
with an empty/bogus bo, leading to potential bugs/crashes.
2) Similar to 1) but here we get a UAF, when the invalidate_mappings
hook is triggered. For example, we get as far as xe_bo_init_locked()
but this fails in some way. But here the bo will be freed on error, but
we still have it attached from dma-buf pov, so if the
invalidate_mappings is now triggered then the bo we access is gone and
we trigger UAF and more bugs/crashes.
To fix this, move the attach step until after we actually have a fully
set up buffer object. Note that the bo is not published to userspace
until later, so not sure what the comment "Don't publish the bo
until we have a valid attachment", is referring to.
We have at least two different customers reporting hitting a NULL ptr
deref in evict_flags when importing something from amdgpu, followed by
triggering the evict flow. Hit rate is also pretty low, which would
hint at some kind of race, so something like 1) or 2) might explain
this.
v2:
- Shuffle the order of the ops slightly (no functional change)
- Improve the comment to better explain the ordering (Matt B)
(cherry picked from commit af1f2ad0c59fe4e2f924c526f66e968289d77971)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s drm/xe/dma-buf subsystem. This vulnerability involves race conditions when handling the invalidate_mappings hook, particularly during buffer object initialization and attachment. An attacker, by triggering specific sequences of operations, could exploit these races to cause a Use-After-Free (UAF) condition or a NULL pointer dereference. This could lead to system instability and crashes, resulting in a Denial of Service (DoS)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:45:52.859Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52951"
},
{
"name": "RHBZ#2492353",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492353"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52951.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: drm/xe/dma-buf: handle empty bo and UAF races",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_dma_buf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9894731e513019df22a29e5c52f1c98890355ff1",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
},
{
"lessThan": "20a99ea1e2fd720856d6ba497ff26b82c604751f",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
},
{
"lessThan": "c473ae25421fddc3dde247ba7b85225b10641d09",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
},
{
"lessThan": "981bedbbe61364fcc3a3b87ebaf648a66cd07108",
"status": "affected",
"version": "dd08ebf6c3525a7ea2186e636df064ea47281987",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/xe_dma_buf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/dma-buf: handle empty bo and UAF races\n\nThere look to be some nasty races here when triggering the\ninvalidate_mappings hook:\n\n1) We do xe_bo_alloc() followed by the attach, before the actual full bo\n init step in xe_dma_buf_init_obj(). However the bo is visible on the\n attachments list after the attach. This is bad since exporter driver,\n say amdgpu, can at any time call back into our invalidate_mappings hook,\n with an empty/bogus bo, leading to potential bugs/crashes.\n\n2) Similar to 1) but here we get a UAF, when the invalidate_mappings\n hook is triggered. For example, we get as far as xe_bo_init_locked()\n but this fails in some way. But here the bo will be freed on error, but\n we still have it attached from dma-buf pov, so if the\n invalidate_mappings is now triggered then the bo we access is gone and\n we trigger UAF and more bugs/crashes.\n\nTo fix this, move the attach step until after we actually have a fully\nset up buffer object. Note that the bo is not published to userspace\nuntil later, so not sure what the comment \"Don\u0027t publish the bo\nuntil we have a valid attachment\", is referring to.\n\nWe have at least two different customers reporting hitting a NULL ptr\nderef in evict_flags when importing something from amdgpu, followed by\ntriggering the evict flow. Hit rate is also pretty low, which would\nhint at some kind of race, so something like 1) or 2) might explain\nthis.\n\nv2:\n - Shuffle the order of the ops slightly (no functional change)\n - Improve the comment to better explain the ordering (Matt B)\n\n(cherry picked from commit af1f2ad0c59fe4e2f924c526f66e968289d77971)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local DRM PRIME ioctls on a xe DRM render/primary node, importing a dma-buf fd into the xe driver. There is no network or adjacent protocol exposure.\nAC:L - The bug is a race, but a local attacker can control the import side and can concurrently trigger exporter-side dma-buf movement/eviction notifications. No condition outside attacker control is required beyond a reasonable affected GPU/dma-buf setup.\nPR:L - The PRIME fd-to-handle ioctl is DRM_RENDER_ALLOW and does not require DRM master, root, or CAP_SYS_ADMIN. The attacker needs ordinary local access to the DRM render device/dma-buf-producing process context, which is low privilege.\nUI:N - The attacker can perform the required ioctls and concurrent operations directly. No separate victim user action is required.\nS:U - The vulnerability is in kernel DRM/dma-buf handling and impacts kernel memory within the same security authority. It is not a VM escape or separate security-scope boundary crossing.\nC:H - The flaw includes a use-after-free of a kernel xe buffer object attachment, which can potentially be shaped into kernel memory disclosure. Under the required higher-severity rule for UAFs, confidentiality impact is High.\nI:H - The UAF/memory-corruption condition can potentially be exploited with heap reuse/spraying to corrupt kernel objects or gain control-flow influence. Under the required higher-severity rule for UAFs, integrity impact is High.\nA:H - The reported and plausible immediate outcomes include NULL pointer dereference, UAF crashes, warnings/oopses, and kernel instability during BO eviction. Kernel crash or hang impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:00.963Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9894731e513019df22a29e5c52f1c98890355ff1"
},
{
"url": "https://git.kernel.org/stable/c/20a99ea1e2fd720856d6ba497ff26b82c604751f"
},
{
"url": "https://git.kernel.org/stable/c/c473ae25421fddc3dde247ba7b85225b10641d09"
},
{
"url": "https://git.kernel.org/stable/c/981bedbbe61364fcc3a3b87ebaf648a66cd07108"
}
],
"title": "drm/xe/dma-buf: handle empty bo and UAF races",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52951",
"datePublished": "2026-06-24T16:28:34.351Z",
"dateReserved": "2026-06-09T07:44:35.372Z",
"dateUpdated": "2026-08-05T12:32:00.963Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53227 (GCVE-0-2026-53227)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: fix possible kfree_skb of ERR_PTR
After the patch in the "Fixes" tag, the allocation of the "reply" skb
can happen either before or after locking the ovs_mutex.
However, error cleanups still follow the classical reversed order,
assuming "reply" is allocated before locking: it is freed after unlocking.
If "reply" allocation happens after locking the mutex and it fails,
"reply" is left with an ERR_PTR, and execution jumps to the correspondent
cleanup stage which will try to free an invalid pointer.
Fix this by setting the pointer to NULL after having saved its error
value.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 893f139b9a6c00c097b9082a90f3041cfb3a0d20 Version: 893f139b9a6c00c097b9082a90f3041cfb3a0d20 Version: 893f139b9a6c00c097b9082a90f3041cfb3a0d20 Version: 893f139b9a6c00c097b9082a90f3041cfb3a0d20 Version: 893f139b9a6c00c097b9082a90f3041cfb3a0d20 Version: 893f139b9a6c00c097b9082a90f3041cfb3a0d20 Version: 893f139b9a6c00c097b9082a90f3041cfb3a0d20 Version: 893f139b9a6c00c097b9082a90f3041cfb3a0d20 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/datapath.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e248fb2e680deb2bd37bac551b72638fe4938a76",
"status": "affected",
"version": "893f139b9a6c00c097b9082a90f3041cfb3a0d20",
"versionType": "git"
},
{
"lessThan": "0bb5b2dc1b90aa7dd1473fc8c4d813a29255ff8d",
"status": "affected",
"version": "893f139b9a6c00c097b9082a90f3041cfb3a0d20",
"versionType": "git"
},
{
"lessThan": "971b1b37774f13acc5add0a2843f8598446b8598",
"status": "affected",
"version": "893f139b9a6c00c097b9082a90f3041cfb3a0d20",
"versionType": "git"
},
{
"lessThan": "25fdf53698535fe8790237f5a8a9626791429785",
"status": "affected",
"version": "893f139b9a6c00c097b9082a90f3041cfb3a0d20",
"versionType": "git"
},
{
"lessThan": "e3d509a1b71396e1452060dbf84a805fd1c3c549",
"status": "affected",
"version": "893f139b9a6c00c097b9082a90f3041cfb3a0d20",
"versionType": "git"
},
{
"lessThan": "ecc55aad3390129a87106841f4b68bf3d70c9264",
"status": "affected",
"version": "893f139b9a6c00c097b9082a90f3041cfb3a0d20",
"versionType": "git"
},
{
"lessThan": "895d1dd9057cde1687fa0f4286d47ceed0b82997",
"status": "affected",
"version": "893f139b9a6c00c097b9082a90f3041cfb3a0d20",
"versionType": "git"
},
{
"lessThan": "ee30dd2909d8b98619f4341c70ec8dc8e155ab02",
"status": "affected",
"version": "893f139b9a6c00c097b9082a90f3041cfb3a0d20",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/datapath.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix possible kfree_skb of ERR_PTR\n\nAfter the patch in the \"Fixes\" tag, the allocation of the \"reply\" skb\ncan happen either before or after locking the ovs_mutex.\n\nHowever, error cleanups still follow the classical reversed order,\nassuming \"reply\" is allocated before locking: it is freed after unlocking.\n\nIf \"reply\" allocation happens after locking the mutex and it fails,\n\"reply\" is left with an ERR_PTR, and execution jumps to the correspondent\ncleanup stage which will try to free an invalid pointer.\n\nFix this by setting the pointer to NULL after having saved its error\nvalue."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:27.229Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e248fb2e680deb2bd37bac551b72638fe4938a76"
},
{
"url": "https://git.kernel.org/stable/c/0bb5b2dc1b90aa7dd1473fc8c4d813a29255ff8d"
},
{
"url": "https://git.kernel.org/stable/c/971b1b37774f13acc5add0a2843f8598446b8598"
},
{
"url": "https://git.kernel.org/stable/c/25fdf53698535fe8790237f5a8a9626791429785"
},
{
"url": "https://git.kernel.org/stable/c/e3d509a1b71396e1452060dbf84a805fd1c3c549"
},
{
"url": "https://git.kernel.org/stable/c/ecc55aad3390129a87106841f4b68bf3d70c9264"
},
{
"url": "https://git.kernel.org/stable/c/895d1dd9057cde1687fa0f4286d47ceed0b82997"
},
{
"url": "https://git.kernel.org/stable/c/ee30dd2909d8b98619f4341c70ec8dc8e155ab02"
}
],
"title": "net: openvswitch: fix possible kfree_skb of ERR_PTR",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53227",
"datePublished": "2026-06-25T08:39:27.229Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-06-25T08:39:27.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46143 (GCVE-0-2026-46143)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-06-14 17:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens
As prepare can be called mulitple times, this can result in multiple
graph opens for playback path.
This will result in a memory leaks, fix this by adding a check before
opening.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f6e1138d76cc684de3b851fc5cc5dac023a3ee89 Version: b377d4df8fb00f861acf1a4d48de17b74cf535aa Version: be1fae62cf253a5b67526cee9fbc07689b97c125 Version: be1fae62cf253a5b67526cee9fbc07689b97c125 Version: be1fae62cf253a5b67526cee9fbc07689b97c125 Version: be1fae62cf253a5b67526cee9fbc07689b97c125 Version: ee211a845d122ca19dc6a65bbd88c085bee2a57c Version: 6.1.154 ≤ Version: 6.6.37 ≤ Version: 6.9.8 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/qcom/qdsp6/q6apm-lpass-dais.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af9cc7c622e596455c5190e6ef53c5b40ea7a90d",
"status": "affected",
"version": "f6e1138d76cc684de3b851fc5cc5dac023a3ee89",
"versionType": "git"
},
{
"lessThan": "3141d8b00cad6d3331953c79060ccc3a0262311b",
"status": "affected",
"version": "b377d4df8fb00f861acf1a4d48de17b74cf535aa",
"versionType": "git"
},
{
"lessThan": "c91b7bcc70346d07f57ef03d1b9a338324e213de",
"status": "affected",
"version": "be1fae62cf253a5b67526cee9fbc07689b97c125",
"versionType": "git"
},
{
"lessThan": "7cab9f2ad51c858263da836baebad050a1bc7914",
"status": "affected",
"version": "be1fae62cf253a5b67526cee9fbc07689b97c125",
"versionType": "git"
},
{
"lessThan": "b97493f0f42ab9d882a62466782e1900e481a9d6",
"status": "affected",
"version": "be1fae62cf253a5b67526cee9fbc07689b97c125",
"versionType": "git"
},
{
"lessThan": "69acc488aaf39d0ddf6c3cf0e47c1873d39919a2",
"status": "affected",
"version": "be1fae62cf253a5b67526cee9fbc07689b97c125",
"versionType": "git"
},
{
"status": "affected",
"version": "ee211a845d122ca19dc6a65bbd88c085bee2a57c",
"versionType": "git"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.154",
"versionType": "semver"
},
{
"lessThan": "6.6.140",
"status": "affected",
"version": "6.6.37",
"versionType": "semver"
},
{
"lessThan": "6.10",
"status": "affected",
"version": "6.9.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/qcom/qdsp6/q6apm-lpass-dais.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.154",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens\n\nAs prepare can be called mulitple times, this can result in multiple\ngraph opens for playback path.\n\nThis will result in a memory leaks, fix this by adding a check before\nopening."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:57:43.842Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af9cc7c622e596455c5190e6ef53c5b40ea7a90d"
},
{
"url": "https://git.kernel.org/stable/c/3141d8b00cad6d3331953c79060ccc3a0262311b"
},
{
"url": "https://git.kernel.org/stable/c/c91b7bcc70346d07f57ef03d1b9a338324e213de"
},
{
"url": "https://git.kernel.org/stable/c/7cab9f2ad51c858263da836baebad050a1bc7914"
},
{
"url": "https://git.kernel.org/stable/c/b97493f0f42ab9d882a62466782e1900e481a9d6"
},
{
"url": "https://git.kernel.org/stable/c/69acc488aaf39d0ddf6c3cf0e47c1873d39919a2"
}
],
"title": "ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46143",
"datePublished": "2026-05-28T09:35:59.117Z",
"dateReserved": "2026-05-13T15:03:33.100Z",
"dateUpdated": "2026-06-14T17:57:43.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46112 (GCVE-0-2026-46112)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/hns: Fix unlocked call to hns_roce_qp_remove()
Sashiko points out that hns_roce_qp_remove() requires the caller to hold
locks. The error flow in hns_roce_create_qp_common() doesn't hold those
locks for the error unwind so it risks corrupting memory.
Grab the same locks the other two callers use.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e088a685eae94a0607b8f7b99949a0e14d748813 Version: e088a685eae94a0607b8f7b99949a0e14d748813 Version: e088a685eae94a0607b8f7b99949a0e14d748813 Version: e088a685eae94a0607b8f7b99949a0e14d748813 Version: e088a685eae94a0607b8f7b99949a0e14d748813 Version: e088a685eae94a0607b8f7b99949a0e14d748813 Version: e088a685eae94a0607b8f7b99949a0e14d748813 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/hns/hns_roce_qp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1f0a3aa8b569d010316b427238222c5d899f9618",
"status": "affected",
"version": "e088a685eae94a0607b8f7b99949a0e14d748813",
"versionType": "git"
},
{
"lessThan": "b6296ff2475fc95ee6ea1b528c4b385302808186",
"status": "affected",
"version": "e088a685eae94a0607b8f7b99949a0e14d748813",
"versionType": "git"
},
{
"lessThan": "fb4ae739811d467409bd07d0e36cfd4140f3d26a",
"status": "affected",
"version": "e088a685eae94a0607b8f7b99949a0e14d748813",
"versionType": "git"
},
{
"lessThan": "fcf6a832c0d5b2bc5398d6996c5570d3ee7993fb",
"status": "affected",
"version": "e088a685eae94a0607b8f7b99949a0e14d748813",
"versionType": "git"
},
{
"lessThan": "1912f78798505dc9c637081bbddfbf1c22494c49",
"status": "affected",
"version": "e088a685eae94a0607b8f7b99949a0e14d748813",
"versionType": "git"
},
{
"lessThan": "615d9d260c32bb678504ca96f29ae46f9d745155",
"status": "affected",
"version": "e088a685eae94a0607b8f7b99949a0e14d748813",
"versionType": "git"
},
{
"lessThan": "0c99acbc8b6c6dd526ae475a48ee1897b61072fb",
"status": "affected",
"version": "e088a685eae94a0607b8f7b99949a0e14d748813",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/hns/hns_roce_qp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/hns: Fix unlocked call to hns_roce_qp_remove()\n\nSashiko points out that hns_roce_qp_remove() requires the caller to hold\nlocks. The error flow in hns_roce_create_qp_common() doesn\u0027t hold those\nlocks for the error unwind so it risks corrupting memory.\n\nGrab the same locks the other two callers use."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached through the local RDMA uverbs character device (ibv_create_qp), a control-plane operation; it cannot be triggered by a remote peer sending RDMA packets.\nAC:L - The attacker can reliably force the error-unwind path (e.g., a faulting ib_copy_to_udata output buffer) and controls both sides of the race by running concurrent QP create/destroy and CQ-poll operations on the same device/CQs.\nPR:L - Creating a QP requires access to the RDMA verbs device but no CAP/root; an unprivileged local user with RDMA access (common in HPC/cloud/container deployments) can reach the code.\nUI:N - The attacker triggers QP creation and the error path directly with no action required from any other user.\nS:U - Corruption stays within the kernel\u0027s own memory/security authority; no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - Unlocked list_del causes linked-list corruption that can be leveraged into use-after-free and arbitrary kernel-memory disclosure; per guidance memory corruption exploitable for info leak is High.\nI:H - Racing list_del/list_add writes attacker-influenced pointer values into neighbor nodes, a memory-corruption write primitive that can be escalated to control-flow hijack; High.\nA:H - List corruption and the resulting use-after-free reliably oops/panic the kernel, a full denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:44.058Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1f0a3aa8b569d010316b427238222c5d899f9618"
},
{
"url": "https://git.kernel.org/stable/c/b6296ff2475fc95ee6ea1b528c4b385302808186"
},
{
"url": "https://git.kernel.org/stable/c/fb4ae739811d467409bd07d0e36cfd4140f3d26a"
},
{
"url": "https://git.kernel.org/stable/c/fcf6a832c0d5b2bc5398d6996c5570d3ee7993fb"
},
{
"url": "https://git.kernel.org/stable/c/1912f78798505dc9c637081bbddfbf1c22494c49"
},
{
"url": "https://git.kernel.org/stable/c/615d9d260c32bb678504ca96f29ae46f9d745155"
},
{
"url": "https://git.kernel.org/stable/c/0c99acbc8b6c6dd526ae475a48ee1897b61072fb"
}
],
"title": "RDMA/hns: Fix unlocked call to hns_roce_qp_remove()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46112",
"datePublished": "2026-05-28T09:35:20.879Z",
"dateReserved": "2026-05-13T15:03:33.098Z",
"dateUpdated": "2026-08-05T12:29:44.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46160 (GCVE-0-2026-46160)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-06-19 11:59
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix missing last_unlink_trans update when removing a directory
When removing a directory we are not updating its last_unlink_trans field,
which can result in incorrect fsync behaviour in case some one fsyncs the
directory after it was removed because it's holding a file descriptor on
it.
Example scenario:
mkdir /mnt/dir1
mkdir /mnt/dir1/dir2
mkdir /mnt/dir3
sync -f /mnt
# Do some change to the directory and fsync it.
chmod 700 /mnt/dir1
xfs_io -c fsync /mnt/dir1
# Move dir2 out of dir1 so that dir1 becomes empty.
mv /mnt/dir1/dir2 /mnt/dir3/
open fd on /mnt/dir1
call rmdir(2) on path "/mnt/dir1"
fsync fd
<trigger power failure>
When attempting to mount the filesystem, the log replay will fail with
an -EIO error and dmesg/syslog has the following:
[445771.626482] BTRFS info (device dm-0): first mount of filesystem 0368bbea-6c5e-44b5-b409-09abe496e650
[445771.626486] BTRFS info (device dm-0): using crc32c checksum algorithm
[445771.627912] BTRFS info (device dm-0): start tree-log replay
[445771.628335] page: refcount:2 mapcount:0 mapping:0000000061443ddc index:0x1d00 pfn:0x7072a5
[445771.629453] memcg:ffff89f400351b00
[445771.629892] aops:btree_aops [btrfs] ino:1
[445771.630737] flags: 0x17fffc00000402a(uptodate|lru|private|writeback|node=0|zone=2|lastcpupid=0x1ffff)
[445771.632359] raw: 017fffc00000402a fffff47284d950c8 fffff472907b7c08 ffff89f458e412b8
[445771.633713] raw: 0000000000001d00 ffff89f6c51d1a90 00000002ffffffff ffff89f400351b00
[445771.635029] page dumped because: eb page dump
[445771.635825] BTRFS critical (device dm-0): corrupt leaf: root=5 block=30408704 slot=10 ino=258, invalid nlink: has 2 expect no more than 1 for dir
[445771.638088] BTRFS info (device dm-0): leaf 30408704 gen 10 total ptrs 17 free space 14878 owner 5
[445771.638091] BTRFS info (device dm-0): refs 4 lock_owner 0 current 3581087
[445771.638094] item 0 key (256 INODE_ITEM 0) itemoff 16123 itemsize 160
[445771.638097] inode generation 3 transid 9 size 16 nbytes 16384
[445771.638098] block group 0 mode 40755 links 1 uid 0 gid 0
[445771.638100] rdev 0 sequence 2 flags 0x0
[445771.638102] atime 1775744884.0
[445771.660056] ctime 1775744885.645502983
[445771.660058] mtime 1775744885.645502983
[445771.660060] otime 1775744884.0
[445771.660062] item 1 key (256 INODE_REF 256) itemoff 16111 itemsize 12
[445771.660064] index 0 name_len 2
[445771.660066] item 2 key (256 DIR_ITEM 1843588421) itemoff 16077 itemsize 34
[445771.660068] location key (259 1 0) type 2
[445771.660070] transid 9 data_len 0 name_len 4
[445771.660075] item 3 key (256 DIR_ITEM 2363071922) itemoff 16043 itemsize 34
[445771.660076] location key (257 1 0) type 2
[445771.660077] transid 9 data_len 0 name_len 4
[445771.660078] item 4 key (256 DIR_INDEX 2) itemoff 16009 itemsize 34
[445771.660079] location key (257 1 0) type 2
[445771.660080] transid 9 data_len 0 name_len 4
[445771.660081] item 5 key (256 DIR_INDEX 3) itemoff 15975 itemsize 34
[445771.660082] location key (259 1 0) type 2
[445771.660083] transid 9 data_len 0 name_len 4
[445771.660084] item 6 key (257 INODE_ITEM 0) itemoff 15815 itemsize 160
[445771.660086] inode generation 9 transid 9 size 8 nbytes 0
[445771.660087] block group 0 mode 40777 links 1 uid 0 gid 0
[445771.660088] rdev 0 sequence 2 flags 0x0
[445771.660089] atime 1775744885.641174097
[445771.660090] ctime 1775744885.645502983
[445771.660091] mtime 1775744885.645502983
[445771.660105] otime 1775744885.641174097
[445771.660106] item 7 key (257 INODE_REF 256) itemoff 15801 itemsize 14
[445771.660107] index 2 name_len 4
[445771.660108] item 8 key (257 DIR_ITEM 2676584006) itemoff 15767 itemsize 34
[445771.660109] location key (2
---truncated---
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 12fcfd22fe5bf4fe74710232098bc101af497995 Version: 12fcfd22fe5bf4fe74710232098bc101af497995 Version: 12fcfd22fe5bf4fe74710232098bc101af497995 Version: 12fcfd22fe5bf4fe74710232098bc101af497995 Version: 12fcfd22fe5bf4fe74710232098bc101af497995 Version: 12fcfd22fe5bf4fe74710232098bc101af497995 Version: 12fcfd22fe5bf4fe74710232098bc101af497995 Version: 12fcfd22fe5bf4fe74710232098bc101af497995 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af467162290f5fe79d6a361b7c84302e45b1fd9f",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
},
{
"lessThan": "2525998ac956476bded26b9f34c4164dc890b87a",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
},
{
"lessThan": "6acbb2f6dff23c9bb9761fb98b516525b9cf1ce9",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
},
{
"lessThan": "cc3c0a0f965754ce230d93ba44ee5b34fbe6138a",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
},
{
"lessThan": "aa9c3ecaf7337df3a689318584f879b5339ede0f",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
},
{
"lessThan": "fb388eb58c1ba047ccabc33901839acfecadcf49",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
},
{
"lessThan": "36fcc2c7517f8a86379154c9793f867592aa8b7e",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
},
{
"lessThan": "999757231c49376cd1a37308d2c8c4c9932571e1",
"status": "affected",
"version": "12fcfd22fe5bf4fe74710232098bc101af497995",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix missing last_unlink_trans update when removing a directory\n\nWhen removing a directory we are not updating its last_unlink_trans field,\nwhich can result in incorrect fsync behaviour in case some one fsyncs the\ndirectory after it was removed because it\u0027s holding a file descriptor on\nit.\n\nExample scenario:\n\n mkdir /mnt/dir1\n mkdir /mnt/dir1/dir2\n mkdir /mnt/dir3\n\n sync -f /mnt\n\n # Do some change to the directory and fsync it.\n chmod 700 /mnt/dir1\n xfs_io -c fsync /mnt/dir1\n\n # Move dir2 out of dir1 so that dir1 becomes empty.\n mv /mnt/dir1/dir2 /mnt/dir3/\n\n open fd on /mnt/dir1\n call rmdir(2) on path \"/mnt/dir1\"\n fsync fd\n\n \u003ctrigger power failure\u003e\n\nWhen attempting to mount the filesystem, the log replay will fail with\nan -EIO error and dmesg/syslog has the following:\n\n [445771.626482] BTRFS info (device dm-0): first mount of filesystem 0368bbea-6c5e-44b5-b409-09abe496e650\n [445771.626486] BTRFS info (device dm-0): using crc32c checksum algorithm\n [445771.627912] BTRFS info (device dm-0): start tree-log replay\n [445771.628335] page: refcount:2 mapcount:0 mapping:0000000061443ddc index:0x1d00 pfn:0x7072a5\n [445771.629453] memcg:ffff89f400351b00\n [445771.629892] aops:btree_aops [btrfs] ino:1\n [445771.630737] flags: 0x17fffc00000402a(uptodate|lru|private|writeback|node=0|zone=2|lastcpupid=0x1ffff)\n [445771.632359] raw: 017fffc00000402a fffff47284d950c8 fffff472907b7c08 ffff89f458e412b8\n [445771.633713] raw: 0000000000001d00 ffff89f6c51d1a90 00000002ffffffff ffff89f400351b00\n [445771.635029] page dumped because: eb page dump\n [445771.635825] BTRFS critical (device dm-0): corrupt leaf: root=5 block=30408704 slot=10 ino=258, invalid nlink: has 2 expect no more than 1 for dir\n [445771.638088] BTRFS info (device dm-0): leaf 30408704 gen 10 total ptrs 17 free space 14878 owner 5\n [445771.638091] BTRFS info (device dm-0): refs 4 lock_owner 0 current 3581087\n [445771.638094] \titem 0 key (256 INODE_ITEM 0) itemoff 16123 itemsize 160\n [445771.638097] \t\tinode generation 3 transid 9 size 16 nbytes 16384\n [445771.638098] \t\tblock group 0 mode 40755 links 1 uid 0 gid 0\n [445771.638100] \t\trdev 0 sequence 2 flags 0x0\n [445771.638102] \t\tatime 1775744884.0\n [445771.660056] \t\tctime 1775744885.645502983\n [445771.660058] \t\tmtime 1775744885.645502983\n [445771.660060] \t\totime 1775744884.0\n [445771.660062] \titem 1 key (256 INODE_REF 256) itemoff 16111 itemsize 12\n [445771.660064] \t\tindex 0 name_len 2\n [445771.660066] \titem 2 key (256 DIR_ITEM 1843588421) itemoff 16077 itemsize 34\n [445771.660068] \t\tlocation key (259 1 0) type 2\n [445771.660070] \t\ttransid 9 data_len 0 name_len 4\n [445771.660075] \titem 3 key (256 DIR_ITEM 2363071922) itemoff 16043 itemsize 34\n [445771.660076] \t\tlocation key (257 1 0) type 2\n [445771.660077] \t\ttransid 9 data_len 0 name_len 4\n [445771.660078] \titem 4 key (256 DIR_INDEX 2) itemoff 16009 itemsize 34\n [445771.660079] \t\tlocation key (257 1 0) type 2\n [445771.660080] \t\ttransid 9 data_len 0 name_len 4\n [445771.660081] \titem 5 key (256 DIR_INDEX 3) itemoff 15975 itemsize 34\n [445771.660082] \t\tlocation key (259 1 0) type 2\n [445771.660083] \t\ttransid 9 data_len 0 name_len 4\n [445771.660084] \titem 6 key (257 INODE_ITEM 0) itemoff 15815 itemsize 160\n [445771.660086] \t\tinode generation 9 transid 9 size 8 nbytes 0\n [445771.660087] \t\tblock group 0 mode 40777 links 1 uid 0 gid 0\n [445771.660088] \t\trdev 0 sequence 2 flags 0x0\n [445771.660089] \t\tatime 1775744885.641174097\n [445771.660090] \t\tctime 1775744885.645502983\n [445771.660091] \t\tmtime 1775744885.645502983\n [445771.660105] \t\totime 1775744885.641174097\n [445771.660106] \titem 7 key (257 INODE_REF 256) itemoff 15801 itemsize 14\n [445771.660107] \t\tindex 2 name_len 4\n [445771.660108] \titem 8 key (257 DIR_ITEM 2676584006) itemoff 15767 itemsize 34\n [445771.660109] \t\tlocation key (2\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-19T11:59:43.255Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af467162290f5fe79d6a361b7c84302e45b1fd9f"
},
{
"url": "https://git.kernel.org/stable/c/2525998ac956476bded26b9f34c4164dc890b87a"
},
{
"url": "https://git.kernel.org/stable/c/6acbb2f6dff23c9bb9761fb98b516525b9cf1ce9"
},
{
"url": "https://git.kernel.org/stable/c/cc3c0a0f965754ce230d93ba44ee5b34fbe6138a"
},
{
"url": "https://git.kernel.org/stable/c/aa9c3ecaf7337df3a689318584f879b5339ede0f"
},
{
"url": "https://git.kernel.org/stable/c/fb388eb58c1ba047ccabc33901839acfecadcf49"
},
{
"url": "https://git.kernel.org/stable/c/36fcc2c7517f8a86379154c9793f867592aa8b7e"
},
{
"url": "https://git.kernel.org/stable/c/999757231c49376cd1a37308d2c8c4c9932571e1"
}
],
"title": "btrfs: fix missing last_unlink_trans update when removing a directory",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46160",
"datePublished": "2026-05-28T09:36:15.580Z",
"dateReserved": "2026-05-13T15:03:33.102Z",
"dateUpdated": "2026-06-19T11:59:43.255Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52909 (GCVE-0-2026-52909)
Vulnerability from cvelistv5
Published
2026-06-19 14:43
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ip6_vti: set netns_immutable on the fallback device.
john1988 and Noam Rathaus reported that vti6_init_net() does not set the
netns_immutable flag on the per-netns fallback tunnel device (ip6_vti0).
Other similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel)
correctly set this flag during their fallback device initialization to
prevent them from being moved to another network namespace.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 Version: 61220ab349485d911083d0b7990ccd3db6c63297 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_vti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "12acc977838c943636fb01e2f3087d2e4cc3b7cc",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "7f28e3948c59481f8db9c9638e204258d26b4e41",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "12c65e2c7fef507551bd7b52123598a761662c01",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "f4b6b4af7ef0661ac153c6f7eb1030aa8482c1a3",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "c5dbd669db5a426b3025512322e1bf2cdbe14305",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "ecf8904067dcba0dad86ece80874841e60317885",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "dcdce3bc9f08026ff3739ee7339e1bef526fc5f3",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
},
{
"lessThan": "d289d5307762d1838aaece22c6b6fcad9e8865f9",
"status": "affected",
"version": "61220ab349485d911083d0b7990ccd3db6c63297",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_vti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_vti: set netns_immutable on the fallback device.\n\njohn1988 and Noam Rathaus reported that vti6_init_net() does not set the\nnetns_immutable flag on the per-netns fallback tunnel device (ip6_vti0).\n\nOther similar tunnel drivers (like ip6_tunnel, sit, ip6_gre, and ip_tunnel)\ncorrectly set this flag during their fallback device initialization to\nprevent them from being moved to another network namespace."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable operation is reached through local rtnetlink device movement, such as RTM_SETLINK with IFLA_NET_NS_FD, not by unauthenticated remote packets.\nAC:L - An attacker can deterministically create or use network namespaces and move ip6_vti0; no race, special timing, or external condition is required.\nPR:L - The path requires CAP_NET_ADMIN in the relevant network namespace, but that is reachable from an unprivileged user via user namespaces on common deployments.\nUI:N - No victim action is required once the attacker can issue the local netlink operation.\nS:U - The impact remains within the kernel/network-namespace security authority and does not cross a VM, IOMMU, or separate hardware-enforced boundary.\nC:H - Moving the singleton fallback device leaves vti6 per-netns tunnel state pointing at a device in another namespace, which can expose VTI/XFRM tunnel traffic or namespace-scoped network state through an attacker-controlled device.\nI:H - The same cross-namespace device/state mismatch can let the attacker redirect or manipulate VTI6 tunnel delivery and per-netns tunnel semantics, so high integrity impact is defensible.\nA:H - The fallback device is assumed to be one immutable device per netns; violating that invariant can unregister or corrupt tunnel state and related vti6 namespace-migration bugs have produced cleanup-time UAF/BUG conditions."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:32.616Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/12acc977838c943636fb01e2f3087d2e4cc3b7cc"
},
{
"url": "https://git.kernel.org/stable/c/7f28e3948c59481f8db9c9638e204258d26b4e41"
},
{
"url": "https://git.kernel.org/stable/c/12c65e2c7fef507551bd7b52123598a761662c01"
},
{
"url": "https://git.kernel.org/stable/c/f4b6b4af7ef0661ac153c6f7eb1030aa8482c1a3"
},
{
"url": "https://git.kernel.org/stable/c/c5dbd669db5a426b3025512322e1bf2cdbe14305"
},
{
"url": "https://git.kernel.org/stable/c/ecf8904067dcba0dad86ece80874841e60317885"
},
{
"url": "https://git.kernel.org/stable/c/dcdce3bc9f08026ff3739ee7339e1bef526fc5f3"
},
{
"url": "https://git.kernel.org/stable/c/d289d5307762d1838aaece22c6b6fcad9e8865f9"
}
],
"title": "ip6_vti: set netns_immutable on the fallback device.",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52909",
"datePublished": "2026-06-19T14:43:33.214Z",
"dateReserved": "2026-06-09T07:44:35.366Z",
"dateUpdated": "2026-08-05T12:31:32.616Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53195 (GCVE-0-2026-53195)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()
build_i2c_fw_hdr() allocates a fixed-size buffer of
(16*1024 - 512) + sizeof(struct ti_i2c_firmware_rec) bytes, then
copies le16_to_cpu(img_header->Length) bytes into it without
validating that Length fits within the available space after the
firmware record header.
img_header->Length is a __le16 from the firmware file and can be
up to 65535. check_fw_sanity() validates the total firmware size
but not img_header->Length specifically.
Fix by rejecting images where img_header->Length exceeds the
available destination space.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/io_ti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3e187152f44d76d7633a3855ffd0099e1588b82a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b7faf660eefa2047ebc2959ff76da2b6eae2e9e3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "2fd64bf0ad66ab5de0c73524591d879427ba5aba",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4cb722747ed25971f35cc47ce5c0e79d7f717713",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "130d6567eb148040eed1b73e1414ad6c27d22bd5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "294692d3296eee3391c348d7ea6401916d27806c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5a79b634ee58786ca627268daefa7744f2af2e14",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "0fd2b00b2d3d05e3eaa13342b3dfb0fa85c226ae",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/serial/io_ti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()\n\nbuild_i2c_fw_hdr() allocates a fixed-size buffer of\n(16*1024 - 512) + sizeof(struct ti_i2c_firmware_rec) bytes, then\ncopies le16_to_cpu(img_header-\u003eLength) bytes into it without\nvalidating that Length fits within the available space after the\nfirmware record header.\n\nimg_header-\u003eLength is a __le16 from the firmware file and can be\nup to 65535. check_fw_sanity() validates the total firmware size\nbut not img_header-\u003eLength specifically.\n\nFix by rejecting images where img_header-\u003eLength exceeds the\navailable destination space."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:05.673Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3e187152f44d76d7633a3855ffd0099e1588b82a"
},
{
"url": "https://git.kernel.org/stable/c/b7faf660eefa2047ebc2959ff76da2b6eae2e9e3"
},
{
"url": "https://git.kernel.org/stable/c/2fd64bf0ad66ab5de0c73524591d879427ba5aba"
},
{
"url": "https://git.kernel.org/stable/c/4cb722747ed25971f35cc47ce5c0e79d7f717713"
},
{
"url": "https://git.kernel.org/stable/c/130d6567eb148040eed1b73e1414ad6c27d22bd5"
},
{
"url": "https://git.kernel.org/stable/c/294692d3296eee3391c348d7ea6401916d27806c"
},
{
"url": "https://git.kernel.org/stable/c/5a79b634ee58786ca627268daefa7744f2af2e14"
},
{
"url": "https://git.kernel.org/stable/c/0fd2b00b2d3d05e3eaa13342b3dfb0fa85c226ae"
}
],
"title": "USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53195",
"datePublished": "2026-06-25T08:39:05.673Z",
"dateReserved": "2026-06-09T07:44:35.390Z",
"dateUpdated": "2026-06-25T08:39:05.673Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53161 (GCVE-0-2026-53161)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context
There is a race between fastrpc_device_release() and the workqueue
that processes DSP responses. When the user closes the file descriptor,
fastrpc_device_release() frees the fastrpc_user structure. Concurrently,
an in-flight DSP invocation can complete and fastrpc_rpmsg_callback()
schedules context cleanup via schedule_work(&ctx->put_work). If the
workqueue runs fastrpc_context_free() in parallel with or after
fastrpc_device_release() has freed the user structure, it dereferences
the freed fastrpc_user. Depending on the state of the context at the
time of the race, any one of the following accesses can be hit:
1. fastrpc_buf_free() calls fastrpc_ipa_to_dma_addr(buf->fl->cctx, ...)
to strip the SID bits from the stored IOVA before passing the
physical address to dma_free_coherent().
2. fastrpc_free_map() reads map->fl->cctx->vmperms[0].vmid to
reconstruct the source permission bitmask needed for the
qcom_scm_assign_mem() call that returns memory from the DSP VM
back to HLOS.
3. fastrpc_free_map() acquires map->fl->lock to safely remove the
map node from the fl->maps list.
The resulting use-after-free manifests as:
pc : fastrpc_buf_free+0x38/0x80 [fastrpc]
lr : fastrpc_context_free+0xa8/0x1b0 [fastrpc]
fastrpc_context_free+0xa8/0x1b0 [fastrpc]
fastrpc_context_put_wq+0x78/0xa0 [fastrpc]
process_one_work+0x180/0x450
worker_thread+0x26c/0x388
Add kref-based reference counting to fastrpc_user. Have each invoke
context take a reference on the user at allocation time and release it
when the context is freed. Release the initial reference in
fastrpc_device_release() at file close. Move the teardown of the user
structure — freeing pending contexts, maps, mmaps, and the channel
context reference — into the kref release callback fastrpc_user_free(),
so that it runs only when the last reference is dropped, regardless of
whether that happens at device close or after the final in-flight
context completes.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6cffd79504ce040f460831030d3069fa1c99bb71 Version: 6cffd79504ce040f460831030d3069fa1c99bb71 Version: 6cffd79504ce040f460831030d3069fa1c99bb71 Version: 6cffd79504ce040f460831030d3069fa1c99bb71 Version: 6cffd79504ce040f460831030d3069fa1c99bb71 Version: 6cffd79504ce040f460831030d3069fa1c99bb71 Version: 6cffd79504ce040f460831030d3069fa1c99bb71 Version: 6cffd79504ce040f460831030d3069fa1c99bb71 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/misc/fastrpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c6e5c2be09f814377d7f1ce97370a5b7b3e02814",
"status": "affected",
"version": "6cffd79504ce040f460831030d3069fa1c99bb71",
"versionType": "git"
},
{
"lessThan": "e1e3a05efe5954d5bad01157d79429d39a67a7ae",
"status": "affected",
"version": "6cffd79504ce040f460831030d3069fa1c99bb71",
"versionType": "git"
},
{
"lessThan": "d42679eef34dd590b694ce3b666c5e2ba10cd4bf",
"status": "affected",
"version": "6cffd79504ce040f460831030d3069fa1c99bb71",
"versionType": "git"
},
{
"lessThan": "df08fadcf0e5f3708365ec3b6d30b5aafd98bea1",
"status": "affected",
"version": "6cffd79504ce040f460831030d3069fa1c99bb71",
"versionType": "git"
},
{
"lessThan": "ecea4967c2bff92c2fafbc59893f711b39f7b152",
"status": "affected",
"version": "6cffd79504ce040f460831030d3069fa1c99bb71",
"versionType": "git"
},
{
"lessThan": "5278ccd357e0d7aeeb1e76c0f3e0e02894a9897c",
"status": "affected",
"version": "6cffd79504ce040f460831030d3069fa1c99bb71",
"versionType": "git"
},
{
"lessThan": "fbe0947420eec18a84638d29468c2d563ce4e6a3",
"status": "affected",
"version": "6cffd79504ce040f460831030d3069fa1c99bb71",
"versionType": "git"
},
{
"lessThan": "e85eb5feca8e254905ffa6c57a3c99c89a674a0f",
"status": "affected",
"version": "6cffd79504ce040f460831030d3069fa1c99bb71",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/misc/fastrpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: fix use-after-free of fastrpc_user in workqueue context\n\nThere is a race between fastrpc_device_release() and the workqueue\nthat processes DSP responses. When the user closes the file descriptor,\nfastrpc_device_release() frees the fastrpc_user structure. Concurrently,\nan in-flight DSP invocation can complete and fastrpc_rpmsg_callback()\nschedules context cleanup via schedule_work(\u0026ctx-\u003eput_work). If the\nworkqueue runs fastrpc_context_free() in parallel with or after\nfastrpc_device_release() has freed the user structure, it dereferences\nthe freed fastrpc_user. Depending on the state of the context at the\ntime of the race, any one of the following accesses can be hit:\n\n 1. fastrpc_buf_free() calls fastrpc_ipa_to_dma_addr(buf-\u003efl-\u003ecctx, ...)\n to strip the SID bits from the stored IOVA before passing the\n physical address to dma_free_coherent().\n\n 2. fastrpc_free_map() reads map-\u003efl-\u003ecctx-\u003evmperms[0].vmid to\n reconstruct the source permission bitmask needed for the\n qcom_scm_assign_mem() call that returns memory from the DSP VM\n back to HLOS.\n\n 3. fastrpc_free_map() acquires map-\u003efl-\u003elock to safely remove the\n map node from the fl-\u003emaps list.\n\nThe resulting use-after-free manifests as:\n\n pc : fastrpc_buf_free+0x38/0x80 [fastrpc]\n lr : fastrpc_context_free+0xa8/0x1b0 [fastrpc]\n fastrpc_context_free+0xa8/0x1b0 [fastrpc]\n fastrpc_context_put_wq+0x78/0xa0 [fastrpc]\n process_one_work+0x180/0x450\n worker_thread+0x26c/0x388\n\nAdd kref-based reference counting to fastrpc_user. Have each invoke\ncontext take a reference on the user at allocation time and release it\nwhen the context is freed. Release the initial reference in\nfastrpc_device_release() at file close. Move the teardown of the user\nstructure \u2014 freeing pending contexts, maps, mmaps, and the channel\ncontext reference \u2014 into the kref release callback fastrpc_user_free(),\nso that it runs only when the last reference is dropped, regardless of\nwhether that happens at device close or after the final in-flight\ncontext completes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through local FastRPC misc-device file operations and ioctls on /dev/fastrpc-* rather than by network or physical input.\nAC:L - The attacker can create in-flight DSP invokes and race close/interruption against DSP response workqueue cleanup, and the race can be retried under attacker control.\nPR:L - No in-driver capability check gates open or invoke; in plausible Qualcomm/Android deployments an unprivileged local app can reach FastRPC directly or through a HAL-provided fd.\nUI:N - Exploitation requires only attacker-controlled local ioctls, close, and timing; no separate victim action is needed.\nS:U - The memory corruption affects the kernel driver and kernel memory within the same OS security authority, with no VM or sandbox boundary escape inherent to the bug.\nC:H - This is a kernel use-after-free of fastrpc_user reachable from deferred context cleanup, and UAF conditions can be shaped into kernel memory disclosure primitives.\nI:H - The UAF can dereference attacker-reclaimed kernel heap state through buffer/map cleanup paths, making kernel memory corruption and potential control-flow or arbitrary-write exploitation defensible.\nA:H - At minimum the stale fastrpc_user dereference can crash or oops the kernel during workqueue cleanup, causing high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:36.090Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c6e5c2be09f814377d7f1ce97370a5b7b3e02814"
},
{
"url": "https://git.kernel.org/stable/c/e1e3a05efe5954d5bad01157d79429d39a67a7ae"
},
{
"url": "https://git.kernel.org/stable/c/d42679eef34dd590b694ce3b666c5e2ba10cd4bf"
},
{
"url": "https://git.kernel.org/stable/c/df08fadcf0e5f3708365ec3b6d30b5aafd98bea1"
},
{
"url": "https://git.kernel.org/stable/c/ecea4967c2bff92c2fafbc59893f711b39f7b152"
},
{
"url": "https://git.kernel.org/stable/c/5278ccd357e0d7aeeb1e76c0f3e0e02894a9897c"
},
{
"url": "https://git.kernel.org/stable/c/fbe0947420eec18a84638d29468c2d563ce4e6a3"
},
{
"url": "https://git.kernel.org/stable/c/e85eb5feca8e254905ffa6c57a3c99c89a674a0f"
}
],
"title": "misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53161",
"datePublished": "2026-06-25T08:38:42.789Z",
"dateReserved": "2026-06-09T07:44:35.388Z",
"dateUpdated": "2026-08-05T12:33:36.090Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31552 (GCVE-0-2026-31552)
Vulnerability from cvelistv5
Published
2026-04-24 14:33
Modified
2026-08-05 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
Since upstream commit e75665dd0968 ("wifi: wlcore: ensure skb headroom
before skb_push"), wl1271_tx_allocate() and with it
wl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails.
However, in wlcore_tx_work_locked(), a return value of -EAGAIN from
wl1271_prepare_tx_frame() is interpreted as the aggregation buffer being
full. This causes the code to flush the buffer, put the skb back at the
head of the queue, and immediately retry the same skb in a tight while
loop.
Because wlcore_tx_work_locked() holds wl->mutex, and the retry happens
immediately with GFP_ATOMIC, this will result in an infinite loop and a
CPU soft lockup. Return -ENOMEM instead so the packet is dropped and
the loop terminates.
The problem was found by an experimental code review agent based on
gemini-3.1-pro while reviewing backports into v6.18.y.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 88295a55fefe5414e64293638b6f7549646e58ed Version: cd89a4656c03f8db0c57350aaec69cd3cfaa3522 Version: 745a0810dbc96a0471e5f5e627ba1e978c3116d4 Version: b167312390fdd461c81ead516f2b0b44e83a9edb Version: 71de0b6e04bbee5575caf9a1e4d424e7dcc50018 Version: 689a7980e4788e13e766763d53569fb78dea2513 Version: e75665dd096819b1184087ba5718bd93beafff51 Version: e75665dd096819b1184087ba5718bd93beafff51 Version: 5.10.250 ≤ Version: 5.15.200 ≤ Version: 6.1.163 ≤ Version: 6.6.124 ≤ Version: 6.12.70 ≤ Version: 6.18.10 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ti/wlcore/tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "980f793645540ca7a6318165cc12f49d5febeb99",
"status": "affected",
"version": "88295a55fefe5414e64293638b6f7549646e58ed",
"versionType": "git"
},
{
"lessThan": "12f9eef39e49716c763714bfda835a733d5f6dea",
"status": "affected",
"version": "cd89a4656c03f8db0c57350aaec69cd3cfaa3522",
"versionType": "git"
},
{
"lessThan": "ceb46b40b021d21911ff8608ce4ed33c1264ad2f",
"status": "affected",
"version": "745a0810dbc96a0471e5f5e627ba1e978c3116d4",
"versionType": "git"
},
{
"lessThan": "a6dc74209462c4fe5a88718d2f3a5286886081c8",
"status": "affected",
"version": "b167312390fdd461c81ead516f2b0b44e83a9edb",
"versionType": "git"
},
{
"lessThan": "cfa64e2b3717be1da7c4c1aff7268a009e8c1610",
"status": "affected",
"version": "71de0b6e04bbee5575caf9a1e4d424e7dcc50018",
"versionType": "git"
},
{
"lessThan": "46c670ff1ff466e5eccb3940f726586473dc053c",
"status": "affected",
"version": "689a7980e4788e13e766763d53569fb78dea2513",
"versionType": "git"
},
{
"lessThan": "f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c",
"status": "affected",
"version": "e75665dd096819b1184087ba5718bd93beafff51",
"versionType": "git"
},
{
"lessThan": "deb353d9bb009638b7762cae2d0b6e8fdbb41a69",
"status": "affected",
"version": "e75665dd096819b1184087ba5718bd93beafff51",
"versionType": "git"
},
{
"lessThan": "5.10.253",
"status": "affected",
"version": "5.10.250",
"versionType": "semver"
},
{
"lessThan": "5.15.203",
"status": "affected",
"version": "5.15.200",
"versionType": "semver"
},
{
"lessThan": "6.1.167",
"status": "affected",
"version": "6.1.163",
"versionType": "semver"
},
{
"lessThan": "6.6.130",
"status": "affected",
"version": "6.6.124",
"versionType": "semver"
},
{
"lessThan": "6.12.78",
"status": "affected",
"version": "6.12.70",
"versionType": "semver"
},
{
"lessThan": "6.18.20",
"status": "affected",
"version": "6.18.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ti/wlcore/tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.19"
},
{
"lessThan": "6.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.10.250",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.15.200",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "6.1.163",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "6.6.124",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.12.70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "6.18.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom\n\nSince upstream commit e75665dd0968 (\"wifi: wlcore: ensure skb headroom\nbefore skb_push\"), wl1271_tx_allocate() and with it\nwl1271_prepare_tx_frame() returns -EAGAIN if pskb_expand_head() fails.\nHowever, in wlcore_tx_work_locked(), a return value of -EAGAIN from\nwl1271_prepare_tx_frame() is interpreted as the aggregation buffer being\nfull. This causes the code to flush the buffer, put the skb back at the\nhead of the queue, and immediately retry the same skb in a tight while\nloop.\n\nBecause wlcore_tx_work_locked() holds wl-\u003emutex, and the retry happens\nimmediately with GFP_ATOMIC, this will result in an infinite loop and a\nCPU soft lockup. Return -ENOMEM instead so the packet is dropped and\nthe loop terminates.\n\nThe problem was found by an experimental code review agent based on\ngemini-3.1-pro while reviewing backports into v6.18.y."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Remote network traffic can cause an affected wlcore-backed host or embedded device to transmit packets through the vulnerable TX path, and an adjacent WiFi attacker can also trigger AP/P2P management/data transmissions. Scoring uses the highest reasonable deployment where the device is reachable over IP via WiFi.\nAC:L - Once `pskb_expand_head()` fails for an skb with insufficient headroom, the erroneous `-EAGAIN` handling deterministically requeues and immediately retries the same skb in a tight loop. There is no race to win, and traffic flooding can sustain the TX/allocation pressure.\nPR:N - An attacker does not need local credentials to induce network or WiFi-originated transmissions in a reachable AP/station/embedded deployment. The vulnerable driver path itself has no authentication or privilege check once packets are queued for transmission.\nUI:N - No victim user action is required after the affected WiFi interface is operating. Attacker-supplied traffic can trigger the transmit path automatically.\nS:U - The impact is confined to the same kernel and device security authority. There is no VM, IOMMU, or separate security-scope boundary crossing.\nC:N - The fixed bug is an error-code confusion that causes an infinite retry loop after allocation failure. The failing `pskb_expand_head()` leaves the skb unmodified and does not provide an information disclosure primitive.\nI:N - The bug does not corrupt memory or modify attacker-chosen data; it requeues the same skb and spins. No arbitrary write or control-flow primitive is exposed by this issue.\nA:H - The loop runs immediately under `wl-\u003emutex` with `GFP_ATOMIC` retry and can cause a CPU soft lockup. This is a kernel-level availability failure and can hang or severely degrade affected systems."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:23:26.516Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/980f793645540ca7a6318165cc12f49d5febeb99"
},
{
"url": "https://git.kernel.org/stable/c/12f9eef39e49716c763714bfda835a733d5f6dea"
},
{
"url": "https://git.kernel.org/stable/c/ceb46b40b021d21911ff8608ce4ed33c1264ad2f"
},
{
"url": "https://git.kernel.org/stable/c/a6dc74209462c4fe5a88718d2f3a5286886081c8"
},
{
"url": "https://git.kernel.org/stable/c/cfa64e2b3717be1da7c4c1aff7268a009e8c1610"
},
{
"url": "https://git.kernel.org/stable/c/46c670ff1ff466e5eccb3940f726586473dc053c"
},
{
"url": "https://git.kernel.org/stable/c/f2c06d718a7b85cbc59ceaa2ff3f46b178ac709c"
},
{
"url": "https://git.kernel.org/stable/c/deb353d9bb009638b7762cae2d0b6e8fdbb41a69"
}
],
"title": "wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31552",
"datePublished": "2026-04-24T14:33:19.065Z",
"dateReserved": "2026-03-09T15:48:24.115Z",
"dateUpdated": "2026-08-05T12:23:26.516Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46161 (GCVE-0-2026-46161)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-06-14 17:59
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
md/raid10: fix divide-by-zero in setup_geo() with zero far_copies
setup_geo() extracts near_copies (nc) and far_copies (fc) from the
user-provided layout parameter without checking for zero. When fc=0
with the "improved" far set layout selected, 'geo->far_set_size =
disks / fc' triggers a divide-by-zero.
Validate nc and fc immediately after extraction, returning -1 if
either is zero.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 475901aff15841fb0a81e7546517407779a9b061 Version: 475901aff15841fb0a81e7546517407779a9b061 Version: 475901aff15841fb0a81e7546517407779a9b061 Version: 475901aff15841fb0a81e7546517407779a9b061 Version: 475901aff15841fb0a81e7546517407779a9b061 Version: 475901aff15841fb0a81e7546517407779a9b061 Version: 475901aff15841fb0a81e7546517407779a9b061 Version: 475901aff15841fb0a81e7546517407779a9b061 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/raid10.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0b43a70394ce492274e67463326be03e0a9897c5",
"status": "affected",
"version": "475901aff15841fb0a81e7546517407779a9b061",
"versionType": "git"
},
{
"lessThan": "c716ab3034f84f8a6c226814247b8c5ac9f95da1",
"status": "affected",
"version": "475901aff15841fb0a81e7546517407779a9b061",
"versionType": "git"
},
{
"lessThan": "553e32adfa1a96b217651139a3f8c3b92b9984ac",
"status": "affected",
"version": "475901aff15841fb0a81e7546517407779a9b061",
"versionType": "git"
},
{
"lessThan": "4af2e558e6fdfb972c61350653fd55d1f62b60a5",
"status": "affected",
"version": "475901aff15841fb0a81e7546517407779a9b061",
"versionType": "git"
},
{
"lessThan": "9d8e03b9a2b1e8ce5c198bf3a409a629f4d02cda",
"status": "affected",
"version": "475901aff15841fb0a81e7546517407779a9b061",
"versionType": "git"
},
{
"lessThan": "913d556e4bd1b56ed822815655b82c7bb54edc51",
"status": "affected",
"version": "475901aff15841fb0a81e7546517407779a9b061",
"versionType": "git"
},
{
"lessThan": "f9ddb621b2325eb69c95692958daf2bab4dea2c4",
"status": "affected",
"version": "475901aff15841fb0a81e7546517407779a9b061",
"versionType": "git"
},
{
"lessThan": "9aa6d860b0930e2f72795665c42c44252a558a0c",
"status": "affected",
"version": "475901aff15841fb0a81e7546517407779a9b061",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/raid10.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix divide-by-zero in setup_geo() with zero far_copies\n\nsetup_geo() extracts near_copies (nc) and far_copies (fc) from the\nuser-provided layout parameter without checking for zero. When fc=0\nwith the \"improved\" far set layout selected, \u0027geo-\u003efar_set_size =\ndisks / fc\u0027 triggers a divide-by-zero.\n\nValidate nc and fc immediately after extraction, returning -1 if\neither is zero."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:59:07.789Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0b43a70394ce492274e67463326be03e0a9897c5"
},
{
"url": "https://git.kernel.org/stable/c/c716ab3034f84f8a6c226814247b8c5ac9f95da1"
},
{
"url": "https://git.kernel.org/stable/c/553e32adfa1a96b217651139a3f8c3b92b9984ac"
},
{
"url": "https://git.kernel.org/stable/c/4af2e558e6fdfb972c61350653fd55d1f62b60a5"
},
{
"url": "https://git.kernel.org/stable/c/9d8e03b9a2b1e8ce5c198bf3a409a629f4d02cda"
},
{
"url": "https://git.kernel.org/stable/c/913d556e4bd1b56ed822815655b82c7bb54edc51"
},
{
"url": "https://git.kernel.org/stable/c/f9ddb621b2325eb69c95692958daf2bab4dea2c4"
},
{
"url": "https://git.kernel.org/stable/c/9aa6d860b0930e2f72795665c42c44252a558a0c"
}
],
"title": "md/raid10: fix divide-by-zero in setup_geo() with zero far_copies",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46161",
"datePublished": "2026-05-28T09:36:16.428Z",
"dateReserved": "2026-05-13T15:03:33.102Z",
"dateUpdated": "2026-06-14T17:59:07.789Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52948 (GCVE-0-2026-52948)
Vulnerability from cvelistv5
Published
2026-06-24 16:26
Modified
2026-06-29 04:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
While fuzzing with Syzkaller, a persistent `schedule_timeout: wrong
timeout value` warning was observed, accompanied by SMBus controller
state machine corruption.
The I2C_TIMEOUT ioctl accepts a user-provided timeout in multiples of
10 ms. The user argument is checked against INT_MAX, but it is
subsequently multiplied by 10 before being passed to msecs_to_jiffies().
A malicious user can pass a large value (e.g., 429496729) that passes
the `arg > INT_MAX` check but overflows when multiplied by 10. This
results in a truncated 32-bit unsigned value that bypasses the
internal `(int)m < 0` check in `msecs_to_jiffies()`.
The truncated value is then assigned to `client->adapter->timeout`
(a signed 32-bit int), which is reinterpreted as a negative number.
When passed to wait_for_completion_timeout(), this negative value
undergoes sign extension to a 64-bit unsigned long, triggering the
`schedule_timeout` warning and causing premature returns. This leaves
the SMBus state machine in an unrecoverable state, constituting a
local Denial of Service (DoS).
Fix this by bounding the user argument to `INT_MAX / 10`.
[wsa: move the comment as well]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d Version: cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d Version: cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d Version: cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d Version: cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d Version: cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d Version: cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d Version: cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/i2c/i2c-dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e9ffd5f5050fbb199d270a85614cd27ebed6fbac",
"status": "affected",
"version": "cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d",
"versionType": "git"
},
{
"lessThan": "0b88ecfbc9dc33b4db8836c37b50cf174e6c0691",
"status": "affected",
"version": "cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d",
"versionType": "git"
},
{
"lessThan": "943e318eedbeaeea08ece3f5dd44c982f4ed2ef5",
"status": "affected",
"version": "cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d",
"versionType": "git"
},
{
"lessThan": "aa6ef734016912653a909477fb30aeb66c98b3a2",
"status": "affected",
"version": "cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d",
"versionType": "git"
},
{
"lessThan": "ff02add34ffd03449b8115904ebe2ec4fed022d4",
"status": "affected",
"version": "cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d",
"versionType": "git"
},
{
"lessThan": "ffbcf31f032eb454ebfd29309f51366fe57f4ac4",
"status": "affected",
"version": "cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d",
"versionType": "git"
},
{
"lessThan": "4576621dc6577f21a032acfd16c3ad61907a5ea7",
"status": "affected",
"version": "cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d",
"versionType": "git"
},
{
"lessThan": "617eb7c0961a8dfcfc811844a6396e406b2923ea",
"status": "affected",
"version": "cd97f39b7cdf1c8a9c9f52865eec795b7f0c811d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/i2c/i2c-dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl\n\nWhile fuzzing with Syzkaller, a persistent `schedule_timeout: wrong\ntimeout value` warning was observed, accompanied by SMBus controller\nstate machine corruption.\n\nThe I2C_TIMEOUT ioctl accepts a user-provided timeout in multiples of\n10 ms. The user argument is checked against INT_MAX, but it is\nsubsequently multiplied by 10 before being passed to msecs_to_jiffies().\n\nA malicious user can pass a large value (e.g., 429496729) that passes\nthe `arg \u003e INT_MAX` check but overflows when multiplied by 10. This\nresults in a truncated 32-bit unsigned value that bypasses the\ninternal `(int)m \u003c 0` check in `msecs_to_jiffies()`.\n\nThe truncated value is then assigned to `client-\u003eadapter-\u003etimeout`\n(a signed 32-bit int), which is reinterpreted as a negative number.\nWhen passed to wait_for_completion_timeout(), this negative value\nundergoes sign extension to a 64-bit unsigned long, triggering the\n`schedule_timeout` warning and causing premature returns. This leaves\nthe SMBus state machine in an unrecoverable state, constituting a\nlocal Denial of Service (DoS).\n\nFix this by bounding the user argument to `INT_MAX / 10`.\n\n[wsa: move the comment as well]"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T04:18:39.866Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e9ffd5f5050fbb199d270a85614cd27ebed6fbac"
},
{
"url": "https://git.kernel.org/stable/c/0b88ecfbc9dc33b4db8836c37b50cf174e6c0691"
},
{
"url": "https://git.kernel.org/stable/c/943e318eedbeaeea08ece3f5dd44c982f4ed2ef5"
},
{
"url": "https://git.kernel.org/stable/c/aa6ef734016912653a909477fb30aeb66c98b3a2"
},
{
"url": "https://git.kernel.org/stable/c/ff02add34ffd03449b8115904ebe2ec4fed022d4"
},
{
"url": "https://git.kernel.org/stable/c/ffbcf31f032eb454ebfd29309f51366fe57f4ac4"
},
{
"url": "https://git.kernel.org/stable/c/4576621dc6577f21a032acfd16c3ad61907a5ea7"
},
{
"url": "https://git.kernel.org/stable/c/617eb7c0961a8dfcfc811844a6396e406b2923ea"
}
],
"title": "i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52948",
"datePublished": "2026-06-24T16:26:05.719Z",
"dateReserved": "2026-06-09T07:44:35.371Z",
"dateUpdated": "2026-06-29T04:18:39.866Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53325 (GCVE-0-2026-53325)
Vulnerability from cvelistv5
Published
2026-06-29 04:53
Modified
2026-08-17 04:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
agp/amd64: Fix broken error propagation in agp_amd64_probe()
A NULL pointer dereference was observed in the AMD64 AGP driver when
running in a virtualized environment (e.g. qemu/kvm) without a physical
AMD northbridge. The crash occurs in amd64_fetch_size() when attempting
to dereference the pointer returned by node_to_amd_nb(0).
The root cause of this crash is broken error propagation in
agp_amd64_probe(): When no AMD northbridges are found, cache_nbs()
correctly returns -ENODEV. However, the probe function erroneously
checks the return value against exactly -1, rather than < 0.
As a result, the hardware absence error is masked, allowing the driver
to improperly proceed with initialization. It eventually calls
agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware
does not exist, node_to_amd_nb(0) returns NULL, leading to a General
Protection Fault (GPF) when accessing its ->misc member.
Fix the issue by correcting the error check in agp_amd64_probe() to
abort properly when cache_nbs() returns any negative error code. This
prevents the driver from erroneously proceeding without hardware, thereby
avoiding the subsequent NULL pointer dereference at its source.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/agp/amd64-agp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ce800993af477fc24187349c6a20d3073140b759",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
},
{
"lessThan": "1d7d45050e14083c1de1460c93f4063c1f0bca7b",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
},
{
"lessThan": "3e844a63668d1c3d10a9d347d7ebf161b2f91c84",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
},
{
"lessThan": "eb045714bc6a2bbb0befb7a31b996a196e188869",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
},
{
"lessThan": "564b3b3f6565313eb6fa5355ffd037d6fb27897f",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
},
{
"lessThan": "53483a9f4ee9eeb18aa866ec16cce79e136987e1",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
},
{
"lessThan": "0aa9b27c454c53074cde592eaceb442d30341585",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
},
{
"lessThan": "cefe535a60a2e00e09f4b2689b0c8ffc6912459a",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
},
{
"lessThan": "b08472db93b1ccff84a7adec5779d47f0e9d3a30",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/agp/amd64-agp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"lessThan": "2.6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.14",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.2",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nagp/amd64: Fix broken error propagation in agp_amd64_probe()\n\nA NULL pointer dereference was observed in the AMD64 AGP driver when\nrunning in a virtualized environment (e.g. qemu/kvm) without a physical\nAMD northbridge. The crash occurs in amd64_fetch_size() when attempting\nto dereference the pointer returned by node_to_amd_nb(0).\n\nThe root cause of this crash is broken error propagation in\nagp_amd64_probe(): When no AMD northbridges are found, cache_nbs()\ncorrectly returns -ENODEV. However, the probe function erroneously\nchecks the return value against exactly -1, rather than \u003c 0.\n\nAs a result, the hardware absence error is masked, allowing the driver\nto improperly proceed with initialization. It eventually calls\nagp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware\ndoes not exist, node_to_amd_nb(0) returns NULL, leading to a General\nProtection Fault (GPF) when accessing its -\u003emisc member.\n\nFix the issue by correcting the error check in agp_amd64_probe() to\nabort properly when cache_nbs() returns any negative error code. This\nprevents the driver from erroneously proceeding without hardware, thereby\navoiding the subsequent NULL pointer dereference at its source."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:26.049Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ce800993af477fc24187349c6a20d3073140b759"
},
{
"url": "https://git.kernel.org/stable/c/1d7d45050e14083c1de1460c93f4063c1f0bca7b"
},
{
"url": "https://git.kernel.org/stable/c/3e844a63668d1c3d10a9d347d7ebf161b2f91c84"
},
{
"url": "https://git.kernel.org/stable/c/eb045714bc6a2bbb0befb7a31b996a196e188869"
},
{
"url": "https://git.kernel.org/stable/c/564b3b3f6565313eb6fa5355ffd037d6fb27897f"
},
{
"url": "https://git.kernel.org/stable/c/53483a9f4ee9eeb18aa866ec16cce79e136987e1"
},
{
"url": "https://git.kernel.org/stable/c/0aa9b27c454c53074cde592eaceb442d30341585"
},
{
"url": "https://git.kernel.org/stable/c/cefe535a60a2e00e09f4b2689b0c8ffc6912459a"
},
{
"url": "https://git.kernel.org/stable/c/b08472db93b1ccff84a7adec5779d47f0e9d3a30"
}
],
"title": "agp/amd64: Fix broken error propagation in agp_amd64_probe()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53325",
"datePublished": "2026-06-29T04:53:35.833Z",
"dateReserved": "2026-06-09T07:44:35.398Z",
"dateUpdated": "2026-08-17T04:50:26.049Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46075 (GCVE-0-2026-46075)
Vulnerability from cvelistv5
Published
2026-05-27 12:58
Modified
2026-06-14 17:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path
Unregister the hwrng to prevent new ->read() calls and flush the Atmel
I2C workqueue before teardown to prevent a potential UAF if a queued
callback runs while the device is being removed.
Drop the early return to ensure sysfs entries are removed and
->hwrng.priv is freed, preventing a memory leak.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: da001fb651b00e1deeaf24767dd691ae8152a4f5 Version: da001fb651b00e1deeaf24767dd691ae8152a4f5 Version: da001fb651b00e1deeaf24767dd691ae8152a4f5 Version: da001fb651b00e1deeaf24767dd691ae8152a4f5 Version: da001fb651b00e1deeaf24767dd691ae8152a4f5 Version: da001fb651b00e1deeaf24767dd691ae8152a4f5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/atmel-sha204a.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6dbeb0f788582e1ab5dfc3f41994eac0ec88c2b5",
"status": "affected",
"version": "da001fb651b00e1deeaf24767dd691ae8152a4f5",
"versionType": "git"
},
{
"lessThan": "c5a45d14234bf26e28a89e3a5dcc08336595cf11",
"status": "affected",
"version": "da001fb651b00e1deeaf24767dd691ae8152a4f5",
"versionType": "git"
},
{
"lessThan": "775c00d87c385b758da9504cf053acea00e2ed40",
"status": "affected",
"version": "da001fb651b00e1deeaf24767dd691ae8152a4f5",
"versionType": "git"
},
{
"lessThan": "1193c12126d39bf986a5a9214827b73707b193ab",
"status": "affected",
"version": "da001fb651b00e1deeaf24767dd691ae8152a4f5",
"versionType": "git"
},
{
"lessThan": "31901371ccd16b42d2f167b1018ba9ae8bd5a6c7",
"status": "affected",
"version": "da001fb651b00e1deeaf24767dd691ae8152a4f5",
"versionType": "git"
},
{
"lessThan": "bab1adf3b87e4bfac92c4f5963c63db434d561c1",
"status": "affected",
"version": "da001fb651b00e1deeaf24767dd691ae8152a4f5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/atmel-sha204a.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: atmel-sha204a - Fix potential UAF and memory leak in remove path\n\nUnregister the hwrng to prevent new -\u003eread() calls and flush the Atmel\nI2C workqueue before teardown to prevent a potential UAF if a queued\ncallback runs while the device is being removed.\n\nDrop the early return to ensure sysfs entries are removed and\n-\u003ehwrng.priv is freed, preventing a memory leak."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:52:29.232Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6dbeb0f788582e1ab5dfc3f41994eac0ec88c2b5"
},
{
"url": "https://git.kernel.org/stable/c/c5a45d14234bf26e28a89e3a5dcc08336595cf11"
},
{
"url": "https://git.kernel.org/stable/c/775c00d87c385b758da9504cf053acea00e2ed40"
},
{
"url": "https://git.kernel.org/stable/c/1193c12126d39bf986a5a9214827b73707b193ab"
},
{
"url": "https://git.kernel.org/stable/c/31901371ccd16b42d2f167b1018ba9ae8bd5a6c7"
},
{
"url": "https://git.kernel.org/stable/c/bab1adf3b87e4bfac92c4f5963c63db434d561c1"
}
],
"title": "crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46075",
"datePublished": "2026-05-27T12:58:07.080Z",
"dateReserved": "2026-05-13T15:03:33.096Z",
"dateUpdated": "2026-06-14T17:52:29.232Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31438 (GCVE-0-2026-31438)
Vulnerability from cvelistv5
Published
2026-04-22 13:53
Modified
2026-05-11 22:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators
When a process crashes and the kernel writes a core dump to a 9P
filesystem, __kernel_write() creates an ITER_KVEC iterator. This
iterator reaches netfs_limit_iter() via netfs_unbuffered_write(), which
only handles ITER_FOLIOQ, ITER_BVEC and ITER_XARRAY iterator types,
hitting the BUG() for any other type.
Fix this by adding netfs_limit_kvec() following the same pattern as
netfs_limit_bvec(), since both kvec and bvec are simple segment arrays
with pointer and length fields. Dispatch it from netfs_limit_iter() when
the iterator type is ITER_KVEC.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/netfs/iterator.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "18c2e20b42dd21db599e42d05ddaeeb647b2bb6d",
"status": "affected",
"version": "cae932d3aee55035a54415dcea8e7ecf2ec469b5",
"versionType": "git"
},
{
"lessThan": "4bc2d72c7695cedf6d4e1a558924903c2b28a78e",
"status": "affected",
"version": "cae932d3aee55035a54415dcea8e7ecf2ec469b5",
"versionType": "git"
},
{
"lessThan": "00d6df7115f6972370974212de9088087820802e",
"status": "affected",
"version": "cae932d3aee55035a54415dcea8e7ecf2ec469b5",
"versionType": "git"
},
{
"lessThan": "67e467a11f62ff64ad219dc6aa5459e132c79d14",
"status": "affected",
"version": "cae932d3aee55035a54415dcea8e7ecf2ec469b5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/netfs/iterator.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators\n\nWhen a process crashes and the kernel writes a core dump to a 9P\nfilesystem, __kernel_write() creates an ITER_KVEC iterator. This\niterator reaches netfs_limit_iter() via netfs_unbuffered_write(), which\nonly handles ITER_FOLIOQ, ITER_BVEC and ITER_XARRAY iterator types,\nhitting the BUG() for any other type.\n\nFix this by adding netfs_limit_kvec() following the same pattern as\nnetfs_limit_bvec(), since both kvec and bvec are simple segment arrays\nwith pointer and length fields. Dispatch it from netfs_limit_iter() when\nthe iterator type is ITER_KVEC."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:08:42.611Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/18c2e20b42dd21db599e42d05ddaeeb647b2bb6d"
},
{
"url": "https://git.kernel.org/stable/c/4bc2d72c7695cedf6d4e1a558924903c2b28a78e"
},
{
"url": "https://git.kernel.org/stable/c/00d6df7115f6972370974212de9088087820802e"
},
{
"url": "https://git.kernel.org/stable/c/67e467a11f62ff64ad219dc6aa5459e132c79d14"
}
],
"title": "netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31438",
"datePublished": "2026-04-22T13:53:37.053Z",
"dateReserved": "2026-03-09T15:48:24.090Z",
"dateUpdated": "2026-05-11T22:08:42.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43337 (GCVE-0-2026-43337)
Vulnerability from cvelistv5
Published
2026-05-08 13:31
Modified
2026-05-23 16:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()
dcn401_init_hw() assumes that update_bw_bounding_box() is valid when
entering the update path. However, the existing condition:
((!fams2_enable && update_bw_bounding_box) || freq_changed)
does not guarantee this, as the freq_changed branch can evaluate to true
independently of the callback pointer.
This can result in calling update_bw_bounding_box() when it is NULL.
Fix this by separating the update condition from the pointer checks and
ensuring the callback, dc->clk_mgr, and bw_params are validated before
use.
Fixes the below:
../dc/hwss/dcn401/dcn401_hwseq.c:367 dcn401_init_hw() error: we previously assumed 'dc->res_pool->funcs->update_bw_bounding_box' could be null (see line 362)
(cherry picked from commit 86117c5ab42f21562fedb0a64bffea3ee5fcd477)
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "10c13c111d0d7f8e101c742feff264fc98e3f9f7",
"status": "affected",
"version": "ca0fb243c3bb53dbbd71d16c76f319bf923ee3d4",
"versionType": "git"
},
{
"lessThan": "2d4a6f0702c5211e0be8b688c5fc24f082ec74d6",
"status": "affected",
"version": "ca0fb243c3bb53dbbd71d16c76f319bf923ee3d4",
"versionType": "git"
},
{
"lessThan": "e927b36ae18b66b49219eaa9f46edc7b4fdbb25e",
"status": "affected",
"version": "ca0fb243c3bb53dbbd71d16c76f319bf923ee3d4",
"versionType": "git"
},
{
"status": "affected",
"version": "e13689793b9c0e7b5749954e77f5f85e68fe7138",
"versionType": "git"
},
{
"lessThan": "6.12",
"status": "affected",
"version": "6.11.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()\n\ndcn401_init_hw() assumes that update_bw_bounding_box() is valid when\nentering the update path. However, the existing condition:\n\n ((!fams2_enable \u0026\u0026 update_bw_bounding_box) || freq_changed)\n\ndoes not guarantee this, as the freq_changed branch can evaluate to true\nindependently of the callback pointer.\n\nThis can result in calling update_bw_bounding_box() when it is NULL.\n\nFix this by separating the update condition from the pointer checks and\nensuring the callback, dc-\u003eclk_mgr, and bw_params are validated before\nuse.\n\nFixes the below:\n../dc/hwss/dcn401/dcn401_hwseq.c:367 dcn401_init_hw() error: we previously assumed \u0027dc-\u003eres_pool-\u003efuncs-\u003eupdate_bw_bounding_box\u0027 could be null (see line 362)\n\n(cherry picked from commit 86117c5ab42f21562fedb0a64bffea3ee5fcd477)"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:06:47.060Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/10c13c111d0d7f8e101c742feff264fc98e3f9f7"
},
{
"url": "https://git.kernel.org/stable/c/2d4a6f0702c5211e0be8b688c5fc24f082ec74d6"
},
{
"url": "https://git.kernel.org/stable/c/e927b36ae18b66b49219eaa9f46edc7b4fdbb25e"
}
],
"title": "drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43337",
"datePublished": "2026-05-08T13:31:22.967Z",
"dateReserved": "2026-05-01T14:12:56.002Z",
"dateUpdated": "2026-05-23T16:06:47.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53245 (GCVE-0-2026-53245)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-06-25 08:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr
In mrp_pdu_parse_vecattr(), vector attribute events are encoded three
per byte and valen tracks the number of events left to process.
The parser decrements valen after processing the first and second events
from each event byte, but not after processing the third one. When valen
is exactly a multiple of three, the loop continues after the last valid
event and consumes the next byte as a new event byte, applying a
spurious event to the MRP applicant state.
Additionally, when valen is zero the parser unconditionally consumes
attrlen bytes as FirstValue and advances the offset, even though per
IEEE 802.1ak a VectorAttribute with only a LeaveAllEvent has valen of
zero and no FirstValue or Vector fields. This corrupts the offset for
subsequent PDU parsing.
Also, when valen exceeds three the loop crosses byte boundaries but
the attribute value is not incremented between the last event of one
byte and the first event of the next. This causes the first event of
the next byte to use the same attribute value as the third event
rather than the next consecutive value.
Decrement valen after processing the third event, skip FirstValue
consumption when valen is zero, and increment the attribute value at
the end of each loop iteration.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: febf018d22347b5df94066bca05d0c11a84e839d Version: febf018d22347b5df94066bca05d0c11a84e839d Version: febf018d22347b5df94066bca05d0c11a84e839d Version: febf018d22347b5df94066bca05d0c11a84e839d Version: febf018d22347b5df94066bca05d0c11a84e839d Version: febf018d22347b5df94066bca05d0c11a84e839d Version: febf018d22347b5df94066bca05d0c11a84e839d Version: febf018d22347b5df94066bca05d0c11a84e839d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/802/mrp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae65714d96f68bb252eb20085320bdaacab36c00",
"status": "affected",
"version": "febf018d22347b5df94066bca05d0c11a84e839d",
"versionType": "git"
},
{
"lessThan": "36d259711872e3b2f6cd76a4d270c21931c0f35f",
"status": "affected",
"version": "febf018d22347b5df94066bca05d0c11a84e839d",
"versionType": "git"
},
{
"lessThan": "cc98717e591a963a616fdf15ecf48eefaf45d758",
"status": "affected",
"version": "febf018d22347b5df94066bca05d0c11a84e839d",
"versionType": "git"
},
{
"lessThan": "6d6e42e8e17f18d61327f8653479c5b5e161ae1d",
"status": "affected",
"version": "febf018d22347b5df94066bca05d0c11a84e839d",
"versionType": "git"
},
{
"lessThan": "fd9c3a47c670bec6b18f44454cea023f93b5adb3",
"status": "affected",
"version": "febf018d22347b5df94066bca05d0c11a84e839d",
"versionType": "git"
},
{
"lessThan": "42446ca0f3570663e87183c065e0b4def52dfba2",
"status": "affected",
"version": "febf018d22347b5df94066bca05d0c11a84e839d",
"versionType": "git"
},
{
"lessThan": "6eea6494e542a03cdf755a593b7d74f3f7c260fd",
"status": "affected",
"version": "febf018d22347b5df94066bca05d0c11a84e839d",
"versionType": "git"
},
{
"lessThan": "7561c7fbc694308da73300f036719e63e42bf0b4",
"status": "affected",
"version": "febf018d22347b5df94066bca05d0c11a84e839d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/802/mrp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr\n\nIn mrp_pdu_parse_vecattr(), vector attribute events are encoded three\nper byte and valen tracks the number of events left to process.\n\nThe parser decrements valen after processing the first and second events\nfrom each event byte, but not after processing the third one. When valen\nis exactly a multiple of three, the loop continues after the last valid\nevent and consumes the next byte as a new event byte, applying a\nspurious event to the MRP applicant state.\n\nAdditionally, when valen is zero the parser unconditionally consumes\nattrlen bytes as FirstValue and advances the offset, even though per\nIEEE 802.1ak a VectorAttribute with only a LeaveAllEvent has valen of\nzero and no FirstValue or Vector fields. This corrupts the offset for\nsubsequent PDU parsing.\n\nAlso, when valen exceeds three the loop crosses byte boundaries but\nthe attribute value is not incremented between the last event of one\nbyte and the first event of the next. This causes the first event of\nthe next byte to use the same attribute value as the third event\nrather than the next consecutive value.\n\nDecrement valen after processing the third event, skip FirstValue\nconsumption when valen is zero, and increment the attribute value at\nthe end of each loop iteration."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:39:39.108Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae65714d96f68bb252eb20085320bdaacab36c00"
},
{
"url": "https://git.kernel.org/stable/c/36d259711872e3b2f6cd76a4d270c21931c0f35f"
},
{
"url": "https://git.kernel.org/stable/c/cc98717e591a963a616fdf15ecf48eefaf45d758"
},
{
"url": "https://git.kernel.org/stable/c/6d6e42e8e17f18d61327f8653479c5b5e161ae1d"
},
{
"url": "https://git.kernel.org/stable/c/fd9c3a47c670bec6b18f44454cea023f93b5adb3"
},
{
"url": "https://git.kernel.org/stable/c/42446ca0f3570663e87183c065e0b4def52dfba2"
},
{
"url": "https://git.kernel.org/stable/c/6eea6494e542a03cdf755a593b7d74f3f7c260fd"
},
{
"url": "https://git.kernel.org/stable/c/7561c7fbc694308da73300f036719e63e42bf0b4"
}
],
"title": "net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53245",
"datePublished": "2026-06-25T08:39:39.108Z",
"dateReserved": "2026-06-09T07:44:35.393Z",
"dateUpdated": "2026-06-25T08:39:39.108Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46231 (GCVE-0-2026-46231)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-06-14 18:04
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: bla: put backbone reference on failed claim hash insert
When batadv_bla_add_claim() fails to insert a new claim into the hash, it
leaked a reference to the backbone_gw for which the claim was intended.
Call batadv_backbone_gw_put() on the error path to release the reference
and avoid leaking the backbone_gw object.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3db0decf1185357d6ab2256d0dede1ca9efda03d Version: 3db0decf1185357d6ab2256d0dede1ca9efda03d Version: 3db0decf1185357d6ab2256d0dede1ca9efda03d Version: 3db0decf1185357d6ab2256d0dede1ca9efda03d Version: 3db0decf1185357d6ab2256d0dede1ca9efda03d Version: 3db0decf1185357d6ab2256d0dede1ca9efda03d Version: 3db0decf1185357d6ab2256d0dede1ca9efda03d Version: 3db0decf1185357d6ab2256d0dede1ca9efda03d Version: 3fdd337ac0b277a1f40aa73b35283520f426e517 Version: 485eedfabc2aefac8f09f98a82ba1c1e3e202a6d Version: 3.16.39 ≤ Version: 4.4.217 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/bridge_loop_avoidance.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6c8b68a7ed667a63aa603ba4d3a7088be143007e",
"status": "affected",
"version": "3db0decf1185357d6ab2256d0dede1ca9efda03d",
"versionType": "git"
},
{
"lessThan": "769f413d374ff2b6ff6d8d8c37b4c1178e6cdf14",
"status": "affected",
"version": "3db0decf1185357d6ab2256d0dede1ca9efda03d",
"versionType": "git"
},
{
"lessThan": "2888c9a154123db0254ae4fb9bea570c7e1f2e06",
"status": "affected",
"version": "3db0decf1185357d6ab2256d0dede1ca9efda03d",
"versionType": "git"
},
{
"lessThan": "65419eb4259a26a3cd3f56fa0e3b3c113bf8c256",
"status": "affected",
"version": "3db0decf1185357d6ab2256d0dede1ca9efda03d",
"versionType": "git"
},
{
"lessThan": "fd0ca034c1e71ca7613cde9dd892836b2c2831bd",
"status": "affected",
"version": "3db0decf1185357d6ab2256d0dede1ca9efda03d",
"versionType": "git"
},
{
"lessThan": "0baf4b659cdc7305cf685b5a5d60f9e3816ab5d0",
"status": "affected",
"version": "3db0decf1185357d6ab2256d0dede1ca9efda03d",
"versionType": "git"
},
{
"lessThan": "7cccf4eb4f96d3c3af91a00b7a9caa652439542e",
"status": "affected",
"version": "3db0decf1185357d6ab2256d0dede1ca9efda03d",
"versionType": "git"
},
{
"lessThan": "ba9d20ee9076dac32c371116bacbe72480eb356c",
"status": "affected",
"version": "3db0decf1185357d6ab2256d0dede1ca9efda03d",
"versionType": "git"
},
{
"status": "affected",
"version": "3fdd337ac0b277a1f40aa73b35283520f426e517",
"versionType": "git"
},
{
"status": "affected",
"version": "485eedfabc2aefac8f09f98a82ba1c1e3e202a6d",
"versionType": "git"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.39",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.217",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/bridge_loop_avoidance.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.217",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: bla: put backbone reference on failed claim hash insert\n\nWhen batadv_bla_add_claim() fails to insert a new claim into the hash, it\nleaked a reference to the backbone_gw for which the claim was intended.\nCall batadv_backbone_gw_put() on the error path to release the reference\nand avoid leaking the backbone_gw object."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:04:27.129Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6c8b68a7ed667a63aa603ba4d3a7088be143007e"
},
{
"url": "https://git.kernel.org/stable/c/769f413d374ff2b6ff6d8d8c37b4c1178e6cdf14"
},
{
"url": "https://git.kernel.org/stable/c/2888c9a154123db0254ae4fb9bea570c7e1f2e06"
},
{
"url": "https://git.kernel.org/stable/c/65419eb4259a26a3cd3f56fa0e3b3c113bf8c256"
},
{
"url": "https://git.kernel.org/stable/c/fd0ca034c1e71ca7613cde9dd892836b2c2831bd"
},
{
"url": "https://git.kernel.org/stable/c/0baf4b659cdc7305cf685b5a5d60f9e3816ab5d0"
},
{
"url": "https://git.kernel.org/stable/c/7cccf4eb4f96d3c3af91a00b7a9caa652439542e"
},
{
"url": "https://git.kernel.org/stable/c/ba9d20ee9076dac32c371116bacbe72480eb356c"
}
],
"title": "batman-adv: bla: put backbone reference on failed claim hash insert",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46231",
"datePublished": "2026-05-28T09:40:53.471Z",
"dateReserved": "2026-05-13T15:03:33.106Z",
"dateUpdated": "2026-06-14T18:04:27.129Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43149 (GCVE-0-2026-43149)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()
The priv->rx_buffer and priv->tx_buffer are alloc'd together as
contiguous buffers in uhdlc_init() but freed as two buffers in
uhdlc_memclean().
Change the cleanup to only call dma_free_coherent() once on the whole
buffer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c19b6d246a35627c3a69b2fa6bdece212b48214b Version: c19b6d246a35627c3a69b2fa6bdece212b48214b Version: c19b6d246a35627c3a69b2fa6bdece212b48214b Version: c19b6d246a35627c3a69b2fa6bdece212b48214b Version: c19b6d246a35627c3a69b2fa6bdece212b48214b Version: c19b6d246a35627c3a69b2fa6bdece212b48214b Version: c19b6d246a35627c3a69b2fa6bdece212b48214b Version: c19b6d246a35627c3a69b2fa6bdece212b48214b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wan/fsl_ucc_hdlc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6496fb830cbb741d831225cc4e7e5601c6e42970",
"status": "affected",
"version": "c19b6d246a35627c3a69b2fa6bdece212b48214b",
"versionType": "git"
},
{
"lessThan": "ba8d8429e5d6c36f9a654d2b96b9e043c43d92b4",
"status": "affected",
"version": "c19b6d246a35627c3a69b2fa6bdece212b48214b",
"versionType": "git"
},
{
"lessThan": "011ae5dd84dc9f05eb9b8e1adff44252ac776e7b",
"status": "affected",
"version": "c19b6d246a35627c3a69b2fa6bdece212b48214b",
"versionType": "git"
},
{
"lessThan": "0f85a9655445e67bb0238cfc983d7c383b54938e",
"status": "affected",
"version": "c19b6d246a35627c3a69b2fa6bdece212b48214b",
"versionType": "git"
},
{
"lessThan": "84b932bc9899d43e5829e6cf088b72d73a922b2b",
"status": "affected",
"version": "c19b6d246a35627c3a69b2fa6bdece212b48214b",
"versionType": "git"
},
{
"lessThan": "d8a522085d09b30aba1016daf1dddac37c0f0285",
"status": "affected",
"version": "c19b6d246a35627c3a69b2fa6bdece212b48214b",
"versionType": "git"
},
{
"lessThan": "d68994e37ac3b285692559776e0279a88a3b5f8d",
"status": "affected",
"version": "c19b6d246a35627c3a69b2fa6bdece212b48214b",
"versionType": "git"
},
{
"lessThan": "36bd7d5deef936c4e1e3cd341598140e5c14c1d3",
"status": "affected",
"version": "c19b6d246a35627c3a69b2fa6bdece212b48214b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wan/fsl_ucc_hdlc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()\n\nThe priv-\u003erx_buffer and priv-\u003etx_buffer are alloc\u0027d together as\ncontiguous buffers in uhdlc_init() but freed as two buffers in\nuhdlc_memclean().\n\nChange the cleanup to only call dma_free_coherent() once on the whole\nbuffer."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:18:42.659Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6496fb830cbb741d831225cc4e7e5601c6e42970"
},
{
"url": "https://git.kernel.org/stable/c/ba8d8429e5d6c36f9a654d2b96b9e043c43d92b4"
},
{
"url": "https://git.kernel.org/stable/c/011ae5dd84dc9f05eb9b8e1adff44252ac776e7b"
},
{
"url": "https://git.kernel.org/stable/c/0f85a9655445e67bb0238cfc983d7c383b54938e"
},
{
"url": "https://git.kernel.org/stable/c/84b932bc9899d43e5829e6cf088b72d73a922b2b"
},
{
"url": "https://git.kernel.org/stable/c/d8a522085d09b30aba1016daf1dddac37c0f0285"
},
{
"url": "https://git.kernel.org/stable/c/d68994e37ac3b285692559776e0279a88a3b5f8d"
},
{
"url": "https://git.kernel.org/stable/c/36bd7d5deef936c4e1e3cd341598140e5c14c1d3"
}
],
"title": "net: wan/fsl_ucc_hdlc: Fix dma_free_coherent() in uhdlc_memclean()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43149",
"datePublished": "2026-05-06T11:27:31.708Z",
"dateReserved": "2026-05-01T14:12:55.989Z",
"dateUpdated": "2026-05-11T22:18:42.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53052 (GCVE-0-2026-53052)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: qcom: qdsp6: topology: check widget type before accessing data
Check widget type before accessing the private data, as this could a
virtual widget which is no associated with a dsp graph, container and
module. Accessing witout check could lead to incorrect memory access.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 36ad9bf1d93d66b901342eab9f8ed6c1537655a6 Version: 36ad9bf1d93d66b901342eab9f8ed6c1537655a6 Version: 36ad9bf1d93d66b901342eab9f8ed6c1537655a6 Version: 36ad9bf1d93d66b901342eab9f8ed6c1537655a6 Version: 36ad9bf1d93d66b901342eab9f8ed6c1537655a6 Version: 36ad9bf1d93d66b901342eab9f8ed6c1537655a6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/qcom/qdsp6/topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8e8cd78b6000c9d19db249a5a68287158f288ef3",
"status": "affected",
"version": "36ad9bf1d93d66b901342eab9f8ed6c1537655a6",
"versionType": "git"
},
{
"lessThan": "1ac96689ce2984f4f6ef8892fcb65da377408421",
"status": "affected",
"version": "36ad9bf1d93d66b901342eab9f8ed6c1537655a6",
"versionType": "git"
},
{
"lessThan": "296810e91f21a21794886c57f954495d8afd7f32",
"status": "affected",
"version": "36ad9bf1d93d66b901342eab9f8ed6c1537655a6",
"versionType": "git"
},
{
"lessThan": "a1a24d4b8c9682f9b7a9138f636ff004c721aef1",
"status": "affected",
"version": "36ad9bf1d93d66b901342eab9f8ed6c1537655a6",
"versionType": "git"
},
{
"lessThan": "6d2491a585202a967ed91f30ec5960024f2536d0",
"status": "affected",
"version": "36ad9bf1d93d66b901342eab9f8ed6c1537655a6",
"versionType": "git"
},
{
"lessThan": "d5bfdd28e0cdd45043ae6e0ac168a451d59283dc",
"status": "affected",
"version": "36ad9bf1d93d66b901342eab9f8ed6c1537655a6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/qcom/qdsp6/topology.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: qdsp6: topology: check widget type before accessing data\n\nCheck widget type before accessing the private data, as this could a\nvirtual widget which is no associated with a dsp graph, container and\nmodule. Accessing witout check could lead to incorrect memory access."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:58.030Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8e8cd78b6000c9d19db249a5a68287158f288ef3"
},
{
"url": "https://git.kernel.org/stable/c/1ac96689ce2984f4f6ef8892fcb65da377408421"
},
{
"url": "https://git.kernel.org/stable/c/296810e91f21a21794886c57f954495d8afd7f32"
},
{
"url": "https://git.kernel.org/stable/c/a1a24d4b8c9682f9b7a9138f636ff004c721aef1"
},
{
"url": "https://git.kernel.org/stable/c/6d2491a585202a967ed91f30ec5960024f2536d0"
},
{
"url": "https://git.kernel.org/stable/c/d5bfdd28e0cdd45043ae6e0ac168a451d59283dc"
}
],
"title": "ASoC: qcom: qdsp6: topology: check widget type before accessing data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53052",
"datePublished": "2026-06-24T16:29:58.030Z",
"dateReserved": "2026-06-09T07:44:35.381Z",
"dateUpdated": "2026-06-24T16:29:58.030Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46146 (GCVE-0-2026-46146)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-06-14 17:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()
The convert_chmap_v3() has a loop with its increment size of
cs_desc->wLength, but we forgot to validate cs_desc->wLength itself,
which may lead to potential endless loop by a malformed descriptor.
Add a proper size check to abort the loop for plugging the hole.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 786571b10b1ae6d90e1242848ce78ee7e1d493c4 Version: 275e37532e8ebe25e8a4069b2d9f955bfd202a46 Version: 47ab3d820cb0a502bd0074f83bb3cf7ab5d79902 Version: 1034719fdefd26caeec0a44a868bb5a412c2c1a5 Version: ae17b3b5e753efc239421d186cd1ff06e5ac296e Version: ecfd41166b72b67d3bdeb88d224ff445f6163869 Version: ecfd41166b72b67d3bdeb88d224ff445f6163869 Version: ecfd41166b72b67d3bdeb88d224ff445f6163869 Version: 799c06ad4c9c790c265e8b6b94947213f1fb389c Version: dfdcbcde5c20df878178245d4449feada7d5b201 Version: 7ef3fd250f84494fb2f7871f357808edaa1fc6ce Version: 5.10.241 ≤ Version: 5.15.190 ≤ Version: 6.1.149 ≤ Version: 6.6.103 ≤ Version: 6.12.43 ≤ Version: 5.4.297 ≤ Version: 6.15.11 ≤ Version: 6.16.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/stream.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "076d5d13eb9c1ad259a7f246149f6676c62285f9",
"status": "affected",
"version": "786571b10b1ae6d90e1242848ce78ee7e1d493c4",
"versionType": "git"
},
{
"lessThan": "316aa0b1e3c5600eae5ab876394c1ac70e6db581",
"status": "affected",
"version": "275e37532e8ebe25e8a4069b2d9f955bfd202a46",
"versionType": "git"
},
{
"lessThan": "24a40df79307ca7ca0eec0889361cf6ac146d72a",
"status": "affected",
"version": "47ab3d820cb0a502bd0074f83bb3cf7ab5d79902",
"versionType": "git"
},
{
"lessThan": "e0e3dcf48189603f3865f1a0b799b3b42baae96d",
"status": "affected",
"version": "1034719fdefd26caeec0a44a868bb5a412c2c1a5",
"versionType": "git"
},
{
"lessThan": "4e0ee232ebe3df04874125d7c7f3e6c25ea5483d",
"status": "affected",
"version": "ae17b3b5e753efc239421d186cd1ff06e5ac296e",
"versionType": "git"
},
{
"lessThan": "be09b47ed8677d76962e3240c145502e2ad9f3c8",
"status": "affected",
"version": "ecfd41166b72b67d3bdeb88d224ff445f6163869",
"versionType": "git"
},
{
"lessThan": "fa5b19ce69067874b1413f3c2027563bae8c2cb3",
"status": "affected",
"version": "ecfd41166b72b67d3bdeb88d224ff445f6163869",
"versionType": "git"
},
{
"lessThan": "6e7247d8f5fefeceb0bb9cc80a5388a636b219cd",
"status": "affected",
"version": "ecfd41166b72b67d3bdeb88d224ff445f6163869",
"versionType": "git"
},
{
"status": "affected",
"version": "799c06ad4c9c790c265e8b6b94947213f1fb389c",
"versionType": "git"
},
{
"status": "affected",
"version": "dfdcbcde5c20df878178245d4449feada7d5b201",
"versionType": "git"
},
{
"status": "affected",
"version": "7ef3fd250f84494fb2f7871f357808edaa1fc6ce",
"versionType": "git"
},
{
"lessThan": "5.10.258",
"status": "affected",
"version": "5.10.241",
"versionType": "semver"
},
{
"lessThan": "5.15.209",
"status": "affected",
"version": "5.15.190",
"versionType": "semver"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.149",
"versionType": "semver"
},
{
"lessThan": "6.6.140",
"status": "affected",
"version": "6.6.103",
"versionType": "semver"
},
{
"lessThan": "6.12.88",
"status": "affected",
"version": "6.12.43",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.297",
"versionType": "semver"
},
{
"lessThan": "6.16",
"status": "affected",
"version": "6.15.11",
"versionType": "semver"
},
{
"lessThan": "6.17",
"status": "affected",
"version": "6.16.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/stream.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10.241",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.15.190",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.149",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "6.6.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.12.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.297",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.16.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()\n\nThe convert_chmap_v3() has a loop with its increment size of\ncs_desc-\u003ewLength, but we forgot to validate cs_desc-\u003ewLength itself,\nwhich may lead to potential endless loop by a malformed descriptor.\n\nAdd a proper size check to abort the loop for plugging the hole."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:57:58.491Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/076d5d13eb9c1ad259a7f246149f6676c62285f9"
},
{
"url": "https://git.kernel.org/stable/c/316aa0b1e3c5600eae5ab876394c1ac70e6db581"
},
{
"url": "https://git.kernel.org/stable/c/24a40df79307ca7ca0eec0889361cf6ac146d72a"
},
{
"url": "https://git.kernel.org/stable/c/e0e3dcf48189603f3865f1a0b799b3b42baae96d"
},
{
"url": "https://git.kernel.org/stable/c/4e0ee232ebe3df04874125d7c7f3e6c25ea5483d"
},
{
"url": "https://git.kernel.org/stable/c/be09b47ed8677d76962e3240c145502e2ad9f3c8"
},
{
"url": "https://git.kernel.org/stable/c/fa5b19ce69067874b1413f3c2027563bae8c2cb3"
},
{
"url": "https://git.kernel.org/stable/c/6e7247d8f5fefeceb0bb9cc80a5388a636b219cd"
}
],
"title": "ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46146",
"datePublished": "2026-05-28T09:36:02.794Z",
"dateReserved": "2026-05-13T15:03:33.100Z",
"dateUpdated": "2026-06-14T17:57:58.491Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43090 (GCVE-0-2026-43090)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-05-11 22:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix refcount leak in xfrm_migrate_policy_find
syzkaller reported a memory leak in xfrm_policy_alloc:
BUG: memory leak
unreferenced object 0xffff888114d79000 (size 1024):
comm "syz.1.17", pid 931
...
xfrm_policy_alloc+0xb3/0x4b0 net/xfrm/xfrm_policy.c:432
The root cause is a double call to xfrm_pol_hold_rcu() in
xfrm_migrate_policy_find(). The lookup function already returns
a policy with held reference, making the second call redundant.
Remove the redundant xfrm_pol_hold_rcu() call to fix the refcount
imbalance and prevent the memory leak.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "21e235a36cfb6d145cefb10728f12f5dc5412f54",
"status": "affected",
"version": "563d5ca93e883b9dcb4b7dc8967ac569fd91820d",
"versionType": "git"
},
{
"lessThan": "836ee1b0426ea3db31531e9581cc32f513d24e32",
"status": "affected",
"version": "563d5ca93e883b9dcb4b7dc8967ac569fd91820d",
"versionType": "git"
},
{
"lessThan": "70c2a89a3bc207c3bfbf6f21bb439809e0a4a27a",
"status": "affected",
"version": "563d5ca93e883b9dcb4b7dc8967ac569fd91820d",
"versionType": "git"
},
{
"lessThan": "83317cce60a032c49480dcdabe146435bd689d03",
"status": "affected",
"version": "563d5ca93e883b9dcb4b7dc8967ac569fd91820d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_policy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix refcount leak in xfrm_migrate_policy_find\n\nsyzkaller reported a memory leak in xfrm_policy_alloc:\n\n BUG: memory leak\n unreferenced object 0xffff888114d79000 (size 1024):\n comm \"syz.1.17\", pid 931\n ...\n xfrm_policy_alloc+0xb3/0x4b0 net/xfrm/xfrm_policy.c:432\n\nThe root cause is a double call to xfrm_pol_hold_rcu() in\nxfrm_migrate_policy_find(). The lookup function already returns\na policy with held reference, making the second call redundant.\n\nRemove the redundant xfrm_pol_hold_rcu() call to fix the refcount\nimbalance and prevent the memory leak.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:17:32.208Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/21e235a36cfb6d145cefb10728f12f5dc5412f54"
},
{
"url": "https://git.kernel.org/stable/c/836ee1b0426ea3db31531e9581cc32f513d24e32"
},
{
"url": "https://git.kernel.org/stable/c/70c2a89a3bc207c3bfbf6f21bb439809e0a4a27a"
},
{
"url": "https://git.kernel.org/stable/c/83317cce60a032c49480dcdabe146435bd689d03"
}
],
"title": "xfrm: fix refcount leak in xfrm_migrate_policy_find",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43090",
"datePublished": "2026-05-06T07:40:23.286Z",
"dateReserved": "2026-05-01T14:12:55.984Z",
"dateUpdated": "2026-05-11T22:17:32.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43336 (GCVE-0-2026-43336)
Vulnerability from cvelistv5
Published
2026-05-08 13:31
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
lib/crypto: chacha: Zeroize permuted_state before it leaves scope
Since the ChaCha permutation is invertible, the local variable
'permuted_state' is sufficient to compute the original 'state', and thus
the key, even after the permutation has been done.
While the kernel is quite inconsistent about zeroizing secrets on the
stack (and some prominent userspace crypto libraries don't bother at all
since it's not guaranteed to work anyway), the kernel does try to do it
as a best practice, especially in cases involving the RNG.
Thus, explicitly zeroize 'permuted_state' before it goes out of scope.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c08d0e647305c3f8f640010a56c9e4bafb9488d3 Version: c08d0e647305c3f8f640010a56c9e4bafb9488d3 Version: c08d0e647305c3f8f640010a56c9e4bafb9488d3 Version: c08d0e647305c3f8f640010a56c9e4bafb9488d3 Version: c08d0e647305c3f8f640010a56c9e4bafb9488d3 Version: c08d0e647305c3f8f640010a56c9e4bafb9488d3 Version: c08d0e647305c3f8f640010a56c9e4bafb9488d3 Version: c08d0e647305c3f8f640010a56c9e4bafb9488d3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"lib/crypto/chacha-block-generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e90ee961af515a484f091678ce58a4c3f7b73b02",
"status": "affected",
"version": "c08d0e647305c3f8f640010a56c9e4bafb9488d3",
"versionType": "git"
},
{
"lessThan": "b416a4245f04a450c67a13e6d96056c37c5b33fe",
"status": "affected",
"version": "c08d0e647305c3f8f640010a56c9e4bafb9488d3",
"versionType": "git"
},
{
"lessThan": "bd62d9b44464a6c20a34a74068e7a784d0afa04a",
"status": "affected",
"version": "c08d0e647305c3f8f640010a56c9e4bafb9488d3",
"versionType": "git"
},
{
"lessThan": "066c760acead1fb743bae294dbd89f479ae43b9b",
"status": "affected",
"version": "c08d0e647305c3f8f640010a56c9e4bafb9488d3",
"versionType": "git"
},
{
"lessThan": "1d761e5a7340c46479fb2399598f331e4fe2c633",
"status": "affected",
"version": "c08d0e647305c3f8f640010a56c9e4bafb9488d3",
"versionType": "git"
},
{
"lessThan": "1933249263c3a98df79992f61a566476e4163bcc",
"status": "affected",
"version": "c08d0e647305c3f8f640010a56c9e4bafb9488d3",
"versionType": "git"
},
{
"lessThan": "91999af43ca2125e3b2c18fcfc02912ada02efc3",
"status": "affected",
"version": "c08d0e647305c3f8f640010a56c9e4bafb9488d3",
"versionType": "git"
},
{
"lessThan": "e5046823f8fa3677341b541a25af2fcb99a5b1e0",
"status": "affected",
"version": "c08d0e647305c3f8f640010a56c9e4bafb9488d3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"lib/crypto/chacha-block-generic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.169",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.135",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.169",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.135",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.82",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/crypto: chacha: Zeroize permuted_state before it leaves scope\n\nSince the ChaCha permutation is invertible, the local variable\n\u0027permuted_state\u0027 is sufficient to compute the original \u0027state\u0027, and thus\nthe key, even after the permutation has been done.\n\nWhile the kernel is quite inconsistent about zeroizing secrets on the\nstack (and some prominent userspace crypto libraries don\u0027t bother at all\nsince it\u0027s not guaranteed to work anyway), the kernel does try to do it\nas a best practice, especially in cases involving the RNG.\n\nThus, explicitly zeroize \u0027permuted_state\u0027 before it goes out of scope."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Network-facing kernel crypto users such as IPsec ESP and WireGuard can drive ChaCha/ChaCha20-Poly1305 from inbound packets into the affected generic block code. This is a reasonable deployment scenario for the affected library crypto code.\nAC:L - Triggering the affected function is deterministic once a configured network crypto endpoint processes a packet; there is no race or fragile heap/layout condition in the bug mechanism. When uncertain, the lower-complexity option is selected.\nPR:N - A remote sender does not need a local account or kernel privilege to send packets to a configured ESP/WireGuard endpoint and cause pre-authentication or authentication-check crypto processing. Local configuration of the endpoint is an environmental precondition, not attacker privilege.\nUI:N - No victim user action is required once the affected kernel subsystem is configured and reachable. The attacker can trigger processing by sending packets or requests directly.\nS:U - The vulnerable component and impacted secrets are within the kernel\u2019s own security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The stale `permuted_state` is invertible back to the original ChaCha state and therefore key-equivalent, including for kernel crypto and RNG users. Exposure of that stack data can compromise full cryptographic keys or RNG state, so confidentiality impact is high.\nI:N - The bug is failure to clear sensitive stack data and does not provide a write primitive or data modification path. No integrity impact is directly caused.\nA:N - The issue does not corrupt memory, dereference invalid pointers, deadlock, or otherwise crash the kernel. No availability impact is directly caused."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:19.605Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e90ee961af515a484f091678ce58a4c3f7b73b02"
},
{
"url": "https://git.kernel.org/stable/c/b416a4245f04a450c67a13e6d96056c37c5b33fe"
},
{
"url": "https://git.kernel.org/stable/c/bd62d9b44464a6c20a34a74068e7a784d0afa04a"
},
{
"url": "https://git.kernel.org/stable/c/066c760acead1fb743bae294dbd89f479ae43b9b"
},
{
"url": "https://git.kernel.org/stable/c/1d761e5a7340c46479fb2399598f331e4fe2c633"
},
{
"url": "https://git.kernel.org/stable/c/1933249263c3a98df79992f61a566476e4163bcc"
},
{
"url": "https://git.kernel.org/stable/c/91999af43ca2125e3b2c18fcfc02912ada02efc3"
},
{
"url": "https://git.kernel.org/stable/c/e5046823f8fa3677341b541a25af2fcb99a5b1e0"
}
],
"title": "lib/crypto: chacha: Zeroize permuted_state before it leaves scope",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43336",
"datePublished": "2026-05-08T13:31:22.280Z",
"dateReserved": "2026-05-01T14:12:56.002Z",
"dateUpdated": "2026-08-05T12:27:19.605Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52916 (GCVE-0-2026-52916)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-06-24 07:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: frag: disallow unicast fragment in fragment
batadv_frag_skb_buffer() is called by batadv_batman_skb_recv() when a
BATADV_UNICAST_FRAG packet is received. Once all fragments are collected
and the packet is reassembled, batadv_recv_frag_packet() calls
batadv_batman_skb_recv() again to process the defragmented payload.
A malicious sender can craft a BATADV_UNICAST_FRAG packet whose reassembled
payload is itself a BATADV_UNICAST_FRAG packet (matryoshka-style nesting).
Each nesting level recurses through batadv_batman_skb_recv() without bound,
growing the kernel stack until it is exhausted.
Since refragmentation or fragments in fragments are not actually allowed,
discard all packets which are still BATADV_UNICAST_FRAG packets after the
defragmentation process.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605 Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605 Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605 Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605 Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605 Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605 Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605 Version: 610bfc6bc99bc83680d190ebc69359a05fc7f605 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/fragmentation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0c208fa3859e3a33a1c38bebc41d021166e94ac8",
"status": "affected",
"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
"versionType": "git"
},
{
"lessThan": "bcda4814dc6524283c0b958882cb963d75fe411d",
"status": "affected",
"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
"versionType": "git"
},
{
"lessThan": "aea54d0bbe156d5ab7d00d68f66149ff41f4612a",
"status": "affected",
"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
"versionType": "git"
},
{
"lessThan": "b54e459cf86943583c1aa2ee3081874e7ab1f5f3",
"status": "affected",
"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
"versionType": "git"
},
{
"lessThan": "5418be6c2e117bf8a316582795a8e3ff90f45e5d",
"status": "affected",
"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
"versionType": "git"
},
{
"lessThan": "5895ad21c7059a652da83fb817510f7a1e962abf",
"status": "affected",
"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
"versionType": "git"
},
{
"lessThan": "7138c35c9ad39a2fca6264af6b87466471f04ffc",
"status": "affected",
"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
"versionType": "git"
},
{
"lessThan": "bc62216dc8e221e3781afa14430f45208bfa9af9",
"status": "affected",
"version": "610bfc6bc99bc83680d190ebc69359a05fc7f605",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/fragmentation.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: frag: disallow unicast fragment in fragment\n\nbatadv_frag_skb_buffer() is called by batadv_batman_skb_recv() when a\nBATADV_UNICAST_FRAG packet is received. Once all fragments are collected\nand the packet is reassembled, batadv_recv_frag_packet() calls\nbatadv_batman_skb_recv() again to process the defragmented payload.\n\nA malicious sender can craft a BATADV_UNICAST_FRAG packet whose reassembled\npayload is itself a BATADV_UNICAST_FRAG packet (matryoshka-style nesting).\nEach nesting level recurses through batadv_batman_skb_recv() without bound,\ngrowing the kernel stack until it is exhausted.\n\nSince refragmentation or fragments in fragments are not actually allowed,\ndiscard all packets which are still BATADV_UNICAST_FRAG packets after the\ndefragmentation process."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T07:14:13.221Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c208fa3859e3a33a1c38bebc41d021166e94ac8"
},
{
"url": "https://git.kernel.org/stable/c/bcda4814dc6524283c0b958882cb963d75fe411d"
},
{
"url": "https://git.kernel.org/stable/c/aea54d0bbe156d5ab7d00d68f66149ff41f4612a"
},
{
"url": "https://git.kernel.org/stable/c/b54e459cf86943583c1aa2ee3081874e7ab1f5f3"
},
{
"url": "https://git.kernel.org/stable/c/5418be6c2e117bf8a316582795a8e3ff90f45e5d"
},
{
"url": "https://git.kernel.org/stable/c/5895ad21c7059a652da83fb817510f7a1e962abf"
},
{
"url": "https://git.kernel.org/stable/c/7138c35c9ad39a2fca6264af6b87466471f04ffc"
},
{
"url": "https://git.kernel.org/stable/c/bc62216dc8e221e3781afa14430f45208bfa9af9"
}
],
"title": "batman-adv: frag: disallow unicast fragment in fragment",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52916",
"datePublished": "2026-06-24T07:14:13.221Z",
"dateReserved": "2026-06-09T07:44:35.367Z",
"dateUpdated": "2026-06-24T07:14:13.221Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31522 (GCVE-0-2026-31522)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-05-23 16:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: magicmouse: avoid memory leak in magicmouse_report_fixup()
The magicmouse_report_fixup() function was returning a
newly kmemdup()-allocated buffer, but never freeing it.
The caller of report_fixup() does not take ownership of the returned
pointer, but it *is* permitted to return a sub-portion of the input
rdesc, whose lifetime is managed by the caller.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e6ad399596bd234be4722022146e33e15c7e424d Version: 0b91b4e4dae63cd43871fc2012370b86ee588f91 Version: 0b91b4e4dae63cd43871fc2012370b86ee588f91 Version: 0b91b4e4dae63cd43871fc2012370b86ee588f91 Version: 0b91b4e4dae63cd43871fc2012370b86ee588f91 Version: 0b91b4e4dae63cd43871fc2012370b86ee588f91 Version: 0b91b4e4dae63cd43871fc2012370b86ee588f91 Version: c394bd1bc8537e61593b6b6799e01495c7cf9008 Version: 5.15.17 ≤ Version: 5.16.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-magicmouse.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "579c4c9857acdc8380fa99803f355f878bd766cb",
"status": "affected",
"version": "e6ad399596bd234be4722022146e33e15c7e424d",
"versionType": "git"
},
{
"lessThan": "d84c21aabaab517b9aaf9bc1d785922cb9db2f31",
"status": "affected",
"version": "0b91b4e4dae63cd43871fc2012370b86ee588f91",
"versionType": "git"
},
{
"lessThan": "7edfe4346b052b708645d0acc0f186425766b785",
"status": "affected",
"version": "0b91b4e4dae63cd43871fc2012370b86ee588f91",
"versionType": "git"
},
{
"lessThan": "79e5dcc95d9abed6f8203cfd529f4ec71f0e505d",
"status": "affected",
"version": "0b91b4e4dae63cd43871fc2012370b86ee588f91",
"versionType": "git"
},
{
"lessThan": "136f605e246b4bfe7ac2259471d1ff814aed0084",
"status": "affected",
"version": "0b91b4e4dae63cd43871fc2012370b86ee588f91",
"versionType": "git"
},
{
"lessThan": "fa95b0146358b49f9858139b67314591fd5871b0",
"status": "affected",
"version": "0b91b4e4dae63cd43871fc2012370b86ee588f91",
"versionType": "git"
},
{
"lessThan": "91e8c6e601bdc1ccdf886479b6513c01c7e51c2c",
"status": "affected",
"version": "0b91b4e4dae63cd43871fc2012370b86ee588f91",
"versionType": "git"
},
{
"status": "affected",
"version": "c394bd1bc8537e61593b6b6799e01495c7cf9008",
"versionType": "git"
},
{
"lessThan": "5.15.203",
"status": "affected",
"version": "5.15.17",
"versionType": "semver"
},
{
"lessThan": "5.17",
"status": "affected",
"version": "5.16.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-magicmouse.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.15.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: magicmouse: avoid memory leak in magicmouse_report_fixup()\n\nThe magicmouse_report_fixup() function was returning a\nnewly kmemdup()-allocated buffer, but never freeing it.\n\nThe caller of report_fixup() does not take ownership of the returned\npointer, but it *is* permitted to return a sub-portion of the input\nrdesc, whose lifetime is managed by the caller."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:05:16.510Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/579c4c9857acdc8380fa99803f355f878bd766cb"
},
{
"url": "https://git.kernel.org/stable/c/d84c21aabaab517b9aaf9bc1d785922cb9db2f31"
},
{
"url": "https://git.kernel.org/stable/c/7edfe4346b052b708645d0acc0f186425766b785"
},
{
"url": "https://git.kernel.org/stable/c/79e5dcc95d9abed6f8203cfd529f4ec71f0e505d"
},
{
"url": "https://git.kernel.org/stable/c/136f605e246b4bfe7ac2259471d1ff814aed0084"
},
{
"url": "https://git.kernel.org/stable/c/fa95b0146358b49f9858139b67314591fd5871b0"
},
{
"url": "https://git.kernel.org/stable/c/91e8c6e601bdc1ccdf886479b6513c01c7e51c2c"
}
],
"title": "HID: magicmouse: avoid memory leak in magicmouse_report_fixup()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31522",
"datePublished": "2026-04-22T13:54:36.885Z",
"dateReserved": "2026-03-09T15:48:24.110Z",
"dateUpdated": "2026-05-23T16:05:16.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46049 (GCVE-0-2026-46049)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-06-14 17:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ctxfi: Add fallback to default RSR for S/PDIF
spdif_passthru_playback_get_resources() uses atc->pll_rate as the RSR
for the MSR calculation loop. However, pll_rate is only updated in
atc_pll_init() and not in hw_pll_init(), so it remains 0 after the
card init.
When spdif_passthru_playback_setup() skips atc_pll_init() for
32000 Hz, (rsr * desc.msr) always becomes 0, causing the loop to spin
indefinitely.
Add fallback to use atc->rsr when atc->pll_rate is 0. This reflects
the hardware state, since hw_card_init() already configures the PLL
to the default RSR.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8cc72361481f00253f1e468ade5795427386d593 Version: 8cc72361481f00253f1e468ade5795427386d593 Version: 8cc72361481f00253f1e468ade5795427386d593 Version: 8cc72361481f00253f1e468ade5795427386d593 Version: 8cc72361481f00253f1e468ade5795427386d593 Version: 8cc72361481f00253f1e468ade5795427386d593 Version: 8cc72361481f00253f1e468ade5795427386d593 Version: 8cc72361481f00253f1e468ade5795427386d593 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/pci/ctxfi/ctatc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d0b53842211f73a10ea174100a213f7fa14b9f33",
"status": "affected",
"version": "8cc72361481f00253f1e468ade5795427386d593",
"versionType": "git"
},
{
"lessThan": "615b7a5e5d8be68d52f262579906f7e015ba4606",
"status": "affected",
"version": "8cc72361481f00253f1e468ade5795427386d593",
"versionType": "git"
},
{
"lessThan": "dfc00979ff00d9dfdfa1df32144a272ee2728102",
"status": "affected",
"version": "8cc72361481f00253f1e468ade5795427386d593",
"versionType": "git"
},
{
"lessThan": "25ded535ee261161bcf19dafd525c542e606559d",
"status": "affected",
"version": "8cc72361481f00253f1e468ade5795427386d593",
"versionType": "git"
},
{
"lessThan": "30f9494c6f2b53a78822cfb653ffbb1d092d44c8",
"status": "affected",
"version": "8cc72361481f00253f1e468ade5795427386d593",
"versionType": "git"
},
{
"lessThan": "09496158f6ebba8830593f8972035c02f97124c1",
"status": "affected",
"version": "8cc72361481f00253f1e468ade5795427386d593",
"versionType": "git"
},
{
"lessThan": "95b1ee8442cabbde83b2848e7c6100df90f3a00d",
"status": "affected",
"version": "8cc72361481f00253f1e468ade5795427386d593",
"versionType": "git"
},
{
"lessThan": "7d61662197ecdc458e33e475b6ada7f6da61d364",
"status": "affected",
"version": "8cc72361481f00253f1e468ade5795427386d593",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/pci/ctxfi/ctatc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ctxfi: Add fallback to default RSR for S/PDIF\n\nspdif_passthru_playback_get_resources() uses atc-\u003epll_rate as the RSR\nfor the MSR calculation loop. However, pll_rate is only updated in\natc_pll_init() and not in hw_pll_init(), so it remains 0 after the\ncard init.\n\nWhen spdif_passthru_playback_setup() skips atc_pll_init() for\n32000 Hz, (rsr * desc.msr) always becomes 0, causing the loop to spin\nindefinitely.\n\nAdd fallback to use atc-\u003ersr when atc-\u003epll_rate is 0. This reflects\nthe hardware state, since hw_card_init() already configures the PLL\nto the default RSR."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:50:38.717Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d0b53842211f73a10ea174100a213f7fa14b9f33"
},
{
"url": "https://git.kernel.org/stable/c/615b7a5e5d8be68d52f262579906f7e015ba4606"
},
{
"url": "https://git.kernel.org/stable/c/dfc00979ff00d9dfdfa1df32144a272ee2728102"
},
{
"url": "https://git.kernel.org/stable/c/25ded535ee261161bcf19dafd525c542e606559d"
},
{
"url": "https://git.kernel.org/stable/c/30f9494c6f2b53a78822cfb653ffbb1d092d44c8"
},
{
"url": "https://git.kernel.org/stable/c/09496158f6ebba8830593f8972035c02f97124c1"
},
{
"url": "https://git.kernel.org/stable/c/95b1ee8442cabbde83b2848e7c6100df90f3a00d"
},
{
"url": "https://git.kernel.org/stable/c/7d61662197ecdc458e33e475b6ada7f6da61d364"
}
],
"title": "ALSA: ctxfi: Add fallback to default RSR for S/PDIF",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46049",
"datePublished": "2026-05-27T12:57:05.761Z",
"dateReserved": "2026-05-13T15:03:33.094Z",
"dateUpdated": "2026-06-14T17:50:38.717Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45902 (GCVE-0-2026-45902)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-27 12:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: supply: bq256xx: Fix use-after-free in power_supply_changed()
Using the `devm_` variant for requesting IRQ _before_ the `devm_`
variant for allocating/registering the `power_supply` handle, means that
the `power_supply` handle will be deallocated/unregistered _before_ the
interrupt handler (since `devm_` naturally deallocates in reverse
allocation order). This means that during removal, there is a race
condition where an interrupt can fire just _after_ the `power_supply`
handle has been freed, *but* just _before_ the corresponding
unregistration of the IRQ handler has run.
This will lead to the IRQ handler calling `power_supply_changed()` with
a freed `power_supply` handle. Which usually crashes the system or
otherwise silently corrupts the memory...
Note that there is a similar situation which can also happen during
`probe()`; the possibility of an interrupt firing _before_ registering
the `power_supply` handle. This would then lead to the nasty situation
of using the `power_supply` handle *uninitialized* in
`power_supply_changed()`.
Fix this racy use-after-free by making sure the IRQ is requested _after_
the registration of the `power_supply` handle.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 32e4978bb920d047fe5de3ea42d176f267c01f63 Version: 32e4978bb920d047fe5de3ea42d176f267c01f63 Version: 32e4978bb920d047fe5de3ea42d176f267c01f63 Version: 32e4978bb920d047fe5de3ea42d176f267c01f63 Version: 32e4978bb920d047fe5de3ea42d176f267c01f63 Version: 32e4978bb920d047fe5de3ea42d176f267c01f63 Version: 32e4978bb920d047fe5de3ea42d176f267c01f63 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/bq256xx_charger.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "81d3688c9a2158329391e08f2d0b8ba204216044",
"status": "affected",
"version": "32e4978bb920d047fe5de3ea42d176f267c01f63",
"versionType": "git"
},
{
"lessThan": "74b5a88318db97d51bb40f774736553c2acd1514",
"status": "affected",
"version": "32e4978bb920d047fe5de3ea42d176f267c01f63",
"versionType": "git"
},
{
"lessThan": "cb5c743936edcebc51880eeb6bf04979b5c9438b",
"status": "affected",
"version": "32e4978bb920d047fe5de3ea42d176f267c01f63",
"versionType": "git"
},
{
"lessThan": "83c27fdd696ac13d023ef7a0345301be93209c53",
"status": "affected",
"version": "32e4978bb920d047fe5de3ea42d176f267c01f63",
"versionType": "git"
},
{
"lessThan": "4b6fb0b6124f558131e502e3ffd03e6583b3ace6",
"status": "affected",
"version": "32e4978bb920d047fe5de3ea42d176f267c01f63",
"versionType": "git"
},
{
"lessThan": "8796910131a32ff29275052df768ef022929a394",
"status": "affected",
"version": "32e4978bb920d047fe5de3ea42d176f267c01f63",
"versionType": "git"
},
{
"lessThan": "8005843369723d9c8975b7c4202d1b85d6125302",
"status": "affected",
"version": "32e4978bb920d047fe5de3ea42d176f267c01f63",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/bq256xx_charger.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: bq256xx: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:17:10.508Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/81d3688c9a2158329391e08f2d0b8ba204216044"
},
{
"url": "https://git.kernel.org/stable/c/74b5a88318db97d51bb40f774736553c2acd1514"
},
{
"url": "https://git.kernel.org/stable/c/cb5c743936edcebc51880eeb6bf04979b5c9438b"
},
{
"url": "https://git.kernel.org/stable/c/83c27fdd696ac13d023ef7a0345301be93209c53"
},
{
"url": "https://git.kernel.org/stable/c/4b6fb0b6124f558131e502e3ffd03e6583b3ace6"
},
{
"url": "https://git.kernel.org/stable/c/8796910131a32ff29275052df768ef022929a394"
},
{
"url": "https://git.kernel.org/stable/c/8005843369723d9c8975b7c4202d1b85d6125302"
}
],
"title": "power: supply: bq256xx: Fix use-after-free in power_supply_changed()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45902",
"datePublished": "2026-05-27T12:17:10.508Z",
"dateReserved": "2026-05-13T15:03:33.084Z",
"dateUpdated": "2026-05-27T12:17:10.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53140 (GCVE-0-2026-53140)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-06-25 08:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups
v3d_rewrite_csd_job_wg_counts_from_indirect() maps both the indirect
buffer and the workgroup buffer and is expected to release them before
returning. When any of the workgroup counts read from the buffer is zero,
the function bailed out early and skipped the cleanup, leaking the vaddr
mappings of both BOs.
Jump to the cleanup path instead of returning directly, so the mappings
are always dropped.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/v3d/v3d_sched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0b59d0946913a0df7d1a033013e259e9b6a76546",
"status": "affected",
"version": "18b8413b25b7070fa2e55858a2c808e6909581d0",
"versionType": "git"
},
{
"lessThan": "90b629269088a9fe24a02c032be9f08357f47873",
"status": "affected",
"version": "18b8413b25b7070fa2e55858a2c808e6909581d0",
"versionType": "git"
},
{
"lessThan": "60ebeb23eaf3d7fd2e0551fe304309305e31d424",
"status": "affected",
"version": "18b8413b25b7070fa2e55858a2c808e6909581d0",
"versionType": "git"
},
{
"lessThan": "ae7676952790f421c40918e2586a2c9f12a682b6",
"status": "affected",
"version": "18b8413b25b7070fa2e55858a2c808e6909581d0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/v3d/v3d_sched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups\n\nv3d_rewrite_csd_job_wg_counts_from_indirect() maps both the indirect\nbuffer and the workgroup buffer and is expected to release them before\nreturning. When any of the workgroup counts read from the buffer is zero,\nthe function bailed out early and skipped the cleanup, leaking the vaddr\nmappings of both BOs.\n\nJump to the cleanup path instead of returning directly, so the mappings\nare always dropped."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:38:28.494Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0b59d0946913a0df7d1a033013e259e9b6a76546"
},
{
"url": "https://git.kernel.org/stable/c/90b629269088a9fe24a02c032be9f08357f47873"
},
{
"url": "https://git.kernel.org/stable/c/60ebeb23eaf3d7fd2e0551fe304309305e31d424"
},
{
"url": "https://git.kernel.org/stable/c/ae7676952790f421c40918e2586a2c9f12a682b6"
}
],
"title": "drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53140",
"datePublished": "2026-06-25T08:38:28.494Z",
"dateReserved": "2026-06-09T07:44:35.387Z",
"dateUpdated": "2026-06-25T08:38:28.494Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31624 (GCVE-0-2026-31624)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-06-14 17:43
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: core: clamp report_size in s32ton() to avoid undefined shift
s32ton() shifts by n-1 where n is the field's report_size, a value that
comes directly from a HID device. The HID parser bounds report_size
only to <= 256, so a broken HID device can supply a report descriptor
with a wide field that triggers shift exponents up to 256 on a 32-bit
type when an output report is built via hid_output_field() or
hid_set_field().
Commit ec61b41918587 ("HID: core: fix shift-out-of-bounds in
hid_report_raw_event") added the same n > 32 clamp to the function
snto32(), but s32ton() was never given the same fix as I guess syzbot
hadn't figured out how to fuzz a device the same way.
Fix this up by just clamping the max value of n, just like snto32()
does.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: dde5845a529ff753364a6d1aea61180946270bfa Version: dde5845a529ff753364a6d1aea61180946270bfa Version: dde5845a529ff753364a6d1aea61180946270bfa Version: dde5845a529ff753364a6d1aea61180946270bfa Version: dde5845a529ff753364a6d1aea61180946270bfa Version: dde5845a529ff753364a6d1aea61180946270bfa Version: dde5845a529ff753364a6d1aea61180946270bfa Version: dde5845a529ff753364a6d1aea61180946270bfa Version: dde5845a529ff753364a6d1aea61180946270bfa |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "76ad02854a30c394e0c076e6e6bed0a388573a94",
"status": "affected",
"version": "dde5845a529ff753364a6d1aea61180946270bfa",
"versionType": "git"
},
{
"lessThan": "eb415ddaf25e09ddb8fe5736a70c9de2e6462534",
"status": "affected",
"version": "dde5845a529ff753364a6d1aea61180946270bfa",
"versionType": "git"
},
{
"lessThan": "0ab048dbdb1daacf17d52e9252297eb6e1298e49",
"status": "affected",
"version": "dde5845a529ff753364a6d1aea61180946270bfa",
"versionType": "git"
},
{
"lessThan": "932ae5309e53561197aa7d1606c7cf63af10e24f",
"status": "affected",
"version": "dde5845a529ff753364a6d1aea61180946270bfa",
"versionType": "git"
},
{
"lessThan": "58386f00af710922cafb0fb69211497beddfaa95",
"status": "affected",
"version": "dde5845a529ff753364a6d1aea61180946270bfa",
"versionType": "git"
},
{
"lessThan": "8a8333237f1f5caab8d4c3d2c2e7578c4263a97f",
"status": "affected",
"version": "dde5845a529ff753364a6d1aea61180946270bfa",
"versionType": "git"
},
{
"lessThan": "ea363a34086ddb4231adc581a7f36c39ec154bfc",
"status": "affected",
"version": "dde5845a529ff753364a6d1aea61180946270bfa",
"versionType": "git"
},
{
"lessThan": "97014719bb8fccb1ffcbbc299e84b1f11b114195",
"status": "affected",
"version": "dde5845a529ff753364a6d1aea61180946270bfa",
"versionType": "git"
},
{
"lessThan": "69c02ffde6ed4d535fa4e693a9e572729cad3d0d",
"status": "affected",
"version": "dde5845a529ff753364a6d1aea61180946270bfa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.20"
},
{
"lessThan": "2.6.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: core: clamp report_size in s32ton() to avoid undefined shift\n\ns32ton() shifts by n-1 where n is the field\u0027s report_size, a value that\ncomes directly from a HID device. The HID parser bounds report_size\nonly to \u003c= 256, so a broken HID device can supply a report descriptor\nwith a wide field that triggers shift exponents up to 256 on a 32-bit\ntype when an output report is built via hid_output_field() or\nhid_set_field().\n\nCommit ec61b41918587 (\"HID: core: fix shift-out-of-bounds in\nhid_report_raw_event\") added the same n \u003e 32 clamp to the function\nsnto32(), but s32ton() was never given the same fix as I guess syzbot\nhadn\u0027t figured out how to fuzz a device the same way.\n\nFix this up by just clamping the max value of n, just like snto32()\ndoes."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:43:12.552Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/76ad02854a30c394e0c076e6e6bed0a388573a94"
},
{
"url": "https://git.kernel.org/stable/c/eb415ddaf25e09ddb8fe5736a70c9de2e6462534"
},
{
"url": "https://git.kernel.org/stable/c/0ab048dbdb1daacf17d52e9252297eb6e1298e49"
},
{
"url": "https://git.kernel.org/stable/c/932ae5309e53561197aa7d1606c7cf63af10e24f"
},
{
"url": "https://git.kernel.org/stable/c/58386f00af710922cafb0fb69211497beddfaa95"
},
{
"url": "https://git.kernel.org/stable/c/8a8333237f1f5caab8d4c3d2c2e7578c4263a97f"
},
{
"url": "https://git.kernel.org/stable/c/ea363a34086ddb4231adc581a7f36c39ec154bfc"
},
{
"url": "https://git.kernel.org/stable/c/97014719bb8fccb1ffcbbc299e84b1f11b114195"
},
{
"url": "https://git.kernel.org/stable/c/69c02ffde6ed4d535fa4e693a9e572729cad3d0d"
}
],
"title": "HID: core: clamp report_size in s32ton() to avoid undefined shift",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31624",
"datePublished": "2026-04-24T14:42:41.655Z",
"dateReserved": "2026-03-09T15:48:24.124Z",
"dateUpdated": "2026-06-14T17:43:12.552Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43374 (GCVE-0-2026-43374)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: nexthop: fix percpu use-after-free in remove_nh_grp_entry
When removing a nexthop from a group, remove_nh_grp_entry() publishes
the new group via rcu_assign_pointer() then immediately frees the
removed entry's percpu stats with free_percpu(). However, the
synchronize_net() grace period in the caller remove_nexthop_from_groups()
runs after the free. RCU readers that entered before the publish still
see the old group and can dereference the freed stats via
nh_grp_entry_stats_inc() -> get_cpu_ptr(nhge->stats), causing a
use-after-free on percpu memory.
Fix by deferring the free_percpu() until after synchronize_net() in the
caller. Removed entries are chained via nh_list onto a local deferred
free list. After the grace period completes and all RCU readers have
finished, the percpu stats are safely freed.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/nexthop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "abf4feaee6405f1441929c6ebe7a250f2cd170a7",
"status": "affected",
"version": "f4676ea74b8549cd88dbfe2a592ce4530039e61f",
"versionType": "git"
},
{
"lessThan": "ab5ebab9664214ba41a7633cb4e72f128204f924",
"status": "affected",
"version": "f4676ea74b8549cd88dbfe2a592ce4530039e61f",
"versionType": "git"
},
{
"lessThan": "9e08ad731862b22a87cc55f752e16d66cdc9e231",
"status": "affected",
"version": "f4676ea74b8549cd88dbfe2a592ce4530039e61f",
"versionType": "git"
},
{
"lessThan": "b2662e7593e94ae09b1cf7ee5f09160a3612bcb2",
"status": "affected",
"version": "f4676ea74b8549cd88dbfe2a592ce4530039e61f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/nexthop.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nexthop: fix percpu use-after-free in remove_nh_grp_entry\n\nWhen removing a nexthop from a group, remove_nh_grp_entry() publishes\nthe new group via rcu_assign_pointer() then immediately frees the\nremoved entry\u0027s percpu stats with free_percpu(). However, the\nsynchronize_net() grace period in the caller remove_nexthop_from_groups()\nruns after the free. RCU readers that entered before the publish still\nsee the old group and can dereference the freed stats via\nnh_grp_entry_stats_inc() -\u003e get_cpu_ptr(nhge-\u003estats), causing a\nuse-after-free on percpu memory.\n\nFix by deferring the free_percpu() until after synchronize_net() in the\ncaller. Removed entries are chained via nh_list onto a local deferred\nfree list. After the grace period completes and all RCU readers have\nfinished, the percpu stats are safely freed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The freeing side is reached through `RTM_DELNEXTHOP` over rtnetlink, which is a local netlink configuration interface. Remote packets can hit the RCU read side, but an attacker must locally trigger nexthop deletion to create the UAF.\nAC:L - A local attacker can create nexthop groups, attach routes, generate concurrent route lookups, and delete a member nexthop, controlling both sides of the race. The bug is a straightforward RCU grace-period violation rather than a condition dependent on external state.\nPR:L - The rtnetlink non-GET path requires `CAP_NET_ADMIN` in the socket\u0027s network namespace. Because this is reachable with namespaced `CAP_NET_ADMIN` via user/network namespaces on affected systems, this is Low rather than High.\nUI:N - No victim interaction is required once the attacker has local access and the needed namespace capability. The attacker can perform the netlink operations and traffic generation directly.\nS:U - The vulnerability corrupts kernel memory within the same kernel security authority. It is a kernel privilege-impact bug, not a VM escape or cross-scope boundary bypass.\nC:H - This is a use-after-free of per-CPU nexthop group statistics reachable from RCU route readers. Following kernel CVSS guidance, UAF memory corruption is treated as enabling high confidentiality impact.\nI:H - The stale reader writes packet counters and sequence state through a freed per-CPU pointer, creating memory corruption that can plausibly be shaped into write/control-flow impact. Per the required guidance, UAF is scored as High integrity impact.\nA:H - The stale dereference of freed per-CPU memory can crash or otherwise destabilize the kernel. Any kernel UAF with crash potential is High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:34.663Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/abf4feaee6405f1441929c6ebe7a250f2cd170a7"
},
{
"url": "https://git.kernel.org/stable/c/ab5ebab9664214ba41a7633cb4e72f128204f924"
},
{
"url": "https://git.kernel.org/stable/c/9e08ad731862b22a87cc55f752e16d66cdc9e231"
},
{
"url": "https://git.kernel.org/stable/c/b2662e7593e94ae09b1cf7ee5f09160a3612bcb2"
}
],
"title": "net: nexthop: fix percpu use-after-free in remove_nh_grp_entry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43374",
"datePublished": "2026-05-08T14:21:24.537Z",
"dateReserved": "2026-05-01T14:12:56.006Z",
"dateUpdated": "2026-08-05T12:27:34.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43426 (GCVE-0-2026-43426)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-05-11 22:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: renesas_usbhs: fix use-after-free in ISR during device removal
In usbhs_remove(), the driver frees resources (including the pipe array)
while the interrupt handler (usbhs_interrupt) is still registered. If an
interrupt fires after usbhs_pipe_remove() but before the driver is fully
unbound, the ISR may access freed memory, causing a use-after-free.
Fix this by calling devm_free_irq() before freeing resources. This ensures
the interrupt handler is both disabled and synchronized (waits for any
running ISR to complete) before usbhs_pipe_remove() is called.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f1407d5c66240b33d11a7f1a41d55ccf6a9d7647 Version: f1407d5c66240b33d11a7f1a41d55ccf6a9d7647 Version: f1407d5c66240b33d11a7f1a41d55ccf6a9d7647 Version: f1407d5c66240b33d11a7f1a41d55ccf6a9d7647 Version: f1407d5c66240b33d11a7f1a41d55ccf6a9d7647 Version: f1407d5c66240b33d11a7f1a41d55ccf6a9d7647 Version: f1407d5c66240b33d11a7f1a41d55ccf6a9d7647 Version: f1407d5c66240b33d11a7f1a41d55ccf6a9d7647 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/renesas_usbhs/common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c7012fc73dab4829404fedeeaa8531f12ac8545f",
"status": "affected",
"version": "f1407d5c66240b33d11a7f1a41d55ccf6a9d7647",
"versionType": "git"
},
{
"lessThan": "51afaf919bbaacdd9cc9e146033ae0a743a42dd7",
"status": "affected",
"version": "f1407d5c66240b33d11a7f1a41d55ccf6a9d7647",
"versionType": "git"
},
{
"lessThan": "1899edac312ef17a7234851686e8a703f56d0a84",
"status": "affected",
"version": "f1407d5c66240b33d11a7f1a41d55ccf6a9d7647",
"versionType": "git"
},
{
"lessThan": "9c6159d5b72d5fc265cce5da04f27d730b552e69",
"status": "affected",
"version": "f1407d5c66240b33d11a7f1a41d55ccf6a9d7647",
"versionType": "git"
},
{
"lessThan": "6287e0c01ccb818e7214f88d885ffb7c9e81b0e0",
"status": "affected",
"version": "f1407d5c66240b33d11a7f1a41d55ccf6a9d7647",
"versionType": "git"
},
{
"lessThan": "0b7d11fd6e742ecc0b1eca44b4f0b93140c74bae",
"status": "affected",
"version": "f1407d5c66240b33d11a7f1a41d55ccf6a9d7647",
"versionType": "git"
},
{
"lessThan": "6ffe44f022c95b1b29c691d2169c5abc046f7580",
"status": "affected",
"version": "f1407d5c66240b33d11a7f1a41d55ccf6a9d7647",
"versionType": "git"
},
{
"lessThan": "3cbc242b88c607f55da3d0d0d336b49bf1e20412",
"status": "affected",
"version": "f1407d5c66240b33d11a7f1a41d55ccf6a9d7647",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/renesas_usbhs/common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: renesas_usbhs: fix use-after-free in ISR during device removal\n\nIn usbhs_remove(), the driver frees resources (including the pipe array)\nwhile the interrupt handler (usbhs_interrupt) is still registered. If an\ninterrupt fires after usbhs_pipe_remove() but before the driver is fully\nunbound, the ISR may access freed memory, causing a use-after-free.\n\nFix this by calling devm_free_irq() before freeing resources. This ensures\nthe interrupt handler is both disabled and synchronized (waits for any\nrunning ISR to complete) before usbhs_pipe_remove() is called."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:21.643Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c7012fc73dab4829404fedeeaa8531f12ac8545f"
},
{
"url": "https://git.kernel.org/stable/c/51afaf919bbaacdd9cc9e146033ae0a743a42dd7"
},
{
"url": "https://git.kernel.org/stable/c/1899edac312ef17a7234851686e8a703f56d0a84"
},
{
"url": "https://git.kernel.org/stable/c/9c6159d5b72d5fc265cce5da04f27d730b552e69"
},
{
"url": "https://git.kernel.org/stable/c/6287e0c01ccb818e7214f88d885ffb7c9e81b0e0"
},
{
"url": "https://git.kernel.org/stable/c/0b7d11fd6e742ecc0b1eca44b4f0b93140c74bae"
},
{
"url": "https://git.kernel.org/stable/c/6ffe44f022c95b1b29c691d2169c5abc046f7580"
},
{
"url": "https://git.kernel.org/stable/c/3cbc242b88c607f55da3d0d0d336b49bf1e20412"
}
],
"title": "usb: renesas_usbhs: fix use-after-free in ISR during device removal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43426",
"datePublished": "2026-05-08T14:21:59.668Z",
"dateReserved": "2026-05-01T14:12:56.009Z",
"dateUpdated": "2026-05-11T22:24:21.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46178 (GCVE-0-2026-46178)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()
Sashiko points out that mlx4_srq_alloc() was not undone during error
unwind, add the missing call to mlx4_srq_free().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 225c7b1feef1b41170f7037a5b10a65cd8a42c54 Version: 225c7b1feef1b41170f7037a5b10a65cd8a42c54 Version: 225c7b1feef1b41170f7037a5b10a65cd8a42c54 Version: 225c7b1feef1b41170f7037a5b10a65cd8a42c54 Version: 225c7b1feef1b41170f7037a5b10a65cd8a42c54 Version: 225c7b1feef1b41170f7037a5b10a65cd8a42c54 Version: 225c7b1feef1b41170f7037a5b10a65cd8a42c54 Version: 225c7b1feef1b41170f7037a5b10a65cd8a42c54 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/mlx4/srq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "53fd4c03558672ccb167754fbacbf045c7ab335c",
"status": "affected",
"version": "225c7b1feef1b41170f7037a5b10a65cd8a42c54",
"versionType": "git"
},
{
"lessThan": "0be6ae614ca7fa53e7389e3c7462ed20abbd4192",
"status": "affected",
"version": "225c7b1feef1b41170f7037a5b10a65cd8a42c54",
"versionType": "git"
},
{
"lessThan": "5b3b220d54e6a3d77380cb7caa1ef79cb8f4fc94",
"status": "affected",
"version": "225c7b1feef1b41170f7037a5b10a65cd8a42c54",
"versionType": "git"
},
{
"lessThan": "c5dc30da990045105c9762248d23076223e7878a",
"status": "affected",
"version": "225c7b1feef1b41170f7037a5b10a65cd8a42c54",
"versionType": "git"
},
{
"lessThan": "0dbd619716fb07b7de1acd64fec673ee6e1adde7",
"status": "affected",
"version": "225c7b1feef1b41170f7037a5b10a65cd8a42c54",
"versionType": "git"
},
{
"lessThan": "e01b8c9286c470b71a38acd320106f2c4f2826a1",
"status": "affected",
"version": "225c7b1feef1b41170f7037a5b10a65cd8a42c54",
"versionType": "git"
},
{
"lessThan": "388617f44d81604a760742a0b5de292d411e63e3",
"status": "affected",
"version": "225c7b1feef1b41170f7037a5b10a65cd8a42c54",
"versionType": "git"
},
{
"lessThan": "c54c7e4cb679c0aaa1cb489b9c3f2cd98e63a44c",
"status": "affected",
"version": "225c7b1feef1b41170f7037a5b10a65cd8a42c54",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/mlx4/srq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.22"
},
{
"lessThan": "2.6.22",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()\n\nSashiko points out that mlx4_srq_alloc() was not undone during error\nunwind, add the missing call to mlx4_srq_free()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached only through the local RDMA uverbs device interface (/dev/infiniband/uverbsN) via a create-SRQ command with driver udata present; it is not reachable from a network peer.\nAC:L - The attacker reliably forces the failing path by supplying a bad/unmapped response buffer (`copy_to_user` \u2192 -EFAULT), which deterministically creates the dangling radix-tree pointer to freed memory; per UAF guidance this is Low.\nPR:L - Triggering requires only an unprivileged local account with access to the RDMA verbs device, which is commonly exposed to non-root users in HPC/cloud/RDMA-enabled environments; no real root is needed.\nUI:N - The attacker performs the create-SRQ call and supplies the faulting buffer entirely on their own; no victim action is required.\nS:U - The freed object and its corruption stay within the kernel\u0027s own security authority; there is no crossing of a VM/IOMMU/sandbox boundary.\nC:H - The dangling pointer is a use-after-free; reclaiming the freed `mlx4_ib_srq` lets an attacker control its contents and read kernel memory through the event-handler dereference chain.\nI:H - The UAF causes `mlx4_srq_event()` to write to freed memory and call function pointers (`srq-\u003eevent`, `event_handler`) read from freed memory, giving a heap-spray-based control-flow-hijack / arbitrary-write primitive.\nA:H - Dereferencing the freed object reliably crashes the kernel, and repeatedly exercising the bug also exhausts the finite hardware SRQ/ICM resource pool, denying RDMA service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:16.484Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/53fd4c03558672ccb167754fbacbf045c7ab335c"
},
{
"url": "https://git.kernel.org/stable/c/0be6ae614ca7fa53e7389e3c7462ed20abbd4192"
},
{
"url": "https://git.kernel.org/stable/c/5b3b220d54e6a3d77380cb7caa1ef79cb8f4fc94"
},
{
"url": "https://git.kernel.org/stable/c/c5dc30da990045105c9762248d23076223e7878a"
},
{
"url": "https://git.kernel.org/stable/c/0dbd619716fb07b7de1acd64fec673ee6e1adde7"
},
{
"url": "https://git.kernel.org/stable/c/e01b8c9286c470b71a38acd320106f2c4f2826a1"
},
{
"url": "https://git.kernel.org/stable/c/388617f44d81604a760742a0b5de292d411e63e3"
},
{
"url": "https://git.kernel.org/stable/c/c54c7e4cb679c0aaa1cb489b9c3f2cd98e63a44c"
}
],
"title": "RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46178",
"datePublished": "2026-05-28T09:36:32.222Z",
"dateReserved": "2026-05-13T15:03:33.103Z",
"dateUpdated": "2026-08-05T12:30:16.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45922 (GCVE-0-2026-45922)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-27 12:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler
The UVERBS_HANDLER(MLX5_IB_METHOD_GET_DATA_DIRECT_SYSFS_PATH) function
allocates memory for the device path using kobject_get_path(). If the
length of the device path exceeds the output buffer length, the function
returns -ENOSPC but does not free the allocated memory, resulting in a
memory leak.
Add a kfree() call to the error path to ensure the allocated memory is
properly freed.
Compile tested only. Issue found using a prototype static analysis tool
and code review.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/mlx5/std_types.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ee998cdbff6680891b0efd9d6ce53a388e5342c3",
"status": "affected",
"version": "ec7ad6530909983c8736c80af46e3529ce7bab55",
"versionType": "git"
},
{
"lessThan": "b2bc649c18fbe8a7fd38d17266da3dcbfbcc44d2",
"status": "affected",
"version": "ec7ad6530909983c8736c80af46e3529ce7bab55",
"versionType": "git"
},
{
"lessThan": "b3a10eca24fcfe913c0875e620f19596001bd6dc",
"status": "affected",
"version": "ec7ad6530909983c8736c80af46e3529ce7bab55",
"versionType": "git"
},
{
"lessThan": "9b9d253908478f504297ac283c514e5953ddafa6",
"status": "affected",
"version": "ec7ad6530909983c8736c80af46e3529ce7bab55",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/hw/mlx5/std_types.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler\n\nThe UVERBS_HANDLER(MLX5_IB_METHOD_GET_DATA_DIRECT_SYSFS_PATH) function\nallocates memory for the device path using kobject_get_path(). If the\nlength of the device path exceeds the output buffer length, the function\nreturns -ENOSPC but does not free the allocated memory, resulting in a\nmemory leak.\n\nAdd a kfree() call to the error path to ensure the allocated memory is\nproperly freed.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:17:41.431Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ee998cdbff6680891b0efd9d6ce53a388e5342c3"
},
{
"url": "https://git.kernel.org/stable/c/b2bc649c18fbe8a7fd38d17266da3dcbfbcc44d2"
},
{
"url": "https://git.kernel.org/stable/c/b3a10eca24fcfe913c0875e620f19596001bd6dc"
},
{
"url": "https://git.kernel.org/stable/c/9b9d253908478f504297ac283c514e5953ddafa6"
}
],
"title": "RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45922",
"datePublished": "2026-05-27T12:17:41.431Z",
"dateReserved": "2026-05-13T15:03:33.085Z",
"dateUpdated": "2026-05-27T12:17:41.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43187 (GCVE-0-2026-43187)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: delete attr leaf freemap entries when empty
Back in commit 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size
underflow"), Brian Foster observed that it's possible for a small
freemap at the end of the end of the xattr entries array to experience
a size underflow when subtracting the space consumed by an expansion of
the entries array. There are only three freemap entries, which means
that it is not a complete index of all free space in the leaf block.
This code can leave behind a zero-length freemap entry with a nonzero
base. Subsequent setxattr operations can increase the base up to the
point that it overlaps with another freemap entry. This isn't in and of
itself a problem because the code in _leaf_add that finds free space
ignores any freemap entry with zero size.
However, there's another bug in the freemap update code in _leaf_add,
which is that it fails to update a freemap entry that begins midway
through the xattr entry that was just appended to the array. That can
result in the freemap containing two entries with the same base but
different sizes (0 for the "pushed-up" entry, nonzero for the entry
that's actually tracking free space). A subsequent _leaf_add can then
allocate xattr namevalue entries on top of the entries array, leading to
data loss. But fixing that is for later.
For now, eliminate the possibility of confusion by zeroing out the base
of any freemap entry that has zero size. Because the freemap is not
intended to be a complete index of free space, a subsequent failure to
find any free space for a new xattr will trigger block compaction, which
regenerates the freemap.
It looks like this bug has been in the codebase for quite a long time.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_attr_leaf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f3c0d1fc1eadbb4adbee5ab7757d41d35f48325b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "aa9083d97e2157da3c6fb45ddb1a97af7f188f7f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a631899025d47ea1aa6464d76db5b4d3b6d196fd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ffaf5c99d0f862db021fb1af8b813c1416b1beb2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e1b8c6452ee99a30e188a88f3f3f804fb1c6004a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f31a8334e1c54b126fcecf98645a49b6bc5ad399",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "479b05fc3ee272090f671b06a41f3da8aa78eece",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6f13c1d2a6271c2e73226864a0e83de2770b6f34",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/libxfs/xfs_attr_leaf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: delete attr leaf freemap entries when empty\n\nBack in commit 2a2b5932db6758 (\"xfs: fix attr leaf header freemap.size\nunderflow\"), Brian Foster observed that it\u0027s possible for a small\nfreemap at the end of the end of the xattr entries array to experience\na size underflow when subtracting the space consumed by an expansion of\nthe entries array. There are only three freemap entries, which means\nthat it is not a complete index of all free space in the leaf block.\n\nThis code can leave behind a zero-length freemap entry with a nonzero\nbase. Subsequent setxattr operations can increase the base up to the\npoint that it overlaps with another freemap entry. This isn\u0027t in and of\nitself a problem because the code in _leaf_add that finds free space\nignores any freemap entry with zero size.\n\nHowever, there\u0027s another bug in the freemap update code in _leaf_add,\nwhich is that it fails to update a freemap entry that begins midway\nthrough the xattr entry that was just appended to the array. That can\nresult in the freemap containing two entries with the same base but\ndifferent sizes (0 for the \"pushed-up\" entry, nonzero for the entry\nthat\u0027s actually tracking free space). A subsequent _leaf_add can then\nallocate xattr namevalue entries on top of the entries array, leading to\ndata loss. But fixing that is for later.\n\nFor now, eliminate the possibility of confusion by zeroing out the base\nof any freemap entry that has zero size. Because the freemap is not\nintended to be a complete index of free space, a subsequent failure to\nfind any free space for a new xattr will trigger block compaction, which\nregenerates the freemap.\n\nIt looks like this bug has been in the codebase for quite a long time."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - XFS xattr set/remove operations can be reached over network file services such as NFSv4.2 SETXATTR/REMOVEXATTR and ksmbd EA handling when an XFS filesystem is exported. Those paths call the VFS xattr helpers and then `xfs_xattr_set`, reaching the vulnerable XFS attr leaf code.\nAC:L - There is no race or external timing dependency; the attacker controls the xattr names, values, sizes, and operation sequence needed to groom the leaf freemap. The required leaf-block state is produced deterministically by repeated xattr operations on a writable file.\nPR:L - The path is gated by file-service or VFS write permission checks, but an unprivileged user with write access to a regular file can set `user.*` xattrs without capabilities. Remote exploitation through NFS/SMB similarly requires only low-privilege write access to the exported object, not administrator privileges.\nUI:N - Once the attacker has access to a writable XFS-backed object, they can trigger the vulnerable xattr operations directly. No separate victim action is required.\nS:U - The corruption occurs within the kernel filesystem and affects resources governed by the same kernel/filesystem security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:H - The freemap confusion can cause xattr name/value storage to overlap the leaf entry array, corrupting namespace, index, and value metadata used for later xattr reads. Because this can misdirect disclosure of filesystem xattr metadata and values, the high-impact choice is warranted.\nI:H - The bug permits controlled corruption of XFS extended-attribute leaf metadata and can allocate new xattr data on top of existing entries. This can cause data loss and modification of security-relevant xattr metadata, so integrity impact is high.\nA:H - The corrupted attr leaf state can lead to filesystem metadata corruption, verifier/assertion failures, and XFS shutdown, as shown by the related freemap-collision fixes. Loss of access to the affected filesystem is a high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:25.415Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f3c0d1fc1eadbb4adbee5ab7757d41d35f48325b"
},
{
"url": "https://git.kernel.org/stable/c/aa9083d97e2157da3c6fb45ddb1a97af7f188f7f"
},
{
"url": "https://git.kernel.org/stable/c/a631899025d47ea1aa6464d76db5b4d3b6d196fd"
},
{
"url": "https://git.kernel.org/stable/c/ffaf5c99d0f862db021fb1af8b813c1416b1beb2"
},
{
"url": "https://git.kernel.org/stable/c/e1b8c6452ee99a30e188a88f3f3f804fb1c6004a"
},
{
"url": "https://git.kernel.org/stable/c/f31a8334e1c54b126fcecf98645a49b6bc5ad399"
},
{
"url": "https://git.kernel.org/stable/c/479b05fc3ee272090f671b06a41f3da8aa78eece"
},
{
"url": "https://git.kernel.org/stable/c/6f13c1d2a6271c2e73226864a0e83de2770b6f34"
}
],
"title": "xfs: delete attr leaf freemap entries when empty",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43187",
"datePublished": "2026-05-06T11:27:57.727Z",
"dateReserved": "2026-05-01T14:12:55.991Z",
"dateUpdated": "2026-08-05T12:26:25.415Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46166 (GCVE-0-2026-46166)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: use safe list iteration in radar detect work
The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to
be freed and removed from the list. Guard against this to avoid a
slab-use-after-free error.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.26.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.84.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.17.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.123.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s mac80211 wireless subsystem. This vulnerability arises from unsafe list iteration during radar detection work, where a channel context can be freed while still being processed. This can lead to a use-after-free memory error. A successful exploit could result in system instability or a denial of service."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-825",
"description": "Expired Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:51:16.820Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-46166"
},
{
"name": "RHBZ#2482645",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482645"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46166.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33215"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27288"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27708"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27789"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:33215: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:27288: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:27708: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:27789: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-28T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-28T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: wifi: mac80211: use safe list iteration in radar detect work",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "887ece6c23b49d02a6678e7a8d5ad213d75883ce",
"status": "affected",
"version": "bca8bc0399ac2efd56e6adbed0307e10125a556c",
"versionType": "git"
},
{
"lessThan": "7577a4b8a10fab45a6ee2045ea038a5adadbb585",
"status": "affected",
"version": "bca8bc0399ac2efd56e6adbed0307e10125a556c",
"versionType": "git"
},
{
"lessThan": "120149fb3ebcf674832ca3cafd32bedcdb686dde",
"status": "affected",
"version": "bca8bc0399ac2efd56e6adbed0307e10125a556c",
"versionType": "git"
},
{
"lessThan": "ac8eb3e18f41e2cc8492cc1d358bcb786c850270",
"status": "affected",
"version": "bca8bc0399ac2efd56e6adbed0307e10125a556c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: use safe list iteration in radar detect work\n\nThe call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to\nbe freed and removed from the list. Guard against this to avoid a\nslab-use-after-free error."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable work is triggered by a PHY-level DFS radar detection event, reachable over-the-air within WiFi radio range; an adjacent attacker can spoof radar pulse waveforms to drive the affected AP into this path, consistent with WiFi being scored Adjacent.\nAC:L - The attacker controls the radar trigger and can repeatedly force CAC restarts on an MLO/split-phy DFS AP to reach the vulnerable iteration; per the higher-severity rule the configuration/timing dependence is treated as Low.\nPR:N - Radar detection is processed below the association layer, so the adjacent RF attacker needs no credentials or authentication on the target.\nUI:N - No victim action is required; the AP only needs to be in its normal operating state on a DFS channel performing CAC.\nS:U - The use-after-free is confined to the kernel\u0027s own memory and security authority with no crossing of a trust boundary.\nC:H - A use-after-free of the freed chanctx allows the corrupted/reallocated object\u0027s contents (e.g., the list next pointer) to be read and traversed, enabling potential information disclosure.\nI:H - The use-after-free can be leveraged via heap reallocation of the freed chanctx to corrupt subsequent list traversal and structure fields, providing a path to memory corruption/control-flow influence.\nA:H - The slab-use-after-free reliably causes kernel oops/panic when the freed chanctx is dereferenced during continued list iteration."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:10.014Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/887ece6c23b49d02a6678e7a8d5ad213d75883ce"
},
{
"url": "https://git.kernel.org/stable/c/7577a4b8a10fab45a6ee2045ea038a5adadbb585"
},
{
"url": "https://git.kernel.org/stable/c/120149fb3ebcf674832ca3cafd32bedcdb686dde"
},
{
"url": "https://git.kernel.org/stable/c/ac8eb3e18f41e2cc8492cc1d358bcb786c850270"
}
],
"title": "wifi: mac80211: use safe list iteration in radar detect work",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46166",
"datePublished": "2026-05-28T09:36:21.675Z",
"dateReserved": "2026-05-13T15:03:33.102Z",
"dateUpdated": "2026-08-05T12:30:10.014Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43467 (GCVE-0-2026-43467)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-23 16:07
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Fix crash when moving to switchdev mode
When moving to switchdev mode when the device doesn't support IPsec,
we try to clean up the IPsec resources anyway which causes the crash
below, fix that by correctly checking for IPsec support before trying
to clean up its resources.
[27642.515799] WARNING: arch/x86/mm/fault.c:1276 at
do_user_addr_fault+0x18a/0x680, CPU#4: devlink/6490
[27642.517159] Modules linked in: xt_conntrack xt_MASQUERADE
ip6table_nat ip6table_filter ip6_tables iptable_nat nf_nat xt_addrtype
rpcsec_gss_krb5 auth_rpcgss oid_registry overlay mlx5_fwctl nfnetlink
zram zsmalloc mlx5_ib fuse rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi
scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_core
ib_core
[27642.521358] CPU: 4 UID: 0 PID: 6490 Comm: devlink Not tainted
6.19.0-rc5_for_upstream_min_debug_2026_01_14_16_47 #1 NONE
[27642.522923] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[27642.524528] RIP: 0010:do_user_addr_fault+0x18a/0x680
[27642.525362] Code: ff 0f 84 75 03 00 00 48 89 ee 4c 89 e7 e8 5e b9 22
00 49 89 c0 48 85 c0 0f 84 a8 02 00 00 f7 c3 60 80 00 00 74 22 31 c9 eb
ae <0f> 0b 48 83 c4 10 48 89 ea 48 89 de 4c 89 f7 5b 5d 41 5c 41 5d
41
[27642.528166] RSP: 0018:ffff88810770f6b8 EFLAGS: 00010046
[27642.529038] RAX: 0000000000000000 RBX: 0000000000000002 RCX:
ffff88810b980f00
[27642.530158] RDX: 00000000000000a0 RSI: 0000000000000002 RDI:
ffff88810770f728
[27642.531270] RBP: 00000000000000a0 R08: 0000000000000000 R09:
0000000000000000
[27642.532383] R10: 0000000000000000 R11: 0000000000000000 R12:
ffff888103f3c4c0
[27642.533499] R13: 0000000000000000 R14: ffff88810770f728 R15:
0000000000000000
[27642.534614] FS: 00007f197c741740(0000) GS:ffff88856a94c000(0000)
knlGS:0000000000000000
[27642.535915] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[27642.536858] CR2: 00000000000000a0 CR3: 000000011334c003 CR4:
0000000000172eb0
[27642.537982] Call Trace:
[27642.538466] <TASK>
[27642.538907] exc_page_fault+0x76/0x140
[27642.539583] asm_exc_page_fault+0x22/0x30
[27642.540282] RIP: 0010:_raw_spin_lock_irqsave+0x10/0x30
[27642.541134] Code: 07 85 c0 75 11 ba ff 00 00 00 f0 0f b1 17 75 06 b8
01 00 00 00 c3 31 c0 c3 90 0f 1f 44 00 00 53 9c 5b fa 31 c0 ba 01 00 00
00 <f0> 0f b1 17 75 05 48 89 d8 5b c3 89 c6 e8 7e 02 00 00 48 89 d8
5b
[27642.543936] RSP: 0018:ffff88810770f7d8 EFLAGS: 00010046
[27642.544803] RAX: 0000000000000000 RBX: 0000000000000202 RCX:
ffff888113ad96d8
[27642.545916] RDX: 0000000000000001 RSI: ffff88810770f818 RDI:
00000000000000a0
[27642.547027] RBP: 0000000000000098 R08: 0000000000000400 R09:
ffff88810b980f00
[27642.548140] R10: 0000000000000001 R11: ffff888101845a80 R12:
00000000000000a8
[27642.549263] R13: ffffffffa02a9060 R14: 00000000000000a0 R15:
ffff8881130d8a40
[27642.550379] complete_all+0x20/0x90
[27642.551010] mlx5e_ipsec_disable_events+0xb6/0xf0 [mlx5_core]
[27642.552022] mlx5e_nic_disable+0x12d/0x220 [mlx5_core]
[27642.552929] mlx5e_detach_netdev+0x66/0xf0 [mlx5_core]
[27642.553822] mlx5e_netdev_change_profile+0x5b/0x120 [mlx5_core]
[27642.554821] mlx5e_vport_rep_load+0x419/0x590 [mlx5_core]
[27642.555757] ? xa_load+0x53/0x90
[27642.556361] __esw_offloads_load_rep+0x54/0x70 [mlx5_core]
[27642.557328] mlx5_esw_offloads_rep_load+0x45/0xd0 [mlx5_core]
[27642.558320] esw_offloads_enable+0xb4b/0xc90 [mlx5_core]
[27642.559247] mlx5_eswitch_enable_locked+0x34e/0x4f0 [mlx5_core]
[27642.560257] ? mlx5_rescan_drivers_locked+0x222/0x2d0 [mlx5_core]
[27642.561284] mlx5_devlink_eswitch_mode_set+0x5ac/0x9c0 [mlx5_core]
[27642.562334] ? devlink_rate_set_ops_supported+0x21/0x3a0
[27642.563220] devlink_nl_eswitch_set_doit+0x67/0xe0
[27642.564026] genl_family_rcv_msg_doit+0xe0/0x130
[27642.564816] genl_rcv_msg+0x183/0x290
[27642.565466] ? __devlink_nl_pre_doit.isra.0+0x160/0x160
[27642.566329] ? d
---truncated---
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7e212cebc863c2c7a82f480446cd731721451691 Version: 664f76be38a18c61151d0ef248c7e2f3afb4f3c7 Version: 664f76be38a18c61151d0ef248c7e2f3afb4f3c7 Version: 664f76be38a18c61151d0ef248c7e2f3afb4f3c7 Version: 8956686d398eca6d324d2d164f9d2a281175a3a1 Version: 6.12.56 ≤ Version: 6.17.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "05c9a6df3646cdd25e0e10e6ef2d20cdba3ed8f9",
"status": "affected",
"version": "7e212cebc863c2c7a82f480446cd731721451691",
"versionType": "git"
},
{
"lessThan": "835778685f157b4fd4683b670cfe4010265bac60",
"status": "affected",
"version": "664f76be38a18c61151d0ef248c7e2f3afb4f3c7",
"versionType": "git"
},
{
"lessThan": "bc72f739f398d9d2e4f3d06f3f75fe98876d5579",
"status": "affected",
"version": "664f76be38a18c61151d0ef248c7e2f3afb4f3c7",
"versionType": "git"
},
{
"lessThan": "24b2795f9683e092dc22a68f487e7aaaf2ddafea",
"status": "affected",
"version": "664f76be38a18c61151d0ef248c7e2f3afb4f3c7",
"versionType": "git"
},
{
"status": "affected",
"version": "8956686d398eca6d324d2d164f9d2a281175a3a1",
"versionType": "git"
},
{
"lessThan": "6.12.78",
"status": "affected",
"version": "6.12.56",
"versionType": "semver"
},
{
"lessThan": "6.18",
"status": "affected",
"version": "6.17.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.12.56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Fix crash when moving to switchdev mode\n\nWhen moving to switchdev mode when the device doesn\u0027t support IPsec,\nwe try to clean up the IPsec resources anyway which causes the crash\nbelow, fix that by correctly checking for IPsec support before trying\nto clean up its resources.\n\n[27642.515799] WARNING: arch/x86/mm/fault.c:1276 at\ndo_user_addr_fault+0x18a/0x680, CPU#4: devlink/6490\n[27642.517159] Modules linked in: xt_conntrack xt_MASQUERADE\nip6table_nat ip6table_filter ip6_tables iptable_nat nf_nat xt_addrtype\nrpcsec_gss_krb5 auth_rpcgss oid_registry overlay mlx5_fwctl nfnetlink\nzram zsmalloc mlx5_ib fuse rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi\nscsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_core\nib_core\n[27642.521358] CPU: 4 UID: 0 PID: 6490 Comm: devlink Not tainted\n6.19.0-rc5_for_upstream_min_debug_2026_01_14_16_47 #1 NONE\n[27642.522923] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\nrel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[27642.524528] RIP: 0010:do_user_addr_fault+0x18a/0x680\n[27642.525362] Code: ff 0f 84 75 03 00 00 48 89 ee 4c 89 e7 e8 5e b9 22\n00 49 89 c0 48 85 c0 0f 84 a8 02 00 00 f7 c3 60 80 00 00 74 22 31 c9 eb\n ae \u003c0f\u003e 0b 48 83 c4 10 48 89 ea 48 89 de 4c 89 f7 5b 5d 41 5c 41 5d\n41\n[27642.528166] RSP: 0018:ffff88810770f6b8 EFLAGS: 00010046\n[27642.529038] RAX: 0000000000000000 RBX: 0000000000000002 RCX:\nffff88810b980f00\n[27642.530158] RDX: 00000000000000a0 RSI: 0000000000000002 RDI:\nffff88810770f728\n[27642.531270] RBP: 00000000000000a0 R08: 0000000000000000 R09:\n0000000000000000\n[27642.532383] R10: 0000000000000000 R11: 0000000000000000 R12:\nffff888103f3c4c0\n[27642.533499] R13: 0000000000000000 R14: ffff88810770f728 R15:\n0000000000000000\n[27642.534614] FS: 00007f197c741740(0000) GS:ffff88856a94c000(0000)\nknlGS:0000000000000000\n[27642.535915] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[27642.536858] CR2: 00000000000000a0 CR3: 000000011334c003 CR4:\n0000000000172eb0\n[27642.537982] Call Trace:\n[27642.538466] \u003cTASK\u003e\n[27642.538907] exc_page_fault+0x76/0x140\n[27642.539583] asm_exc_page_fault+0x22/0x30\n[27642.540282] RIP: 0010:_raw_spin_lock_irqsave+0x10/0x30\n[27642.541134] Code: 07 85 c0 75 11 ba ff 00 00 00 f0 0f b1 17 75 06 b8\n01 00 00 00 c3 31 c0 c3 90 0f 1f 44 00 00 53 9c 5b fa 31 c0 ba 01 00 00\n 00 \u003cf0\u003e 0f b1 17 75 05 48 89 d8 5b c3 89 c6 e8 7e 02 00 00 48 89 d8\n 5b\n[27642.543936] RSP: 0018:ffff88810770f7d8 EFLAGS: 00010046\n[27642.544803] RAX: 0000000000000000 RBX: 0000000000000202 RCX:\nffff888113ad96d8\n[27642.545916] RDX: 0000000000000001 RSI: ffff88810770f818 RDI:\n00000000000000a0\n[27642.547027] RBP: 0000000000000098 R08: 0000000000000400 R09:\nffff88810b980f00\n[27642.548140] R10: 0000000000000001 R11: ffff888101845a80 R12:\n00000000000000a8\n[27642.549263] R13: ffffffffa02a9060 R14: 00000000000000a0 R15:\nffff8881130d8a40\n[27642.550379] complete_all+0x20/0x90\n[27642.551010] mlx5e_ipsec_disable_events+0xb6/0xf0 [mlx5_core]\n[27642.552022] mlx5e_nic_disable+0x12d/0x220 [mlx5_core]\n[27642.552929] mlx5e_detach_netdev+0x66/0xf0 [mlx5_core]\n[27642.553822] mlx5e_netdev_change_profile+0x5b/0x120 [mlx5_core]\n[27642.554821] mlx5e_vport_rep_load+0x419/0x590 [mlx5_core]\n[27642.555757] ? xa_load+0x53/0x90\n[27642.556361] __esw_offloads_load_rep+0x54/0x70 [mlx5_core]\n[27642.557328] mlx5_esw_offloads_rep_load+0x45/0xd0 [mlx5_core]\n[27642.558320] esw_offloads_enable+0xb4b/0xc90 [mlx5_core]\n[27642.559247] mlx5_eswitch_enable_locked+0x34e/0x4f0 [mlx5_core]\n[27642.560257] ? mlx5_rescan_drivers_locked+0x222/0x2d0 [mlx5_core]\n[27642.561284] mlx5_devlink_eswitch_mode_set+0x5ac/0x9c0 [mlx5_core]\n[27642.562334] ? devlink_rate_set_ops_supported+0x21/0x3a0\n[27642.563220] devlink_nl_eswitch_set_doit+0x67/0xe0\n[27642.564026] genl_family_rcv_msg_doit+0xe0/0x130\n[27642.564816] genl_rcv_msg+0x183/0x290\n[27642.565466] ? __devlink_nl_pre_doit.isra.0+0x160/0x160\n[27642.566329] ? d\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:07:09.943Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/05c9a6df3646cdd25e0e10e6ef2d20cdba3ed8f9"
},
{
"url": "https://git.kernel.org/stable/c/835778685f157b4fd4683b670cfe4010265bac60"
},
{
"url": "https://git.kernel.org/stable/c/bc72f739f398d9d2e4f3d06f3f75fe98876d5579"
},
{
"url": "https://git.kernel.org/stable/c/24b2795f9683e092dc22a68f487e7aaaf2ddafea"
}
],
"title": "net/mlx5: Fix crash when moving to switchdev mode",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43467",
"datePublished": "2026-05-08T14:22:28.216Z",
"dateReserved": "2026-05-01T14:12:56.011Z",
"dateUpdated": "2026-05-23T16:07:09.943Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43094 (GCVE-0-2026-43094)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-06-01 16:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ixgbevf: add missing negotiate_features op to Hyper-V ops table
Commit a7075f501bd3 ("ixgbevf: fix mailbox API compatibility by
negotiating supported features") added the .negotiate_features callback
to ixgbe_mac_operations and populated it in ixgbevf_mac_ops, but forgot
to add it to ixgbevf_hv_mac_ops. This leaves the function pointer NULL
on Hyper-V VMs.
During probe, ixgbevf_negotiate_api() calls ixgbevf_set_features(),
which unconditionally dereferences hw->mac.ops.negotiate_features().
On Hyper-V this results in a NULL pointer dereference:
BUG: kernel NULL pointer dereference, address: 0000000000000000
[...]
Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine [...]
Workqueue: events work_for_cpu_fn
RIP: 0010:0x0
[...]
Call Trace:
ixgbevf_negotiate_api+0x66/0x160 [ixgbevf]
ixgbevf_sw_init+0xe4/0x1f0 [ixgbevf]
ixgbevf_probe+0x20f/0x4a0 [ixgbevf]
local_pci_probe+0x50/0xa0
work_for_cpu_fn+0x1a/0x30
[...]
Add ixgbevf_hv_negotiate_features_vf() that returns -EOPNOTSUPP and
wire it into ixgbevf_hv_mac_ops. The caller already handles -EOPNOTSUPP
gracefully.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 871ac1cd4ce4804defcb428cbb003fd84c415ff4 Version: 2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18 Version: bf580112ed61736c2645a893413a04732505d4b1 Version: a7075f501bd33c93570af759b6f4302ef0175168 Version: a7075f501bd33c93570af759b6f4302ef0175168 Version: a7075f501bd33c93570af759b6f4302ef0175168 Version: a376e29b1b196dc90b50df7e5e3947e3026300c4 Version: 6.1.158 ≤ Version: 6.6.114 ≤ Version: 6.12.55 ≤ Version: 6.17.5 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ixgbevf/vf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "376d74ea03589914fbe2dedcbebf418396c04fd0",
"status": "affected",
"version": "871ac1cd4ce4804defcb428cbb003fd84c415ff4",
"versionType": "git"
},
{
"lessThan": "d8a747057a17ffc79e31df1abb11d05e1669d8e5",
"status": "affected",
"version": "2e0aab9ddaf1428602c78f12064cd1e6ffcc4d18",
"versionType": "git"
},
{
"lessThan": "2270ebab53128fb73c4a70a292be09094074737f",
"status": "affected",
"version": "bf580112ed61736c2645a893413a04732505d4b1",
"versionType": "git"
},
{
"lessThan": "4db7b61ec1d1b2b67c0881b62fc4f9583bc21484",
"status": "affected",
"version": "a7075f501bd33c93570af759b6f4302ef0175168",
"versionType": "git"
},
{
"lessThan": "1455ff8809843e6e83f1f5b5c0bcc2224c99a3cb",
"status": "affected",
"version": "a7075f501bd33c93570af759b6f4302ef0175168",
"versionType": "git"
},
{
"lessThan": "4821d563cd7f251ae728be1a6d04af82a294a5b9",
"status": "affected",
"version": "a7075f501bd33c93570af759b6f4302ef0175168",
"versionType": "git"
},
{
"status": "affected",
"version": "a376e29b1b196dc90b50df7e5e3947e3026300c4",
"versionType": "git"
},
{
"lessThan": "6.1.175",
"status": "affected",
"version": "6.1.158",
"versionType": "semver"
},
{
"lessThan": "6.6.136",
"status": "affected",
"version": "6.6.114",
"versionType": "semver"
},
{
"lessThan": "6.12.83",
"status": "affected",
"version": "6.12.55",
"versionType": "semver"
},
{
"lessThan": "6.18",
"status": "affected",
"version": "6.17.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ixgbevf/vf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "6.1.158",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "6.6.114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "6.12.55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nixgbevf: add missing negotiate_features op to Hyper-V ops table\n\nCommit a7075f501bd3 (\"ixgbevf: fix mailbox API compatibility by\nnegotiating supported features\") added the .negotiate_features callback\nto ixgbe_mac_operations and populated it in ixgbevf_mac_ops, but forgot\nto add it to ixgbevf_hv_mac_ops. This leaves the function pointer NULL\non Hyper-V VMs.\n\nDuring probe, ixgbevf_negotiate_api() calls ixgbevf_set_features(),\nwhich unconditionally dereferences hw-\u003emac.ops.negotiate_features().\nOn Hyper-V this results in a NULL pointer dereference:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n [...]\n Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine [...]\n Workqueue: events work_for_cpu_fn\n RIP: 0010:0x0\n [...]\n Call Trace:\n ixgbevf_negotiate_api+0x66/0x160 [ixgbevf]\n ixgbevf_sw_init+0xe4/0x1f0 [ixgbevf]\n ixgbevf_probe+0x20f/0x4a0 [ixgbevf]\n local_pci_probe+0x50/0xa0\n work_for_cpu_fn+0x1a/0x30\n [...]\n\nAdd ixgbevf_hv_negotiate_features_vf() that returns -EOPNOTSUPP and\nwire it into ixgbevf_hv_mac_ops. The caller already handles -EOPNOTSUPP\ngracefully."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T16:14:38.068Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/376d74ea03589914fbe2dedcbebf418396c04fd0"
},
{
"url": "https://git.kernel.org/stable/c/d8a747057a17ffc79e31df1abb11d05e1669d8e5"
},
{
"url": "https://git.kernel.org/stable/c/2270ebab53128fb73c4a70a292be09094074737f"
},
{
"url": "https://git.kernel.org/stable/c/4db7b61ec1d1b2b67c0881b62fc4f9583bc21484"
},
{
"url": "https://git.kernel.org/stable/c/1455ff8809843e6e83f1f5b5c0bcc2224c99a3cb"
},
{
"url": "https://git.kernel.org/stable/c/4821d563cd7f251ae728be1a6d04af82a294a5b9"
}
],
"title": "ixgbevf: add missing negotiate_features op to Hyper-V ops table",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43094",
"datePublished": "2026-05-06T07:40:25.930Z",
"dateReserved": "2026-05-01T14:12:55.984Z",
"dateUpdated": "2026-06-01T16:14:38.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31765 (GCVE-0-2026-31765)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-05-11 22:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB
Currently, AMDGPU_VA_RESERVED_TRAP_SIZE is hardcoded to 8KB, while
KFD_CWSR_TBA_TMA_SIZE is defined as 2 * PAGE_SIZE. On systems with
4K pages, both values match (8KB), so allocation and reserved space
are consistent.
However, on 64K page-size systems, KFD_CWSR_TBA_TMA_SIZE becomes 128KB,
while the reserved trap area remains 8KB. This mismatch causes the
kernel to crash when running rocminfo or rccl unit tests.
Kernel attempted to read user page (2) - exploit attempt? (uid: 1001)
BUG: Kernel NULL pointer dereference on read at 0x00000002
Faulting instruction address: 0xc0000000002c8a64
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
CPU: 34 UID: 1001 PID: 9379 Comm: rocminfo Tainted: G E
6.19.0-rc4-amdgpu-00320-gf23176405700 #56 VOLUNTARY
Tainted: [E]=UNSIGNED_MODULE
Hardware name: IBM,9105-42A POWER10 (architected) 0x800200 0xf000006
of:IBM,FW1060.30 (ML1060_896) hv:phyp pSeries
NIP: c0000000002c8a64 LR: c00000000125dbc8 CTR: c00000000125e730
REGS: c0000001e0957580 TRAP: 0300 Tainted: G E
MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24008268
XER: 00000036
CFAR: c00000000125dbc4 DAR: 0000000000000002 DSISR: 40000000
IRQMASK: 1
GPR00: c00000000125d908 c0000001e0957820 c0000000016e8100
c00000013d814540
GPR04: 0000000000000002 c00000013d814550 0000000000000045
0000000000000000
GPR08: c00000013444d000 c00000013d814538 c00000013d814538
0000000084002268
GPR12: c00000000125e730 c000007e2ffd5f00 ffffffffffffffff
0000000000020000
GPR16: 0000000000000000 0000000000000002 c00000015f653000
0000000000000000
GPR20: c000000138662400 c00000013d814540 0000000000000000
c00000013d814500
GPR24: 0000000000000000 0000000000000002 c0000001e0957888
c0000001e0957878
GPR28: c00000013d814548 0000000000000000 c00000013d814540
c0000001e0957888
NIP [c0000000002c8a64] __mutex_add_waiter+0x24/0xc0
LR [c00000000125dbc8] __mutex_lock.constprop.0+0x318/0xd00
Call Trace:
0xc0000001e0957890 (unreliable)
__mutex_lock.constprop.0+0x58/0xd00
amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x6fc/0xb60 [amdgpu]
kfd_process_alloc_gpuvm+0x54/0x1f0 [amdgpu]
kfd_process_device_init_cwsr_dgpu+0xa4/0x1a0 [amdgpu]
kfd_process_device_init_vm+0xd8/0x2e0 [amdgpu]
kfd_ioctl_acquire_vm+0xd0/0x130 [amdgpu]
kfd_ioctl+0x514/0x670 [amdgpu]
sys_ioctl+0x134/0x180
system_call_exception+0x114/0x300
system_call_vectored_common+0x15c/0x2ec
This patch changes AMDGPU_VA_RESERVED_TRAP_SIZE to 64 KB and
KFD_CWSR_TBA_TMA_SIZE to the AMD GPU page size. This means we reserve
64 KB for the trap in the address space, but only allocate 8 KB within
it. With this approach, the allocation size never exceeds the reserved
area.
(cherry picked from commit 31b8de5e55666f26ea7ece5f412b83eab3f56dbb)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h",
"drivers/gpu/drm/amd/amdkfd/kfd_priv.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6b2614a0ff05a2d2836311425091c8feca6f0c21",
"status": "affected",
"version": "34a1de0f79352086884553f78db271f957a98583",
"versionType": "git"
},
{
"lessThan": "77c918eaa4c916751769242567407f61c6af142a",
"status": "affected",
"version": "34a1de0f79352086884553f78db271f957a98583",
"versionType": "git"
},
{
"lessThan": "d3508cf822c4d96d3e492210314f8f6f2da7df58",
"status": "affected",
"version": "34a1de0f79352086884553f78db271f957a98583",
"versionType": "git"
},
{
"lessThan": "4487571ef17a30d274600b3bd6965f497a881299",
"status": "affected",
"version": "34a1de0f79352086884553f78db271f957a98583",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h",
"drivers/gpu/drm/amd/amdkfd/kfd_priv.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB\n\nCurrently, AMDGPU_VA_RESERVED_TRAP_SIZE is hardcoded to 8KB, while\nKFD_CWSR_TBA_TMA_SIZE is defined as 2 * PAGE_SIZE. On systems with\n4K pages, both values match (8KB), so allocation and reserved space\nare consistent.\n\nHowever, on 64K page-size systems, KFD_CWSR_TBA_TMA_SIZE becomes 128KB,\nwhile the reserved trap area remains 8KB. This mismatch causes the\nkernel to crash when running rocminfo or rccl unit tests.\n\nKernel attempted to read user page (2) - exploit attempt? (uid: 1001)\nBUG: Kernel NULL pointer dereference on read at 0x00000002\nFaulting instruction address: 0xc0000000002c8a64\nOops: Kernel access of bad area, sig: 11 [#1]\nLE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries\nCPU: 34 UID: 1001 PID: 9379 Comm: rocminfo Tainted: G E\n6.19.0-rc4-amdgpu-00320-gf23176405700 #56 VOLUNTARY\nTainted: [E]=UNSIGNED_MODULE\nHardware name: IBM,9105-42A POWER10 (architected) 0x800200 0xf000006\nof:IBM,FW1060.30 (ML1060_896) hv:phyp pSeries\nNIP: c0000000002c8a64 LR: c00000000125dbc8 CTR: c00000000125e730\nREGS: c0000001e0957580 TRAP: 0300 Tainted: G E\nMSR: 8000000000009033 \u003cSF,EE,ME,IR,DR,RI,LE\u003e CR: 24008268\nXER: 00000036\nCFAR: c00000000125dbc4 DAR: 0000000000000002 DSISR: 40000000\nIRQMASK: 1\nGPR00: c00000000125d908 c0000001e0957820 c0000000016e8100\nc00000013d814540\nGPR04: 0000000000000002 c00000013d814550 0000000000000045\n0000000000000000\nGPR08: c00000013444d000 c00000013d814538 c00000013d814538\n0000000084002268\nGPR12: c00000000125e730 c000007e2ffd5f00 ffffffffffffffff\n0000000000020000\nGPR16: 0000000000000000 0000000000000002 c00000015f653000\n0000000000000000\nGPR20: c000000138662400 c00000013d814540 0000000000000000\nc00000013d814500\nGPR24: 0000000000000000 0000000000000002 c0000001e0957888\nc0000001e0957878\nGPR28: c00000013d814548 0000000000000000 c00000013d814540\nc0000001e0957888\nNIP [c0000000002c8a64] __mutex_add_waiter+0x24/0xc0\nLR [c00000000125dbc8] __mutex_lock.constprop.0+0x318/0xd00\nCall Trace:\n0xc0000001e0957890 (unreliable)\n__mutex_lock.constprop.0+0x58/0xd00\namdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x6fc/0xb60 [amdgpu]\nkfd_process_alloc_gpuvm+0x54/0x1f0 [amdgpu]\nkfd_process_device_init_cwsr_dgpu+0xa4/0x1a0 [amdgpu]\nkfd_process_device_init_vm+0xd8/0x2e0 [amdgpu]\nkfd_ioctl_acquire_vm+0xd0/0x130 [amdgpu]\nkfd_ioctl+0x514/0x670 [amdgpu]\nsys_ioctl+0x134/0x180\nsystem_call_exception+0x114/0x300\nsystem_call_vectored_common+0x15c/0x2ec\n\nThis patch changes AMDGPU_VA_RESERVED_TRAP_SIZE to 64 KB and\nKFD_CWSR_TBA_TMA_SIZE to the AMD GPU page size. This means we reserve\n64 KB for the trap in the address space, but only allocate 8 KB within\nit. With this approach, the allocation size never exceeds the reserved\narea.\n\n(cherry picked from commit 31b8de5e55666f26ea7ece5f412b83eab3f56dbb)"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:15:22.861Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6b2614a0ff05a2d2836311425091c8feca6f0c21"
},
{
"url": "https://git.kernel.org/stable/c/77c918eaa4c916751769242567407f61c6af142a"
},
{
"url": "https://git.kernel.org/stable/c/d3508cf822c4d96d3e492210314f8f6f2da7df58"
},
{
"url": "https://git.kernel.org/stable/c/4487571ef17a30d274600b3bd6965f497a881299"
}
],
"title": "drm/amdgpu: Change AMDGPU_VA_RESERVED_TRAP_SIZE to 64KB",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31765",
"datePublished": "2026-05-01T14:14:55.907Z",
"dateReserved": "2026-03-09T15:48:24.140Z",
"dateUpdated": "2026-05-11T22:15:22.861Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31498 (GCVE-0-2026-31498)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-05-23 16:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
l2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED
state to support L2CAP reconfiguration (e.g. MTU changes). However,
since both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from
the initial configuration, the reconfiguration path falls through to
l2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and
retrans_list without freeing the previous allocations and sets
chan->sdu to NULL without freeing the existing skb. This leaks all
previously allocated ERTM resources.
Additionally, l2cap_parse_conf_req() does not validate the minimum
value of remote_mps derived from the RFC max_pdu_size option. A zero
value propagates to l2cap_segment_sdu() where pdu_len becomes zero,
causing the while loop to never terminate since len is never
decremented, exhausting all available memory.
Fix the double-init by skipping l2cap_ertm_init() and
l2cap_chan_ready() when the channel is already in BT_CONNECTED state,
while still allowing the reconfiguration parameters to be updated
through l2cap_parse_conf_req(). Also add a pdu_len zero check in
l2cap_segment_sdu() as a safeguard.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 96298f640104e4cd9a913a6e50b0b981829b94ff Version: 96298f640104e4cd9a913a6e50b0b981829b94ff Version: 96298f640104e4cd9a913a6e50b0b981829b94ff Version: 96298f640104e4cd9a913a6e50b0b981829b94ff Version: 96298f640104e4cd9a913a6e50b0b981829b94ff Version: 96298f640104e4cd9a913a6e50b0b981829b94ff Version: 96298f640104e4cd9a913a6e50b0b981829b94ff Version: 96298f640104e4cd9a913a6e50b0b981829b94ff Version: 4ad03ff6f680681c5f78254e37c4c856fa953629 Version: b7d0ca715c1008acd2fc018f02a56fed88f78b75 Version: 799263eb37a4f7f6d39334046929c3bc92452a7f Version: 8828622fb9b4201eeb0870587052e3d834cfaf61 Version: b432ea85ab8472763870dd0f2c186130dd36d68c Version: 4.4.238 ≤ Version: 4.9.238 ≤ Version: 4.14.200 ≤ Version: 4.19.149 ≤ Version: 5.4.69 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9760b83cfd24b38caee663f429011a0dd6064fa9",
"status": "affected",
"version": "96298f640104e4cd9a913a6e50b0b981829b94ff",
"versionType": "git"
},
{
"lessThan": "de37e2655b7abc3f59254c6b72256840f39fc6d5",
"status": "affected",
"version": "96298f640104e4cd9a913a6e50b0b981829b94ff",
"versionType": "git"
},
{
"lessThan": "e7aab23b7df89a3d754a5f0a7d2237548b328bd0",
"status": "affected",
"version": "96298f640104e4cd9a913a6e50b0b981829b94ff",
"versionType": "git"
},
{
"lessThan": "52667c859fe33f70c2e711cb81bbd505d5eb8e75",
"status": "affected",
"version": "96298f640104e4cd9a913a6e50b0b981829b94ff",
"versionType": "git"
},
{
"lessThan": "9a21a631ee034b1573dce14b572a24943dbfd7ae",
"status": "affected",
"version": "96298f640104e4cd9a913a6e50b0b981829b94ff",
"versionType": "git"
},
{
"lessThan": "900e4db5385ec2cacd372345a80ab9c8e105b3a3",
"status": "affected",
"version": "96298f640104e4cd9a913a6e50b0b981829b94ff",
"versionType": "git"
},
{
"lessThan": "042e2cd4bb11e5313b19b87593616524949e4c52",
"status": "affected",
"version": "96298f640104e4cd9a913a6e50b0b981829b94ff",
"versionType": "git"
},
{
"lessThan": "25f420a0d4cfd61d3d23ec4b9c56d9f443d91377",
"status": "affected",
"version": "96298f640104e4cd9a913a6e50b0b981829b94ff",
"versionType": "git"
},
{
"status": "affected",
"version": "4ad03ff6f680681c5f78254e37c4c856fa953629",
"versionType": "git"
},
{
"status": "affected",
"version": "b7d0ca715c1008acd2fc018f02a56fed88f78b75",
"versionType": "git"
},
{
"status": "affected",
"version": "799263eb37a4f7f6d39334046929c3bc92452a7f",
"versionType": "git"
},
{
"status": "affected",
"version": "8828622fb9b4201eeb0870587052e3d834cfaf61",
"versionType": "git"
},
{
"status": "affected",
"version": "b432ea85ab8472763870dd0f2c186130dd36d68c",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.238",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.238",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.200",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.149",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.69",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.200",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.149",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.69",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop\n\nl2cap_config_req() processes CONFIG_REQ for channels in BT_CONNECTED\nstate to support L2CAP reconfiguration (e.g. MTU changes). However,\nsince both CONF_INPUT_DONE and CONF_OUTPUT_DONE are already set from\nthe initial configuration, the reconfiguration path falls through to\nl2cap_ertm_init(), which re-initializes tx_q, srej_q, srej_list, and\nretrans_list without freeing the previous allocations and sets\nchan-\u003esdu to NULL without freeing the existing skb. This leaks all\npreviously allocated ERTM resources.\n\nAdditionally, l2cap_parse_conf_req() does not validate the minimum\nvalue of remote_mps derived from the RFC max_pdu_size option. A zero\nvalue propagates to l2cap_segment_sdu() where pdu_len becomes zero,\ncausing the while loop to never terminate since len is never\ndecremented, exhausting all available memory.\n\nFix the double-init by skipping l2cap_ertm_init() and\nl2cap_chan_ready() when the channel is already in BT_CONNECTED state,\nwhile still allowing the reconfiguration parameters to be updated\nthrough l2cap_parse_conf_req(). Also add a pdu_len zero check in\nl2cap_segment_sdu() as a safeguard."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:05:11.217Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9760b83cfd24b38caee663f429011a0dd6064fa9"
},
{
"url": "https://git.kernel.org/stable/c/de37e2655b7abc3f59254c6b72256840f39fc6d5"
},
{
"url": "https://git.kernel.org/stable/c/e7aab23b7df89a3d754a5f0a7d2237548b328bd0"
},
{
"url": "https://git.kernel.org/stable/c/52667c859fe33f70c2e711cb81bbd505d5eb8e75"
},
{
"url": "https://git.kernel.org/stable/c/9a21a631ee034b1573dce14b572a24943dbfd7ae"
},
{
"url": "https://git.kernel.org/stable/c/900e4db5385ec2cacd372345a80ab9c8e105b3a3"
},
{
"url": "https://git.kernel.org/stable/c/042e2cd4bb11e5313b19b87593616524949e4c52"
},
{
"url": "https://git.kernel.org/stable/c/25f420a0d4cfd61d3d23ec4b9c56d9f443d91377"
}
],
"title": "Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31498",
"datePublished": "2026-04-22T13:54:19.714Z",
"dateReserved": "2026-03-09T15:48:24.103Z",
"dateUpdated": "2026-05-23T16:05:11.217Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43264 (GCVE-0-2026-43264)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: of: display_timing: fix refcount leak in of_get_display_timings()
of_parse_phandle() returns a device_node with refcount incremented,
which is stored in 'entry' and then copied to 'native_mode'. When the
error paths at lines 184 or 192 jump to 'entryfail', native_mode's
refcount is not decremented, causing a refcount leak.
Fix this by changing the goto target from 'entryfail' to 'timingfail',
which properly calls of_node_put(native_mode) before cleanup.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cc3f414cf2e404130584b63d373161ba6fd24bc2 Version: cc3f414cf2e404130584b63d373161ba6fd24bc2 Version: cc3f414cf2e404130584b63d373161ba6fd24bc2 Version: cc3f414cf2e404130584b63d373161ba6fd24bc2 Version: cc3f414cf2e404130584b63d373161ba6fd24bc2 Version: cc3f414cf2e404130584b63d373161ba6fd24bc2 Version: cc3f414cf2e404130584b63d373161ba6fd24bc2 Version: cc3f414cf2e404130584b63d373161ba6fd24bc2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/of_display_timing.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "20881ad42e651c69d89eb38a2042838187900fd6",
"status": "affected",
"version": "cc3f414cf2e404130584b63d373161ba6fd24bc2",
"versionType": "git"
},
{
"lessThan": "b5bdcc5afbff845834d04d651773cb6b47db5dd3",
"status": "affected",
"version": "cc3f414cf2e404130584b63d373161ba6fd24bc2",
"versionType": "git"
},
{
"lessThan": "2b22e4fe1273c24f405ed7903349c4bbd82b6368",
"status": "affected",
"version": "cc3f414cf2e404130584b63d373161ba6fd24bc2",
"versionType": "git"
},
{
"lessThan": "3ed019654234edb8625c05d05e15d40f74e64f70",
"status": "affected",
"version": "cc3f414cf2e404130584b63d373161ba6fd24bc2",
"versionType": "git"
},
{
"lessThan": "d6f34bbff07476c6abb8672c89d217824871c5ed",
"status": "affected",
"version": "cc3f414cf2e404130584b63d373161ba6fd24bc2",
"versionType": "git"
},
{
"lessThan": "69290f2d3999c5fa1a7f5d5593cfc5461fa3ee64",
"status": "affected",
"version": "cc3f414cf2e404130584b63d373161ba6fd24bc2",
"versionType": "git"
},
{
"lessThan": "c5734f9030a8b1e13868d1641b5163d8e659306e",
"status": "affected",
"version": "cc3f414cf2e404130584b63d373161ba6fd24bc2",
"versionType": "git"
},
{
"lessThan": "eacf9840ae1285a1ef47eb0ce16d786e542bd4d7",
"status": "affected",
"version": "cc3f414cf2e404130584b63d373161ba6fd24bc2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/of_display_timing.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: of: display_timing: fix refcount leak in of_get_display_timings()\n\nof_parse_phandle() returns a device_node with refcount incremented,\nwhich is stored in \u0027entry\u0027 and then copied to \u0027native_mode\u0027. When the\nerror paths at lines 184 or 192 jump to \u0027entryfail\u0027, native_mode\u0027s\nrefcount is not decremented, causing a refcount leak.\n\nFix this by changing the goto target from \u0027entryfail\u0027 to \u0027timingfail\u0027,\nwhich properly calls of_node_put(native_mode) before cleanup."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:21:11.841Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/20881ad42e651c69d89eb38a2042838187900fd6"
},
{
"url": "https://git.kernel.org/stable/c/b5bdcc5afbff845834d04d651773cb6b47db5dd3"
},
{
"url": "https://git.kernel.org/stable/c/2b22e4fe1273c24f405ed7903349c4bbd82b6368"
},
{
"url": "https://git.kernel.org/stable/c/3ed019654234edb8625c05d05e15d40f74e64f70"
},
{
"url": "https://git.kernel.org/stable/c/d6f34bbff07476c6abb8672c89d217824871c5ed"
},
{
"url": "https://git.kernel.org/stable/c/69290f2d3999c5fa1a7f5d5593cfc5461fa3ee64"
},
{
"url": "https://git.kernel.org/stable/c/c5734f9030a8b1e13868d1641b5163d8e659306e"
},
{
"url": "https://git.kernel.org/stable/c/eacf9840ae1285a1ef47eb0ce16d786e542bd4d7"
}
],
"title": "fbdev: of: display_timing: fix refcount leak in of_get_display_timings()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43264",
"datePublished": "2026-05-06T11:28:50.867Z",
"dateReserved": "2026-05-01T14:12:55.997Z",
"dateUpdated": "2026-05-11T22:21:11.841Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45899 (GCVE-0-2026-45899)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-05-30 10:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: drop extent cache when splitting extent fails
When the split extent fails, we might leave some extents still being
processed and return an error directly, which will result in stale
extent entries remaining in the extent status tree. So drop all of the
remaining potentially stale extents if the splitting fails.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 107a7bd31ac003e42c0f966aa8e5b26947de6024 Version: 107a7bd31ac003e42c0f966aa8e5b26947de6024 Version: 107a7bd31ac003e42c0f966aa8e5b26947de6024 Version: 107a7bd31ac003e42c0f966aa8e5b26947de6024 Version: 107a7bd31ac003e42c0f966aa8e5b26947de6024 Version: 107a7bd31ac003e42c0f966aa8e5b26947de6024 Version: 107a7bd31ac003e42c0f966aa8e5b26947de6024 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/extents.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6e54f8dfee359bbd58086c883ea8cffd5312999d",
"status": "affected",
"version": "107a7bd31ac003e42c0f966aa8e5b26947de6024",
"versionType": "git"
},
{
"lessThan": "337506dc652383c80839edb8d8dcdd8ff2129b4f",
"status": "affected",
"version": "107a7bd31ac003e42c0f966aa8e5b26947de6024",
"versionType": "git"
},
{
"lessThan": "dc7c9b9d03a59a7fe483574531327e650a4b4adc",
"status": "affected",
"version": "107a7bd31ac003e42c0f966aa8e5b26947de6024",
"versionType": "git"
},
{
"lessThan": "120c6bd7ca9d3e80a968b758cbb3fbd67570f132",
"status": "affected",
"version": "107a7bd31ac003e42c0f966aa8e5b26947de6024",
"versionType": "git"
},
{
"lessThan": "808f3191498f300174523c54cab101e18795ae4e",
"status": "affected",
"version": "107a7bd31ac003e42c0f966aa8e5b26947de6024",
"versionType": "git"
},
{
"lessThan": "31bf37cf53ede8145e2bc62da803d4506da92975",
"status": "affected",
"version": "107a7bd31ac003e42c0f966aa8e5b26947de6024",
"versionType": "git"
},
{
"lessThan": "79b592e8f1b435796cbc2722190368e3e8ffd7a1",
"status": "affected",
"version": "107a7bd31ac003e42c0f966aa8e5b26947de6024",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/extents.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.12"
},
{
"lessThan": "3.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: drop extent cache when splitting extent fails\n\nWhen the split extent fails, we might leave some extents still being\nprocessed and return an error directly, which will result in stale\nextent entries remaining in the extent status tree. So drop all of the\nremaining potentially stale extents if the splitting fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-30T10:41:44.680Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6e54f8dfee359bbd58086c883ea8cffd5312999d"
},
{
"url": "https://git.kernel.org/stable/c/337506dc652383c80839edb8d8dcdd8ff2129b4f"
},
{
"url": "https://git.kernel.org/stable/c/dc7c9b9d03a59a7fe483574531327e650a4b4adc"
},
{
"url": "https://git.kernel.org/stable/c/120c6bd7ca9d3e80a968b758cbb3fbd67570f132"
},
{
"url": "https://git.kernel.org/stable/c/808f3191498f300174523c54cab101e18795ae4e"
},
{
"url": "https://git.kernel.org/stable/c/31bf37cf53ede8145e2bc62da803d4506da92975"
},
{
"url": "https://git.kernel.org/stable/c/79b592e8f1b435796cbc2722190368e3e8ffd7a1"
}
],
"title": "ext4: drop extent cache when splitting extent fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45899",
"datePublished": "2026-05-27T12:17:08.447Z",
"dateReserved": "2026-05-13T15:03:33.083Z",
"dateUpdated": "2026-05-30T10:41:44.680Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46216 (GCVE-0-2026-46216)
Vulnerability from cvelistv5
Published
2026-05-28 09:40
Modified
2026-06-14 18:03
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()
When media GT is disabled via configfs, there is no allocation for
media_gt, which is kept as NULL. In such scenario,
intel_hdcp_gsc_check_status() results in a kernel pagefault error due to
>->uc.gsc being evaluated as an invalid memory address.
Fix that by introducing a NULL check on media_gt and bailing out early
if so.
While at it, also drop the NULL check for gsc, since it can't be NULL if
media_gt is not NULL.
v2:
- Get address for gsc only after checking that gt is not NULL.
(Shuicheng)
- Drop the NULL check for gsc. (Shuicheng)
v3:
- Add "Fixes" and "Cc: <stable...>" tags. (Matt)
(cherry picked from commit bfaf87e84ca3ca3f6e275f9ae56da47a8b55ffd1)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/display/xe_hdcp_gsc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cad210d2851f3a7d9573bdfc02aa61d9287bbe8c",
"status": "affected",
"version": "4af50beb4e0f9e6aed9cd53436c099f1dba826f1",
"versionType": "git"
},
{
"lessThan": "814326e86e929b865020ff44f4576dbdfe3f7ff3",
"status": "affected",
"version": "4af50beb4e0f9e6aed9cd53436c099f1dba826f1",
"versionType": "git"
},
{
"lessThan": "d8ab4b47edf4578dbfbe5e95817107a514fa34cc",
"status": "affected",
"version": "4af50beb4e0f9e6aed9cd53436c099f1dba826f1",
"versionType": "git"
},
{
"lessThan": "60a1e131a811b68703da58fd805ab359b704ab03",
"status": "affected",
"version": "4af50beb4e0f9e6aed9cd53436c099f1dba826f1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/xe/display/xe_hdcp_gsc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()\n\nWhen media GT is disabled via configfs, there is no allocation for\nmedia_gt, which is kept as NULL. In such scenario,\nintel_hdcp_gsc_check_status() results in a kernel pagefault error due to\n\u0026gt-\u003euc.gsc being evaluated as an invalid memory address.\n\nFix that by introducing a NULL check on media_gt and bailing out early\nif so.\n\nWhile at it, also drop the NULL check for gsc, since it can\u0027t be NULL if\nmedia_gt is not NULL.\n\nv2:\n - Get address for gsc only after checking that gt is not NULL.\n (Shuicheng)\n - Drop the NULL check for gsc. (Shuicheng)\nv3:\n - Add \"Fixes\" and \"Cc: \u003cstable...\u003e\" tags. (Matt)\n\n(cherry picked from commit bfaf87e84ca3ca3f6e275f9ae56da47a8b55ffd1)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:03:22.909Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cad210d2851f3a7d9573bdfc02aa61d9287bbe8c"
},
{
"url": "https://git.kernel.org/stable/c/814326e86e929b865020ff44f4576dbdfe3f7ff3"
},
{
"url": "https://git.kernel.org/stable/c/d8ab4b47edf4578dbfbe5e95817107a514fa34cc"
},
{
"url": "https://git.kernel.org/stable/c/60a1e131a811b68703da58fd805ab359b704ab03"
}
],
"title": "drm/xe/hdcp: Add NULL check for media_gt in intel_hdcp_gsc_check_status()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46216",
"datePublished": "2026-05-28T09:40:32.891Z",
"dateReserved": "2026-05-13T15:03:33.105Z",
"dateUpdated": "2026-06-14T18:03:22.909Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52962 (GCVE-0-2026-52962)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-06-29 04:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ceph: fix a buffer leak in __ceph_setxattr()
The old_blob in __ceph_setxattr() can store
ci->i_xattrs.prealloc_blob value during the retry.
However, it is never called the ceph_buffer_put()
for the old_blob object. This patch fixes the issue of
the buffer leak.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 86968ef21596515958d5f0a40233d02be78ecec0 Version: 86968ef21596515958d5f0a40233d02be78ecec0 Version: 86968ef21596515958d5f0a40233d02be78ecec0 Version: 86968ef21596515958d5f0a40233d02be78ecec0 Version: 86968ef21596515958d5f0a40233d02be78ecec0 Version: 86968ef21596515958d5f0a40233d02be78ecec0 Version: 86968ef21596515958d5f0a40233d02be78ecec0 Version: 86968ef21596515958d5f0a40233d02be78ecec0 Version: 1d86cb8d3204337e1853b84d69ea0f30dc0ba973 Version: 9cec64d3f6d91da590cc4069172254067b43d0b2 Version: de30fc2ca852365ed635f62d7d818bffc15e55c9 Version: dfb8712c7acce0689aed6c400a22b35f4d2861fe Version: f41cd559f1f3412db8e0acdede05ecf990ebfd8a Version: 4.4.192 ≤ Version: 4.9.192 ≤ Version: 4.14.143 ≤ Version: 4.19.72 ≤ Version: 5.2.14 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ceph/xattr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "521e5aba857fd267624892c8dd6295f22ce0267e",
"status": "affected",
"version": "86968ef21596515958d5f0a40233d02be78ecec0",
"versionType": "git"
},
{
"lessThan": "d0cb994605c84a159c1d00d72cdc8583c321ef95",
"status": "affected",
"version": "86968ef21596515958d5f0a40233d02be78ecec0",
"versionType": "git"
},
{
"lessThan": "ecf94823c5c6a20790bb76ed2816822b0beb0c22",
"status": "affected",
"version": "86968ef21596515958d5f0a40233d02be78ecec0",
"versionType": "git"
},
{
"lessThan": "4bfdcefdaa6092a06cacd59389c7756b36e6de8c",
"status": "affected",
"version": "86968ef21596515958d5f0a40233d02be78ecec0",
"versionType": "git"
},
{
"lessThan": "7d3e8d2d648d5f0df29b4710246680f47695fe94",
"status": "affected",
"version": "86968ef21596515958d5f0a40233d02be78ecec0",
"versionType": "git"
},
{
"lessThan": "3fa13ceefbc5f36131110342743994cb3de80637",
"status": "affected",
"version": "86968ef21596515958d5f0a40233d02be78ecec0",
"versionType": "git"
},
{
"lessThan": "bc7abce4460e490dcb579eec770f175b150b685f",
"status": "affected",
"version": "86968ef21596515958d5f0a40233d02be78ecec0",
"versionType": "git"
},
{
"lessThan": "5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e",
"status": "affected",
"version": "86968ef21596515958d5f0a40233d02be78ecec0",
"versionType": "git"
},
{
"status": "affected",
"version": "1d86cb8d3204337e1853b84d69ea0f30dc0ba973",
"versionType": "git"
},
{
"status": "affected",
"version": "9cec64d3f6d91da590cc4069172254067b43d0b2",
"versionType": "git"
},
{
"status": "affected",
"version": "de30fc2ca852365ed635f62d7d818bffc15e55c9",
"versionType": "git"
},
{
"status": "affected",
"version": "dfb8712c7acce0689aed6c400a22b35f4d2861fe",
"versionType": "git"
},
{
"status": "affected",
"version": "f41cd559f1f3412db8e0acdede05ecf990ebfd8a",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.192",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.192",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.143",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.72",
"versionType": "semver"
},
{
"lessThan": "5.3",
"status": "affected",
"version": "5.2.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ceph/xattr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.192",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.192",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.143",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.2.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix a buffer leak in __ceph_setxattr()\n\nThe old_blob in __ceph_setxattr() can store\nci-\u003ei_xattrs.prealloc_blob value during the retry.\nHowever, it is never called the ceph_buffer_put()\nfor the old_blob object. This patch fixes the issue of\nthe buffer leak."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T04:18:48.908Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/521e5aba857fd267624892c8dd6295f22ce0267e"
},
{
"url": "https://git.kernel.org/stable/c/d0cb994605c84a159c1d00d72cdc8583c321ef95"
},
{
"url": "https://git.kernel.org/stable/c/ecf94823c5c6a20790bb76ed2816822b0beb0c22"
},
{
"url": "https://git.kernel.org/stable/c/4bfdcefdaa6092a06cacd59389c7756b36e6de8c"
},
{
"url": "https://git.kernel.org/stable/c/7d3e8d2d648d5f0df29b4710246680f47695fe94"
},
{
"url": "https://git.kernel.org/stable/c/3fa13ceefbc5f36131110342743994cb3de80637"
},
{
"url": "https://git.kernel.org/stable/c/bc7abce4460e490dcb579eec770f175b150b685f"
},
{
"url": "https://git.kernel.org/stable/c/5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e"
}
],
"title": "ceph: fix a buffer leak in __ceph_setxattr()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52962",
"datePublished": "2026-06-24T16:28:42.688Z",
"dateReserved": "2026-06-09T07:44:35.374Z",
"dateUpdated": "2026-06-29T04:18:48.908Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43470 (GCVE-0-2026-43470)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-11 22:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfs: return EISDIR on nfs3_proc_create if d_alias is a dir
If we found an alias through nfs3_do_create/nfs_add_or_obtain
/d_splice_alias which happens to be a dir dentry, we don't return
any error, and simply forget about this alias, but the original
dentry we were adding and passed as parameter remains negative.
This later causes an oops on nfs_atomic_open_v23/finish_open since we
supply a negative dentry to do_dentry_open.
This has been observed running lustre-racer, where dirs and files are
created/removed concurrently with the same name and O_EXCL is not
used to open files (frequent file redirection).
While d_splice_alias typically returns a directory alias or NULL, we
explicitly check d_is_dir() to ensure that we don't attempt to perform
file operations (like finish_open) on a directory inode, which triggers
the observed oops.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfs/nfs3proc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7e2963773760a664684435201960dd2fb712f1b5",
"status": "affected",
"version": "7c6c5249f061b64fc6b5b90bc147169a048691bf",
"versionType": "git"
},
{
"lessThan": "203c792cb4315360d49973ae2e57feeb6d3dcf7e",
"status": "affected",
"version": "7c6c5249f061b64fc6b5b90bc147169a048691bf",
"versionType": "git"
},
{
"lessThan": "9ee1770fcb2f1b48354622b926e7dc10222805f5",
"status": "affected",
"version": "7c6c5249f061b64fc6b5b90bc147169a048691bf",
"versionType": "git"
},
{
"lessThan": "410666a298c34ebd57256fde6b24c96bd23059a2",
"status": "affected",
"version": "7c6c5249f061b64fc6b5b90bc147169a048691bf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfs/nfs3proc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs: return EISDIR on nfs3_proc_create if d_alias is a dir\n\nIf we found an alias through nfs3_do_create/nfs_add_or_obtain\n/d_splice_alias which happens to be a dir dentry, we don\u0027t return\nany error, and simply forget about this alias, but the original\ndentry we were adding and passed as parameter remains negative.\n\nThis later causes an oops on nfs_atomic_open_v23/finish_open since we\nsupply a negative dentry to do_dentry_open.\n\nThis has been observed running lustre-racer, where dirs and files are\ncreated/removed concurrently with the same name and O_EXCL is not\nused to open files (frequent file redirection).\n\nWhile d_splice_alias typically returns a directory alias or NULL, we\nexplicitly check d_is_dir() to ensure that we don\u0027t attempt to perform\nfile operations (like finish_open) on a directory inode, which triggers\nthe observed oops."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:25:13.820Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7e2963773760a664684435201960dd2fb712f1b5"
},
{
"url": "https://git.kernel.org/stable/c/203c792cb4315360d49973ae2e57feeb6d3dcf7e"
},
{
"url": "https://git.kernel.org/stable/c/9ee1770fcb2f1b48354622b926e7dc10222805f5"
},
{
"url": "https://git.kernel.org/stable/c/410666a298c34ebd57256fde6b24c96bd23059a2"
}
],
"title": "nfs: return EISDIR on nfs3_proc_create if d_alias is a dir",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43470",
"datePublished": "2026-05-08T14:22:30.218Z",
"dateReserved": "2026-05-01T14:12:56.011Z",
"dateUpdated": "2026-05-11T22:25:13.820Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53098 (GCVE-0-2026-53098)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-06-24 16:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
When the mt7915 pci chip is detaching, the mt7915_crash_data is
released in mt7915_coredump_unregister(). However, the work item
dump_work may still be running or pending, leading to UAF bugs
when the already freed crash_data is dereferenced again in
mt7915_mac_dump_work().
The race condition can occur as follows:
CPU 0 (removal path) | CPU 1 (workqueue)
mt7915_pci_remove() | mt7915_sys_recovery_set()
mt7915_unregister_device() | mt7915_reset()
mt7915_coredump_unregister() | queue_work()
vfree(dev->coredump.crash_data) | mt7915_mac_dump_work()
| crash_data-> // UAF
Fix this by ensuring dump_work is properly canceled before
the crash_data is deallocated. Add cancel_work_sync() in
mt7915_unregister_device() to synchronize with any pending
or executing dump work.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7915/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6d5202409467d621b6d1dfd7fc7dadb997fe66d2",
"status": "affected",
"version": "4dbcb9125cc3e10a6d879c10e4f5816d05a87c49",
"versionType": "git"
},
{
"lessThan": "e6856af8a22a8e2cd18241a465ed00c2301b3a5e",
"status": "affected",
"version": "4dbcb9125cc3e10a6d879c10e4f5816d05a87c49",
"versionType": "git"
},
{
"lessThan": "6b7cbb13c838cf2a5f2e7be0e96fe15250087939",
"status": "affected",
"version": "4dbcb9125cc3e10a6d879c10e4f5816d05a87c49",
"versionType": "git"
},
{
"lessThan": "21ce6d867867645fff0ef657be18f61d9f39dcd8",
"status": "affected",
"version": "4dbcb9125cc3e10a6d879c10e4f5816d05a87c49",
"versionType": "git"
},
{
"lessThan": "1146d0946b5358fad24812bd39d68f31cd40cc34",
"status": "affected",
"version": "4dbcb9125cc3e10a6d879c10e4f5816d05a87c49",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt7915/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()\n\nWhen the mt7915 pci chip is detaching, the mt7915_crash_data is\nreleased in mt7915_coredump_unregister(). However, the work item\ndump_work may still be running or pending, leading to UAF bugs\nwhen the already freed crash_data is dereferenced again in\nmt7915_mac_dump_work().\n\nThe race condition can occur as follows:\n\nCPU 0 (removal path) | CPU 1 (workqueue)\nmt7915_pci_remove() | mt7915_sys_recovery_set()\n mt7915_unregister_device() | mt7915_reset()\n mt7915_coredump_unregister() | queue_work()\n vfree(dev-\u003ecoredump.crash_data) | mt7915_mac_dump_work()\n | crash_data-\u003e // UAF\n\nFix this by ensuring dump_work is properly canceled before\nthe crash_data is deallocated. Add cancel_work_sync() in\nmt7915_unregister_device() to synchronize with any pending\nor executing dump work."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:30:35.887Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6d5202409467d621b6d1dfd7fc7dadb997fe66d2"
},
{
"url": "https://git.kernel.org/stable/c/e6856af8a22a8e2cd18241a465ed00c2301b3a5e"
},
{
"url": "https://git.kernel.org/stable/c/6b7cbb13c838cf2a5f2e7be0e96fe15250087939"
},
{
"url": "https://git.kernel.org/stable/c/21ce6d867867645fff0ef657be18f61d9f39dcd8"
},
{
"url": "https://git.kernel.org/stable/c/1146d0946b5358fad24812bd39d68f31cd40cc34"
}
],
"title": "wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53098",
"datePublished": "2026-06-24T16:30:35.887Z",
"dateReserved": "2026-06-09T07:44:35.384Z",
"dateUpdated": "2026-06-24T16:30:35.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43501 (GCVE-0-2026-43501)
Vulnerability from cvelistv5
Published
2026-05-21 12:17
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
ipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps
the next segment into ipv6_hdr->daddr, recompresses, then pulls the old
header and pushes the new one plus the IPv6 header back. The
recompressed header can be larger than the received one when the swap
reduces the common-prefix length the segments share with daddr (CmprI=0,
CmprE>0, seg[0][0] != daddr[0] gives the maximum +8 bytes).
pskb_expand_head() was gated on segments_left == 0, so on earlier
segments the push consumed unchecked headroom. Once skb_push() leaves
fewer than skb->mac_len bytes in front of data,
skb_mac_header_rebuild()'s call to:
skb_set_mac_header(skb, -skb->mac_len);
will store (data - head) - mac_len into the u16 mac_header field, which
wraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB
past skb->head.
A single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two
segment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one
pass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv.
Fix this by expanding the head whenever the remaining room is less than
the push size plus mac_len, and request that much extra so the rebuilt
MAC header fits afterwards.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 Version: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 Version: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 Version: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 Version: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 Version: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 Version: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 Version: 8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.22.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.82.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.15.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.178.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.178.1.rt14.463.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.134.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.125.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel. A local attacker can exploit an out-of-bounds write vulnerability when the kernel recomputes an IPv6 Source Routing Header (SRH). This issue occurs because insufficient headroom is reserved during the recompression process, leading to memory corruption. Successful exploitation could result in a denial of service or potentially arbitrary code execution."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-131",
"description": "Incorrect Calculation of Buffer Size",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:55:47.874Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-43501"
},
{
"name": "RHBZ#2480457",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480457"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43501.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27731"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25191"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34095"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27713"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34094"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25217"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33900"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:27731: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:25191: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:34095: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:27713: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:34094: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:25217: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:33900: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-21T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-21T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, disable IPv6 Source Routing by setting the `accept_source_route` sysctl parameter to 0 for all IPv6 interfaces. This can prevent the kernel from processing IPv6 Source Routing Headers, thereby avoiding the vulnerable code path.\n\nTo disable IPv6 Source Routing:\n`sysctl -w net.ipv6.conf.all.accept_source_route=0`\n`sysctl -w net.ipv6.conf.default.accept_source_route=0`\n\nTo make this change persistent across reboots, add the following lines to `/etc/sysctl.d/99-disable-ipv6-srh.conf`:\n`net.ipv6.conf.all.accept_source_route = 0`\n`net.ipv6.conf.default.accept_source_route = 0`\n\nThen, apply the changes with:\n`sysctl --system`\n\nDisabling IPv6 Source Routing may impact network configurations that rely on this feature."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/exthdrs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bde199c72d319a4e207f88daabc888317504e2fb",
"status": "affected",
"version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
"versionType": "git"
},
{
"lessThan": "be1fa0aa9b4fdd5a8b7a61ba520a690a68391e6e",
"status": "affected",
"version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
"versionType": "git"
},
{
"lessThan": "0a9e8053f1f8a8e1bfc1dd61ffe67be6c1180402",
"status": "affected",
"version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
"versionType": "git"
},
{
"lessThan": "8e8be63465a5e80394c70324603dfea1bfdad48f",
"status": "affected",
"version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
"versionType": "git"
},
{
"lessThan": "4babc2d9fda2df43823b85d08a0180b68f1b0854",
"status": "affected",
"version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
"versionType": "git"
},
{
"lessThan": "c261d07a80576dc8ccf394ef8f074f8c67a06b37",
"status": "affected",
"version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
"versionType": "git"
},
{
"lessThan": "7398ebefbfd4f8a31d4f665a4213302fa995494b",
"status": "affected",
"version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
"versionType": "git"
},
{
"lessThan": "9e6bf146b55999a095bb14f73a843942456d1adc",
"status": "affected",
"version": "8610c7c6e3bd647ff98d21c8bc0580e77bc2f8b3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/exthdrs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: rpl: reserve mac_len headroom when recompressed SRH grows\n\nipv6_rpl_srh_rcv() decompresses an RFC 6554 Source Routing Header, swaps\nthe next segment into ipv6_hdr-\u003edaddr, recompresses, then pulls the old\nheader and pushes the new one plus the IPv6 header back. The\nrecompressed header can be larger than the received one when the swap\nreduces the common-prefix length the segments share with daddr (CmprI=0,\nCmprE\u003e0, seg[0][0] != daddr[0] gives the maximum +8 bytes).\n\npskb_expand_head() was gated on segments_left == 0, so on earlier\nsegments the push consumed unchecked headroom. Once skb_push() leaves\nfewer than skb-\u003emac_len bytes in front of data,\nskb_mac_header_rebuild()\u0027s call to:\n\n\tskb_set_mac_header(skb, -skb-\u003emac_len);\n\nwill store (data - head) - mac_len into the u16 mac_header field, which\nwraps to ~65530, and the following memmove() writes mac_len bytes ~64KiB\npast skb-\u003ehead.\n\nA single AF_INET6/SOCK_RAW/IPV6_HDRINCL packet over lo with a two\nsegment type-3 SRH (CmprI=0, CmprE=15) reaches headroom 8 after one\npass; KASAN reports a 14-byte OOB write in ipv6_rthdr_rcv.\n\nFix this by expanding the head whenever the remaining room is less than\nthe push size plus mac_len, and request that much extra so the rebuilt\nMAC header fits afterwards."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in the IPv6 receive path processing a routing extension header (RFC 6554 RPL SRH); a remote attacker triggers it by sending a crafted unicast IPv6 packet addressed to a host that processes RPL source routing, with no link-locality requirement in the code.\nAC:L - Triggering is deterministic \u2014 a single packet drains headroom over loopback, and the attacker fully controls header compression and segment count (forcing repeated looped_back passes) to drive headroom below mac_len; success does not depend on uncontrolled memory layout.\nPR:N - Processing happens automatically during inbound packet handling with no authentication or capability check; an unauthenticated network peer needs only to send a packet.\nUI:N - The kernel processes the malicious extension header automatically on receipt; no victim action is required.\nS:U - The out-of-bounds write corrupts kernel heap memory within the kernel\u0027s own security authority; no crossing of a VM/IOMMU/sandbox boundary occurs.\nC:H - The out-of-bounds heap write is a memory-corruption primitive that can corrupt adjacent length/pointer fields to enable subsequent kernel memory disclosure, warranting High under the corruption-could-leak-info guidance.\nI:H - This is a heap out-of-bounds write (~64 KiB past skb-\u003ehead), directly corrupting kernel memory \u2014 out-of-bounds writes are High integrity impact and can be groomed toward control-flow hijacking.\nA:H - Writing mac_len bytes far past the skb buffer corrupts unrelated kernel memory, reliably producing an oops/panic (confirmed by KASAN), a High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:24.185Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bde199c72d319a4e207f88daabc888317504e2fb"
},
{
"url": "https://git.kernel.org/stable/c/be1fa0aa9b4fdd5a8b7a61ba520a690a68391e6e"
},
{
"url": "https://git.kernel.org/stable/c/0a9e8053f1f8a8e1bfc1dd61ffe67be6c1180402"
},
{
"url": "https://git.kernel.org/stable/c/8e8be63465a5e80394c70324603dfea1bfdad48f"
},
{
"url": "https://git.kernel.org/stable/c/4babc2d9fda2df43823b85d08a0180b68f1b0854"
},
{
"url": "https://git.kernel.org/stable/c/c261d07a80576dc8ccf394ef8f074f8c67a06b37"
},
{
"url": "https://git.kernel.org/stable/c/7398ebefbfd4f8a31d4f665a4213302fa995494b"
},
{
"url": "https://git.kernel.org/stable/c/9e6bf146b55999a095bb14f73a843942456d1adc"
}
],
"title": "ipv6: rpl: reserve mac_len headroom when recompressed SRH grows",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43501",
"datePublished": "2026-05-21T12:17:49.885Z",
"dateReserved": "2026-05-01T14:12:56.014Z",
"dateUpdated": "2026-08-05T12:28:24.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43043 (GCVE-0-2026-43043)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-05-11 22:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: af-alg - fix NULL pointer dereference in scatterwalk
The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL)
when chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL
exactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent
sendmsg() allocates a new SGL and chains it, but fails to clear the end
marker on the previous SGL's last data entry.
This causes the crypto scatterwalk to hit a premature end, returning NULL
on sg_next() and leading to a kernel panic during dereference.
Fix this by explicitly unmarking the end of the previous SGL when
performing sg_chain() in af_alg_alloc_tsgl().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 Version: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 Version: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 Version: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 Version: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 Version: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 Version: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 Version: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/af_alg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f48d3dd99199180cf37d6253550c55e86372309a",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "f9acceae7b004956851fd4268edf9f518a9bce04",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "7195350fb78538c25cd790d703f8f2c73ee0d395",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "7cdf2c6381b21ab5ccf8116750d5582fcd6c0f49",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "44eafa39363e8d5dfda6a8c6eb6b45458ed4b948",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "00cbdec17c15d024a1c5002c7365df7624a18a75",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "4b03ab0a587ec57eb7ddb5c115d84a42896f60f7",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "62397b493e14107ae82d8b80938f293d95425bcb",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/af_alg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af-alg - fix NULL pointer dereference in scatterwalk\n\nThe AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL)\nwhen chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL\nexactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent\nsendmsg() allocates a new SGL and chains it, but fails to clear the end\nmarker on the previous SGL\u0027s last data entry.\n\nThis causes the crypto scatterwalk to hit a premature end, returning NULL\non sg_next() and leading to a kernel panic during dereference.\n\nFix this by explicitly unmarking the end of the previous SGL when\nperforming sg_chain() in af_alg_alloc_tsgl()."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:16:36.820Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f48d3dd99199180cf37d6253550c55e86372309a"
},
{
"url": "https://git.kernel.org/stable/c/f9acceae7b004956851fd4268edf9f518a9bce04"
},
{
"url": "https://git.kernel.org/stable/c/7195350fb78538c25cd790d703f8f2c73ee0d395"
},
{
"url": "https://git.kernel.org/stable/c/7cdf2c6381b21ab5ccf8116750d5582fcd6c0f49"
},
{
"url": "https://git.kernel.org/stable/c/44eafa39363e8d5dfda6a8c6eb6b45458ed4b948"
},
{
"url": "https://git.kernel.org/stable/c/00cbdec17c15d024a1c5002c7365df7624a18a75"
},
{
"url": "https://git.kernel.org/stable/c/4b03ab0a587ec57eb7ddb5c115d84a42896f60f7"
},
{
"url": "https://git.kernel.org/stable/c/62397b493e14107ae82d8b80938f293d95425bcb"
}
],
"title": "crypto: af-alg - fix NULL pointer dereference in scatterwalk",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43043",
"datePublished": "2026-05-01T14:15:39.576Z",
"dateReserved": "2026-05-01T14:12:55.979Z",
"dateUpdated": "2026-05-11T22:16:36.820Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46275 (GCVE-0-2026-46275)
Vulnerability from cvelistv5
Published
2026-06-08 14:30
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer
Dereference (NPD) conditions were observed in the lifecycle management
of hci_uart.
The primary issue arises because the workqueues (init_ready and
write_work) are only flushed/cancelled if the HCI_UART_PROTO_READY
flag is set during TTY close. If a hangup occurs before setup completes,
hci_uart_tty_close() skips the teardown of these workqueues and
proceeds to free the `hu` struct. When the scheduled work executes
later, it blindly dereferences the freed `hu` struct.
Furthermore, several data races and UAFs were identified in the teardown
sequence:
1. Calling hci_uart_flush() from hci_uart_close() without effectively
disabling write_work causes a race condition where both can concurrently
double-free hu->tx_skb. This happens because protocol timers can
concurrently invoke hci_uart_tx_wakeup() and requeue write_work.
2. Calling hci_free_dev(hdev) before hu->proto->close(hu) causes a UAF
when vendor specific protocol close callbacks dereference hu->hdev.
3. In the initialization error paths, failing to take the proto_lock
write lock before clearing PROTO_READY leads to races with active
readers. Additionally, hci_uart_tty_receive() accesses hu->hdev
outside the read lock, leading to UAFs if the initialization error
path frees hdev concurrently.
Fix these synchronization and lifecycle issues by:
1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first,
followed immediately by a cancel_work_sync(&hu->write_work). Clearing
the flag locks out concurrent protocol timers from successfully invoking
hci_uart_tx_wakeup(), effectively rendering the cancellation permanent
and preventing the tx_skb double-free.
2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip
hu->proto->flush(). This is perfectly safe in the tty_close path
because hu->proto->close() executes shortly after, which intrinsically
purges all protocol SKB queues and tears down the state.
3. Relocating hu->proto->close(hu) strictly prior to hci_free_dev(hdev)
across all close and error paths to prevent vendor-level UAFs.
4. Moving the hdev->stat.byte_rx increment in hci_uart_tty_receive()
inside the proto_lock read-side critical section to safely synchronize
with device unregistration.
5. Adding cancel_work_sync(&hu->write_work) to hci_uart_close() to safely
flush the workqueue before hci_uart_flush() is invoked via the HCI core.
6. Utilizing cancel_work_sync() instead of disable_work_sync() across
all paths to prevent permanently breaking user-space retry capabilities.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3b799254cf6f481460719023d7a18f46651e5e7f Version: 3b799254cf6f481460719023d7a18f46651e5e7f Version: 3b799254cf6f481460719023d7a18f46651e5e7f Version: 3b799254cf6f481460719023d7a18f46651e5e7f Version: 3b799254cf6f481460719023d7a18f46651e5e7f Version: 3b799254cf6f481460719023d7a18f46651e5e7f Version: 3b799254cf6f481460719023d7a18f46651e5e7f Version: 3b799254cf6f481460719023d7a18f46651e5e7f Version: cd27019bc149f20f12ebec943c2b4c775745a5a0 Version: aea63181b6fcb6b9ccde1ada9ea51be19c4015af Version: 0d234d1135dcd8876de0576dac68efd0a87eef87 Version: 3fe978892ab46efc2f3830d9abc015eff72caaf9 Version: 0d987e14bebaf0f67ee7dbefaf6165c62cd1d27f Version: 4.14.203 ≤ Version: 4.19.153 ≤ Version: 5.4.73 ≤ Version: 5.8.17 ≤ Version: 5.9.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/hci_ldisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "78aad93e938f013d9272fe0ee168f27883afa95c",
"status": "affected",
"version": "3b799254cf6f481460719023d7a18f46651e5e7f",
"versionType": "git"
},
{
"lessThan": "e2d19969c8d9198ecc3090bcd5312ecd503a3339",
"status": "affected",
"version": "3b799254cf6f481460719023d7a18f46651e5e7f",
"versionType": "git"
},
{
"lessThan": "c85cff648a2bc92322912db5f1727ad05afae7b6",
"status": "affected",
"version": "3b799254cf6f481460719023d7a18f46651e5e7f",
"versionType": "git"
},
{
"lessThan": "9d20d48be2c4a071fb015eb09bda2cecd25daf34",
"status": "affected",
"version": "3b799254cf6f481460719023d7a18f46651e5e7f",
"versionType": "git"
},
{
"lessThan": "81c7a3c22a0f2808cf4ae0b4908f59763b23606d",
"status": "affected",
"version": "3b799254cf6f481460719023d7a18f46651e5e7f",
"versionType": "git"
},
{
"lessThan": "192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894",
"status": "affected",
"version": "3b799254cf6f481460719023d7a18f46651e5e7f",
"versionType": "git"
},
{
"lessThan": "7338031946bd06f6dff149e67b60c4cd083bfea8",
"status": "affected",
"version": "3b799254cf6f481460719023d7a18f46651e5e7f",
"versionType": "git"
},
{
"lessThan": "c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b",
"status": "affected",
"version": "3b799254cf6f481460719023d7a18f46651e5e7f",
"versionType": "git"
},
{
"status": "affected",
"version": "cd27019bc149f20f12ebec943c2b4c775745a5a0",
"versionType": "git"
},
{
"status": "affected",
"version": "aea63181b6fcb6b9ccde1ada9ea51be19c4015af",
"versionType": "git"
},
{
"status": "affected",
"version": "0d234d1135dcd8876de0576dac68efd0a87eef87",
"versionType": "git"
},
{
"status": "affected",
"version": "3fe978892ab46efc2f3830d9abc015eff72caaf9",
"versionType": "git"
},
{
"status": "affected",
"version": "0d987e14bebaf0f67ee7dbefaf6165c62cd1d27f",
"versionType": "git"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.203",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.153",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.73",
"versionType": "semver"
},
{
"lessThan": "5.9",
"status": "affected",
"version": "5.8.17",
"versionType": "semver"
},
{
"lessThan": "5.10",
"status": "affected",
"version": "5.9.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/hci_ldisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.203",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.153",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.8.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.9.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_uart: fix UAFs and race conditions in close and init paths\n\nVulnerabilities leading to Use-After-Free (UAF) and Null Pointer\nDereference (NPD) conditions were observed in the lifecycle management\nof hci_uart.\n\nThe primary issue arises because the workqueues (init_ready and\nwrite_work) are only flushed/cancelled if the HCI_UART_PROTO_READY\nflag is set during TTY close. If a hangup occurs before setup completes,\nhci_uart_tty_close() skips the teardown of these workqueues and\nproceeds to free the `hu` struct. When the scheduled work executes\nlater, it blindly dereferences the freed `hu` struct.\n\nFurthermore, several data races and UAFs were identified in the teardown\nsequence:\n1. Calling hci_uart_flush() from hci_uart_close() without effectively\n disabling write_work causes a race condition where both can concurrently\n double-free hu-\u003etx_skb. This happens because protocol timers can\n concurrently invoke hci_uart_tx_wakeup() and requeue write_work.\n2. Calling hci_free_dev(hdev) before hu-\u003eproto-\u003eclose(hu) causes a UAF\n when vendor specific protocol close callbacks dereference hu-\u003ehdev.\n3. In the initialization error paths, failing to take the proto_lock\n write lock before clearing PROTO_READY leads to races with active\n readers. Additionally, hci_uart_tty_receive() accesses hu-\u003ehdev\n outside the read lock, leading to UAFs if the initialization error\n path frees hdev concurrently.\n\nFix these synchronization and lifecycle issues by:\n1. Re-ordering hci_uart_tty_close() to clear HCI_UART_PROTO_READY first,\n followed immediately by a cancel_work_sync(\u0026hu-\u003ewrite_work). Clearing\n the flag locks out concurrent protocol timers from successfully invoking\n hci_uart_tx_wakeup(), effectively rendering the cancellation permanent\n and preventing the tx_skb double-free.\n2. Note: Clearing PROTO_READY early causes hci_uart_close() to skip\n hu-\u003eproto-\u003eflush(). This is perfectly safe in the tty_close path\n because hu-\u003eproto-\u003eclose() executes shortly after, which intrinsically\n purges all protocol SKB queues and tears down the state.\n3. Relocating hu-\u003eproto-\u003eclose(hu) strictly prior to hci_free_dev(hdev)\n across all close and error paths to prevent vendor-level UAFs.\n4. Moving the hdev-\u003estat.byte_rx increment in hci_uart_tty_receive()\n inside the proto_lock read-side critical section to safely synchronize\n with device unregistration.\n5. Adding cancel_work_sync(\u0026hu-\u003ewrite_work) to hci_uart_close() to safely\n flush the workqueue before hci_uart_flush() is invoked via the HCI core.\n6. Utilizing cancel_work_sync() instead of disable_work_sync() across\n all paths to prevent permanently breaking user-space retry capabilities."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local TTY control (TIOCSETD to N_HCI, HCIUARTSETPROTO ioctl, hangup/close) gated by CAP_NET_ADMIN at hci_uart_tty_open(); the bugs are in driver lifecycle teardown, not in processing of remote Bluetooth over-the-air packets.\nAC:L - The attacker controls both sides of every race by concurrently opening/closing the TTY line discipline, issuing HCIUART ioctls, and timing hangup against in-flight workqueues and protocol timers; UAF conditions are reliably winnable without luck-dependent memory layout.\nPR:L - hci_uart_tty_open() explicitly requires CAP_NET_ADMIN, and adapter teardown paths are similarly admin-gated; CAP_NET_ADMIN is obtainable by an unprivileged user inside a user namespace, satisfying the Low privileges threshold rather than High.\nUI:N - Once the attacker has the required local TTY/HCI access, triggering the UAF or double-free races requires no action from a separate victim user.\nS:U - The vulnerability corrupts kernel heap memory within the kernel\u0027s own security boundary; successful exploitation yields kernel privilege escalation, not a cross-boundary escape such as VM or sandbox breakout.\nC:H - Multiple use-after-free conditions on the hci_uart and hci_dev structures allow dereferencing attacker-influenced freed memory, providing a standard kernel info-leak primitive consistent with UAF severity guidance.\nI:H - The UAF and hu-\u003etx_skb double-free races enable control of freed slab objects and heap grooming, providing a path to arbitrary kernel memory corruption and potential code execution in kernel context.\nA:H - Use-after-free and double-free in kernel workqueue and teardown paths reliably cause kernel oops or panic, and can be triggered repeatedly to deny availability of the affected system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:58.918Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/78aad93e938f013d9272fe0ee168f27883afa95c"
},
{
"url": "https://git.kernel.org/stable/c/e2d19969c8d9198ecc3090bcd5312ecd503a3339"
},
{
"url": "https://git.kernel.org/stable/c/c85cff648a2bc92322912db5f1727ad05afae7b6"
},
{
"url": "https://git.kernel.org/stable/c/9d20d48be2c4a071fb015eb09bda2cecd25daf34"
},
{
"url": "https://git.kernel.org/stable/c/81c7a3c22a0f2808cf4ae0b4908f59763b23606d"
},
{
"url": "https://git.kernel.org/stable/c/192cb0f1ca706d9a1bc36ae0ad5f666d1e4fd894"
},
{
"url": "https://git.kernel.org/stable/c/7338031946bd06f6dff149e67b60c4cd083bfea8"
},
{
"url": "https://git.kernel.org/stable/c/c1bb9336ae6b54a5f6a353c4bd4ed9a4307e429b"
}
],
"title": "Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46275",
"datePublished": "2026-06-08T14:30:54.232Z",
"dateReserved": "2026-05-13T15:03:33.109Z",
"dateUpdated": "2026-08-05T12:30:58.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31680 (GCVE-0-2026-31680)
Vulnerability from cvelistv5
Published
2026-04-25 08:46
Modified
2026-08-05 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: flowlabel: defer exclusive option free until RCU teardown
`ip6fl_seq_show()` walks the global flowlabel hash under the seq-file
RCU read-side lock and prints `fl->opt->opt_nflen` when an option block
is present.
Exclusive flowlabels currently free `fl->opt` as soon as `fl->users`
drops to zero in `fl_release()`. However, the surrounding
`struct ip6_flowlabel` remains visible in the global hash table until
later garbage collection removes it and `fl_free_rcu()` finally tears it
down.
A concurrent `/proc/net/ip6_flowlabel` reader can therefore race that
early `kfree()` and dereference freed option state, triggering a crash
in `ip6fl_seq_show()`.
Fix this by keeping `fl->opt` alive until `fl_free_rcu()`. That matches
the lifetime already required for the enclosing flowlabel while readers
can still reach it under RCU.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d3aedd5ebd4b0b925b0bcda548066803e1318499 Version: d3aedd5ebd4b0b925b0bcda548066803e1318499 Version: d3aedd5ebd4b0b925b0bcda548066803e1318499 Version: d3aedd5ebd4b0b925b0bcda548066803e1318499 Version: d3aedd5ebd4b0b925b0bcda548066803e1318499 Version: d3aedd5ebd4b0b925b0bcda548066803e1318499 Version: d3aedd5ebd4b0b925b0bcda548066803e1318499 Version: d3aedd5ebd4b0b925b0bcda548066803e1318499 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:40.722Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_flowlabel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4b6798024f7b2d535f3db1002c760143cdbd1bd3",
"status": "affected",
"version": "d3aedd5ebd4b0b925b0bcda548066803e1318499",
"versionType": "git"
},
{
"lessThan": "3c54b66c83fb8fcbde8e6a7bf90b65856e39f827",
"status": "affected",
"version": "d3aedd5ebd4b0b925b0bcda548066803e1318499",
"versionType": "git"
},
{
"lessThan": "5a6b15f861b7c1304949e3350d23490a5fe429fd",
"status": "affected",
"version": "d3aedd5ebd4b0b925b0bcda548066803e1318499",
"versionType": "git"
},
{
"lessThan": "6c7fbdb8ffde6413640de7cfbd7c976c353e89f8",
"status": "affected",
"version": "d3aedd5ebd4b0b925b0bcda548066803e1318499",
"versionType": "git"
},
{
"lessThan": "8027964931785cb73d520ac70a342a3dc16c249b",
"status": "affected",
"version": "d3aedd5ebd4b0b925b0bcda548066803e1318499",
"versionType": "git"
},
{
"lessThan": "414726b69921fe6355ae453f5b35e68dd078342a",
"status": "affected",
"version": "d3aedd5ebd4b0b925b0bcda548066803e1318499",
"versionType": "git"
},
{
"lessThan": "572ce62778519a7d4d1c15f55dd2e45a474133c4",
"status": "affected",
"version": "d3aedd5ebd4b0b925b0bcda548066803e1318499",
"versionType": "git"
},
{
"lessThan": "9ca562bb8e66978b53028fa32b1a190708e6a091",
"status": "affected",
"version": "d3aedd5ebd4b0b925b0bcda548066803e1318499",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_flowlabel.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: flowlabel: defer exclusive option free until RCU teardown\n\n`ip6fl_seq_show()` walks the global flowlabel hash under the seq-file\nRCU read-side lock and prints `fl-\u003eopt-\u003eopt_nflen` when an option block\nis present.\n\nExclusive flowlabels currently free `fl-\u003eopt` as soon as `fl-\u003eusers`\ndrops to zero in `fl_release()`. However, the surrounding\n`struct ip6_flowlabel` remains visible in the global hash table until\nlater garbage collection removes it and `fl_free_rcu()` finally tears it\ndown.\n\nA concurrent `/proc/net/ip6_flowlabel` reader can therefore race that\nearly `kfree()` and dereference freed option state, triggering a crash\nin `ip6fl_seq_show()`.\n\nFix this by keeping `fl-\u003eopt` alive until `fl_free_rcu()`. That matches\nthe lifetime already required for the enclosing flowlabel while readers\ncan still reach it under RCU."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is local: an attacker creates/releases IPv6 flowlabels through setsockopt(IPV6_FLOWLABEL_MGR) while reading /proc/net/ip6_flowlabel. Remote IPv6 packets do not reach this flowlabel option lifetime bug.\nAC:L - The race is between two attacker-controlled operations: flowlabel release and procfs seq-file reading. The attacker can run both sides concurrently and repeat the race without relying on external conditions.\nPR:L - Supplying the needed IPv6 option state commonly requires CAP_NET_RAW, but the check is against the socket network namespace user_ns and is reachable with low privileges via user namespaces. No real init-namespace root/admin privilege is required in the highest reasonable deployment scenario.\nUI:N - The attacker can create the socket state, release it, and read /proc/net/ip6_flowlabel directly. No victim action is required.\nS:U - This is a kernel memory lifetime bug within the same host kernel security authority. It does not cross a VM, IOMMU, or separate authorization boundary.\nC:H - The bug is a use-after-free of struct ipv6_txoptions reachable from procfs output, and freed kernel heap contents can be exposed or attacker-shaped. Per the required conservative guidance, kernel UAFs are scored High for confidentiality.\nI:H - Although the observed dereference is a stale read, this is a kernel heap use-after-free in attacker-reclaimable memory. Per the required conservative guidance and upward scoring on uncertainty, UAFs are scored High for integrity.\nA:H - A concurrent /proc/net/ip6_flowlabel reader can dereference freed option state in ip6fl_seq_show(), causing an oops or kernel crash. Kernel crashes are High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:26.787Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4b6798024f7b2d535f3db1002c760143cdbd1bd3"
},
{
"url": "https://git.kernel.org/stable/c/3c54b66c83fb8fcbde8e6a7bf90b65856e39f827"
},
{
"url": "https://git.kernel.org/stable/c/5a6b15f861b7c1304949e3350d23490a5fe429fd"
},
{
"url": "https://git.kernel.org/stable/c/6c7fbdb8ffde6413640de7cfbd7c976c353e89f8"
},
{
"url": "https://git.kernel.org/stable/c/8027964931785cb73d520ac70a342a3dc16c249b"
},
{
"url": "https://git.kernel.org/stable/c/414726b69921fe6355ae453f5b35e68dd078342a"
},
{
"url": "https://git.kernel.org/stable/c/572ce62778519a7d4d1c15f55dd2e45a474133c4"
},
{
"url": "https://git.kernel.org/stable/c/9ca562bb8e66978b53028fa32b1a190708e6a091"
}
],
"title": "net: ipv6: flowlabel: defer exclusive option free until RCU teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31680",
"datePublished": "2026-04-25T08:46:56.807Z",
"dateReserved": "2026-03-09T15:48:24.130Z",
"dateUpdated": "2026-08-05T12:24:26.787Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53049 (GCVE-0-2026-53049)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
gfs2: add some missing log locking
Function gfs2_logd() calls the log flushing functions gfs2_ail1_start(),
gfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock,
but these functions require exclusion against concurrent transactions.
To fix that, add a non-locking __gfs2_log_flush() function. Then, in
gfs2_logd(), take sdp->sd_log_flush_lock before calling the above mentioned log
flushing functions and __gfs2_log_flush().
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5e4c7632aae1cce137792647f4fb6f599d1da893 Version: 5e4c7632aae1cce137792647f4fb6f599d1da893 Version: 5e4c7632aae1cce137792647f4fb6f599d1da893 Version: 5e4c7632aae1cce137792647f4fb6f599d1da893 Version: 5e4c7632aae1cce137792647f4fb6f599d1da893 Version: 5e4c7632aae1cce137792647f4fb6f599d1da893 Version: 5e4c7632aae1cce137792647f4fb6f599d1da893 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/gfs2/log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3b28eb75afe520972bacc833850c2b30aa0824cd",
"status": "affected",
"version": "5e4c7632aae1cce137792647f4fb6f599d1da893",
"versionType": "git"
},
{
"lessThan": "ca95342cb1b39062a03c115830286f0a426053d5",
"status": "affected",
"version": "5e4c7632aae1cce137792647f4fb6f599d1da893",
"versionType": "git"
},
{
"lessThan": "bf5fcd9c37c2546beaf7b401d31aefd89017dc3d",
"status": "affected",
"version": "5e4c7632aae1cce137792647f4fb6f599d1da893",
"versionType": "git"
},
{
"lessThan": "f2f225cf505ac016132ded21690f3ba0a080a4e8",
"status": "affected",
"version": "5e4c7632aae1cce137792647f4fb6f599d1da893",
"versionType": "git"
},
{
"lessThan": "49d9be0722da3a4a893ba905720cba1921834ec3",
"status": "affected",
"version": "5e4c7632aae1cce137792647f4fb6f599d1da893",
"versionType": "git"
},
{
"lessThan": "98e8bf249c790d56de1abc4a5f8bd68035a00921",
"status": "affected",
"version": "5e4c7632aae1cce137792647f4fb6f599d1da893",
"versionType": "git"
},
{
"lessThan": "fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8",
"status": "affected",
"version": "5e4c7632aae1cce137792647f4fb6f599d1da893",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/gfs2/log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: add some missing log locking\n\nFunction gfs2_logd() calls the log flushing functions gfs2_ail1_start(),\ngfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp-\u003esd_log_flush_lock,\nbut these functions require exclusion against concurrent transactions.\n\nTo fix that, add a non-locking __gfs2_log_flush() function. Then, in\ngfs2_logd(), take sdp-\u003esd_log_flush_lock before calling the above mentioned log\nflushing functions and __gfs2_log_flush()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - GFS2 can back kernel NFS/ksmbd exports, and remote file create/write/unlink requests reach the GFS2 VFS paths that create transactions and wake gfs2_logd. A remote attacker therefore does not need local code execution on a reasonably deployed file server using GFS2 storage.\nAC:L - The race is driven by ordinary concurrent filesystem activity and log pressure, which an attacker can create by issuing repeated parallel writes/metadata operations. No rare hardware state or uncontrollable timing condition is required beyond normal kernel scheduling.\nPR:N - In the highest reasonable deployment, a writable NFS export or guest/share can allow anonymous or unauthenticated remote write activity to reach these paths. No kernel capability or local administrative privilege is required to trigger the vulnerable log/transaction interaction in that scenario.\nUI:N - Once the GFS2 filesystem is mounted/exported, exploitation only requires attacker-initiated filesystem operations. No separate victim action is needed during the attack.\nS:U - The affected component is the host kernel filesystem implementation, and the impact remains within that kernel/filesystem security authority. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The missing exclusion can corrupt GFS2 log/revoke and AIL state, making stale or incorrect filesystem contents plausibly reachable after replay or recovery. Under the required uncertainty rule, filesystem journal corruption that can expose arbitrary stored data is scored as high confidentiality impact.\nI:H - The bug affects journal/log bookkeeping that protects filesystem metadata and replay ordering, so a triggered race can corrupt or roll back arbitrary filesystem state. This is high integrity impact for a shared GFS2 volume.\nA:H - The race can lead to GFS2 withdraws, hangs, assertion failures, or filesystem unavailability under log flushing pressure. That is a high availability impact for the affected kernel/filesystem instance."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:55.082Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3b28eb75afe520972bacc833850c2b30aa0824cd"
},
{
"url": "https://git.kernel.org/stable/c/ca95342cb1b39062a03c115830286f0a426053d5"
},
{
"url": "https://git.kernel.org/stable/c/bf5fcd9c37c2546beaf7b401d31aefd89017dc3d"
},
{
"url": "https://git.kernel.org/stable/c/f2f225cf505ac016132ded21690f3ba0a080a4e8"
},
{
"url": "https://git.kernel.org/stable/c/49d9be0722da3a4a893ba905720cba1921834ec3"
},
{
"url": "https://git.kernel.org/stable/c/98e8bf249c790d56de1abc4a5f8bd68035a00921"
},
{
"url": "https://git.kernel.org/stable/c/fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8"
}
],
"title": "gfs2: add some missing log locking",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53049",
"datePublished": "2026-06-24T16:29:55.190Z",
"dateReserved": "2026-06-09T07:44:35.381Z",
"dateUpdated": "2026-08-05T12:32:55.082Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53045 (GCVE-0-2026-53045)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
memory: tegra124-emc: Fix dll_change check
The code checking whether the specified memory timing enables DLL
in the EMRS register was reversed. DLL is enabled if bit A0 is low.
Fix the check.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 73a7f0a90641b09300d47308682b674c570dd6a2 Version: 73a7f0a90641b09300d47308682b674c570dd6a2 Version: 73a7f0a90641b09300d47308682b674c570dd6a2 Version: 73a7f0a90641b09300d47308682b674c570dd6a2 Version: 73a7f0a90641b09300d47308682b674c570dd6a2 Version: 73a7f0a90641b09300d47308682b674c570dd6a2 Version: 73a7f0a90641b09300d47308682b674c570dd6a2 Version: 73a7f0a90641b09300d47308682b674c570dd6a2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/memory/tegra/tegra124-emc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a85967331144fde9300be38bb44d2558eb6b742e",
"status": "affected",
"version": "73a7f0a90641b09300d47308682b674c570dd6a2",
"versionType": "git"
},
{
"lessThan": "db0ae80865b515cc0b705c85877ec00f7eebe9fe",
"status": "affected",
"version": "73a7f0a90641b09300d47308682b674c570dd6a2",
"versionType": "git"
},
{
"lessThan": "2369b1831161356e1bcb51385d3e532dc4fe2771",
"status": "affected",
"version": "73a7f0a90641b09300d47308682b674c570dd6a2",
"versionType": "git"
},
{
"lessThan": "7e19e72f306484996c52ff96cc92f69b78ed5435",
"status": "affected",
"version": "73a7f0a90641b09300d47308682b674c570dd6a2",
"versionType": "git"
},
{
"lessThan": "05f138fc7e27ee8e7a83ccf966c3fa26cda44dda",
"status": "affected",
"version": "73a7f0a90641b09300d47308682b674c570dd6a2",
"versionType": "git"
},
{
"lessThan": "1793249c067a4b28e1aba0ad0e4d73aa9f9e165a",
"status": "affected",
"version": "73a7f0a90641b09300d47308682b674c570dd6a2",
"versionType": "git"
},
{
"lessThan": "1ebbbef47d11cc90219c081492ccf995aaa3e9b3",
"status": "affected",
"version": "73a7f0a90641b09300d47308682b674c570dd6a2",
"versionType": "git"
},
{
"lessThan": "9597ab9a8296ab337e6820f8a717ff621078b632",
"status": "affected",
"version": "73a7f0a90641b09300d47308682b674c570dd6a2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/memory/tegra/tegra124-emc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemory: tegra124-emc: Fix dll_change check\n\nThe code checking whether the specified memory timing enables DLL\nin the EMRS register was reversed. DLL is enabled if bit A0 is low.\nFix the check."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On networked Tegra124 devices, unauthenticated remote traffic can induce memory/CPU load that drives ACTMON/devfreq EMC rate transitions into the vulnerable timing-change path.\nAC:L - Once running on an affected Tegra124 DDR3 configuration with timings that cross the DLL enable boundary, the attacker only needs to induce rate changes; there is no race or hard-to-control memory layout requirement.\nPR:N - The remote-load ACTMON/devfreq path has no authentication or privilege check before the vulnerable EMC clock transition is reached.\nUI:N - No victim action is required; rate changes are performed automatically by kernel power-management code in response to load.\nS:U - The impact remains within the same kernel-controlled system and does not cross a hypervisor, IOMMU, or separate security-authority boundary.\nC:H - The reversed DLL transition handling can misprogram DDR3 timing/state during EMC clock changes, creating system-wide DRAM corruption that may expose arbitrary kernel or process memory.\nI:H - Incorrect DRAM DLL sequencing can corrupt arbitrary memory contents, including kernel data or page tables, making high integrity impact defensible.\nA:H - Bad memory-controller timing during live DRAM operation can hang, panic, or otherwise crash the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:52.914Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a85967331144fde9300be38bb44d2558eb6b742e"
},
{
"url": "https://git.kernel.org/stable/c/db0ae80865b515cc0b705c85877ec00f7eebe9fe"
},
{
"url": "https://git.kernel.org/stable/c/2369b1831161356e1bcb51385d3e532dc4fe2771"
},
{
"url": "https://git.kernel.org/stable/c/7e19e72f306484996c52ff96cc92f69b78ed5435"
},
{
"url": "https://git.kernel.org/stable/c/05f138fc7e27ee8e7a83ccf966c3fa26cda44dda"
},
{
"url": "https://git.kernel.org/stable/c/1793249c067a4b28e1aba0ad0e4d73aa9f9e165a"
},
{
"url": "https://git.kernel.org/stable/c/1ebbbef47d11cc90219c081492ccf995aaa3e9b3"
},
{
"url": "https://git.kernel.org/stable/c/9597ab9a8296ab337e6820f8a717ff621078b632"
}
],
"title": "memory: tegra124-emc: Fix dll_change check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53045",
"datePublished": "2026-06-24T16:29:51.795Z",
"dateReserved": "2026-06-09T07:44:35.381Z",
"dateUpdated": "2026-08-05T12:32:52.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31672 (GCVE-0-2026-31672)
Vulnerability from cvelistv5
Published
2026-04-24 14:45
Modified
2026-05-11 22:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rt2x00usb: fix devres lifetime
USB drivers bind to USB interfaces and any device managed resources
should have their lifetime tied to the interface rather than parent USB
device. This avoids issues like memory leaks when drivers are unbound
without their devices being physically disconnected (e.g. on probe
deferral or configuration changes).
Fix the USB anchor lifetime so that it is released on driver unbind.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8b4c0009313f3d42e2540e3e1f776097dd0db73d Version: 8b4c0009313f3d42e2540e3e1f776097dd0db73d Version: 8b4c0009313f3d42e2540e3e1f776097dd0db73d Version: 8b4c0009313f3d42e2540e3e1f776097dd0db73d Version: 8b4c0009313f3d42e2540e3e1f776097dd0db73d Version: 8b4c0009313f3d42e2540e3e1f776097dd0db73d Version: 8b4c0009313f3d42e2540e3e1f776097dd0db73d Version: 8b4c0009313f3d42e2540e3e1f776097dd0db73d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ralink/rt2x00/rt2x00usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "64a457f6afbf15f984d95201a9a1e71eed3f9dd1",
"status": "affected",
"version": "8b4c0009313f3d42e2540e3e1f776097dd0db73d",
"versionType": "git"
},
{
"lessThan": "65518a6965d527c53013947031f26754f6a4f6af",
"status": "affected",
"version": "8b4c0009313f3d42e2540e3e1f776097dd0db73d",
"versionType": "git"
},
{
"lessThan": "15b233e33b35b927bd8d0044c15325564ea1ba24",
"status": "affected",
"version": "8b4c0009313f3d42e2540e3e1f776097dd0db73d",
"versionType": "git"
},
{
"lessThan": "1de5c76bf40e9cdeebf54662f63011fb10fa452f",
"status": "affected",
"version": "8b4c0009313f3d42e2540e3e1f776097dd0db73d",
"versionType": "git"
},
{
"lessThan": "b245db719bc7e57abf48bd5701662b270c3880f7",
"status": "affected",
"version": "8b4c0009313f3d42e2540e3e1f776097dd0db73d",
"versionType": "git"
},
{
"lessThan": "e360d15fcb1e819eef49e3d4434d8050542eed16",
"status": "affected",
"version": "8b4c0009313f3d42e2540e3e1f776097dd0db73d",
"versionType": "git"
},
{
"lessThan": "c99f198841b41735796e2ddfcd573783fb552eb9",
"status": "affected",
"version": "8b4c0009313f3d42e2540e3e1f776097dd0db73d",
"versionType": "git"
},
{
"lessThan": "25369b22223d1c56e42a0cd4ac9137349d5a898e",
"status": "affected",
"version": "8b4c0009313f3d42e2540e3e1f776097dd0db73d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ralink/rt2x00/rt2x00usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.169",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.135",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.169",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.135",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.82",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rt2x00usb: fix devres lifetime\n\nUSB drivers bind to USB interfaces and any device managed resources\nshould have their lifetime tied to the interface rather than parent USB\ndevice. This avoids issues like memory leaks when drivers are unbound\nwithout their devices being physically disconnected (e.g. on probe\ndeferral or configuration changes).\n\nFix the USB anchor lifetime so that it is released on driver unbind."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:13:24.521Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/64a457f6afbf15f984d95201a9a1e71eed3f9dd1"
},
{
"url": "https://git.kernel.org/stable/c/65518a6965d527c53013947031f26754f6a4f6af"
},
{
"url": "https://git.kernel.org/stable/c/15b233e33b35b927bd8d0044c15325564ea1ba24"
},
{
"url": "https://git.kernel.org/stable/c/1de5c76bf40e9cdeebf54662f63011fb10fa452f"
},
{
"url": "https://git.kernel.org/stable/c/b245db719bc7e57abf48bd5701662b270c3880f7"
},
{
"url": "https://git.kernel.org/stable/c/e360d15fcb1e819eef49e3d4434d8050542eed16"
},
{
"url": "https://git.kernel.org/stable/c/c99f198841b41735796e2ddfcd573783fb552eb9"
},
{
"url": "https://git.kernel.org/stable/c/25369b22223d1c56e42a0cd4ac9137349d5a898e"
}
],
"title": "wifi: rt2x00usb: fix devres lifetime",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31672",
"datePublished": "2026-04-24T14:45:19.725Z",
"dateReserved": "2026-03-09T15:48:24.130Z",
"dateUpdated": "2026-05-11T22:13:24.521Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43430 (GCVE-0-2026-43430)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-11 22:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: yurex: fix race in probe
The bbu member of the descriptor must be set to the value
standing for uninitialized values before the URB whose
completion handler sets bbu is submitted. Otherwise there is
a window during which probing can overwrite already retrieved
data.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6bc235a2e24a5ef677daee3fd4f74f6cd643e23c Version: 6bc235a2e24a5ef677daee3fd4f74f6cd643e23c Version: 6bc235a2e24a5ef677daee3fd4f74f6cd643e23c Version: 6bc235a2e24a5ef677daee3fd4f74f6cd643e23c Version: 6bc235a2e24a5ef677daee3fd4f74f6cd643e23c Version: 6bc235a2e24a5ef677daee3fd4f74f6cd643e23c Version: 6bc235a2e24a5ef677daee3fd4f74f6cd643e23c Version: 6bc235a2e24a5ef677daee3fd4f74f6cd643e23c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/yurex.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a7934d7202a39c3160aa30521c382c7b744ae4a2",
"status": "affected",
"version": "6bc235a2e24a5ef677daee3fd4f74f6cd643e23c",
"versionType": "git"
},
{
"lessThan": "a8b3b3d730acea1640bc89465f2832cf06a1e13a",
"status": "affected",
"version": "6bc235a2e24a5ef677daee3fd4f74f6cd643e23c",
"versionType": "git"
},
{
"lessThan": "687d26d43a5aaf44323ce7d601cf242bb87e9559",
"status": "affected",
"version": "6bc235a2e24a5ef677daee3fd4f74f6cd643e23c",
"versionType": "git"
},
{
"lessThan": "939e3d17b843b0bae70467fef4481069d73c8520",
"status": "affected",
"version": "6bc235a2e24a5ef677daee3fd4f74f6cd643e23c",
"versionType": "git"
},
{
"lessThan": "3cec135415a89723e2d38e1c8cc5098203355965",
"status": "affected",
"version": "6bc235a2e24a5ef677daee3fd4f74f6cd643e23c",
"versionType": "git"
},
{
"lessThan": "a41d3d9202e951995cfac6248c565423079c71fa",
"status": "affected",
"version": "6bc235a2e24a5ef677daee3fd4f74f6cd643e23c",
"versionType": "git"
},
{
"lessThan": "af83e92c329f11139d5eea2b5b7b83c26c3f67e7",
"status": "affected",
"version": "6bc235a2e24a5ef677daee3fd4f74f6cd643e23c",
"versionType": "git"
},
{
"lessThan": "7a875c09899ba0404844abfd8f0d54cdc481c151",
"status": "affected",
"version": "6bc235a2e24a5ef677daee3fd4f74f6cd643e23c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/yurex.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.37"
},
{
"lessThan": "2.6.37",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: yurex: fix race in probe\n\nThe bbu member of the descriptor must be set to the value\nstanding for uninitialized values before the URB whose\ncompletion handler sets bbu is submitted. Otherwise there is\na window during which probing can overwrite already retrieved\ndata."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:26.330Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a7934d7202a39c3160aa30521c382c7b744ae4a2"
},
{
"url": "https://git.kernel.org/stable/c/a8b3b3d730acea1640bc89465f2832cf06a1e13a"
},
{
"url": "https://git.kernel.org/stable/c/687d26d43a5aaf44323ce7d601cf242bb87e9559"
},
{
"url": "https://git.kernel.org/stable/c/939e3d17b843b0bae70467fef4481069d73c8520"
},
{
"url": "https://git.kernel.org/stable/c/3cec135415a89723e2d38e1c8cc5098203355965"
},
{
"url": "https://git.kernel.org/stable/c/a41d3d9202e951995cfac6248c565423079c71fa"
},
{
"url": "https://git.kernel.org/stable/c/af83e92c329f11139d5eea2b5b7b83c26c3f67e7"
},
{
"url": "https://git.kernel.org/stable/c/7a875c09899ba0404844abfd8f0d54cdc481c151"
}
],
"title": "usb: yurex: fix race in probe",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43430",
"datePublished": "2026-05-08T14:22:02.458Z",
"dateReserved": "2026-05-01T14:12:56.009Z",
"dateUpdated": "2026-05-11T22:24:26.330Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43346 (GCVE-0-2026-43346)
Vulnerability from cvelistv5
Published
2026-05-08 13:39
Modified
2026-05-23 16:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ice: ptp: don't WARN when controlling PF is unavailable
In VFIO passthrough setups, it is possible to pass through only a PF
which doesn't own the source timer. In that case the PTP controlling PF
(adapter->ctrl_pf) is never initialized in the VM, so ice_get_ctrl_ptp()
returns NULL and triggers WARN_ON() in ice_ptp_setup_pf().
Since this is an expected behavior in that configuration, replace
WARN_ON() with an informational message and return -EOPNOTSUPP.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_ptp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e19675b384e9dcaca1bd5e4a67b8ad136eccfbe8",
"status": "affected",
"version": "e800654e85b5b27966fc6493201f5f8cf658beb6",
"versionType": "git"
},
{
"lessThan": "c73f365707d3b1b78b7d16e1f029020d1ae50d0f",
"status": "affected",
"version": "e800654e85b5b27966fc6493201f5f8cf658beb6",
"versionType": "git"
},
{
"lessThan": "bb3f21edc7056cdf44a7f7bd7ba65af40741838c",
"status": "affected",
"version": "e800654e85b5b27966fc6493201f5f8cf658beb6",
"versionType": "git"
},
{
"status": "affected",
"version": "2f59743be4d9568cad2d9cf697d1b897975421ed",
"versionType": "git"
},
{
"lessThan": "6.13",
"status": "affected",
"version": "6.12.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_ptp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.12.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: ptp: don\u0027t WARN when controlling PF is unavailable\n\nIn VFIO passthrough setups, it is possible to pass through only a PF\nwhich doesn\u0027t own the source timer. In that case the PTP controlling PF\n(adapter-\u003ectrl_pf) is never initialized in the VM, so ice_get_ctrl_ptp()\nreturns NULL and triggers WARN_ON() in ice_ptp_setup_pf().\n\nSince this is an expected behavior in that configuration, replace\nWARN_ON() with an informational message and return -EOPNOTSUPP."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:06:48.122Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e19675b384e9dcaca1bd5e4a67b8ad136eccfbe8"
},
{
"url": "https://git.kernel.org/stable/c/c73f365707d3b1b78b7d16e1f029020d1ae50d0f"
},
{
"url": "https://git.kernel.org/stable/c/bb3f21edc7056cdf44a7f7bd7ba65af40741838c"
}
],
"title": "ice: ptp: don\u0027t WARN when controlling PF is unavailable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43346",
"datePublished": "2026-05-08T13:39:31.930Z",
"dateReserved": "2026-05-01T14:12:56.003Z",
"dateUpdated": "2026-05-23T16:06:48.122Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31781 (GCVE-0-2026-31781)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-05-23 16:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/ioc32: stop speculation on the drm_compat_ioctl path
The drm compat ioctl path takes a user controlled pointer, and then
dereferences it into a table of function pointers, the signature method
of spectre problems. Fix this up by calling array_index_nospec() on the
index to the function pointer list.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 505b5240329b922f21f91d5b5d1e535c805eca6d Version: 505b5240329b922f21f91d5b5d1e535c805eca6d Version: 505b5240329b922f21f91d5b5d1e535c805eca6d Version: 505b5240329b922f21f91d5b5d1e535c805eca6d Version: 505b5240329b922f21f91d5b5d1e535c805eca6d Version: 505b5240329b922f21f91d5b5d1e535c805eca6d Version: 505b5240329b922f21f91d5b5d1e535c805eca6d Version: 505b5240329b922f21f91d5b5d1e535c805eca6d Version: abc60edcfc87771ff244763d4d19c67766f5dd0f Version: a2a840d6dcae960c2dfdf3fcb1b759e1b7d90663 Version: 00279b505289f7529d9be2e78915d0483ffbd314 Version: d04e6ea0cec9e7d6cba806508f657d2d0dc6cacf Version: 7f3ebea19795eb38438cd3709fabf2afd53cf447 Version: 3.16.63 ≤ Version: 4.4.170 ≤ Version: 4.9.148 ≤ Version: 4.14.91 ≤ Version: 4.19.13 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_ioc32.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "46a60ee8956ef1975f00455f614761c7ecedc09d",
"status": "affected",
"version": "505b5240329b922f21f91d5b5d1e535c805eca6d",
"versionType": "git"
},
{
"lessThan": "5bb398991f378ef74d90b14a6ea8b61ff96cc03a",
"status": "affected",
"version": "505b5240329b922f21f91d5b5d1e535c805eca6d",
"versionType": "git"
},
{
"lessThan": "d59c5d8539662d95887b4564f3f72ad38076a2d5",
"status": "affected",
"version": "505b5240329b922f21f91d5b5d1e535c805eca6d",
"versionType": "git"
},
{
"lessThan": "489f2ef2b908898d01df697dc4fe1476674be640",
"status": "affected",
"version": "505b5240329b922f21f91d5b5d1e535c805eca6d",
"versionType": "git"
},
{
"lessThan": "4a41c2b18fc05d30b718d2602cac339eae710b34",
"status": "affected",
"version": "505b5240329b922f21f91d5b5d1e535c805eca6d",
"versionType": "git"
},
{
"lessThan": "f0e441be08a2eab10b2d06fccfa267ee599dd6b3",
"status": "affected",
"version": "505b5240329b922f21f91d5b5d1e535c805eca6d",
"versionType": "git"
},
{
"lessThan": "27ef84bba9b9d7b03418c60fbc6069ea0e87b13c",
"status": "affected",
"version": "505b5240329b922f21f91d5b5d1e535c805eca6d",
"versionType": "git"
},
{
"lessThan": "f8995c2df519f382525ca4bc90553ad2ec611067",
"status": "affected",
"version": "505b5240329b922f21f91d5b5d1e535c805eca6d",
"versionType": "git"
},
{
"status": "affected",
"version": "abc60edcfc87771ff244763d4d19c67766f5dd0f",
"versionType": "git"
},
{
"status": "affected",
"version": "a2a840d6dcae960c2dfdf3fcb1b759e1b7d90663",
"versionType": "git"
},
{
"status": "affected",
"version": "00279b505289f7529d9be2e78915d0483ffbd314",
"versionType": "git"
},
{
"status": "affected",
"version": "d04e6ea0cec9e7d6cba806508f657d2d0dc6cacf",
"versionType": "git"
},
{
"status": "affected",
"version": "7f3ebea19795eb38438cd3709fabf2afd53cf447",
"versionType": "git"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.63",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.170",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.148",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.91",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.13",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_ioc32.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.170",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ioc32: stop speculation on the drm_compat_ioctl path\n\nThe drm compat ioctl path takes a user controlled pointer, and then\ndereferences it into a table of function pointers, the signature method\nof spectre problems. Fix this up by calling array_index_nospec() on the\nindex to the function pointer list."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:05:56.217Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/46a60ee8956ef1975f00455f614761c7ecedc09d"
},
{
"url": "https://git.kernel.org/stable/c/5bb398991f378ef74d90b14a6ea8b61ff96cc03a"
},
{
"url": "https://git.kernel.org/stable/c/d59c5d8539662d95887b4564f3f72ad38076a2d5"
},
{
"url": "https://git.kernel.org/stable/c/489f2ef2b908898d01df697dc4fe1476674be640"
},
{
"url": "https://git.kernel.org/stable/c/4a41c2b18fc05d30b718d2602cac339eae710b34"
},
{
"url": "https://git.kernel.org/stable/c/f0e441be08a2eab10b2d06fccfa267ee599dd6b3"
},
{
"url": "https://git.kernel.org/stable/c/27ef84bba9b9d7b03418c60fbc6069ea0e87b13c"
},
{
"url": "https://git.kernel.org/stable/c/f8995c2df519f382525ca4bc90553ad2ec611067"
}
],
"title": "drm/ioc32: stop speculation on the drm_compat_ioctl path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31781",
"datePublished": "2026-05-01T14:15:07.933Z",
"dateReserved": "2026-03-09T15:48:24.141Z",
"dateUpdated": "2026-05-23T16:05:56.217Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43020 (GCVE-0-2026-43020)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-05-11 22:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: validate LTK enc_size on load
Load Long Term Keys stores the user-provided enc_size and later uses
it to size fixed-size stack operations when replying to LE LTK
requests. An enc_size larger than the 16-byte key buffer can therefore
overflow the reply stack buffer.
Reject oversized enc_size values while validating the management LTK
record so invalid keys never reach the stored key state.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 346af67b8d116f01ef696fd47959a55deb2db8b6 Version: 346af67b8d116f01ef696fd47959a55deb2db8b6 Version: 346af67b8d116f01ef696fd47959a55deb2db8b6 Version: 346af67b8d116f01ef696fd47959a55deb2db8b6 Version: 346af67b8d116f01ef696fd47959a55deb2db8b6 Version: 346af67b8d116f01ef696fd47959a55deb2db8b6 Version: 346af67b8d116f01ef696fd47959a55deb2db8b6 Version: 346af67b8d116f01ef696fd47959a55deb2db8b6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f37d1e65c6d71ad94ccfb5c602163c525db789d",
"status": "affected",
"version": "346af67b8d116f01ef696fd47959a55deb2db8b6",
"versionType": "git"
},
{
"lessThan": "257cdb960d8ff6d60bb6461b03c814b6cf0c9e64",
"status": "affected",
"version": "346af67b8d116f01ef696fd47959a55deb2db8b6",
"versionType": "git"
},
{
"lessThan": "c34577f517b556fb6ca173d45bf7e766ae2564ce",
"status": "affected",
"version": "346af67b8d116f01ef696fd47959a55deb2db8b6",
"versionType": "git"
},
{
"lessThan": "f71695e81f4cb428f3c7e2138eae88199005b52c",
"status": "affected",
"version": "346af67b8d116f01ef696fd47959a55deb2db8b6",
"versionType": "git"
},
{
"lessThan": "82f342b3b006ca1d65f4890c05f2ec32fcb808b6",
"status": "affected",
"version": "346af67b8d116f01ef696fd47959a55deb2db8b6",
"versionType": "git"
},
{
"lessThan": "50fb64defa72a3fecd0af1ca7c6b47b5c5c2b257",
"status": "affected",
"version": "346af67b8d116f01ef696fd47959a55deb2db8b6",
"versionType": "git"
},
{
"lessThan": "40ba329e8b4cd2fb11b0caf5e6a543ceaebb6009",
"status": "affected",
"version": "346af67b8d116f01ef696fd47959a55deb2db8b6",
"versionType": "git"
},
{
"lessThan": "b8dbe9648d69059cfe3a28917bfbf7e61efd7f15",
"status": "affected",
"version": "346af67b8d116f01ef696fd47959a55deb2db8b6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/mgmt.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.4"
},
{
"lessThan": "3.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: validate LTK enc_size on load\n\nLoad Long Term Keys stores the user-provided enc_size and later uses\nit to size fixed-size stack operations when replying to LE LTK\nrequests. An enc_size larger than the 16-byte key buffer can therefore\noverflow the reply stack buffer.\n\nReject oversized enc_size values while validating the management LTK\nrecord so invalid keys never reach the stored key state."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:16:09.294Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f37d1e65c6d71ad94ccfb5c602163c525db789d"
},
{
"url": "https://git.kernel.org/stable/c/257cdb960d8ff6d60bb6461b03c814b6cf0c9e64"
},
{
"url": "https://git.kernel.org/stable/c/c34577f517b556fb6ca173d45bf7e766ae2564ce"
},
{
"url": "https://git.kernel.org/stable/c/f71695e81f4cb428f3c7e2138eae88199005b52c"
},
{
"url": "https://git.kernel.org/stable/c/82f342b3b006ca1d65f4890c05f2ec32fcb808b6"
},
{
"url": "https://git.kernel.org/stable/c/50fb64defa72a3fecd0af1ca7c6b47b5c5c2b257"
},
{
"url": "https://git.kernel.org/stable/c/40ba329e8b4cd2fb11b0caf5e6a543ceaebb6009"
},
{
"url": "https://git.kernel.org/stable/c/b8dbe9648d69059cfe3a28917bfbf7e61efd7f15"
}
],
"title": "Bluetooth: MGMT: validate LTK enc_size on load",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43020",
"datePublished": "2026-05-01T14:15:23.699Z",
"dateReserved": "2026-05-01T14:12:55.975Z",
"dateUpdated": "2026-05-11T22:16:09.294Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46270 (GCVE-0-2026-46270)
Vulnerability from cvelistv5
Published
2026-06-03 15:50
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
power: supply: rt9455: Fix use-after-free in power_supply_changed()
Using the `devm_` variant for requesting IRQ _before_ the `devm_`
variant for allocating/registering the `power_supply` handle, means that
the `power_supply` handle will be deallocated/unregistered _before_ the
interrupt handler (since `devm_` naturally deallocates in reverse
allocation order). This means that during removal, there is a race
condition where an interrupt can fire just _after_ the `power_supply`
handle has been freed, *but* just _before_ the corresponding
unregistration of the IRQ handler has run.
This will lead to the IRQ handler calling `power_supply_changed()` with
a freed `power_supply` handle. Which usually crashes the system or
otherwise silently corrupts the memory...
Note that there is a similar situation which can also happen during
`probe()`; the possibility of an interrupt firing _before_ registering
the `power_supply` handle. This would then lead to the nasty situation
of using the `power_supply` handle *uninitialized* in
`power_supply_changed()`.
Fix this racy use-after-free by making sure the IRQ is requested _after_
the registration of the `power_supply` handle.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e86d69dd786e94046b8f5be7df1b9a8226a40b2a Version: e86d69dd786e94046b8f5be7df1b9a8226a40b2a Version: e86d69dd786e94046b8f5be7df1b9a8226a40b2a Version: e86d69dd786e94046b8f5be7df1b9a8226a40b2a Version: e86d69dd786e94046b8f5be7df1b9a8226a40b2a Version: e86d69dd786e94046b8f5be7df1b9a8226a40b2a Version: e86d69dd786e94046b8f5be7df1b9a8226a40b2a Version: e86d69dd786e94046b8f5be7df1b9a8226a40b2a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/rt9455_charger.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d4e2e3c3caa26b93aa9f36d0a6824b584e2a8dfc",
"status": "affected",
"version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a",
"versionType": "git"
},
{
"lessThan": "62d753b916bd500bb269b7078cdab73198ab4718",
"status": "affected",
"version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a",
"versionType": "git"
},
{
"lessThan": "a39f8f06216f73ef40e71e2fe4ad071964c1fd36",
"status": "affected",
"version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a",
"versionType": "git"
},
{
"lessThan": "af261f218a7606f93d2c786353d60bb4feb56ef0",
"status": "affected",
"version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a",
"versionType": "git"
},
{
"lessThan": "2178dc65d45e2f7bcaa8af8d80d100419bdab251",
"status": "affected",
"version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a",
"versionType": "git"
},
{
"lessThan": "64e15155095f39f4dec9b4659da1238ef8fc54d4",
"status": "affected",
"version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a",
"versionType": "git"
},
{
"lessThan": "721449a15170fc5f028a7576d7f65b9f60d53482",
"status": "affected",
"version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a",
"versionType": "git"
},
{
"lessThan": "e2febe375e5ea5afed92f4cd9711bde8f24ee6d2",
"status": "affected",
"version": "e86d69dd786e94046b8f5be7df1b9a8226a40b2a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/power/supply/rt9455_charger.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npower: supply: rt9455: Fix use-after-free in power_supply_changed()\n\nUsing the `devm_` variant for requesting IRQ _before_ the `devm_`\nvariant for allocating/registering the `power_supply` handle, means that\nthe `power_supply` handle will be deallocated/unregistered _before_ the\ninterrupt handler (since `devm_` naturally deallocates in reverse\nallocation order). This means that during removal, there is a race\ncondition where an interrupt can fire just _after_ the `power_supply`\nhandle has been freed, *but* just _before_ the corresponding\nunregistration of the IRQ handler has run.\n\nThis will lead to the IRQ handler calling `power_supply_changed()` with\na freed `power_supply` handle. Which usually crashes the system or\notherwise silently corrupts the memory...\n\nNote that there is a similar situation which can also happen during\n`probe()`; the possibility of an interrupt firing _before_ registering\nthe `power_supply` handle. This would then lead to the nasty situation\nof using the `power_supply` handle *uninitialized* in\n`power_supply_changed()`.\n\nFix this racy use-after-free by making sure the IRQ is requested _after_\nthe registration of the `power_supply` handle."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local driver teardown (module unload, sysfs unbind, or shutdown/reboot) that runs `devres_release_all()`; the vulnerable `power_supply_changed()` path is only reachable from the on-chip IRQ handler during that window, not from any network-facing protocol.\nAC:L - An attacker who can initiate driver removal can repeatedly assert charger interrupts (USB plug/unplug, charge events) to hit the narrow race between `power_supply_unregister()` and IRQ release; this is a standard attacker-controlled UAF race, not a layout-dependent condition.\nPR:N - On battery-powered embedded/mobile platforms with this IC, an attacker with brief physical possession can force power-off/reboot (no Linux account or capability) while manipulating the charging port to fire IRQs during devm teardown; explicit unbind/rmmod also works but is not the only path.\nUI:N - No victim interaction is required beyond the attacker\u2019s own physical control of the device and charging port; exploitation does not depend on the victim opening files, mounting filesystems, or approving prompts.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the kernel security boundary; it does not cross VM, container, or IOMMU isolation boundaries.\nC:H - The IRQ handler calls `power_supply_changed()` on a freed `struct power_supply`, performing spinlock operations and `schedule_work()` on freed heap memory, which is a classic UAF that can be turned into arbitrary kernel memory disclosure.\nI:H - The same UAF writes to freed object fields (`changed`, locks, workqueue) and can be combined with heap grooming for arbitrary kernel writes or control-flow hijack, as noted by the fix author (\u201csilently corrupts the memory\u201d).\nA:H - Use-after-free in interrupt context typically causes immediate kernel oops/panic or silent memory corruption; the commit explicitly states this \u201cusually crashes the system.\u201d"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:54.591Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d4e2e3c3caa26b93aa9f36d0a6824b584e2a8dfc"
},
{
"url": "https://git.kernel.org/stable/c/62d753b916bd500bb269b7078cdab73198ab4718"
},
{
"url": "https://git.kernel.org/stable/c/a39f8f06216f73ef40e71e2fe4ad071964c1fd36"
},
{
"url": "https://git.kernel.org/stable/c/af261f218a7606f93d2c786353d60bb4feb56ef0"
},
{
"url": "https://git.kernel.org/stable/c/2178dc65d45e2f7bcaa8af8d80d100419bdab251"
},
{
"url": "https://git.kernel.org/stable/c/64e15155095f39f4dec9b4659da1238ef8fc54d4"
},
{
"url": "https://git.kernel.org/stable/c/721449a15170fc5f028a7576d7f65b9f60d53482"
},
{
"url": "https://git.kernel.org/stable/c/e2febe375e5ea5afed92f4cd9711bde8f24ee6d2"
}
],
"title": "power: supply: rt9455: Fix use-after-free in power_supply_changed()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46270",
"datePublished": "2026-06-03T15:50:12.537Z",
"dateReserved": "2026-05-13T15:03:33.109Z",
"dateUpdated": "2026-08-05T12:30:54.591Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43476 (GCVE-0-2026-43476)
Vulnerability from cvelistv5
Published
2026-05-13 15:08
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
sizeof(num) evaluates to sizeof(size_t) (8 bytes on 64-bit) instead
of the intended __be32 element size (4 bytes). Use sizeof(*meas) to
correctly match the buffer element type.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8f3f130852785dac0759843835ca97c3bacc2b10 Version: 8f3f130852785dac0759843835ca97c3bacc2b10 Version: 8f3f130852785dac0759843835ca97c3bacc2b10 Version: 8f3f130852785dac0759843835ca97c3bacc2b10 Version: 8f3f130852785dac0759843835ca97c3bacc2b10 Version: 8f3f130852785dac0759843835ca97c3bacc2b10 Version: 8f3f130852785dac0759843835ca97c3bacc2b10 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/chemical/sps30_i2c.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9aff2e9c2927ecd9652872a43a0725f101128104",
"status": "affected",
"version": "8f3f130852785dac0759843835ca97c3bacc2b10",
"versionType": "git"
},
{
"lessThan": "08881d82f94deaa51800360029908863e5c4c39d",
"status": "affected",
"version": "8f3f130852785dac0759843835ca97c3bacc2b10",
"versionType": "git"
},
{
"lessThan": "dcdf1e92674efb6692f4ebe189e0aa9fde23a541",
"status": "affected",
"version": "8f3f130852785dac0759843835ca97c3bacc2b10",
"versionType": "git"
},
{
"lessThan": "2a4d111a6a34afb8bb4f118009e7728ed2ec7e10",
"status": "affected",
"version": "8f3f130852785dac0759843835ca97c3bacc2b10",
"versionType": "git"
},
{
"lessThan": "90e978ace598567e6e30de79805bddf37cf892ac",
"status": "affected",
"version": "8f3f130852785dac0759843835ca97c3bacc2b10",
"versionType": "git"
},
{
"lessThan": "165f12b40901c6a7aca15796da239726ddcdc5ad",
"status": "affected",
"version": "8f3f130852785dac0759843835ca97c3bacc2b10",
"versionType": "git"
},
{
"lessThan": "216345f98cae7fcc84f49728c67478ac00321c87",
"status": "affected",
"version": "8f3f130852785dac0759843835ca97c3bacc2b10",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/chemical/sps30_i2c.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()\n\nsizeof(num) evaluates to sizeof(size_t) (8 bytes on 64-bit) instead\nof the intended __be32 element size (4 bytes). Use sizeof(*meas) to\ncorrectly match the buffer element type."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An attacker reaches the vulnerable path by locally reading world-readable IIO sysfs channel attributes for the SPS30 I2C device, which invoke the driver read path. The bug is not exposed through a network protocol or adjacent wireless interface.\nAC:L - Triggering requires only a normal measurement read once an affected SPS30 I2C device is present; there is no race and the attacker controls repeated attempts. The 64-bit size_t condition is a common affected platform property, not an exploitation hurdle.\nPR:L - The raw IIO channel attributes are created read-only with mode 0444, so any basic local unprivileged user can trigger the vulnerable read. No CAP_SYS_ADMIN, CAP_NET_ADMIN, root-only ioctl, or user-namespace capability path is required.\nUI:N - No victim action is required after the attacker has local access. The attacker can directly read the exposed sysfs attribute.\nS:U - The memory corruption occurs in kernel driver context and affects the same kernel security authority. This is a standard local kernel compromise scenario, not a VM, IOMMU, or sandbox boundary crossing that changes scope.\nC:H - The old sizeof(num) calculation causes decoded I2C measurement data to be copied past the caller\u0027s 32-bit measurement buffer on the kernel stack. As an out-of-bounds stack write, this memory corruption is defensibly treated as capable of enabling kernel information disclosure.\nI:H - The bug is an out-of-bounds kernel stack write of up to 16 bytes on the PM10/read-buffer path, and repeated local triggering is possible. Kernel OOB writes are treated as high integrity impact because they can plausibly corrupt control data or other sensitive stack state.\nA:H - The stack corruption can crash or oops the kernel, especially with stack protector or corrupted adjacent state. Repeated unprivileged reads can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:11.813Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9aff2e9c2927ecd9652872a43a0725f101128104"
},
{
"url": "https://git.kernel.org/stable/c/08881d82f94deaa51800360029908863e5c4c39d"
},
{
"url": "https://git.kernel.org/stable/c/dcdf1e92674efb6692f4ebe189e0aa9fde23a541"
},
{
"url": "https://git.kernel.org/stable/c/2a4d111a6a34afb8bb4f118009e7728ed2ec7e10"
},
{
"url": "https://git.kernel.org/stable/c/90e978ace598567e6e30de79805bddf37cf892ac"
},
{
"url": "https://git.kernel.org/stable/c/165f12b40901c6a7aca15796da239726ddcdc5ad"
},
{
"url": "https://git.kernel.org/stable/c/216345f98cae7fcc84f49728c67478ac00321c87"
}
],
"title": "iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43476",
"datePublished": "2026-05-13T15:08:26.152Z",
"dateReserved": "2026-05-01T14:12:56.011Z",
"dateUpdated": "2026-08-05T12:28:11.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45870 (GCVE-0-2026-45870)
Vulnerability from cvelistv5
Published
2026-05-27 12:15
Modified
2026-05-27 12:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths
The gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name()
functions allocate memory via gssx_dec_buffer(), which calls
kmemdup(). When a subsequent decode operation fails, these
functions return immediately without freeing previously
allocated buffers, causing memory leaks.
The leak in gssx_dec_ctx() is particularly relevant because
the caller (gssp_accept_sec_context_upcall) initializes several
buffer length fields to non-zero values, resulting in memory
allocation:
struct gssx_ctx rctxh = {
.exported_context_token.len = GSSX_max_output_handle_sz,
.mech.len = GSS_OID_MAX_LEN,
.src_name.display_name.len = GSSX_max_princ_sz,
.targ_name.display_name.len = GSSX_max_princ_sz
};
If, for example, gssx_dec_name() succeeds for src_name but
fails for targ_name, the memory allocated for
exported_context_token, mech, and src_name.display_name
remains unreferenced and cannot be reclaimed.
Add error handling with goto-based cleanup to free any
previously allocated buffers before returning an error.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1d658336b05f8697d6445834f8867f8ad5e4f735 Version: 1d658336b05f8697d6445834f8867f8ad5e4f735 Version: 1d658336b05f8697d6445834f8867f8ad5e4f735 Version: 1d658336b05f8697d6445834f8867f8ad5e4f735 Version: 1d658336b05f8697d6445834f8867f8ad5e4f735 Version: 1d658336b05f8697d6445834f8867f8ad5e4f735 Version: 1d658336b05f8697d6445834f8867f8ad5e4f735 Version: 1d658336b05f8697d6445834f8867f8ad5e4f735 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/auth_gss/gss_rpc_xdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c81431b1b9fbd21e9a5a9211b5517b7295d18e6a",
"status": "affected",
"version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
"versionType": "git"
},
{
"lessThan": "caf7eff432e91a9eba1c79fa545c2f54be15d62b",
"status": "affected",
"version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
"versionType": "git"
},
{
"lessThan": "64303b92d94c0c7845a273acd8d84b796d6f1db7",
"status": "affected",
"version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
"versionType": "git"
},
{
"lessThan": "df10f23defff22c8d55fe6db74f6e4ce927145bf",
"status": "affected",
"version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
"versionType": "git"
},
{
"lessThan": "b4af3806846778799cd4ab0766dc18341e777264",
"status": "affected",
"version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
"versionType": "git"
},
{
"lessThan": "d79b9097a6a2b91471b40755f1225364be5d85ff",
"status": "affected",
"version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
"versionType": "git"
},
{
"lessThan": "3b56eb90feb8a3709417f5624f3871847d42bcb1",
"status": "affected",
"version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
"versionType": "git"
},
{
"lessThan": "3e6397b056335cc56ef0e9da36c95946a19f5118",
"status": "affected",
"version": "1d658336b05f8697d6445834f8867f8ad5e4f735",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/auth_gss/gss_rpc_xdr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: auth_gss: fix memory leaks in XDR decoding error paths\n\nThe gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name()\nfunctions allocate memory via gssx_dec_buffer(), which calls\nkmemdup(). When a subsequent decode operation fails, these\nfunctions return immediately without freeing previously\nallocated buffers, causing memory leaks.\n\nThe leak in gssx_dec_ctx() is particularly relevant because\nthe caller (gssp_accept_sec_context_upcall) initializes several\nbuffer length fields to non-zero values, resulting in memory\nallocation:\n\n struct gssx_ctx rctxh = {\n .exported_context_token.len = GSSX_max_output_handle_sz,\n .mech.len = GSS_OID_MAX_LEN,\n .src_name.display_name.len = GSSX_max_princ_sz,\n .targ_name.display_name.len = GSSX_max_princ_sz\n };\n\nIf, for example, gssx_dec_name() succeeds for src_name but\nfails for targ_name, the memory allocated for\nexported_context_token, mech, and src_name.display_name\nremains unreferenced and cannot be reclaimed.\n\nAdd error handling with goto-based cleanup to free any\npreviously allocated buffers before returning an error."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:15:50.199Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c81431b1b9fbd21e9a5a9211b5517b7295d18e6a"
},
{
"url": "https://git.kernel.org/stable/c/caf7eff432e91a9eba1c79fa545c2f54be15d62b"
},
{
"url": "https://git.kernel.org/stable/c/64303b92d94c0c7845a273acd8d84b796d6f1db7"
},
{
"url": "https://git.kernel.org/stable/c/df10f23defff22c8d55fe6db74f6e4ce927145bf"
},
{
"url": "https://git.kernel.org/stable/c/b4af3806846778799cd4ab0766dc18341e777264"
},
{
"url": "https://git.kernel.org/stable/c/d79b9097a6a2b91471b40755f1225364be5d85ff"
},
{
"url": "https://git.kernel.org/stable/c/3b56eb90feb8a3709417f5624f3871847d42bcb1"
},
{
"url": "https://git.kernel.org/stable/c/3e6397b056335cc56ef0e9da36c95946a19f5118"
}
],
"title": "SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45870",
"datePublished": "2026-05-27T12:15:50.199Z",
"dateReserved": "2026-05-13T15:03:33.081Z",
"dateUpdated": "2026-05-27T12:15:50.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53149 (GCVE-0-2026-53149)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-06-25 08:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Bound root directory content to block size
__tb_property_parse_dir() does not check that content_offset +
content_len fits within block_len for the root directory case.
When rootdir->length equals or exceeds block_len - 2, the entry
loop reads past the allocated property block.
Add a bounds check after computing content_offset and content_len
to reject directories whose content extends past the block.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/property.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5c7657d38d07268124782f03519f07c22a5814fb",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "b212bc161d8a9937b42153723a4a3f2f74fab528",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "1912be23daf4afc8d24ce916021ab68ca4c679db",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "4d0b1524caadb04c10a71f3f88692c63dcb39115",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "0a32040a48db8cf35de48b85d6115df5623e4964",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "60ba6217460792356a238299edd675d91d46bab4",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "cbeb68cbaa0a6f979ef428a7f2d0268c082ba166",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "65423079c7420e3dbf9a7aa345c243a3f5752e5d",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/property.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Bound root directory content to block size\n\n__tb_property_parse_dir() does not check that content_offset +\ncontent_len fits within block_len for the root directory case.\nWhen rootdir-\u003elength equals or exceeds block_len - 2, the entry\nloop reads past the allocated property block.\n\nAdd a bounds check after computing content_offset and content_len\nto reject directories whose content extends past the block."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:38:34.869Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5c7657d38d07268124782f03519f07c22a5814fb"
},
{
"url": "https://git.kernel.org/stable/c/b212bc161d8a9937b42153723a4a3f2f74fab528"
},
{
"url": "https://git.kernel.org/stable/c/1912be23daf4afc8d24ce916021ab68ca4c679db"
},
{
"url": "https://git.kernel.org/stable/c/4d0b1524caadb04c10a71f3f88692c63dcb39115"
},
{
"url": "https://git.kernel.org/stable/c/0a32040a48db8cf35de48b85d6115df5623e4964"
},
{
"url": "https://git.kernel.org/stable/c/60ba6217460792356a238299edd675d91d46bab4"
},
{
"url": "https://git.kernel.org/stable/c/cbeb68cbaa0a6f979ef428a7f2d0268c082ba166"
},
{
"url": "https://git.kernel.org/stable/c/65423079c7420e3dbf9a7aa345c243a3f5752e5d"
}
],
"title": "thunderbolt: Bound root directory content to block size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53149",
"datePublished": "2026-06-25T08:38:34.869Z",
"dateReserved": "2026-06-09T07:44:35.387Z",
"dateUpdated": "2026-06-25T08:38:34.869Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46252 (GCVE-0-2026-46252)
Vulnerability from cvelistv5
Published
2026-06-03 15:49
Modified
2026-07-04 11:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
regulator: core: fix locking in regulator_resolve_supply() error path
If late enabling of a supply regulator fails in
regulator_resolve_supply(), the code currently triggers a lockdep
warning:
WARNING: drivers/regulator/core.c:2649 at _regulator_put+0x80/0xa0, CPU#6: kworker/u32:4/596
...
Call trace:
_regulator_put+0x80/0xa0 (P)
regulator_resolve_supply+0x7cc/0xbe0
regulator_register_resolve_supply+0x28/0xb8
as the regulator_list_mutex must be held when calling _regulator_put().
To solve this, simply switch to using regulator_put().
While at it, we should also make sure that no concurrent access happens
to our rdev while we clear out the supply pointer. Add appropriate
locking to ensure that.
While the code in question will be removed altogether in a follow-up
commit, I believe it is still beneficial to have this corrected before
removal for future reference.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 36a1f1b6ddc6d1442424e29548e790633ca39c7b Version: 36a1f1b6ddc6d1442424e29548e790633ca39c7b Version: 36a1f1b6ddc6d1442424e29548e790633ca39c7b Version: 36a1f1b6ddc6d1442424e29548e790633ca39c7b Version: 36a1f1b6ddc6d1442424e29548e790633ca39c7b Version: 36a1f1b6ddc6d1442424e29548e790633ca39c7b Version: 36a1f1b6ddc6d1442424e29548e790633ca39c7b Version: 36a1f1b6ddc6d1442424e29548e790633ca39c7b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/regulator/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e77357dc2293283fc08a485b1e2e571d91d02622",
"status": "affected",
"version": "36a1f1b6ddc6d1442424e29548e790633ca39c7b",
"versionType": "git"
},
{
"lessThan": "a8a2eab1166bc33ee38ca371cff425bdb5681e47",
"status": "affected",
"version": "36a1f1b6ddc6d1442424e29548e790633ca39c7b",
"versionType": "git"
},
{
"lessThan": "60747114fd2a38739130b715e7b2d40ce848f0be",
"status": "affected",
"version": "36a1f1b6ddc6d1442424e29548e790633ca39c7b",
"versionType": "git"
},
{
"lessThan": "c84860dac7af7dc3c3e3c9ae86d65e222c2f3b0c",
"status": "affected",
"version": "36a1f1b6ddc6d1442424e29548e790633ca39c7b",
"versionType": "git"
},
{
"lessThan": "3b7fffd7a8984a1c009f668765ee7631fd6b87c8",
"status": "affected",
"version": "36a1f1b6ddc6d1442424e29548e790633ca39c7b",
"versionType": "git"
},
{
"lessThan": "bde74af8d4466213007bdd42cc85fa72c861dea7",
"status": "affected",
"version": "36a1f1b6ddc6d1442424e29548e790633ca39c7b",
"versionType": "git"
},
{
"lessThan": "c66e0db0f37290b53c57994f998bb55590364fd0",
"status": "affected",
"version": "36a1f1b6ddc6d1442424e29548e790633ca39c7b",
"versionType": "git"
},
{
"lessThan": "497330b203d2c59c5ff3fa4c34d14494d7203bc3",
"status": "affected",
"version": "36a1f1b6ddc6d1442424e29548e790633ca39c7b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/regulator/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: core: fix locking in regulator_resolve_supply() error path\n\nIf late enabling of a supply regulator fails in\nregulator_resolve_supply(), the code currently triggers a lockdep\nwarning:\n\n WARNING: drivers/regulator/core.c:2649 at _regulator_put+0x80/0xa0, CPU#6: kworker/u32:4/596\n ...\n Call trace:\n _regulator_put+0x80/0xa0 (P)\n regulator_resolve_supply+0x7cc/0xbe0\n regulator_register_resolve_supply+0x28/0xb8\n\nas the regulator_list_mutex must be held when calling _regulator_put().\n\nTo solve this, simply switch to using regulator_put().\n\nWhile at it, we should also make sure that no concurrent access happens\nto our rdev while we clear out the supply pointer. Add appropriate\nlocking to ensure that.\n\nWhile the code in question will be removed altogether in a follow-up\ncommit, I believe it is still beneficial to have this corrected before\nremoval for future reference."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:50:44.068Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e77357dc2293283fc08a485b1e2e571d91d02622"
},
{
"url": "https://git.kernel.org/stable/c/a8a2eab1166bc33ee38ca371cff425bdb5681e47"
},
{
"url": "https://git.kernel.org/stable/c/60747114fd2a38739130b715e7b2d40ce848f0be"
},
{
"url": "https://git.kernel.org/stable/c/c84860dac7af7dc3c3e3c9ae86d65e222c2f3b0c"
},
{
"url": "https://git.kernel.org/stable/c/3b7fffd7a8984a1c009f668765ee7631fd6b87c8"
},
{
"url": "https://git.kernel.org/stable/c/bde74af8d4466213007bdd42cc85fa72c861dea7"
},
{
"url": "https://git.kernel.org/stable/c/c66e0db0f37290b53c57994f998bb55590364fd0"
},
{
"url": "https://git.kernel.org/stable/c/497330b203d2c59c5ff3fa4c34d14494d7203bc3"
}
],
"title": "regulator: core: fix locking in regulator_resolve_supply() error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46252",
"datePublished": "2026-06-03T15:49:48.784Z",
"dateReserved": "2026-05-13T15:03:33.107Z",
"dateUpdated": "2026-07-04T11:50:44.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53229 (GCVE-0-2026-53229)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure
In the XSK branch of mlx5e_xmit_xdp_buff(), when sq->xmit_xdp_frame()
returns false (e.g. XDPSQ is full), the function returns without
unmapping the DMA address or freeing the xdp_frame allocated by
xdp_convert_zc_to_xdp_frame(). The xdpi_fifo push only happens on
success, so the completion path cannot recover these entries.
With CONFIG_DMA_API_DEBUG=y, the leak surfaces on driver unbind:
DMA-API: pci 0000:08:00.0: device driver has pending DMA
allocations while released from device [count=1116]
One of leaked entries details: [device address=0x000000010ffd7028]
[size=1534 bytes] [mapped with DMA_TO_DEVICE] [mapped as phy]
WARNING: kernel/dma/debug.c:881 at dma_debug_device_change+0x127/0x180
...
DMA-API: Mapped at:
debug_dma_map_phys+0x4b/0xd0
dma_map_phys+0xfd/0x2d0
mlx5e_xdp_handle+0x5ae/0xac0 [mlx5_core]
mlx5e_xsk_skb_from_cqe_mpwrq_linear+0xc4/0x170 [mlx5_core]
mlx5e_handle_rx_cqe_mpwrq+0xc1/0x290 [mlx5_core]
Add the missing unmap + xdp_return_frame, matching the cleanup already
done in mlx5e_xdp_xmit(). has_frags is rejected earlier in this branch,
so no per-frag unmap is needed.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7b3eeba50fbc3b45f279037c29a87a90e8bac1e1",
"status": "affected",
"version": "84a0a2310d6de247335574649726cb000c7c0074",
"versionType": "git"
},
{
"lessThan": "2789b74ae1f4b68333c9d5eec2f3354d07b16e61",
"status": "affected",
"version": "84a0a2310d6de247335574649726cb000c7c0074",
"versionType": "git"
},
{
"lessThan": "0aabca726b43d833721034e97d99efcc8237b22a",
"status": "affected",
"version": "84a0a2310d6de247335574649726cb000c7c0074",
"versionType": "git"
},
{
"lessThan": "b69004f5a6ad32da84d8aa5b23b9c0caafe6252e",
"status": "affected",
"version": "84a0a2310d6de247335574649726cb000c7c0074",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure\n\nIn the XSK branch of mlx5e_xmit_xdp_buff(), when sq-\u003exmit_xdp_frame()\nreturns false (e.g. XDPSQ is full), the function returns without\nunmapping the DMA address or freeing the xdp_frame allocated by\nxdp_convert_zc_to_xdp_frame(). The xdpi_fifo push only happens on\nsuccess, so the completion path cannot recover these entries.\n\nWith CONFIG_DMA_API_DEBUG=y, the leak surfaces on driver unbind:\n\n DMA-API: pci 0000:08:00.0: device driver has pending DMA\n allocations while released from device [count=1116]\n One of leaked entries details: [device address=0x000000010ffd7028]\n [size=1534 bytes] [mapped with DMA_TO_DEVICE] [mapped as phy]\n WARNING: kernel/dma/debug.c:881 at dma_debug_device_change+0x127/0x180\n ...\n DMA-API: Mapped at:\n debug_dma_map_phys+0x4b/0xd0\n dma_map_phys+0xfd/0x2d0\n mlx5e_xdp_handle+0x5ae/0xac0 [mlx5_core]\n mlx5e_xsk_skb_from_cqe_mpwrq_linear+0xc4/0x170 [mlx5_core]\n mlx5e_handle_rx_cqe_mpwrq+0xc1/0x290 [mlx5_core]\n\nAdd the missing unmap + xdp_return_frame, matching the cleanup already\ndone in mlx5e_xdp_xmit(). has_frags is rejected earlier in this branch,\nso no per-frag unmap is needed."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Remote packets received by an mlx5 interface can traverse the NAPI RX/CQE path into the XSK receive helper and `XDP_TX` transmit path. In a plausible AF_XDP zero-copy/XDP_TX deployment, the attacker only needs to send network traffic to the affected interface.\nAC:L - Once the victim has the affected XDP/AF_XDP configuration, the failure condition is reliably reachable by driving the XDP transmit queue full or otherwise causing transmit rejection. There is no attacker-uncontrolled race or memory-layout dependency.\nPR:N - The packet-triggering path requires no authentication or attacker privileges after the victim system is configured. Loading the XDP program and binding the XSK pool are administrative setup prerequisites, not privileges held by the remote packet sender.\nUI:N - No victim user action is needed for each trigger. Packets are processed automatically by the NIC driver receive path.\nS:U - The bug leaks kernel/driver resources within the same kernel security authority. It does not provide a VM escape, sandbox escape, or IOMMU/DMA boundary bypass.\nC:N - The leaked `xdp_frame` page and DMA mapping are not exposed back to the attacker and are not freed for attacker-controlled reuse. The bug is a resource leak, not an information disclosure primitive.\nI:N - The failure path does not corrupt memory or create an arbitrary write primitive. The transmit WQE is not successfully queued, and the missing operation is cleanup only.\nA:H - Each failed `XDP_TX` can permanently leak an order-0 page-backed `xdp_frame` and a DMA mapping, and unauthenticated network traffic can repeat this in a high-rate XDP deployment. Sustained triggering can exhaust kernel memory or DMA/IOMMU resources and disrupt the NIC or host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:21.351Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7b3eeba50fbc3b45f279037c29a87a90e8bac1e1"
},
{
"url": "https://git.kernel.org/stable/c/2789b74ae1f4b68333c9d5eec2f3354d07b16e61"
},
{
"url": "https://git.kernel.org/stable/c/0aabca726b43d833721034e97d99efcc8237b22a"
},
{
"url": "https://git.kernel.org/stable/c/b69004f5a6ad32da84d8aa5b23b9c0caafe6252e"
}
],
"title": "net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53229",
"datePublished": "2026-06-25T08:39:28.552Z",
"dateReserved": "2026-06-09T07:44:35.393Z",
"dateUpdated": "2026-08-05T12:34:21.351Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43152 (GCVE-0-2026-43152)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: hid-pl: handle probe errors
Errors in init must be reported back or we'll
follow a NULL pointer the first time FF is used.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 20eb12790670985c8e30821218993bd260387b89 Version: 20eb12790670985c8e30821218993bd260387b89 Version: 20eb12790670985c8e30821218993bd260387b89 Version: 20eb12790670985c8e30821218993bd260387b89 Version: 20eb12790670985c8e30821218993bd260387b89 Version: 20eb12790670985c8e30821218993bd260387b89 Version: 20eb12790670985c8e30821218993bd260387b89 Version: 20eb12790670985c8e30821218993bd260387b89 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-pl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "78df3de826668fe842c6061a91bc1ed68f493e80",
"status": "affected",
"version": "20eb12790670985c8e30821218993bd260387b89",
"versionType": "git"
},
{
"lessThan": "8a84149337eb5e716e6d59f48ff0374dae8d8b2b",
"status": "affected",
"version": "20eb12790670985c8e30821218993bd260387b89",
"versionType": "git"
},
{
"lessThan": "926e6715b48b575ed7754bf163a67686bb2eb111",
"status": "affected",
"version": "20eb12790670985c8e30821218993bd260387b89",
"versionType": "git"
},
{
"lessThan": "449004434e1f55be85604b2645f2d07c4a92fe53",
"status": "affected",
"version": "20eb12790670985c8e30821218993bd260387b89",
"versionType": "git"
},
{
"lessThan": "04e50f45b5175bb90a06f5003113cb4ed6ba44c2",
"status": "affected",
"version": "20eb12790670985c8e30821218993bd260387b89",
"versionType": "git"
},
{
"lessThan": "1d46d07458dba369daf61fb643d40a62c8423d8e",
"status": "affected",
"version": "20eb12790670985c8e30821218993bd260387b89",
"versionType": "git"
},
{
"lessThan": "7d2f4fdf134e7398847417b25743e1e04928c7d7",
"status": "affected",
"version": "20eb12790670985c8e30821218993bd260387b89",
"versionType": "git"
},
{
"lessThan": "3756a272d2cf356d2203da8474d173257f5f8521",
"status": "affected",
"version": "20eb12790670985c8e30821218993bd260387b89",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-pl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.21"
},
{
"lessThan": "2.6.21",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.21",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hid-pl: handle probe errors\n\nErrors in init must be reported back or we\u0027ll\nfollow a NULL pointer the first time FF is used."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:18:46.106Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/78df3de826668fe842c6061a91bc1ed68f493e80"
},
{
"url": "https://git.kernel.org/stable/c/8a84149337eb5e716e6d59f48ff0374dae8d8b2b"
},
{
"url": "https://git.kernel.org/stable/c/926e6715b48b575ed7754bf163a67686bb2eb111"
},
{
"url": "https://git.kernel.org/stable/c/449004434e1f55be85604b2645f2d07c4a92fe53"
},
{
"url": "https://git.kernel.org/stable/c/04e50f45b5175bb90a06f5003113cb4ed6ba44c2"
},
{
"url": "https://git.kernel.org/stable/c/1d46d07458dba369daf61fb643d40a62c8423d8e"
},
{
"url": "https://git.kernel.org/stable/c/7d2f4fdf134e7398847417b25743e1e04928c7d7"
},
{
"url": "https://git.kernel.org/stable/c/3756a272d2cf356d2203da8474d173257f5f8521"
}
],
"title": "HID: hid-pl: handle probe errors",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43152",
"datePublished": "2026-05-06T11:27:33.736Z",
"dateReserved": "2026-05-01T14:12:55.989Z",
"dateUpdated": "2026-05-11T22:18:46.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46238 (GCVE-0-2026-46238)
Vulnerability from cvelistv5
Published
2026-05-28 09:41
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: stop caching unowned originator pointers in BAT IV
BAT IV keeps the last-hop neighbor address in each neigh_node, but some
paths also cache an originator pointer derived from a temporary lookup.
That pointer is not owned by the neigh_node and may no longer refer to a
live originator entry after purge handling runs.
Stop storing the auxiliary originator pointer in the BAT IV neighbor
state. When BAT IV needs the neighbor originator data, resolve it from
the stored neighbor address and drop the reference again after use.
[sven: avoid bonding logic for outgoing OGM]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 Version: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 Version: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 Version: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 Version: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 Version: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 Version: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 Version: c6c8fea29769d998d94fcec9b9f14d4b52b349d3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/bat_iv_ogm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "86b2b58d7c228d850c8c78e4144e6123e8ed2718",
"status": "affected",
"version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
"versionType": "git"
},
{
"lessThan": "384e3050a42be9085d50507b4d5f8266a588d742",
"status": "affected",
"version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
"versionType": "git"
},
{
"lessThan": "8c16c68fdbb69778f8d04f650340c3f4d1518f8e",
"status": "affected",
"version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
"versionType": "git"
},
{
"lessThan": "aafcbaf1159ea224528ca4075d0ba8c10ef374af",
"status": "affected",
"version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
"versionType": "git"
},
{
"lessThan": "6e20700f8c524ac379ba8274ff5d453023b7c006",
"status": "affected",
"version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
"versionType": "git"
},
{
"lessThan": "09dc0d1a12222ffca6481916eab3cfea477b9620",
"status": "affected",
"version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
"versionType": "git"
},
{
"lessThan": "67bceeb22207f1f5a402973a3a0809e5f2698f38",
"status": "affected",
"version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
"versionType": "git"
},
{
"lessThan": "f03e8583532941b07761c5429de7d50766fa3110",
"status": "affected",
"version": "c6c8fea29769d998d94fcec9b9f14d4b52b349d3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/bat_iv_ogm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.90",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.32",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.90",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.32",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.9",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: stop caching unowned originator pointers in BAT IV\n\nBAT IV keeps the last-hop neighbor address in each neigh_node, but some\npaths also cache an originator pointer derived from a temporary lookup.\nThat pointer is not owned by the neigh_node and may no longer refer to a\nlive originator entry after purge handling runs.\n\nStop storing the auxiliary originator pointer in the BAT IV neighbor\nstate. When BAT IV needs the neighbor originator data, resolve it from\nthe stored neighbor address and drop the reference again after use.\n\n[sven: avoid bonding logic for outgoing OGM]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - batman-adv OGMs are raw layer-2 broadcast management frames (ethertype 0x4305) confined to the mesh segment; the attacker must be on the same WiFi/ad-hoc or wired link-layer mesh as the victim, matching the Adjacent vector for mesh/WiFi frame injection.\nAC:L - The attacker controls all OGM traffic and can deterministically set up the freed-originator condition (purge timeout is fixed and purge work runs every second) before triggering the dereference, so no uncontrollable race is involved.\nPR:N - batman-adv OGM/management packets are unauthenticated with no privilege check; any node able to put frames on the mesh segment can inject them.\nUI:N - No victim interaction is required \u2014 the vulnerable BAT IV OGM processing runs automatically on any node running batman-adv with the default routing algorithm.\nS:U - The use-after-free is contained within the kernel\u0027s own memory/security context with no crossing of a trust or virtualization boundary.\nC:H - The UAF dereferences a freed originator object that can be reallocated with attacker-controlled heap content, enabling kernel memory disclosure.\nI:H - The stale pointer is used for spinlock acquisition and field access on freed memory; UAF of a heap object enables heap grooming toward an arbitrary write / control-flow primitive.\nA:H - Dereferencing the freed/dangling originator pointer reliably causes a kernel oops/panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:39.402Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/86b2b58d7c228d850c8c78e4144e6123e8ed2718"
},
{
"url": "https://git.kernel.org/stable/c/384e3050a42be9085d50507b4d5f8266a588d742"
},
{
"url": "https://git.kernel.org/stable/c/8c16c68fdbb69778f8d04f650340c3f4d1518f8e"
},
{
"url": "https://git.kernel.org/stable/c/aafcbaf1159ea224528ca4075d0ba8c10ef374af"
},
{
"url": "https://git.kernel.org/stable/c/6e20700f8c524ac379ba8274ff5d453023b7c006"
},
{
"url": "https://git.kernel.org/stable/c/09dc0d1a12222ffca6481916eab3cfea477b9620"
},
{
"url": "https://git.kernel.org/stable/c/67bceeb22207f1f5a402973a3a0809e5f2698f38"
},
{
"url": "https://git.kernel.org/stable/c/f03e8583532941b07761c5429de7d50766fa3110"
}
],
"title": "batman-adv: stop caching unowned originator pointers in BAT IV",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46238",
"datePublished": "2026-05-28T09:41:06.816Z",
"dateReserved": "2026-05-13T15:03:33.107Z",
"dateUpdated": "2026-08-05T12:30:39.402Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31762 (GCVE-0-2026-31762)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-05-11 22:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: gyro: mpu3050: Fix irq resource leak
The interrupt handler is setup but only a few lines down if
iio_trigger_register() fails the function returns without properly
releasing the handler.
Add cleanup goto to resolve resource leak.
Detected by Smatch:
drivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() warn:
'irq' from request_threaded_irq() not released on lines: 1124.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 Version: 3904b28efb2c780c23dcddfb87e07fe0230661e5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/gyro/mpu3050-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "beb23092571e627190f23da4bb8548065cacd89c",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "658d9deb45d5032baf388ac51991d1e789157334",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "889253494ec73d60bd47c0518f8fe3a748520d5b",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "8f237c408f3007d7d9667623ffb41a9e9d661ee9",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "b52fd1644ad2c4e96bbec97543a966d7ad8f21ea",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "3a8e68d65a443de05061818823037931674740e0",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "e66215fc1878357d5c980066e650f542330524af",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
},
{
"lessThan": "4216db1043a3be72ef9c2b7b9f393d7fa72496e6",
"status": "affected",
"version": "3904b28efb2c780c23dcddfb87e07fe0230661e5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/gyro/mpu3050-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: gyro: mpu3050: Fix irq resource leak\n\nThe interrupt handler is setup but only a few lines down if\niio_trigger_register() fails the function returns without properly\nreleasing the handler.\n\nAdd cleanup goto to resolve resource leak.\n\nDetected by Smatch:\ndrivers/iio/gyro/mpu3050-core.c:1128 mpu3050_trigger_probe() warn:\n\u0027irq\u0027 from request_threaded_irq() not released on lines: 1124."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:15:19.429Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/beb23092571e627190f23da4bb8548065cacd89c"
},
{
"url": "https://git.kernel.org/stable/c/658d9deb45d5032baf388ac51991d1e789157334"
},
{
"url": "https://git.kernel.org/stable/c/889253494ec73d60bd47c0518f8fe3a748520d5b"
},
{
"url": "https://git.kernel.org/stable/c/8f237c408f3007d7d9667623ffb41a9e9d661ee9"
},
{
"url": "https://git.kernel.org/stable/c/b52fd1644ad2c4e96bbec97543a966d7ad8f21ea"
},
{
"url": "https://git.kernel.org/stable/c/3a8e68d65a443de05061818823037931674740e0"
},
{
"url": "https://git.kernel.org/stable/c/e66215fc1878357d5c980066e650f542330524af"
},
{
"url": "https://git.kernel.org/stable/c/4216db1043a3be72ef9c2b7b9f393d7fa72496e6"
}
],
"title": "iio: gyro: mpu3050: Fix irq resource leak",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31762",
"datePublished": "2026-05-01T14:14:53.891Z",
"dateReserved": "2026-03-09T15:48:24.139Z",
"dateUpdated": "2026-05-11T22:15:19.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46151 (GCVE-0-2026-46151)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-06-14 17:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: usblp: fix heap leak in IEEE 1284 device ID via short response
usblp_ctrl_msg() collapses the usb_control_msg() return value to
0/-errno, discarding the actual number of bytes transferred. A broken
printer can complete the GET_DEVICE_ID control transfer short and the
driver has no way to know.
usblp_cache_device_id_string() reads the 2-byte big-endian length prefix
from the response and trusts it (clamped only to the buffer bounds).
The buffer is kmalloc(1024) at probe time. A device that sends exactly
two bytes (e.g. 0x03 0xFF, claiming a 1023-byte ID) leaves
device_id_string[2..1022] holding stale kmalloc heap.
That stale data is then exposed:
- via the ieee1284_id sysfs attribute (sprintf("%s", buf+2), truncated
at the first NUL in the stale heap), and
- via the IOCNR_GET_DEVICE_ID ioctl, which copy_to_user()s the full
claimed length regardless of NULs, up to 1021 bytes of uninitialized
heap, with the leak size chosen by the device.
Fix this up by just zapping the buffer with zeros before each request
sent to the device.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/class/usblp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4650cce898fcd0bb8c33e529984687a8caed10c3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "612640abbd9e0947fe8f37aaf0cf324265d7caa4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4220d4dd062ea3d3eb056a6cbe0b568e740d20b1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6e29c32a27218f2dcd4a4e9b0b3c5e7728640698",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6d8142141c942c0d8e79343cffda9c44bb1f3f4f",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8247f52d822180e94ccbfdab91613af386a4e34d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "522d17e93a85575256894212d10e5a1fa6f36529",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7a400c6fe3617e31e690e3f7ca37bb335e0498f3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/class/usblp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: usblp: fix heap leak in IEEE 1284 device ID via short response\n\nusblp_ctrl_msg() collapses the usb_control_msg() return value to\n0/-errno, discarding the actual number of bytes transferred. A broken\nprinter can complete the GET_DEVICE_ID control transfer short and the\ndriver has no way to know.\n\nusblp_cache_device_id_string() reads the 2-byte big-endian length prefix\nfrom the response and trusts it (clamped only to the buffer bounds).\nThe buffer is kmalloc(1024) at probe time. A device that sends exactly\ntwo bytes (e.g. 0x03 0xFF, claiming a 1023-byte ID) leaves\ndevice_id_string[2..1022] holding stale kmalloc heap.\n\nThat stale data is then exposed:\n - via the ieee1284_id sysfs attribute (sprintf(\"%s\", buf+2), truncated\n at the first NUL in the stale heap), and\n - via the IOCNR_GET_DEVICE_ID ioctl, which copy_to_user()s the full\n claimed length regardless of NULs, up to 1021 bytes of uninitialized\n heap, with the leak size chosen by the device.\n\nFix this up by just zapping the buffer with zeros before each request\nsent to the device."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:58:20.398Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4650cce898fcd0bb8c33e529984687a8caed10c3"
},
{
"url": "https://git.kernel.org/stable/c/612640abbd9e0947fe8f37aaf0cf324265d7caa4"
},
{
"url": "https://git.kernel.org/stable/c/4220d4dd062ea3d3eb056a6cbe0b568e740d20b1"
},
{
"url": "https://git.kernel.org/stable/c/6e29c32a27218f2dcd4a4e9b0b3c5e7728640698"
},
{
"url": "https://git.kernel.org/stable/c/6d8142141c942c0d8e79343cffda9c44bb1f3f4f"
},
{
"url": "https://git.kernel.org/stable/c/8247f52d822180e94ccbfdab91613af386a4e34d"
},
{
"url": "https://git.kernel.org/stable/c/522d17e93a85575256894212d10e5a1fa6f36529"
},
{
"url": "https://git.kernel.org/stable/c/7a400c6fe3617e31e690e3f7ca37bb335e0498f3"
}
],
"title": "usb: usblp: fix heap leak in IEEE 1284 device ID via short response",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46151",
"datePublished": "2026-05-28T09:36:07.397Z",
"dateReserved": "2026-05-13T15:03:33.101Z",
"dateUpdated": "2026-06-14T17:58:20.398Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46322 (GCVE-0-2026-46322)
Vulnerability from cvelistv5
Published
2026-06-09 12:11
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tun: free page on build_skb failure in tun_xdp_one()
When build_skb() fails in tun_xdp_one(), the function sets ret to
-ENOMEM and jumps to the out label, which returns without freeing the
page that vhost_net_build_xdp() allocated for the frame. As with the
short-frame rejection path, tun_sendmsg() discards the per-buffer error
and still returns total_len, so vhost_tx_batch() takes the success path
and never frees the page. Each build_skb() failure in a batch leaks one
page-frag chunk.
Free the page before taking the error path, matching the put_page() the
other error exits of tun_xdp_one() already perform.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 043d222f93ab8c76b56a3b315cd8692e35affb6c Version: 043d222f93ab8c76b56a3b315cd8692e35affb6c Version: 043d222f93ab8c76b56a3b315cd8692e35affb6c Version: 043d222f93ab8c76b56a3b315cd8692e35affb6c Version: 043d222f93ab8c76b56a3b315cd8692e35affb6c Version: 043d222f93ab8c76b56a3b315cd8692e35affb6c Version: 043d222f93ab8c76b56a3b315cd8692e35affb6c Version: 043d222f93ab8c76b56a3b315cd8692e35affb6c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/tun.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9",
"status": "affected",
"version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
"versionType": "git"
},
{
"lessThan": "793385c154771603b8671dd8338927221e9d8d78",
"status": "affected",
"version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
"versionType": "git"
},
{
"lessThan": "2638a9c1521905bb5c5d1e95c8fbc09f79148ed7",
"status": "affected",
"version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
"versionType": "git"
},
{
"lessThan": "60d9c0d6cdde5420d6483c921b16fe5465eb5238",
"status": "affected",
"version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
"versionType": "git"
},
{
"lessThan": "d16e38fac09a47bfcf98c1ad65a1bb53f94540f5",
"status": "affected",
"version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
"versionType": "git"
},
{
"lessThan": "aa308e9dbb9acb17cacdbbce9e4504f69bac8385",
"status": "affected",
"version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
"versionType": "git"
},
{
"lessThan": "4fefc6156a162a9f50035c12091a5e5130c82c6e",
"status": "affected",
"version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
"versionType": "git"
},
{
"lessThan": "aa8963fdce667a42fb7f0bdd2909fadcab02f9a8",
"status": "affected",
"version": "043d222f93ab8c76b56a3b315cd8692e35affb6c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/tun.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntun: free page on build_skb failure in tun_xdp_one()\n\nWhen build_skb() fails in tun_xdp_one(), the function sets ret to\n-ENOMEM and jumps to the out label, which returns without freeing the\npage that vhost_net_build_xdp() allocated for the frame. As with the\nshort-frame rejection path, tun_sendmsg() discards the per-buffer error\nand still returns total_len, so vhost_tx_batch() takes the success path\nand never frees the page. Each build_skb() failure in a batch leaks one\npage-frag chunk.\n\nFree the page before taking the error path, matching the put_page() the\nother error exits of tun_xdp_one() already perform."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only through the TUN `sendmsg()` path with `TUN_MSG_PTR`, which in production is driven by host `vhost-net` processing virtio-net TX descriptors from a VM guest or a local process holding a TUN/vhost-net fd\u2014not by the host parsing remote network packets.\nAC:L - An attacker can reliably trigger `build_skb()` failure by first pressuring the `sk_buff` slab (e.g., flooding virtio TX or other allocations) and then sending batched virtio TX frames; they control both the memory-pressure side and the batch submission side.\nPR:N - In the highest-impact scenario\u2014a malicious tenant in a cloud/KVM guest with virtio-net and vhost-net\u2014the attacker needs no host privileges; any guest process that can transmit on the virtio TX queue can drive this path.\nUI:N - Exploitation requires no victim interaction beyond normal VM networking; the guest attacker can trigger the leak programmatically without the host user performing any action.\nS:C - The leak consumes host kernel memory from a guest VM security context, crossing the VM/host boundary and impacting resources outside the attacker\u0027s guest security authority.\nC:N - This is a pure page reference leak with no out-of-bounds access, use-after-free, or attacker-readable disclosure; leaked pages remain in the kernel allocator and are not exposed to the attacker.\nI:N - No memory corruption, arbitrary write, or control-flow hijack occurs; the only defect is failing to `put_page()` on the `build_skb()` error path.\nA:H - Each failed `build_skb()` leaks a page-frag (~4 KiB), batches can hold up to 64 XDP buffers, and `tun_sendmsg()` masks per-buffer errors so leaks are unbounded and repeatable, enabling sustained host kernel memory exhaustion and OOM/DoS."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:17.322Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/26fe549b5192536b6c1c68a2dfdc8c0dcf9fa4a9"
},
{
"url": "https://git.kernel.org/stable/c/793385c154771603b8671dd8338927221e9d8d78"
},
{
"url": "https://git.kernel.org/stable/c/2638a9c1521905bb5c5d1e95c8fbc09f79148ed7"
},
{
"url": "https://git.kernel.org/stable/c/60d9c0d6cdde5420d6483c921b16fe5465eb5238"
},
{
"url": "https://git.kernel.org/stable/c/d16e38fac09a47bfcf98c1ad65a1bb53f94540f5"
},
{
"url": "https://git.kernel.org/stable/c/aa308e9dbb9acb17cacdbbce9e4504f69bac8385"
},
{
"url": "https://git.kernel.org/stable/c/4fefc6156a162a9f50035c12091a5e5130c82c6e"
},
{
"url": "https://git.kernel.org/stable/c/aa8963fdce667a42fb7f0bdd2909fadcab02f9a8"
}
],
"title": "tun: free page on build_skb failure in tun_xdp_one()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46322",
"datePublished": "2026-06-09T12:11:14.776Z",
"dateReserved": "2026-05-13T15:03:33.112Z",
"dateUpdated": "2026-08-05T12:31:17.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52923 (GCVE-0-2026-52923)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-08-28 12:04
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipc: limit next_id allocation to the valid ID range
The checkpoint/restore sysctl path can request the next SysV IPC id
through ids->next_id. ipc_idr_alloc() currently forwards that request to
idr_alloc() with an open-ended upper bound.
If the valid tail of the SysV IPC id space is full, the allocation can
spill beyond ipc_mni. The returned SysV IPC id still uses the normal
index encoding, so later lookup and removal can target the wrong slot.
This leaves the real IDR entry behind and breaks the IDR state for the
object.
The bug is in ipc_idr_alloc() in the checkpoint/restore path.
1. ids->next_id is passed to:
idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...)
2. The zero upper bound makes the allocation effectively open-ended.
Once the valid SysV IPC tail is occupied, idr_alloc() can spill past
ipc_mni and allocate an entry beyond the valid IPC id range.
3. The new object id is still encoded with the narrower SysV IPC index
width:
new->id = (new->seq << ipcmni_seq_shift()) + idx
4. Later removal goes through ipc_rmid(), which uses:
ipcid_to_idx(ipcp->id)
That truncates the real IDR index. An object actually stored at a
high index can then be removed as if it lived at a low in-range
index.
5. For shared memory, shm_destroy() frees the current object anyway, but
the real high IDR slot is left behind as a dangling pointer.
6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry
and dereferences freed memory.
Prevent this by bounding the requested allocation to ipc_mni so the
checkpoint/restore path fails once the valid range is exhausted.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 03f595668017f1a1fb971c02fc37140bc6e7bb1c Version: 03f595668017f1a1fb971c02fc37140bc6e7bb1c Version: 03f595668017f1a1fb971c02fc37140bc6e7bb1c Version: 03f595668017f1a1fb971c02fc37140bc6e7bb1c Version: 03f595668017f1a1fb971c02fc37140bc6e7bb1c Version: 03f595668017f1a1fb971c02fc37140bc6e7bb1c Version: 03f595668017f1a1fb971c02fc37140bc6e7bb1c Version: 03f595668017f1a1fb971c02fc37140bc6e7bb1c |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.46.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.95.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.151.1.rt7.492.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.151.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.200.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.200.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.158.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.158.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.33.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.186.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.186.1.rt14.471.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.141.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.131.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel. The `ipc_idr_alloc()` function, used in the checkpoint/restore path for SysV Inter-Process Communication (IPC) ID allocation, does not properly limit ID allocation to the valid range. This can result in the system attempting to dereference freed memory, leading to a use-after-free vulnerability. This issue could potentially cause system instability or information disclosure."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-825",
"description": "Expired Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T12:04:16.286Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-52923"
},
{
"name": "RHBZ#2492094",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492094"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52923.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:52764"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:53330"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:51603"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:48386"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49031"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49212"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49857"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47248"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:52649"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:49851"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:51604"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:52764: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:53330: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:51603: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:48386: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:49031: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:49212: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:49857: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:47248: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:52649: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:49851: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:51604: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: ipc: limit next_id allocation to the valid ID range",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"ipc/util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3bbe2bb9111ce6967a951bfac79af142d816fae5",
"status": "affected",
"version": "03f595668017f1a1fb971c02fc37140bc6e7bb1c",
"versionType": "git"
},
{
"lessThan": "8c58a92849175f5e2ab7bc2734b3b89afe79f6ef",
"status": "affected",
"version": "03f595668017f1a1fb971c02fc37140bc6e7bb1c",
"versionType": "git"
},
{
"lessThan": "af24e202b543ded8a34f1d5d3db54eb916173f04",
"status": "affected",
"version": "03f595668017f1a1fb971c02fc37140bc6e7bb1c",
"versionType": "git"
},
{
"lessThan": "157ce2c6836ce0ff19108a819f38df061345425f",
"status": "affected",
"version": "03f595668017f1a1fb971c02fc37140bc6e7bb1c",
"versionType": "git"
},
{
"lessThan": "41058d4c3f63ab64901560a704882e0565f4e456",
"status": "affected",
"version": "03f595668017f1a1fb971c02fc37140bc6e7bb1c",
"versionType": "git"
},
{
"lessThan": "a3cc795129e5ec0f8948653a3bf471e7d8852f5e",
"status": "affected",
"version": "03f595668017f1a1fb971c02fc37140bc6e7bb1c",
"versionType": "git"
},
{
"lessThan": "bd4be70669af55b974860d13680348cfdf50bbed",
"status": "affected",
"version": "03f595668017f1a1fb971c02fc37140bc6e7bb1c",
"versionType": "git"
},
{
"lessThan": "fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139",
"status": "affected",
"version": "03f595668017f1a1fb971c02fc37140bc6e7bb1c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"ipc/util.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipc: limit next_id allocation to the valid ID range\n\nThe checkpoint/restore sysctl path can request the next SysV IPC id\nthrough ids-\u003enext_id. ipc_idr_alloc() currently forwards that request to\nidr_alloc() with an open-ended upper bound.\n\nIf the valid tail of the SysV IPC id space is full, the allocation can\nspill beyond ipc_mni. The returned SysV IPC id still uses the normal\nindex encoding, so later lookup and removal can target the wrong slot. \nThis leaves the real IDR entry behind and breaks the IDR state for the\nobject.\n\nThe bug is in ipc_idr_alloc() in the checkpoint/restore path.\n\n1. ids-\u003enext_id is passed to:\n\n idr_alloc(\u0026ids-\u003eipcs_idr, new, ipcid_to_idx(next_id), 0, ...)\n\n2. The zero upper bound makes the allocation effectively open-ended.\n Once the valid SysV IPC tail is occupied, idr_alloc() can spill past\n ipc_mni and allocate an entry beyond the valid IPC id range.\n\n3. The new object id is still encoded with the narrower SysV IPC index\n width:\n\n new-\u003eid = (new-\u003eseq \u003c\u003c ipcmni_seq_shift()) + idx\n\n4. Later removal goes through ipc_rmid(), which uses:\n\n ipcid_to_idx(ipcp-\u003eid)\n\n That truncates the real IDR index. An object actually stored at a\n high index can then be removed as if it lived at a low in-range\n index.\n\n5. For shared memory, shm_destroy() frees the current object anyway, but\n the real high IDR slot is left behind as a dangling pointer.\n\n6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry\n and dereferences freed memory.\n\nPrevent this by bounding the requested allocation to ipc_mni so the\ncheckpoint/restore path fails once the valid range is exhausted."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local SysV IPC syscalls plus writes to `/proc/sys/kernel/*_next_id`, not through network or physical input.\nAC:L - The attacker controls the sysctl value, IPC allocation pattern, removal, and proc/syscall enumeration needed to trigger the stale IDR pointer; filling the valid ID tail is resource-intensive but deterministic.\nPR:L - A basic local user can reasonably reach this via unprivileged user namespaces by creating a user/IPC namespace and gaining the namespace capabilities needed for the checkpoint/restore sysctls.\nUI:N - No victim action is required after the local attacker runs the sysctl and SysV IPC operations.\nS:U - This is a standard kernel memory corruption/local privilege escalation class issue within the same kernel security authority.\nC:H - The bug leaves a freed SysV IPC object reachable through the IDR, producing a kernel use-after-free; UAFs are scored as high confidentiality impact because reclaimed kernel heap contents can be exposed or used for read primitives.\nI:H - The stale pointer/use-after-free can plausibly be exploited through heap reuse for kernel memory corruption and control-flow or object manipulation, so integrity impact is high.\nA:H - Even without full exploitation, walking `/proc/sysvipc/shm` or related enumeration can dereference freed memory and crash or hang the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:44.559Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3bbe2bb9111ce6967a951bfac79af142d816fae5"
},
{
"url": "https://git.kernel.org/stable/c/8c58a92849175f5e2ab7bc2734b3b89afe79f6ef"
},
{
"url": "https://git.kernel.org/stable/c/af24e202b543ded8a34f1d5d3db54eb916173f04"
},
{
"url": "https://git.kernel.org/stable/c/157ce2c6836ce0ff19108a819f38df061345425f"
},
{
"url": "https://git.kernel.org/stable/c/41058d4c3f63ab64901560a704882e0565f4e456"
},
{
"url": "https://git.kernel.org/stable/c/a3cc795129e5ec0f8948653a3bf471e7d8852f5e"
},
{
"url": "https://git.kernel.org/stable/c/bd4be70669af55b974860d13680348cfdf50bbed"
},
{
"url": "https://git.kernel.org/stable/c/fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139"
}
],
"title": "ipc: limit next_id allocation to the valid ID range",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52923",
"datePublished": "2026-06-24T07:14:17.849Z",
"dateReserved": "2026-06-09T07:44:35.367Z",
"dateUpdated": "2026-08-28T12:04:16.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46040 (GCVE-0-2026-46040)
Vulnerability from cvelistv5
Published
2026-05-27 12:56
Modified
2026-06-14 17:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails
When fsnotify_add_inode_mark_locked() fails in inotify_new_watch(),
the error path calls inotify_remove_from_idr() but does not call
dec_inotify_watches() to undo the preceding inc_inotify_watches().
This leaks a watch count, and repeated failures can exhaust the
max_user_watches limit with -ENOSPC even when no watches are active.
Prior to commit 1cce1eea0aff ("inotify: Convert to using per-namespace
limits"), the watch count was incremented after fsnotify_add_mark_locked()
succeeded, so this path was not affected. The conversion moved
inc_inotify_watches() before the mark insertion without adding the
corresponding rollback.
Add the missing dec_inotify_watches() call in the error path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1cce1eea0aff51201753fcaca421df825b0813b6 Version: 1cce1eea0aff51201753fcaca421df825b0813b6 Version: 1cce1eea0aff51201753fcaca421df825b0813b6 Version: 1cce1eea0aff51201753fcaca421df825b0813b6 Version: 1cce1eea0aff51201753fcaca421df825b0813b6 Version: 1cce1eea0aff51201753fcaca421df825b0813b6 Version: 1cce1eea0aff51201753fcaca421df825b0813b6 Version: 1cce1eea0aff51201753fcaca421df825b0813b6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/notify/inotify/inotify_user.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3ab58cf42c46bf2366d2f55ae5c59299d5e178b7",
"status": "affected",
"version": "1cce1eea0aff51201753fcaca421df825b0813b6",
"versionType": "git"
},
{
"lessThan": "10edf7e0ffdc7faa18e2244b17722c1b882b8273",
"status": "affected",
"version": "1cce1eea0aff51201753fcaca421df825b0813b6",
"versionType": "git"
},
{
"lessThan": "3ad9ccea1b25435f6179b57aa891960beb7ce8f9",
"status": "affected",
"version": "1cce1eea0aff51201753fcaca421df825b0813b6",
"versionType": "git"
},
{
"lessThan": "8bcc1cd237ab5ccfdd102869fa031c541943cf40",
"status": "affected",
"version": "1cce1eea0aff51201753fcaca421df825b0813b6",
"versionType": "git"
},
{
"lessThan": "73ddc8518a32baff6bc17afda4ee1ebae5b4ed12",
"status": "affected",
"version": "1cce1eea0aff51201753fcaca421df825b0813b6",
"versionType": "git"
},
{
"lessThan": "fdaa42ca370d056428e5e171247c8fdce8dff36a",
"status": "affected",
"version": "1cce1eea0aff51201753fcaca421df825b0813b6",
"versionType": "git"
},
{
"lessThan": "9e48844f708eb48bae4e79cb21edc097c966306d",
"status": "affected",
"version": "1cce1eea0aff51201753fcaca421df825b0813b6",
"versionType": "git"
},
{
"lessThan": "6a320935fa4293e9e599ec9f85dc9eb3be7029f8",
"status": "affected",
"version": "1cce1eea0aff51201753fcaca421df825b0813b6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/notify/inotify/inotify_user.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails\n\nWhen fsnotify_add_inode_mark_locked() fails in inotify_new_watch(),\nthe error path calls inotify_remove_from_idr() but does not call\ndec_inotify_watches() to undo the preceding inc_inotify_watches().\nThis leaks a watch count, and repeated failures can exhaust the\nmax_user_watches limit with -ENOSPC even when no watches are active.\n\nPrior to commit 1cce1eea0aff (\"inotify: Convert to using per-namespace\nlimits\"), the watch count was incremented after fsnotify_add_mark_locked()\nsucceeded, so this path was not affected. The conversion moved\ninc_inotify_watches() before the mark insertion without adding the\ncorresponding rollback.\n\nAdd the missing dec_inotify_watches() call in the error path."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:49:57.876Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3ab58cf42c46bf2366d2f55ae5c59299d5e178b7"
},
{
"url": "https://git.kernel.org/stable/c/10edf7e0ffdc7faa18e2244b17722c1b882b8273"
},
{
"url": "https://git.kernel.org/stable/c/3ad9ccea1b25435f6179b57aa891960beb7ce8f9"
},
{
"url": "https://git.kernel.org/stable/c/8bcc1cd237ab5ccfdd102869fa031c541943cf40"
},
{
"url": "https://git.kernel.org/stable/c/73ddc8518a32baff6bc17afda4ee1ebae5b4ed12"
},
{
"url": "https://git.kernel.org/stable/c/fdaa42ca370d056428e5e171247c8fdce8dff36a"
},
{
"url": "https://git.kernel.org/stable/c/9e48844f708eb48bae4e79cb21edc097c966306d"
},
{
"url": "https://git.kernel.org/stable/c/6a320935fa4293e9e599ec9f85dc9eb3be7029f8"
}
],
"title": "inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46040",
"datePublished": "2026-05-27T12:56:52.161Z",
"dateReserved": "2026-05-13T15:03:33.094Z",
"dateUpdated": "2026-06-14T17:49:57.876Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-20585 (GCVE-0-2023-20585)
Vulnerability from cvelistv5
Published
2026-04-16 18:42
Modified
2026-04-16 19:12
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-788 - Access of Memory Location After End of Buffer
Summary
Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds condition without RMP checks, resulting in a potential loss of confidential guest integrity.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-20585",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-16T18:58:05.996293Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-16T18:58:58.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "AMD EPYC\u2122 7003 Series Processors",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "SEV FW 1.37.23"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC\u2122 9004 Series Processors",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "SEV FW 1.37.31"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC\u2122 Embedded 7003 Series Processors",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "EmbMilanPI-SP3 1.0.0.B"
}
]
},
{
"defaultStatus": "affected",
"product": "AMD EPYC\u2122 Embedded 9004 Series Processors",
"vendor": "AMD",
"versions": [
{
"status": "unaffected",
"version": "EmbGenoaPI-1.0.0.A"
}
]
}
],
"datePublic": "2026-04-16T18:42:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds condition without RMP checks, resulting in a potential loss of confidential guest integrity."
}
],
"value": "Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds condition without RMP checks, resulting in a potential loss of confidential guest integrity."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-788",
"description": "CWE-788 Access of Memory Location After End of Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-16T19:12:06.991Z",
"orgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"shortName": "AMD"
},
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-3016.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "AMD PSIRT Automation 1.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b58fc414-a1e4-4f92-9d70-1add41838648",
"assignerShortName": "AMD",
"cveId": "CVE-2023-20585",
"datePublished": "2026-04-16T18:42:28.281Z",
"dateReserved": "2022-10-27T18:53:39.759Z",
"dateUpdated": "2026-04-16T19:12:06.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46247 (GCVE-0-2026-46247)
Vulnerability from cvelistv5
Published
2026-06-03 15:49
Modified
2026-06-03 15:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
clk: qcom: gfx3d: add parent to parent request map
After commit d228ece36345 ("clk: divider: remove round_rate() in favor
of determine_rate()") determining GFX3D clock rate crashes, because the
passed parent map doesn't provide the expected best_parent_hw clock
(with the roundd_rate path before the offending commit the
best_parent_hw was ignored).
Set the field in parent_req in addition to setting it in the req,
fixing the crash.
clk_hw_round_rate (drivers/clk/clk.c:1764) (P)
clk_divider_bestdiv (drivers/clk/clk-divider.c:336)
divider_determine_rate (drivers/clk/clk-divider.c:358)
clk_alpha_pll_postdiv_determine_rate (drivers/clk/qcom/clk-alpha-pll.c:1275)
clk_core_determine_round_nolock (drivers/clk/clk.c:1606)
clk_core_round_rate_nolock (drivers/clk/clk.c:1701)
__clk_determine_rate (drivers/clk/clk.c:1741)
clk_gfx3d_determine_rate (drivers/clk/qcom/clk-rcg2.c:1268)
clk_core_determine_round_nolock (drivers/clk/clk.c:1606)
clk_core_round_rate_nolock (drivers/clk/clk.c:1701)
clk_core_round_rate_nolock (drivers/clk/clk.c:1710)
clk_round_rate (drivers/clk/clk.c:1804)
dev_pm_opp_set_rate (drivers/opp/core.c:1440 (discriminator 1))
msm_devfreq_target (drivers/gpu/drm/msm/msm_gpu_devfreq.c:51)
devfreq_set_target (drivers/devfreq/devfreq.c:360)
devfreq_update_target (drivers/devfreq/devfreq.c:426)
devfreq_monitor (drivers/devfreq/devfreq.c:458)
process_one_work (arch/arm64/include/asm/jump_label.h:36 include/trace/events/workqueue.h:110 kernel/workqueue.c:3284)
worker_thread (kernel/workqueue.c:3356 (discriminator 2) kernel/workqueue.c:3443 (discriminator 2))
kthread (kernel/kthread.c:467)
ret_from_fork (arch/arm64/kernel/entry.S:861)
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 55213e1acec9218580c90d36034aa0370a51daab Version: 55213e1acec9218580c90d36034aa0370a51daab Version: 55213e1acec9218580c90d36034aa0370a51daab Version: 55213e1acec9218580c90d36034aa0370a51daab Version: 55213e1acec9218580c90d36034aa0370a51daab Version: 55213e1acec9218580c90d36034aa0370a51daab |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/clk/qcom/clk-rcg2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "82cfe5292b11deb1dc33822f67f73cfbe8eafe25",
"status": "affected",
"version": "55213e1acec9218580c90d36034aa0370a51daab",
"versionType": "git"
},
{
"lessThan": "547ae2f17349c7586953af5ef50de43ef3f65e9e",
"status": "affected",
"version": "55213e1acec9218580c90d36034aa0370a51daab",
"versionType": "git"
},
{
"lessThan": "56360aa4ddd736fc19e6d0b0206c5e437e0d6ff8",
"status": "affected",
"version": "55213e1acec9218580c90d36034aa0370a51daab",
"versionType": "git"
},
{
"lessThan": "aed53da569fb96eec09b4817b1953bcc2e467eea",
"status": "affected",
"version": "55213e1acec9218580c90d36034aa0370a51daab",
"versionType": "git"
},
{
"lessThan": "8aa972eba1f29068d13bec716d33abca30fb3f2a",
"status": "affected",
"version": "55213e1acec9218580c90d36034aa0370a51daab",
"versionType": "git"
},
{
"lessThan": "2583cb925ca1ce450aa5d74a05a67448db970193",
"status": "affected",
"version": "55213e1acec9218580c90d36034aa0370a51daab",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/clk/qcom/clk-rcg2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.5"
},
{
"lessThan": "4.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: qcom: gfx3d: add parent to parent request map\n\nAfter commit d228ece36345 (\"clk: divider: remove round_rate() in favor\nof determine_rate()\") determining GFX3D clock rate crashes, because the\npassed parent map doesn\u0027t provide the expected best_parent_hw clock\n(with the roundd_rate path before the offending commit the\nbest_parent_hw was ignored).\n\nSet the field in parent_req in addition to setting it in the req,\nfixing the crash.\n\n clk_hw_round_rate (drivers/clk/clk.c:1764) (P)\n clk_divider_bestdiv (drivers/clk/clk-divider.c:336)\n divider_determine_rate (drivers/clk/clk-divider.c:358)\n clk_alpha_pll_postdiv_determine_rate (drivers/clk/qcom/clk-alpha-pll.c:1275)\n clk_core_determine_round_nolock (drivers/clk/clk.c:1606)\n clk_core_round_rate_nolock (drivers/clk/clk.c:1701)\n __clk_determine_rate (drivers/clk/clk.c:1741)\n clk_gfx3d_determine_rate (drivers/clk/qcom/clk-rcg2.c:1268)\n clk_core_determine_round_nolock (drivers/clk/clk.c:1606)\n clk_core_round_rate_nolock (drivers/clk/clk.c:1701)\n clk_core_round_rate_nolock (drivers/clk/clk.c:1710)\n clk_round_rate (drivers/clk/clk.c:1804)\n dev_pm_opp_set_rate (drivers/opp/core.c:1440 (discriminator 1))\n msm_devfreq_target (drivers/gpu/drm/msm/msm_gpu_devfreq.c:51)\n devfreq_set_target (drivers/devfreq/devfreq.c:360)\n devfreq_update_target (drivers/devfreq/devfreq.c:426)\n devfreq_monitor (drivers/devfreq/devfreq.c:458)\n process_one_work (arch/arm64/include/asm/jump_label.h:36 include/trace/events/workqueue.h:110 kernel/workqueue.c:3284)\n worker_thread (kernel/workqueue.c:3356 (discriminator 2) kernel/workqueue.c:3443 (discriminator 2))\n kthread (kernel/kthread.c:467)\n ret_from_fork (arch/arm64/kernel/entry.S:861)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-03T15:49:42.833Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/82cfe5292b11deb1dc33822f67f73cfbe8eafe25"
},
{
"url": "https://git.kernel.org/stable/c/547ae2f17349c7586953af5ef50de43ef3f65e9e"
},
{
"url": "https://git.kernel.org/stable/c/56360aa4ddd736fc19e6d0b0206c5e437e0d6ff8"
},
{
"url": "https://git.kernel.org/stable/c/aed53da569fb96eec09b4817b1953bcc2e467eea"
},
{
"url": "https://git.kernel.org/stable/c/8aa972eba1f29068d13bec716d33abca30fb3f2a"
},
{
"url": "https://git.kernel.org/stable/c/2583cb925ca1ce450aa5d74a05a67448db970193"
}
],
"title": "clk: qcom: gfx3d: add parent to parent request map",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46247",
"datePublished": "2026-06-03T15:49:42.833Z",
"dateReserved": "2026-05-13T15:03:33.107Z",
"dateUpdated": "2026-06-03T15:49:42.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46108 (GCVE-0-2026-46108)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-06-14 17:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipmi:si: Return state to normal if message allocation fails
There were places where nothing would get started if a message
allocation failed, so the driver needs to return to normal state.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_si_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c204fab7f76a055eac346e3b1a75c6b4bb99600e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ab48817aebe4d831f87d4da6f94f50498c130d9e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9c6ded95ac6281e390d167637ccbde6cea2ba1ae",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ce905b65e649eee378a0f37e8219f1d70efb3007",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "88881dc1da86064f479378bc9d0a4956c3d0bb12",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bc13fce9eeec88c4950924754c3347c6dc66ff4c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ba60140d4133231b49185ac8bf6e54f318d3134e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "09dd798270ff582d7309f285d4aaf5dbebae01cb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_si_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi:si: Return state to normal if message allocation fails\n\nThere were places where nothing would get started if a message\nallocation failed, so the driver needs to return to normal state."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:55:01.962Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c204fab7f76a055eac346e3b1a75c6b4bb99600e"
},
{
"url": "https://git.kernel.org/stable/c/ab48817aebe4d831f87d4da6f94f50498c130d9e"
},
{
"url": "https://git.kernel.org/stable/c/9c6ded95ac6281e390d167637ccbde6cea2ba1ae"
},
{
"url": "https://git.kernel.org/stable/c/ce905b65e649eee378a0f37e8219f1d70efb3007"
},
{
"url": "https://git.kernel.org/stable/c/88881dc1da86064f479378bc9d0a4956c3d0bb12"
},
{
"url": "https://git.kernel.org/stable/c/bc13fce9eeec88c4950924754c3347c6dc66ff4c"
},
{
"url": "https://git.kernel.org/stable/c/ba60140d4133231b49185ac8bf6e54f318d3134e"
},
{
"url": "https://git.kernel.org/stable/c/09dd798270ff582d7309f285d4aaf5dbebae01cb"
}
],
"title": "ipmi:si: Return state to normal if message allocation fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46108",
"datePublished": "2026-05-28T09:35:14.978Z",
"dateReserved": "2026-05-13T15:03:33.098Z",
"dateUpdated": "2026-06-14T17:55:01.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53078 (GCVE-0-2026-53078)
Vulnerability from cvelistv5
Published
2026-06-24 16:30
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
When a BPF sock_ops program accesses ctx fields with dst_reg == src_reg,
the SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the
destination register in the !fullsock / !locked_tcp_sock path.
Both macros borrow a temporary register to check is_fullsock /
is_locked_tcp_sock when dst_reg == src_reg, because dst_reg holds the
ctx pointer. When the check is false (e.g., TCP_NEW_SYN_RECV state with
a request_sock), dst_reg should be zeroed but is not, leaving the stale
ctx pointer:
- SOCK_OPS_GET_SK: dst_reg retains the ctx pointer, passes NULL checks
as PTR_TO_SOCKET_OR_NULL, and can be used as a bogus socket pointer,
leading to stack-out-of-bounds access in helpers like
bpf_skc_to_tcp6_sock().
- SOCK_OPS_GET_FIELD: dst_reg retains the ctx pointer which the
verifier believes is a SCALAR_VALUE, leaking a kernel pointer.
Fix both macros by:
- Changing JMP_A(1) to JMP_A(2) in the fullsock path to skip the
added instruction.
- Adding BPF_MOV64_IMM(si->dst_reg, 0) after the temp register
restore in the !fullsock path, placed after the restore because
dst_reg == src_reg means we need src_reg intact to read ctx->temp.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fd09af010788a884de1c39537c288830c3d305db Version: fd09af010788a884de1c39537c288830c3d305db Version: fd09af010788a884de1c39537c288830c3d305db Version: fd09af010788a884de1c39537c288830c3d305db Version: 48be3df15aa19c04eadf156c9129293c9a10389f Version: cd4644d904e1d153d516e73e2e127e7a2fe687e1 Version: 6e0bc946cbeec538322820786b5fb5200a2216ab Version: a7e52f7f675046d9ffc5692d815fa67c82fcdbf5 Version: db7f8c57dbdd31f7e59f8dc8d1e1b38607a320ef Version: 5.7.18 ≤ Version: 5.8.4 ≤ Version: 5.4.61 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2a2c98141e0a75f2d4a7d78b0316c88b3da784ac",
"status": "affected",
"version": "fd09af010788a884de1c39537c288830c3d305db",
"versionType": "git"
},
{
"lessThan": "22400725de070b787cd6d806c5795370ab46d269",
"status": "affected",
"version": "fd09af010788a884de1c39537c288830c3d305db",
"versionType": "git"
},
{
"lessThan": "18e3ffde1822f0b48b1753bf34aa97ce839df1d8",
"status": "affected",
"version": "fd09af010788a884de1c39537c288830c3d305db",
"versionType": "git"
},
{
"lessThan": "10f86a2a5c91fc4c4d001960f1c21abe52545ef6",
"status": "affected",
"version": "fd09af010788a884de1c39537c288830c3d305db",
"versionType": "git"
},
{
"status": "affected",
"version": "48be3df15aa19c04eadf156c9129293c9a10389f",
"versionType": "git"
},
{
"status": "affected",
"version": "cd4644d904e1d153d516e73e2e127e7a2fe687e1",
"versionType": "git"
},
{
"status": "affected",
"version": "6e0bc946cbeec538322820786b5fb5200a2216ab",
"versionType": "git"
},
{
"status": "affected",
"version": "a7e52f7f675046d9ffc5692d815fa67c82fcdbf5",
"versionType": "git"
},
{
"status": "affected",
"version": "db7f8c57dbdd31f7e59f8dc8d1e1b38607a320ef",
"versionType": "git"
},
{
"lessThan": "5.8",
"status": "affected",
"version": "5.7.18",
"versionType": "semver"
},
{
"lessThan": "5.9",
"status": "affected",
"version": "5.8.4",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.61",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.7.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.8.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.7.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.8.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix same-register dst/src OOB read and pointer leak in sock_ops\n\nWhen a BPF sock_ops program accesses ctx fields with dst_reg == src_reg,\nthe SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the\ndestination register in the !fullsock / !locked_tcp_sock path.\n\nBoth macros borrow a temporary register to check is_fullsock /\nis_locked_tcp_sock when dst_reg == src_reg, because dst_reg holds the\nctx pointer. When the check is false (e.g., TCP_NEW_SYN_RECV state with\na request_sock), dst_reg should be zeroed but is not, leaving the stale\nctx pointer:\n\n - SOCK_OPS_GET_SK: dst_reg retains the ctx pointer, passes NULL checks\n as PTR_TO_SOCKET_OR_NULL, and can be used as a bogus socket pointer,\n leading to stack-out-of-bounds access in helpers like\n bpf_skc_to_tcp6_sock().\n\n - SOCK_OPS_GET_FIELD: dst_reg retains the ctx pointer which the\n verifier believes is a SCALAR_VALUE, leaking a kernel pointer.\n\nFix both macros by:\n - Changing JMP_A(1) to JMP_A(2) in the fullsock path to skip the\n added instruction.\n - Adding BPF_MOV64_IMM(si-\u003edst_reg, 0) after the temp register\n restore in the !fullsock path, placed after the restore because\n dst_reg == src_reg means we need src_reg intact to read ctx-\u003etemp."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires loading and attaching a crafted BPF_PROG_TYPE_SOCK_OPS program through the local bpf() interface. Remote TCP traffic can trigger an attached program, but cannot by itself create the malicious program.\nAC:L - The attacker controls the BPF bytecode pattern and can reliably trigger non-fullsock/request_sock sock_ops callbacks with local TCP activity. No uncontrolled race or rare runtime condition is required.\nPR:L - Loading/attaching sock_ops BPF requires BPF and net-admin style privileges, but these can be available to a local user through user-namespace/BPF-token delegation in plausible deployments. Under the required overestimate rule this is Low rather than High.\nUI:N - No victim action is needed after the attacker loads and attaches the crafted sock_ops program. The attacker can trigger the callback path directly.\nS:U - The impact is within the same kernel security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The bug leaks a kernel context pointer as a scalar and lets it be used as a bogus socket pointer. Helper dereferences can perform kernel stack out-of-bounds reads, so confidentiality impact is High.\nI:H - The bogus verifier-approved socket pointer can reach helpers that mutate socket-associated state, creating plausible kernel memory corruption from a misinterpreted stack object. With uncertainty required to resolve upward, integrity impact is High.\nA:H - The same bogus pointer path can cause kernel stack out-of-bounds accesses and invalid helper dereferences. These can crash or panic the kernel, so availability impact is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:11.207Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2a2c98141e0a75f2d4a7d78b0316c88b3da784ac"
},
{
"url": "https://git.kernel.org/stable/c/22400725de070b787cd6d806c5795370ab46d269"
},
{
"url": "https://git.kernel.org/stable/c/18e3ffde1822f0b48b1753bf34aa97ce839df1d8"
},
{
"url": "https://git.kernel.org/stable/c/10f86a2a5c91fc4c4d001960f1c21abe52545ef6"
}
],
"title": "bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53078",
"datePublished": "2026-06-24T16:30:18.858Z",
"dateReserved": "2026-06-09T07:44:35.383Z",
"dateUpdated": "2026-08-05T12:33:11.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43180 (GCVE-0-2026-43180)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
kaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls
netif_stop_queue() and netif_wake_queue(). These are TX queue flow
control functions unrelated to RX multicast configuration.
The premature netif_wake_queue() can re-enable TX while tx_urb is still
in-flight, leading to a double usb_submit_urb() on the same URB:
kaweth_start_xmit() {
netif_stop_queue();
usb_submit_urb(kaweth->tx_urb);
}
kaweth_set_rx_mode() {
netif_stop_queue();
netif_wake_queue(); // wakes TX queue before URB is done
}
kaweth_start_xmit() {
netif_stop_queue();
usb_submit_urb(kaweth->tx_urb); // URB submitted while active
}
This triggers the WARN in usb_submit_urb():
"URB submitted while active"
This is a similar class of bug fixed in rtl8150 by
- commit 958baf5eaee3 ("net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast").
Also kaweth_set_rx_mode() is already functionally broken, the
real set_rx_mode action is performed by kaweth_async_set_rx_mode(),
which in turn is not a no-op only at ndo_open() time.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/kaweth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "443a830b1dc4f85c7560da59d4494b629feee215",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "586318c2730433184c6f1d21183e346ddf25e81d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a2cd4b4db315a845a5603d08c9d03b11ddfc799d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ef9b10a020503888eb6c8ed85a3d901a624ede4c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9c79b839a63980c7da7ec5db895198045e154112",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "fc393af769af845d9985e2845e49553d8f015a64",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8367c0e90126426e60581e4c07e1ec4411a0f843",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "64868f5ecadeb359a49bc4485bfa7c497047f13a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/kaweth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode\n\nkaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls\nnetif_stop_queue() and netif_wake_queue(). These are TX queue flow\ncontrol functions unrelated to RX multicast configuration.\n\nThe premature netif_wake_queue() can re-enable TX while tx_urb is still\nin-flight, leading to a double usb_submit_urb() on the same URB:\n\nkaweth_start_xmit() {\n netif_stop_queue();\n usb_submit_urb(kaweth-\u003etx_urb);\n}\n\nkaweth_set_rx_mode() {\n netif_stop_queue();\n netif_wake_queue(); // wakes TX queue before URB is done\n}\n\nkaweth_start_xmit() {\n netif_stop_queue();\n usb_submit_urb(kaweth-\u003etx_urb); // URB submitted while active\n}\n\nThis triggers the WARN in usb_submit_urb():\n\n \"URB submitted while active\"\n\nThis is a similar class of bug fixed in rtl8150 by\n\n- commit 958baf5eaee3 (\"net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast\").\n\nAlso kaweth_set_rx_mode() is already functionally broken, the\nreal set_rx_mode action is performed by kaweth_async_set_rx_mode(),\nwhich in turn is not a no-op only at ndo_open() time."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable callback is reachable through local socket operations such as IPv4/IPv6 multicast membership changes on a host with a kaweth USB Ethernet interface. Remote network packets alone do not invoke ndo_set_rx_mode.\nAC:L - The attacker can control both sides by generating transmit traffic while repeatedly changing multicast/RX mode state. The active-URB window is repeatable and does not depend on conditions outside attacker control once the affected device is present.\nPR:L - A local unprivileged user can reach the callback through normal multicast socket membership paths without CAP_NET_ADMIN. Admin ioctl/netlink paths also exist, but they are not the least-privileged path.\nUI:N - No victim action is required after the affected interface is present and usable. The attacker can trigger both TX and RX-mode changes from their own local process.\nS:U - The impact remains within the same kernel/host security authority. This is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The second transmit can refill an active URB and overwrite kaweth-\u003etx_skb; the failed submit frees that skb while completion later uses/frees the same pointer. Treating this kernel heap UAF/double-free as exploitable, high confidentiality impact is defensible.\nI:H - The stale skb and active URB manipulation create kernel memory corruption, not merely a clean error return. With heap shaping, this can plausibly become arbitrary write or control-flow compromise.\nA:H - At minimum the bug triggers the usb_submit_urb active-URB WARN path. The associated UAF/double-free memory corruption can also oops, panic, or hang the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:21.114Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/443a830b1dc4f85c7560da59d4494b629feee215"
},
{
"url": "https://git.kernel.org/stable/c/586318c2730433184c6f1d21183e346ddf25e81d"
},
{
"url": "https://git.kernel.org/stable/c/a2cd4b4db315a845a5603d08c9d03b11ddfc799d"
},
{
"url": "https://git.kernel.org/stable/c/ef9b10a020503888eb6c8ed85a3d901a624ede4c"
},
{
"url": "https://git.kernel.org/stable/c/9c79b839a63980c7da7ec5db895198045e154112"
},
{
"url": "https://git.kernel.org/stable/c/fc393af769af845d9985e2845e49553d8f015a64"
},
{
"url": "https://git.kernel.org/stable/c/8367c0e90126426e60581e4c07e1ec4411a0f843"
},
{
"url": "https://git.kernel.org/stable/c/64868f5ecadeb359a49bc4485bfa7c497047f13a"
}
],
"title": "net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43180",
"datePublished": "2026-05-06T11:27:52.983Z",
"dateReserved": "2026-05-01T14:12:55.991Z",
"dateUpdated": "2026-08-05T12:26:21.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43256 (GCVE-0-2026-43256)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()
vfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM(7) as the loop
bound and passes the index to vfe_isr_reg_update(). However,
vfe->line[] array is defined with VFE_LINE_NUM_MAX(4):
struct vfe_line line[VFE_LINE_NUM_MAX];
When index is 4, 5, 6, the access to vfe->line[line_id] exceeds
the array bounds and resulting in out-of-bounds memory access.
Fix this by using separate loops for output lines and write masters.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4edc8eae715cecf5f8bf12a0c77c281f336c37db Version: 4edc8eae715cecf5f8bf12a0c77c281f336c37db Version: 4edc8eae715cecf5f8bf12a0c77c281f336c37db Version: 4edc8eae715cecf5f8bf12a0c77c281f336c37db Version: 4edc8eae715cecf5f8bf12a0c77c281f336c37db Version: 4edc8eae715cecf5f8bf12a0c77c281f336c37db |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/qcom/camss/camss-vfe-480.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e6cbf765686fb6c1d8f2530b3daf6c66efc92f5d",
"status": "affected",
"version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
"versionType": "git"
},
{
"lessThan": "0c074e80921fd18984b75836730d76c768c84f65",
"status": "affected",
"version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
"versionType": "git"
},
{
"lessThan": "1b103307df6d461a0731be25aca69ad0335b0933",
"status": "affected",
"version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
"versionType": "git"
},
{
"lessThan": "fade67c88870f497a13ed450ba01f7236c92dd9b",
"status": "affected",
"version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
"versionType": "git"
},
{
"lessThan": "e7a38ecda2498e7ce998793ac2a46ca47317635d",
"status": "affected",
"version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
"versionType": "git"
},
{
"lessThan": "d965919af524e68cb2ab1a685872050ad2ee933d",
"status": "affected",
"version": "4edc8eae715cecf5f8bf12a0c77c281f336c37db",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/qcom/camss/camss-vfe-480.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()\n\nvfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM(7) as the loop\nbound and passes the index to vfe_isr_reg_update(). However,\nvfe-\u003eline[] array is defined with VFE_LINE_NUM_MAX(4):\n\n struct vfe_line line[VFE_LINE_NUM_MAX];\n\nWhen index is 4, 5, 6, the access to vfe-\u003eline[line_id] exceeds\nthe array bounds and resulting in out-of-bounds memory access.\n\nFix this by using separate loops for output lines and write masters."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local V4L2/media device use, where a process starts CAMSS camera streaming and the hardware interrupt enters vfe_isr(). It is not directly network-facing and does not require physical hotplug beyond the affected built-in camera hardware.\nAC:L - On SM8250 VFE-lite, ordinary bus completion bits overlap the erroneous RDI_RUP checks for indices 4-6, so normal streaming interrupts can pass out-of-bounds line IDs. No race or condition outside the attacker\u0027s control is required once streaming is active.\nPR:L - The driver has no capable() or administrator-only check on this path; access is governed by V4L2 device-node or camera-service permissions. This is basic local privilege, not real root in the init namespace.\nUI:N - A malicious local process with access to the camera device can configure buffers and start streaming itself. No separate victim action is required.\nS:U - The impact remains within the kernel/CAMSS security authority. There is no guest-to-host, IOMMU, or other cross-scope boundary bypass.\nC:H - The bug performs out-of-bounds reads from kernel memory beyond vfe-\u003eline[]. Because this is repeatable kernel memory corruption, high confidentiality impact is defensible.\nI:H - If the out-of-bounds wait_reg_update field is nonzero, the ISR writes to out-of-bounds memory and calls complete() on an out-of-bounds completion object. This can corrupt adjacent kernel objects, so integrity impact is high.\nA:H - The out-of-bounds access and possible complete() on invalid memory occur in interrupt context and can cause an oops or panic. The trigger can be repeated by restarting or continuing camera streaming."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:55.873Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e6cbf765686fb6c1d8f2530b3daf6c66efc92f5d"
},
{
"url": "https://git.kernel.org/stable/c/0c074e80921fd18984b75836730d76c768c84f65"
},
{
"url": "https://git.kernel.org/stable/c/1b103307df6d461a0731be25aca69ad0335b0933"
},
{
"url": "https://git.kernel.org/stable/c/fade67c88870f497a13ed450ba01f7236c92dd9b"
},
{
"url": "https://git.kernel.org/stable/c/e7a38ecda2498e7ce998793ac2a46ca47317635d"
},
{
"url": "https://git.kernel.org/stable/c/d965919af524e68cb2ab1a685872050ad2ee933d"
}
],
"title": "media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43256",
"datePublished": "2026-05-06T11:28:45.209Z",
"dateReserved": "2026-05-01T14:12:55.996Z",
"dateUpdated": "2026-08-05T12:26:55.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46187 (GCVE-0-2026-46187)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-06-14 18:01
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rsi: fix kthread lifetime race between self-exit and external-stop
RSI driver use both self-exit(kthread_complete_and_exit) and external-stop
(kthread_stop) when killing a kthread. Generally, kthread_stop() is called
first, and in this case, no particular issues occur.
However, in rare instances where kthread_complete_and_exit() is called
first and then kthread_stop() is called, a UAF occurs because the kthread
object, which has already exited and been freed, is accessed again.
Therefore, to prevent this with minimal modification, you must remove
kthread_stop() and change the code to wait until the self-exit operation
is completed.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4c62764d0fc21a34ffc44eec1210038c3a2e4473 Version: 4c62764d0fc21a34ffc44eec1210038c3a2e4473 Version: 4c62764d0fc21a34ffc44eec1210038c3a2e4473 Version: 4c62764d0fc21a34ffc44eec1210038c3a2e4473 Version: 4c62764d0fc21a34ffc44eec1210038c3a2e4473 Version: 4c62764d0fc21a34ffc44eec1210038c3a2e4473 Version: 4c62764d0fc21a34ffc44eec1210038c3a2e4473 Version: 4c62764d0fc21a34ffc44eec1210038c3a2e4473 Version: d8f70ad66032363e3edceee81a7be2aaccb2d7f5 Version: ec759c0015fb7d4f5c7cb5711d2c8905724c7983 Version: c8ed05b1d8520f40395916438da9b38ce937a896 Version: ad78e2e057ab8d914a2b5e3e6acf29c3c8a428a3 Version: de1fd69b6541ff61177114d63af7ea719c426cf0 Version: 3.18.139 ≤ Version: 4.4.179 ≤ Version: 4.9.170 ≤ Version: 4.14.113 ≤ Version: 4.19.36 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/rsi/rsi_common.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4ac3095da22fc50e51ec10c3b8323c21ab3e441a",
"status": "affected",
"version": "4c62764d0fc21a34ffc44eec1210038c3a2e4473",
"versionType": "git"
},
{
"lessThan": "9dfe8a4458a063c6433526bc59112a169eee1aa3",
"status": "affected",
"version": "4c62764d0fc21a34ffc44eec1210038c3a2e4473",
"versionType": "git"
},
{
"lessThan": "4f697813162d5f9151726a6d2bee82bffe4b0256",
"status": "affected",
"version": "4c62764d0fc21a34ffc44eec1210038c3a2e4473",
"versionType": "git"
},
{
"lessThan": "95fcb436586dc3c2983537d557ac05bbc6a027f3",
"status": "affected",
"version": "4c62764d0fc21a34ffc44eec1210038c3a2e4473",
"versionType": "git"
},
{
"lessThan": "16d9f674c619838bdeae42abc0929c9c5477ea1f",
"status": "affected",
"version": "4c62764d0fc21a34ffc44eec1210038c3a2e4473",
"versionType": "git"
},
{
"lessThan": "4f9a4ae8d2c198f01611ea376034c326ef43ab56",
"status": "affected",
"version": "4c62764d0fc21a34ffc44eec1210038c3a2e4473",
"versionType": "git"
},
{
"lessThan": "4f4c9b13c485abd0a2d2c97f9db339d1dd8e147f",
"status": "affected",
"version": "4c62764d0fc21a34ffc44eec1210038c3a2e4473",
"versionType": "git"
},
{
"lessThan": "db57a1aa54ff68669781976e4edb045e09e2b65b",
"status": "affected",
"version": "4c62764d0fc21a34ffc44eec1210038c3a2e4473",
"versionType": "git"
},
{
"status": "affected",
"version": "d8f70ad66032363e3edceee81a7be2aaccb2d7f5",
"versionType": "git"
},
{
"status": "affected",
"version": "ec759c0015fb7d4f5c7cb5711d2c8905724c7983",
"versionType": "git"
},
{
"status": "affected",
"version": "c8ed05b1d8520f40395916438da9b38ce937a896",
"versionType": "git"
},
{
"status": "affected",
"version": "ad78e2e057ab8d914a2b5e3e6acf29c3c8a428a3",
"versionType": "git"
},
{
"status": "affected",
"version": "de1fd69b6541ff61177114d63af7ea719c426cf0",
"versionType": "git"
},
{
"lessThan": "3.19",
"status": "affected",
"version": "3.18.139",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.179",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.170",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.113",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.36",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/rsi/rsi_common.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.139",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.179",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.170",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.113",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rsi: fix kthread lifetime race between self-exit and external-stop\n\nRSI driver use both self-exit(kthread_complete_and_exit) and external-stop\n(kthread_stop) when killing a kthread. Generally, kthread_stop() is called\nfirst, and in this case, no particular issues occur.\n\nHowever, in rare instances where kthread_complete_and_exit() is called\nfirst and then kthread_stop() is called, a UAF occurs because the kthread\nobject, which has already exited and been freed, is accessed again.\n\nTherefore, to prevent this with minimal modification, you must remove\nkthread_stop() and change the code to wait until the self-exit operation\nis completed."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T18:01:14.431Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4ac3095da22fc50e51ec10c3b8323c21ab3e441a"
},
{
"url": "https://git.kernel.org/stable/c/9dfe8a4458a063c6433526bc59112a169eee1aa3"
},
{
"url": "https://git.kernel.org/stable/c/4f697813162d5f9151726a6d2bee82bffe4b0256"
},
{
"url": "https://git.kernel.org/stable/c/95fcb436586dc3c2983537d557ac05bbc6a027f3"
},
{
"url": "https://git.kernel.org/stable/c/16d9f674c619838bdeae42abc0929c9c5477ea1f"
},
{
"url": "https://git.kernel.org/stable/c/4f9a4ae8d2c198f01611ea376034c326ef43ab56"
},
{
"url": "https://git.kernel.org/stable/c/4f4c9b13c485abd0a2d2c97f9db339d1dd8e147f"
},
{
"url": "https://git.kernel.org/stable/c/db57a1aa54ff68669781976e4edb045e09e2b65b"
}
],
"title": "wifi: rsi: fix kthread lifetime race between self-exit and external-stop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46187",
"datePublished": "2026-05-28T09:36:41.427Z",
"dateReserved": "2026-05-13T15:03:33.104Z",
"dateUpdated": "2026-06-14T18:01:14.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43113 (GCVE-0-2026-43113)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: wl1251: validate packet IDs before indexing tx_frames
wl1251_tx_packet_cb() uses the firmware completion ID directly to index
the fixed 16-entry wl->tx_frames[] array. The ID is a raw u8 from the
completion block, and the callback does not currently verify that it
fits the array before dereferencing it.
Reject completion IDs that fall outside wl->tx_frames[] and keep the
existing NULL check in the same guard. This keeps the fix local to the
trust boundary and avoids touching the rest of the completion flow.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 Version: 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 Version: 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 Version: 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 Version: 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 Version: 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 Version: 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 Version: 2f01a1f58889fbfeb68b1bc1b52e4197f3333490 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ti/wl1251/tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6509dbece7339dbc8980c706b9d623119a6de105",
"status": "affected",
"version": "2f01a1f58889fbfeb68b1bc1b52e4197f3333490",
"versionType": "git"
},
{
"lessThan": "a8a11a876f0a97061ee5d9e61d0f5a0df7e241c7",
"status": "affected",
"version": "2f01a1f58889fbfeb68b1bc1b52e4197f3333490",
"versionType": "git"
},
{
"lessThan": "e0dc1ad870d6788b049bfe1511ac75b2333a7550",
"status": "affected",
"version": "2f01a1f58889fbfeb68b1bc1b52e4197f3333490",
"versionType": "git"
},
{
"lessThan": "b6ba1eacf276063ebeefbbae8056043c24f2efaf",
"status": "affected",
"version": "2f01a1f58889fbfeb68b1bc1b52e4197f3333490",
"versionType": "git"
},
{
"lessThan": "df15adc692a802636dd3f258fc7cca8bf7a0ed9a",
"status": "affected",
"version": "2f01a1f58889fbfeb68b1bc1b52e4197f3333490",
"versionType": "git"
},
{
"lessThan": "8d7465be5163a923ee5d7459719ef5a021c1584a",
"status": "affected",
"version": "2f01a1f58889fbfeb68b1bc1b52e4197f3333490",
"versionType": "git"
},
{
"lessThan": "26ee518695c484f75e3606d631278e84bd24ae02",
"status": "affected",
"version": "2f01a1f58889fbfeb68b1bc1b52e4197f3333490",
"versionType": "git"
},
{
"lessThan": "0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0",
"status": "affected",
"version": "2f01a1f58889fbfeb68b1bc1b52e4197f3333490",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ti/wl1251/tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wl1251: validate packet IDs before indexing tx_frames\n\nwl1251_tx_packet_cb() uses the firmware completion ID directly to index\nthe fixed 16-entry wl-\u003etx_frames[] array. The ID is a raw u8 from the\ncompletion block, and the callback does not currently verify that it\nfits the array before dereferencing it.\n\nReject completion IDs that fall outside wl-\u003etx_frames[] and keep the\nexisting NULL check in the same guard. This keeps the fix local to the\ntrust boundary and avoids touching the rest of the completion flow."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable completion path belongs to a Wi-Fi driver and is reached through wl1251 transmit-completion processing after wireless activity. The highest defensible scenario is a radio-adjacent attacker influencing firmware TX results on the local Wi-Fi medium.\nAC:L - There is no race or hard timing requirement in the vulnerable callback. Once the TX-result path is reached, one completion record with an out-of-range u8 packet ID is enough to trigger the out-of-bounds access.\nPR:N - The TX completion interrupt path performs no attacker credential or authorization check before trusting the firmware completion ring. A radio-adjacent attacker does not need an account or local privileges on the victim.\nUI:N - Completion records are processed automatically by the driver when the device raises a TX-result interrupt. Exploitation does not require the victim to open a file, mount anything, or perform a deliberate action.\nS:U - The vulnerable component is a kernel Wi-Fi driver and the impacts are to the same kernel security authority. This is not a VM escape, IOMMU bypass, or cross-authority boundary crossing.\nC:H - The unchecked u8 index can read a pointer outside the fixed 16-entry tx_frames array and then treat that memory as an skb. As kernel memory corruption, this is defensibly scoreable as high confidentiality impact.\nI:H - The old code can write NULL back through wl-\u003etx_frames[result-\u003eid] out of bounds and can also mutate fields through a bogus skb pointer. That is kernel memory corruption with potential control-flow or data-integrity impact.\nA:H - An out-of-bounds pointer dereference or write in this kernel path can readily cause an oops, panic, or device/driver failure. Availability impact is therefore high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:00.700Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6509dbece7339dbc8980c706b9d623119a6de105"
},
{
"url": "https://git.kernel.org/stable/c/a8a11a876f0a97061ee5d9e61d0f5a0df7e241c7"
},
{
"url": "https://git.kernel.org/stable/c/e0dc1ad870d6788b049bfe1511ac75b2333a7550"
},
{
"url": "https://git.kernel.org/stable/c/b6ba1eacf276063ebeefbbae8056043c24f2efaf"
},
{
"url": "https://git.kernel.org/stable/c/df15adc692a802636dd3f258fc7cca8bf7a0ed9a"
},
{
"url": "https://git.kernel.org/stable/c/8d7465be5163a923ee5d7459719ef5a021c1584a"
},
{
"url": "https://git.kernel.org/stable/c/26ee518695c484f75e3606d631278e84bd24ae02"
},
{
"url": "https://git.kernel.org/stable/c/0fd56fad9c56356e7fa7a7c52e7ecbf807a44eb0"
}
],
"title": "wifi: wl1251: validate packet IDs before indexing tx_frames",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43113",
"datePublished": "2026-05-06T07:40:39.234Z",
"dateReserved": "2026-05-01T14:12:55.986Z",
"dateUpdated": "2026-08-05T12:26:00.700Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45948 (GCVE-0-2026-45948)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-05-27 12:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix memory leak in ext4_ext_shift_extents()
In ext4_ext_shift_extents(), if the extent is NULL in the while loop, the
function returns immediately without releasing the path obtained via
ext4_find_extent(), leading to a memory leak.
Fix this by jumping to the out label to ensure the path is properly
released.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a18ed359bdddcded4f97ff5e2f07793ff9336913 Version: a18ed359bdddcded4f97ff5e2f07793ff9336913 Version: a18ed359bdddcded4f97ff5e2f07793ff9336913 Version: a18ed359bdddcded4f97ff5e2f07793ff9336913 Version: a18ed359bdddcded4f97ff5e2f07793ff9336913 Version: a18ed359bdddcded4f97ff5e2f07793ff9336913 Version: a18ed359bdddcded4f97ff5e2f07793ff9336913 Version: a18ed359bdddcded4f97ff5e2f07793ff9336913 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/extents.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7e807cb8603b7664fa630a696cd891d9a03c248d",
"status": "affected",
"version": "a18ed359bdddcded4f97ff5e2f07793ff9336913",
"versionType": "git"
},
{
"lessThan": "afc5e61e1a07b2b833bd72cbee36ecce9cd901e2",
"status": "affected",
"version": "a18ed359bdddcded4f97ff5e2f07793ff9336913",
"versionType": "git"
},
{
"lessThan": "1bce219ee5512cf179ba40cf114945a14a16e21f",
"status": "affected",
"version": "a18ed359bdddcded4f97ff5e2f07793ff9336913",
"versionType": "git"
},
{
"lessThan": "4a79fde8db7eba7f1128d971ceba4e3c9ac84aec",
"status": "affected",
"version": "a18ed359bdddcded4f97ff5e2f07793ff9336913",
"versionType": "git"
},
{
"lessThan": "2f4b1052246ca646bb17bfe0f53df2fdf9729b58",
"status": "affected",
"version": "a18ed359bdddcded4f97ff5e2f07793ff9336913",
"versionType": "git"
},
{
"lessThan": "12615ab4bfb69678e5d961b28bb70040299e51b1",
"status": "affected",
"version": "a18ed359bdddcded4f97ff5e2f07793ff9336913",
"versionType": "git"
},
{
"lessThan": "bd7b52557e4a3ccd7595fdb3a585f1257de57935",
"status": "affected",
"version": "a18ed359bdddcded4f97ff5e2f07793ff9336913",
"versionType": "git"
},
{
"lessThan": "ca81109d4a8f192dc1cbad4a1ee25246363c2833",
"status": "affected",
"version": "a18ed359bdddcded4f97ff5e2f07793ff9336913",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/extents.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix memory leak in ext4_ext_shift_extents()\n\nIn ext4_ext_shift_extents(), if the extent is NULL in the while loop, the\nfunction returns immediately without releasing the path obtained via\next4_find_extent(), leading to a memory leak.\n\nFix this by jumping to the out label to ensure the path is properly\nreleased."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:18:04.937Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7e807cb8603b7664fa630a696cd891d9a03c248d"
},
{
"url": "https://git.kernel.org/stable/c/afc5e61e1a07b2b833bd72cbee36ecce9cd901e2"
},
{
"url": "https://git.kernel.org/stable/c/1bce219ee5512cf179ba40cf114945a14a16e21f"
},
{
"url": "https://git.kernel.org/stable/c/4a79fde8db7eba7f1128d971ceba4e3c9ac84aec"
},
{
"url": "https://git.kernel.org/stable/c/2f4b1052246ca646bb17bfe0f53df2fdf9729b58"
},
{
"url": "https://git.kernel.org/stable/c/12615ab4bfb69678e5d961b28bb70040299e51b1"
},
{
"url": "https://git.kernel.org/stable/c/bd7b52557e4a3ccd7595fdb3a585f1257de57935"
},
{
"url": "https://git.kernel.org/stable/c/ca81109d4a8f192dc1cbad4a1ee25246363c2833"
}
],
"title": "ext4: fix memory leak in ext4_ext_shift_extents()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45948",
"datePublished": "2026-05-27T12:18:04.937Z",
"dateReserved": "2026-05-13T15:03:33.088Z",
"dateUpdated": "2026-05-27T12:18:04.937Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31663 (GCVE-0-2026-31663)
Vulnerability from cvelistv5
Published
2026-04-24 14:45
Modified
2026-08-21 12:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: hold dev ref until after transport_finish NF_HOOK
After async crypto completes, xfrm_input_resume() calls dev_put()
immediately on re-entry before the skb reaches transport_finish.
The skb->dev pointer is then used inside NF_HOOK and its okfn,
which can race with device teardown.
Remove the dev_put from the async resumption entry and instead
drop the reference after the NF_HOOK call in transport_finish,
using a saved device pointer since NF_HOOK may consume the skb.
This covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip
the okfn.
For non-transport exits (decaps, gro, drop) and secondary
async return points, release the reference inline when
async is set.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: acf568ee859f098279eadf551612f103afdacb4e Version: acf568ee859f098279eadf551612f103afdacb4e Version: acf568ee859f098279eadf551612f103afdacb4e Version: acf568ee859f098279eadf551612f103afdacb4e Version: 69895c5ea0ca2e8d7de1e6d36965d0ab9730787f Version: 833760100588acfb267dac4d6a02ab9931237739 Version: e095ecaec6d94aa2156cceb98a85d409b51190f3 Version: 3.2.100 ≤ Version: 3.16.55 ≤ Version: 4.14.24 ≤ |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s `xfrm` (IP eXtensible FRamework) subsystem. This vulnerability involves a race condition where a network device\u0027s reference is released too early during packet processing after asynchronous cryptography. This premature release can lead to the system attempting to access a deallocated device, potentially causing a system crash (Denial of Service)."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-826",
"description": "Premature Release of Resource During Expected Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T12:12:59.640Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-31663"
},
{
"name": "RHBZ#2461462",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461462"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31663.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-24T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-24T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: xfrm: hold dev ref until after transport_finish NF_HOOK",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/xfrm4_input.c",
"net/ipv6/xfrm6_input.c",
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4236c30b437b80f673b9e08c8fae38b8d471ac9e",
"status": "affected",
"version": "acf568ee859f098279eadf551612f103afdacb4e",
"versionType": "git"
},
{
"lessThan": "0f451b43c88bf2b9c038b414be580efee42e031b",
"status": "affected",
"version": "acf568ee859f098279eadf551612f103afdacb4e",
"versionType": "git"
},
{
"lessThan": "5002beda5cac69d522dc54da0d5d463ed9c963d2",
"status": "affected",
"version": "acf568ee859f098279eadf551612f103afdacb4e",
"versionType": "git"
},
{
"lessThan": "1c428b03840094410c5fb6a5db30640486bbbfcb",
"status": "affected",
"version": "acf568ee859f098279eadf551612f103afdacb4e",
"versionType": "git"
},
{
"status": "affected",
"version": "69895c5ea0ca2e8d7de1e6d36965d0ab9730787f",
"versionType": "git"
},
{
"status": "affected",
"version": "833760100588acfb267dac4d6a02ab9931237739",
"versionType": "git"
},
{
"status": "affected",
"version": "e095ecaec6d94aa2156cceb98a85d409b51190f3",
"versionType": "git"
},
{
"lessThan": "3.3",
"status": "affected",
"version": "3.2.100",
"versionType": "semver"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.55",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.24",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/xfrm4_input.c",
"net/ipv6/xfrm6_input.c",
"net/xfrm/xfrm_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.100",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: hold dev ref until after transport_finish NF_HOOK\n\nAfter async crypto completes, xfrm_input_resume() calls dev_put()\nimmediately on re-entry before the skb reaches transport_finish.\nThe skb-\u003edev pointer is then used inside NF_HOOK and its okfn,\nwhich can race with device teardown.\n\nRemove the dev_put from the async resumption entry and instead\ndrop the reference after the NF_HOOK call in transport_finish,\nusing a saved device pointer since NF_HOOK may consume the skb.\nThis covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip\nthe okfn.\n\nFor non-transport exits (decaps, gro, drop) and secondary\nasync return points, release the reference inline when\nasync is set."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The complete attacker-controlled path requires a local unprivileged user to create a user/net namespace, configure transport-mode XFRM state, send traffic, and tear down the namespace/device in parallel.\nAC:L - The race is attacker-controlled in the user-namespace scenario: the attacker controls packet injection and device/netns teardown and can repeat the sequence reliably.\nPR:L - XFRM and rtnetlink setup require CAP_NET_ADMIN, but these checks are against the network namespace user_ns and are reachable after unshare -Urn by an unprivileged local user.\nUI:N - No victim action is required once the attacker can run local code and create the namespace setup.\nS:U - The vulnerable component and impacted resource are the kernel itself; this is a standard kernel memory-safety issue rather than a VM or hardware boundary escape.\nC:H - This is a net_device use-after-free, and freed kernel heap objects can potentially be reclaimed and abused for kernel memory disclosure.\nI:H - Use-after-free in kernel networking code can potentially be shaped into control-flow or data-structure corruption, so high integrity impact is appropriate.\nA:H - The issue was reproduced as a KASAN slab-use-after-free in the async XFRM reinject path and can crash the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:13.957Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4236c30b437b80f673b9e08c8fae38b8d471ac9e"
},
{
"url": "https://git.kernel.org/stable/c/0f451b43c88bf2b9c038b414be580efee42e031b"
},
{
"url": "https://git.kernel.org/stable/c/5002beda5cac69d522dc54da0d5d463ed9c963d2"
},
{
"url": "https://git.kernel.org/stable/c/1c428b03840094410c5fb6a5db30640486bbbfcb"
}
],
"title": "xfrm: hold dev ref until after transport_finish NF_HOOK",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31663",
"datePublished": "2026-04-24T14:45:13.239Z",
"dateReserved": "2026-03-09T15:48:24.129Z",
"dateUpdated": "2026-08-21T12:12:59.640Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43147 (GCVE-0-2026-43147)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-23 16:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"
This reverts commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking
when enabling/disabling SR-IOV"), which causes a deadlock by recursively
taking pci_rescan_remove_lock when sriov_del_vfs() is called as part of
pci_stop_and_remove_bus_device(). For example with the following sequence
of commands:
$ echo <NUM> > /sys/bus/pci/devices/<pf>/sriov_numvfs
$ echo 1 > /sys/bus/pci/devices/<pf>/remove
A trimmed trace of the deadlock on a mlx5 device is as below:
zsh/5715 is trying to acquire lock:
000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: sriov_disable+0x34/0x140
but task is already holding lock:
000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_stop_and_remove_bus_device_locked+0x24/0x80
...
Call Trace:
[<00000259778c4f90>] dump_stack_lvl+0xc0/0x110
[<00000259779c844e>] print_deadlock_bug+0x31e/0x330
[<00000259779c1908>] __lock_acquire+0x16c8/0x32f0
[<00000259779bffac>] lock_acquire+0x14c/0x350
[<00000259789643a6>] __mutex_lock_common+0xe6/0x1520
[<000002597896413c>] mutex_lock_nested+0x3c/0x50
[<00000259784a07e4>] sriov_disable+0x34/0x140
[<00000258f7d6dd80>] mlx5_sriov_disable+0x50/0x80 [mlx5_core]
[<00000258f7d5745e>] remove_one+0x5e/0xf0 [mlx5_core]
[<00000259784857fc>] pci_device_remove+0x3c/0xa0
[<000002597851012e>] device_release_driver_internal+0x18e/0x280
[<000002597847ae22>] pci_stop_bus_device+0x82/0xa0
[<000002597847afce>] pci_stop_and_remove_bus_device_locked+0x5e/0x80
[<00000259784972c2>] remove_store+0x72/0x90
[<0000025977e6661a>] kernfs_fop_write_iter+0x15a/0x200
[<0000025977d7241c>] vfs_write+0x24c/0x300
[<0000025977d72696>] ksys_write+0x86/0x110
[<000002597895b61c>] __do_syscall+0x14c/0x400
[<000002597896e0ee>] system_call+0x6e/0x90
This alone is not a complete fix as it restores the issue the cited commit
tried to solve. A new fix will be provided as a follow on.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1e8a80290f964bdbad225221c8a1594c7e01c8fd Version: a645ca21de09e3137cbb224fa6c23cca873a1d01 Version: a24219172456f035d886857e265ca24c85b167c8 Version: 36039348bca77828bf06eae41b8f76e38cd15847 Version: 53154cd40ccf285f1d1c24367824082061d155bd Version: 05703271c3cdcc0f2a8cf6ebdc45892b8ca83520 Version: 05703271c3cdcc0f2a8cf6ebdc45892b8ca83520 Version: 05703271c3cdcc0f2a8cf6ebdc45892b8ca83520 Version: 5c1cd7d405e94dc6cb320cc0cc092b74895b6ddf Version: ee40e5db052d7c6f406fdb95ad639c894c74674c Version: 5.10.246 ≤ Version: 5.15.195 ≤ Version: 6.1.157 ≤ Version: 6.6.113 ≤ Version: 6.12.54 ≤ Version: 5.4.301 ≤ Version: 6.17.4 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/iov.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f61cdd7e9b67bb8961b0a81bf294b78343e5db05",
"status": "affected",
"version": "1e8a80290f964bdbad225221c8a1594c7e01c8fd",
"versionType": "git"
},
{
"lessThan": "0de341b2365bad430aade0853fe09c2cbe468f59",
"status": "affected",
"version": "a645ca21de09e3137cbb224fa6c23cca873a1d01",
"versionType": "git"
},
{
"lessThan": "83651d37474c762920e345a3a0828f975ca4d732",
"status": "affected",
"version": "a24219172456f035d886857e265ca24c85b167c8",
"versionType": "git"
},
{
"lessThan": "639265296fe6ee21b6f00e00ee2bab65f3b07252",
"status": "affected",
"version": "36039348bca77828bf06eae41b8f76e38cd15847",
"versionType": "git"
},
{
"lessThan": "d47f27e145f8bd13f3c230da5e3af29225b4a2f7",
"status": "affected",
"version": "53154cd40ccf285f1d1c24367824082061d155bd",
"versionType": "git"
},
{
"lessThan": "40f67686a5002c0c322fac918406bbc8d9c2ec2f",
"status": "affected",
"version": "05703271c3cdcc0f2a8cf6ebdc45892b8ca83520",
"versionType": "git"
},
{
"lessThan": "58677783c89681871077f50a7042b0c6380c4fd8",
"status": "affected",
"version": "05703271c3cdcc0f2a8cf6ebdc45892b8ca83520",
"versionType": "git"
},
{
"lessThan": "2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a",
"status": "affected",
"version": "05703271c3cdcc0f2a8cf6ebdc45892b8ca83520",
"versionType": "git"
},
{
"status": "affected",
"version": "5c1cd7d405e94dc6cb320cc0cc092b74895b6ddf",
"versionType": "git"
},
{
"status": "affected",
"version": "ee40e5db052d7c6f406fdb95ad639c894c74674c",
"versionType": "git"
},
{
"lessThan": "5.10.252",
"status": "affected",
"version": "5.10.246",
"versionType": "semver"
},
{
"lessThan": "5.15.202",
"status": "affected",
"version": "5.15.195",
"versionType": "semver"
},
{
"lessThan": "6.1.165",
"status": "affected",
"version": "6.1.157",
"versionType": "semver"
},
{
"lessThan": "6.6.128",
"status": "affected",
"version": "6.6.113",
"versionType": "semver"
},
{
"lessThan": "6.12.75",
"status": "affected",
"version": "6.12.54",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.301",
"versionType": "semver"
},
{
"lessThan": "6.18",
"status": "affected",
"version": "6.17.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/iov.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "5.10.246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.15.195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.1.157",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.6.113",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.12.54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.301",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV\"\n\nThis reverts commit 05703271c3cd (\"PCI/IOV: Add PCI rescan-remove locking\nwhen enabling/disabling SR-IOV\"), which causes a deadlock by recursively\ntaking pci_rescan_remove_lock when sriov_del_vfs() is called as part of\npci_stop_and_remove_bus_device(). For example with the following sequence\nof commands:\n\n $ echo \u003cNUM\u003e \u003e /sys/bus/pci/devices/\u003cpf\u003e/sriov_numvfs\n $ echo 1 \u003e /sys/bus/pci/devices/\u003cpf\u003e/remove\n\nA trimmed trace of the deadlock on a mlx5 device is as below:\n\n zsh/5715 is trying to acquire lock:\n 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: sriov_disable+0x34/0x140\n\n but task is already holding lock:\n 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_stop_and_remove_bus_device_locked+0x24/0x80\n ...\n Call Trace:\n [\u003c00000259778c4f90\u003e] dump_stack_lvl+0xc0/0x110\n [\u003c00000259779c844e\u003e] print_deadlock_bug+0x31e/0x330\n [\u003c00000259779c1908\u003e] __lock_acquire+0x16c8/0x32f0\n [\u003c00000259779bffac\u003e] lock_acquire+0x14c/0x350\n [\u003c00000259789643a6\u003e] __mutex_lock_common+0xe6/0x1520\n [\u003c000002597896413c\u003e] mutex_lock_nested+0x3c/0x50\n [\u003c00000259784a07e4\u003e] sriov_disable+0x34/0x140\n [\u003c00000258f7d6dd80\u003e] mlx5_sriov_disable+0x50/0x80 [mlx5_core]\n [\u003c00000258f7d5745e\u003e] remove_one+0x5e/0xf0 [mlx5_core]\n [\u003c00000259784857fc\u003e] pci_device_remove+0x3c/0xa0\n [\u003c000002597851012e\u003e] device_release_driver_internal+0x18e/0x280\n [\u003c000002597847ae22\u003e] pci_stop_bus_device+0x82/0xa0\n [\u003c000002597847afce\u003e] pci_stop_and_remove_bus_device_locked+0x5e/0x80\n [\u003c00000259784972c2\u003e] remove_store+0x72/0x90\n [\u003c0000025977e6661a\u003e] kernfs_fop_write_iter+0x15a/0x200\n [\u003c0000025977d7241c\u003e] vfs_write+0x24c/0x300\n [\u003c0000025977d72696\u003e] ksys_write+0x86/0x110\n [\u003c000002597895b61c\u003e] __do_syscall+0x14c/0x400\n [\u003c000002597896e0ee\u003e] system_call+0x6e/0x90\n\nThis alone is not a complete fix as it restores the issue the cited commit\ntried to solve. A new fix will be provided as a follow on."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:06:24.518Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f61cdd7e9b67bb8961b0a81bf294b78343e5db05"
},
{
"url": "https://git.kernel.org/stable/c/0de341b2365bad430aade0853fe09c2cbe468f59"
},
{
"url": "https://git.kernel.org/stable/c/83651d37474c762920e345a3a0828f975ca4d732"
},
{
"url": "https://git.kernel.org/stable/c/639265296fe6ee21b6f00e00ee2bab65f3b07252"
},
{
"url": "https://git.kernel.org/stable/c/d47f27e145f8bd13f3c230da5e3af29225b4a2f7"
},
{
"url": "https://git.kernel.org/stable/c/40f67686a5002c0c322fac918406bbc8d9c2ec2f"
},
{
"url": "https://git.kernel.org/stable/c/58677783c89681871077f50a7042b0c6380c4fd8"
},
{
"url": "https://git.kernel.org/stable/c/2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a"
}
],
"title": "Revert \"PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV\"",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43147",
"datePublished": "2026-05-06T11:27:30.235Z",
"dateReserved": "2026-05-01T14:12:55.989Z",
"dateUpdated": "2026-05-23T16:06:24.518Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43270 (GCVE-0-2026-43270)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()
In mtk_mdp_probe(), vpu_get_plat_device() increases the reference
count of the returned platform device. Add platform_device_put()
to prevent reference leak.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a Version: c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a Version: c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a Version: c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a Version: c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a Version: c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a Version: c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a Version: c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/mediatek/mdp/mtk_mdp_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "403b7c757ac9f6b2ffb7d00ff4795a245f5e8911",
"status": "affected",
"version": "c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a",
"versionType": "git"
},
{
"lessThan": "dd530e29bd514d7187b3e2df8eb2107419c7988f",
"status": "affected",
"version": "c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a",
"versionType": "git"
},
{
"lessThan": "c44beed2e5caf2cbbe651432baa3a129f18b0169",
"status": "affected",
"version": "c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a",
"versionType": "git"
},
{
"lessThan": "564fd3a63efc3ebbdb5d0a8fc7c0d3f753fbbd5d",
"status": "affected",
"version": "c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a",
"versionType": "git"
},
{
"lessThan": "4f2a51433a3a65d16975d1e32052d80656da077d",
"status": "affected",
"version": "c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a",
"versionType": "git"
},
{
"lessThan": "a62ba5aa9ee95fd953583e95e519badf0b76ecf3",
"status": "affected",
"version": "c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a",
"versionType": "git"
},
{
"lessThan": "2d93758f42a57f3485534eab858b308e41653de4",
"status": "affected",
"version": "c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a",
"versionType": "git"
},
{
"lessThan": "f128bab57b8018e526b7eda854ca20069863af47",
"status": "affected",
"version": "c8eb2d7e8202fd9cb912f5d33cc34ede66dcb24a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/mediatek/mdp/mtk_mdp_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()\n\nIn mtk_mdp_probe(), vpu_get_plat_device() increases the reference\ncount of the returned platform device. Add platform_device_put()\nto prevent reference leak."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:21:18.648Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/403b7c757ac9f6b2ffb7d00ff4795a245f5e8911"
},
{
"url": "https://git.kernel.org/stable/c/dd530e29bd514d7187b3e2df8eb2107419c7988f"
},
{
"url": "https://git.kernel.org/stable/c/c44beed2e5caf2cbbe651432baa3a129f18b0169"
},
{
"url": "https://git.kernel.org/stable/c/564fd3a63efc3ebbdb5d0a8fc7c0d3f753fbbd5d"
},
{
"url": "https://git.kernel.org/stable/c/4f2a51433a3a65d16975d1e32052d80656da077d"
},
{
"url": "https://git.kernel.org/stable/c/a62ba5aa9ee95fd953583e95e519badf0b76ecf3"
},
{
"url": "https://git.kernel.org/stable/c/2d93758f42a57f3485534eab858b308e41653de4"
},
{
"url": "https://git.kernel.org/stable/c/f128bab57b8018e526b7eda854ca20069863af47"
}
],
"title": "media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43270",
"datePublished": "2026-05-06T11:28:54.866Z",
"dateReserved": "2026-05-01T14:12:55.997Z",
"dateUpdated": "2026-05-11T22:21:18.648Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43035 (GCVE-0-2026-43035)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-07-14 12:49
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak
When building netlink messages, tc_chain_fill_node() never initializes
the tcm_info field of struct tcmsg. Since the allocation is not zeroed,
kernel heap memory is leaked to userspace through this 4-byte field.
The fix simply zeroes tcm_info alongside the other fields that are
already initialized.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 32a4f5ecd7381f30ae3bb36dea77a150ba68af2e Version: 32a4f5ecd7381f30ae3bb36dea77a150ba68af2e Version: 32a4f5ecd7381f30ae3bb36dea77a150ba68af2e Version: 32a4f5ecd7381f30ae3bb36dea77a150ba68af2e Version: 32a4f5ecd7381f30ae3bb36dea77a150ba68af2e Version: 32a4f5ecd7381f30ae3bb36dea77a150ba68af2e Version: 32a4f5ecd7381f30ae3bb36dea77a150ba68af2e Version: 32a4f5ecd7381f30ae3bb36dea77a150ba68af2e |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:49:08.579Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/cls_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "903c3405cfcc7700260e456ab66a5867586c9e69",
"status": "affected",
"version": "32a4f5ecd7381f30ae3bb36dea77a150ba68af2e",
"versionType": "git"
},
{
"lessThan": "71a3eda7e850ae844cb8993065f4e410c11a46ce",
"status": "affected",
"version": "32a4f5ecd7381f30ae3bb36dea77a150ba68af2e",
"versionType": "git"
},
{
"lessThan": "4ae5d23f51fb91d7d1140c6f1ba77ab0756054c3",
"status": "affected",
"version": "32a4f5ecd7381f30ae3bb36dea77a150ba68af2e",
"versionType": "git"
},
{
"lessThan": "e35f5195cd44ff4053fbc5d71ea97681728a0099",
"status": "affected",
"version": "32a4f5ecd7381f30ae3bb36dea77a150ba68af2e",
"versionType": "git"
},
{
"lessThan": "d6db08484c6cb3d4ad696246f9d288eceba2a078",
"status": "affected",
"version": "32a4f5ecd7381f30ae3bb36dea77a150ba68af2e",
"versionType": "git"
},
{
"lessThan": "906997ea3766c24fbbf9cc4bf17c047315bbd138",
"status": "affected",
"version": "32a4f5ecd7381f30ae3bb36dea77a150ba68af2e",
"versionType": "git"
},
{
"lessThan": "1091b3c174441a52fdbb92e2fe00338f9371a91c",
"status": "affected",
"version": "32a4f5ecd7381f30ae3bb36dea77a150ba68af2e",
"versionType": "git"
},
{
"lessThan": "e6e3eb5ee89ac4c163d46429391c889a1bb5e404",
"status": "affected",
"version": "32a4f5ecd7381f30ae3bb36dea77a150ba68af2e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/cls_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak\n\nWhen building netlink messages, tc_chain_fill_node() never initializes\nthe tcm_info field of struct tcmsg. Since the allocation is not zeroed,\nkernel heap memory is leaked to userspace through this 4-byte field.\n\nThe fix simply zeroes tcm_info alongside the other fields that are\nalready initialized."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:16:27.484Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/903c3405cfcc7700260e456ab66a5867586c9e69"
},
{
"url": "https://git.kernel.org/stable/c/71a3eda7e850ae844cb8993065f4e410c11a46ce"
},
{
"url": "https://git.kernel.org/stable/c/4ae5d23f51fb91d7d1140c6f1ba77ab0756054c3"
},
{
"url": "https://git.kernel.org/stable/c/e35f5195cd44ff4053fbc5d71ea97681728a0099"
},
{
"url": "https://git.kernel.org/stable/c/d6db08484c6cb3d4ad696246f9d288eceba2a078"
},
{
"url": "https://git.kernel.org/stable/c/906997ea3766c24fbbf9cc4bf17c047315bbd138"
},
{
"url": "https://git.kernel.org/stable/c/1091b3c174441a52fdbb92e2fe00338f9371a91c"
},
{
"url": "https://git.kernel.org/stable/c/e6e3eb5ee89ac4c163d46429391c889a1bb5e404"
}
],
"title": "net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43035",
"datePublished": "2026-05-01T14:15:33.922Z",
"dateReserved": "2026-05-01T14:12:55.977Z",
"dateUpdated": "2026-07-14T12:49:08.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43218 (GCVE-0-2026-43218)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-05-11 22:20
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: i2c/tw9903: Fix potential memory leak in tw9903_probe()
In one of the error paths in tw9903_probe(), the memory allocated in
v4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not freed. Fix that
by calling v4l2_ctrl_handler_free() on the handler in that error path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0890ec19c65def8c8e445931b026e0fa8d809a34 Version: 0890ec19c65def8c8e445931b026e0fa8d809a34 Version: 0890ec19c65def8c8e445931b026e0fa8d809a34 Version: 0890ec19c65def8c8e445931b026e0fa8d809a34 Version: 0890ec19c65def8c8e445931b026e0fa8d809a34 Version: 0890ec19c65def8c8e445931b026e0fa8d809a34 Version: 0890ec19c65def8c8e445931b026e0fa8d809a34 Version: 0890ec19c65def8c8e445931b026e0fa8d809a34 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/i2c/tw9903.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e54aa17c968c4de2c5f7b7ea390c63d33c07513b",
"status": "affected",
"version": "0890ec19c65def8c8e445931b026e0fa8d809a34",
"versionType": "git"
},
{
"lessThan": "32f0493506313775d3bd448de34762b6538da6bd",
"status": "affected",
"version": "0890ec19c65def8c8e445931b026e0fa8d809a34",
"versionType": "git"
},
{
"lessThan": "92537a15780b6d0281fd8286f93fbc3652e35f48",
"status": "affected",
"version": "0890ec19c65def8c8e445931b026e0fa8d809a34",
"versionType": "git"
},
{
"lessThan": "9cb9eca33d20316ed3c7a938793b8735ac3e128b",
"status": "affected",
"version": "0890ec19c65def8c8e445931b026e0fa8d809a34",
"versionType": "git"
},
{
"lessThan": "a114918270f0d95c607d69b03a244e6afe54813f",
"status": "affected",
"version": "0890ec19c65def8c8e445931b026e0fa8d809a34",
"versionType": "git"
},
{
"lessThan": "cc7aeed33e4f55c76f35f0fca73e4dfe12a63a3a",
"status": "affected",
"version": "0890ec19c65def8c8e445931b026e0fa8d809a34",
"versionType": "git"
},
{
"lessThan": "add02a3fb1fd71b004f0ed824cbac00f850de558",
"status": "affected",
"version": "0890ec19c65def8c8e445931b026e0fa8d809a34",
"versionType": "git"
},
{
"lessThan": "9cea16fea47e5553f51d10957677ff735b1eff03",
"status": "affected",
"version": "0890ec19c65def8c8e445931b026e0fa8d809a34",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/i2c/tw9903.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: i2c/tw9903: Fix potential memory leak in tw9903_probe()\n\nIn one of the error paths in tw9903_probe(), the memory allocated in\nv4l2_ctrl_handler_init() and v4l2_ctrl_new_std() is not freed. Fix that\nby calling v4l2_ctrl_handler_free() on the handler in that error path."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:20:17.331Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e54aa17c968c4de2c5f7b7ea390c63d33c07513b"
},
{
"url": "https://git.kernel.org/stable/c/32f0493506313775d3bd448de34762b6538da6bd"
},
{
"url": "https://git.kernel.org/stable/c/92537a15780b6d0281fd8286f93fbc3652e35f48"
},
{
"url": "https://git.kernel.org/stable/c/9cb9eca33d20316ed3c7a938793b8735ac3e128b"
},
{
"url": "https://git.kernel.org/stable/c/a114918270f0d95c607d69b03a244e6afe54813f"
},
{
"url": "https://git.kernel.org/stable/c/cc7aeed33e4f55c76f35f0fca73e4dfe12a63a3a"
},
{
"url": "https://git.kernel.org/stable/c/add02a3fb1fd71b004f0ed824cbac00f850de558"
},
{
"url": "https://git.kernel.org/stable/c/9cea16fea47e5553f51d10957677ff735b1eff03"
}
],
"title": "media: i2c/tw9903: Fix potential memory leak in tw9903_probe()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43218",
"datePublished": "2026-05-06T11:28:19.570Z",
"dateReserved": "2026-05-01T14:12:55.993Z",
"dateUpdated": "2026-05-11T22:20:17.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46190 (GCVE-0-2026-46190)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
Sashiko noticed an out-of-bounds read [1].
In spi_nor_params_show(), the snor_f_names array is passed to
spi_nor_print_flags() using sizeof(snor_f_names).
Since snor_f_names is an array of pointers, sizeof() returns the total
number of bytes occupied by the pointers
(element_count * sizeof(void *))
rather than the element count itself. On 64-bit systems, this makes the
passed length 8x larger than intended.
Inside spi_nor_print_flags(), the 'names_len' argument is used to
bounds-check the 'names' array access. An out-of-bounds read occurs
if a flag bit is set that exceeds the array's actual element count
but is within the inflated byte-size count.
Correct this by using ARRAY_SIZE() to pass the actual number of
string pointers in the array.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0257be79fc4a16a3252ce80aa13b3640f728c425 Version: 0257be79fc4a16a3252ce80aa13b3640f728c425 Version: 0257be79fc4a16a3252ce80aa13b3640f728c425 Version: 0257be79fc4a16a3252ce80aa13b3640f728c425 Version: 0257be79fc4a16a3252ce80aa13b3640f728c425 Version: 0257be79fc4a16a3252ce80aa13b3640f728c425 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mtd/spi-nor/debugfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "231b8e1f604f6e0a7e100536f506cdf482e2c5f5",
"status": "affected",
"version": "0257be79fc4a16a3252ce80aa13b3640f728c425",
"versionType": "git"
},
{
"lessThan": "9a80c458320e0514e11945402dd6e48fcee05524",
"status": "affected",
"version": "0257be79fc4a16a3252ce80aa13b3640f728c425",
"versionType": "git"
},
{
"lessThan": "ca18c180b053f6ce80394322b314ac721c316af7",
"status": "affected",
"version": "0257be79fc4a16a3252ce80aa13b3640f728c425",
"versionType": "git"
},
{
"lessThan": "34bdcfb496b29f9a52431194f94473b37fb8c162",
"status": "affected",
"version": "0257be79fc4a16a3252ce80aa13b3640f728c425",
"versionType": "git"
},
{
"lessThan": "c0b654bc0b76a1da102d9138be1ed1223bd99310",
"status": "affected",
"version": "0257be79fc4a16a3252ce80aa13b3640f728c425",
"versionType": "git"
},
{
"lessThan": "e47029b977e747cb3a9174308fd55762cce70147",
"status": "affected",
"version": "0257be79fc4a16a3252ce80aa13b3640f728c425",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mtd/spi-nor/debugfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()\n\nSashiko noticed an out-of-bounds read [1].\n\nIn spi_nor_params_show(), the snor_f_names array is passed to\nspi_nor_print_flags() using sizeof(snor_f_names).\n\nSince snor_f_names is an array of pointers, sizeof() returns the total\nnumber of bytes occupied by the pointers\n\t(element_count * sizeof(void *))\nrather than the element count itself. On 64-bit systems, this makes the\npassed length 8x larger than intended.\n\nInside spi_nor_print_flags(), the \u0027names_len\u0027 argument is used to\nbounds-check the \u0027names\u0027 array access. An out-of-bounds read occurs\nif a flag bit is set that exceeds the array\u0027s actual element count\nbut is within the inflated byte-size count.\n\nCorrect this by using ARRAY_SIZE() to pass the actual number of\nstring pointers in the array."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is a debugfs `params` file (mode 0444) under CONFIG_DEBUG_FS, reachable only by a local VFS read of /sys/kernel/debug/spi-nor/\u003cdev\u003e/params; there is no network or physical path.\nAC:L - While the read itself is reliable, the OOB only manifests if a flag bit \u226517 is set in nor-\u003eflags; per the directive to consider the most severe reasonable case and resolve uncertainty toward higher severity, the read is treated as reliably performable.\nPR:L - The file is created world-readable (0444), and on reasonable embedded/dev SPI-NOR deployments where debugfs is mounted and traversable by non-root, an unprivileged local user can read it.\nUI:N - Exploitation only requires the attacker to read the debugfs file; no victim action is needed.\nS:U - The defect is confined to the kernel\u0027s own memory and security authority with no crossing of a trust boundary such as VM or IOMMU.\nC:H - An out-of-bounds read that, when triggered, makes seq_puts() dereference an adjacent-memory-derived pointer and emit a kernel string into readable output \u2014 not strictly bounded to a few bytes.\nI:N - The operation is purely a read path emitting to a seq_file; it provides no memory-write or control-flow primitive.\nA:H - If the out-of-array slot holds a non-NULL invalid pointer, seq_puts() dereferences a wild pointer, which can oops/crash the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:19.706Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/231b8e1f604f6e0a7e100536f506cdf482e2c5f5"
},
{
"url": "https://git.kernel.org/stable/c/9a80c458320e0514e11945402dd6e48fcee05524"
},
{
"url": "https://git.kernel.org/stable/c/ca18c180b053f6ce80394322b314ac721c316af7"
},
{
"url": "https://git.kernel.org/stable/c/34bdcfb496b29f9a52431194f94473b37fb8c162"
},
{
"url": "https://git.kernel.org/stable/c/c0b654bc0b76a1da102d9138be1ed1223bd99310"
},
{
"url": "https://git.kernel.org/stable/c/e47029b977e747cb3a9174308fd55762cce70147"
}
],
"title": "mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46190",
"datePublished": "2026-05-28T09:36:44.017Z",
"dateReserved": "2026-05-13T15:03:33.104Z",
"dateUpdated": "2026-08-05T12:30:19.706Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31586 (GCVE-0-2026-31586)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-08-05 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
cgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses
wb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the last
reference, the blkcg can be freed asynchronously (css_free_rwork_fn ->
blkcg_css_free -> kfree) before blkcg_unpin_online() dereferences the
pointer to access blkcg->online_pin, resulting in a use-after-free:
BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367)
Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531
Workqueue: cgwb_release cgwb_release_workfn
Call Trace:
<TASK>
blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367)
cgwb_release_workfn (mm/backing-dev.c:629)
process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385)
Freed by task 1016:
kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561)
css_free_rwork_fn (kernel/cgroup/cgroup.c:5542)
process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385)
** Stack based on commit 66672af7a095 ("Add linux-next specific files
for 20260410")
I am seeing this crash sporadically in Meta fleet across multiple kernel
versions. A full reproducer is available at:
https://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh
(The race window is narrow. To make it easily reproducible, inject a
msleep(100) between css_put() and blkcg_unpin_online() in
cgwb_release_workfn(). With that delay and a KASAN-enabled kernel, the
reproducer triggers the splat reliably in less than a second.)
Fix this by moving blkcg_unpin_online() before css_put(), so the
cgwb's CSS reference keeps the blkcg alive while blkcg_unpin_online()
accesses it.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 59b57717fff8b562825d9d25e0180ad7e8048ca9 Version: 59b57717fff8b562825d9d25e0180ad7e8048ca9 Version: 59b57717fff8b562825d9d25e0180ad7e8048ca9 Version: 59b57717fff8b562825d9d25e0180ad7e8048ca9 Version: 59b57717fff8b562825d9d25e0180ad7e8048ca9 Version: 59b57717fff8b562825d9d25e0180ad7e8048ca9 Version: 59b57717fff8b562825d9d25e0180ad7e8048ca9 Version: 59b57717fff8b562825d9d25e0180ad7e8048ca9 Version: 59b57717fff8b562825d9d25e0180ad7e8048ca9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/backing-dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "23acef4156c260e8598397a1a2e8b3a23e919893",
"status": "affected",
"version": "59b57717fff8b562825d9d25e0180ad7e8048ca9",
"versionType": "git"
},
{
"lessThan": "1bd36e93b542d9dd020190c6607c6a3663405195",
"status": "affected",
"version": "59b57717fff8b562825d9d25e0180ad7e8048ca9",
"versionType": "git"
},
{
"lessThan": "740ba1ebb223f137ff088ab74d533a13f9167bd8",
"status": "affected",
"version": "59b57717fff8b562825d9d25e0180ad7e8048ca9",
"versionType": "git"
},
{
"lessThan": "115a5266749dcde7fe4127e8623d19c752088f69",
"status": "affected",
"version": "59b57717fff8b562825d9d25e0180ad7e8048ca9",
"versionType": "git"
},
{
"lessThan": "dfc8292a1d6782c76b626315605e0585a5a18447",
"status": "affected",
"version": "59b57717fff8b562825d9d25e0180ad7e8048ca9",
"versionType": "git"
},
{
"lessThan": "ea3af09eb87d8f8708c66747fcf1a2762902e839",
"status": "affected",
"version": "59b57717fff8b562825d9d25e0180ad7e8048ca9",
"versionType": "git"
},
{
"lessThan": "50879a3c1faf06e661090015d59e2127255cff27",
"status": "affected",
"version": "59b57717fff8b562825d9d25e0180ad7e8048ca9",
"versionType": "git"
},
{
"lessThan": "67cb119d32f35e32acd0393bbeb318b2bb1fdafe",
"status": "affected",
"version": "59b57717fff8b562825d9d25e0180ad7e8048ca9",
"versionType": "git"
},
{
"lessThan": "8f5857be99f1ed1fa80991c72449541f634626ee",
"status": "affected",
"version": "59b57717fff8b562825d9d25e0180ad7e8048ca9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/backing-dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.1",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: blk-cgroup: fix use-after-free in cgwb_release_workfn()\n\ncgwb_release_workfn() calls css_put(wb-\u003eblkcg_css) and then later accesses\nwb-\u003eblkcg_css again via blkcg_unpin_online(). If css_put() drops the last\nreference, the blkcg can be freed asynchronously (css_free_rwork_fn -\u003e\nblkcg_css_free -\u003e kfree) before blkcg_unpin_online() dereferences the\npointer to access blkcg-\u003eonline_pin, resulting in a use-after-free:\n\n BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367)\n Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531\n Workqueue: cgwb_release cgwb_release_workfn\n Call Trace:\n \u003cTASK\u003e\n blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367)\n cgwb_release_workfn (mm/backing-dev.c:629)\n process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385)\n\n Freed by task 1016:\n kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561)\n css_free_rwork_fn (kernel/cgroup/cgroup.c:5542)\n process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385)\n\n** Stack based on commit 66672af7a095 (\"Add linux-next specific files\nfor 20260410\")\n\nI am seeing this crash sporadically in Meta fleet across multiple kernel\nversions. A full reproducer is available at:\nhttps://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh\n\n(The race window is narrow. To make it easily reproducible, inject a\nmsleep(100) between css_put() and blkcg_unpin_online() in\ncgwb_release_workfn(). With that delay and a KASAN-enabled kernel, the\nreproducer triggers the splat reliably in less than a second.)\n\nFix this by moving blkcg_unpin_online() before css_put(), so the\ncgwb\u0027s CSS reference keeps the blkcg alive while blkcg_unpin_online()\naccesses it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached by local cgroup/writeback activity: creating/removing cgroup v2 subgroups, moving a task into them, and dirtying files on a block-backed filesystem. There is no network or physical packet/device entry point.\nAC:L - Although the timing window is narrow, the attacker can repeatedly drive both cgroup teardown and cgwb creation/release through cgroup churn and buffered writes. Per the scoring rule for attacker-driven races and UAFs, this is low complexity.\nPR:L - The attacker needs local ability to manipulate a delegated cgroup subtree and run file I/O, which is available to low-privileged users in reasonable delegated cgroup v2 or container/user-slice deployments. It does not require real init-namespace root in those scenarios.\nUI:N - No victim action is required once the attacker has local execution and cgroup access. The attacker triggers creation, writeback, and removal directly.\nS:U - The vulnerability is in the host kernel\u2019s cgroup/writeback lifetime management and impacts the same kernel security authority. Standard local kernel privilege escalation is scored as unchanged scope.\nC:H - The bug is a use-after-free of a freed blkcg object after css_put can lead to blkcg_css_free and kfree before blkcg_unpin_online dereferences it. Kernel UAFs are scored high for confidentiality because reclaimed slab contents can be abused for memory disclosure primitives.\nI:H - The immediate UAF performs a refcount decrement/write through freed memory, and reclaimed-object corruption can plausibly be shaped into broader kernel heap corruption or control-flow compromise. Kernel UAF memory corruption is scored high for integrity.\nA:H - The reported failure is a slab-use-after-free in a kernel worker and can cause an oops, panic, or persistent kernel instability. Repeated local triggering makes availability impact high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:23:37.101Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/23acef4156c260e8598397a1a2e8b3a23e919893"
},
{
"url": "https://git.kernel.org/stable/c/1bd36e93b542d9dd020190c6607c6a3663405195"
},
{
"url": "https://git.kernel.org/stable/c/740ba1ebb223f137ff088ab74d533a13f9167bd8"
},
{
"url": "https://git.kernel.org/stable/c/115a5266749dcde7fe4127e8623d19c752088f69"
},
{
"url": "https://git.kernel.org/stable/c/dfc8292a1d6782c76b626315605e0585a5a18447"
},
{
"url": "https://git.kernel.org/stable/c/ea3af09eb87d8f8708c66747fcf1a2762902e839"
},
{
"url": "https://git.kernel.org/stable/c/50879a3c1faf06e661090015d59e2127255cff27"
},
{
"url": "https://git.kernel.org/stable/c/67cb119d32f35e32acd0393bbeb318b2bb1fdafe"
},
{
"url": "https://git.kernel.org/stable/c/8f5857be99f1ed1fa80991c72449541f634626ee"
}
],
"title": "mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31586",
"datePublished": "2026-04-24T14:42:14.937Z",
"dateReserved": "2026-03-09T15:48:24.120Z",
"dateUpdated": "2026-08-05T12:23:37.101Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45894 (GCVE-0-2026-45894)
Vulnerability from cvelistv5
Published
2026-05-27 12:17
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Clear Present bit before tearing down PASID entry
The Intel VT-d Scalable Mode PASID table entry consists of 512 bits (64
bytes). When tearing down an entry, the current implementation zeros the
entire 64-byte structure immediately using multiple 64-bit writes.
Since the IOMMU hardware may fetch these 64 bytes using multiple
internal transactions (e.g., four 128-bit bursts), updating or zeroing
the entire entry while it is active (P=1) risks a "torn" read. If a
hardware fetch occurs simultaneously with the CPU zeroing the entry, the
hardware could observe an inconsistent state, leading to unpredictable
behavior or spurious faults.
Follow the "Guidance to Software for Invalidations" in the VT-d spec
(Section 6.5.3.3) by implementing the recommended ownership handshake:
1. Clear only the 'Present' (P) bit of the PASID entry.
2. Use a dma_wmb() to ensure the cleared bit is visible to hardware
before proceeding.
3. Execute the required invalidation sequence (PASID cache, IOTLB, and
Device-TLB flush) to ensure the hardware has released all cached
references.
4. Only after the flushes are complete, zero out the remaining fields
of the PASID entry.
Also, add a dma_wmb() in pasid_set_present() to ensure that all other
fields of the PASID entry are visible to the hardware before the Present
bit is set.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/pasid.c",
"drivers/iommu/intel/pasid.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a84d30e8d2bacd21782a6481158b7c9c552f4868",
"status": "affected",
"version": "0bbeb01a4fafbf8422e5c8882d461d6ac4f71e15",
"versionType": "git"
},
{
"lessThan": "821807c167b7b48a41b95b6607c6b9f97600f7d9",
"status": "affected",
"version": "0bbeb01a4fafbf8422e5c8882d461d6ac4f71e15",
"versionType": "git"
},
{
"lessThan": "949d71666e9dd19f21e7b4b53a88cd2c5b902858",
"status": "affected",
"version": "0bbeb01a4fafbf8422e5c8882d461d6ac4f71e15",
"versionType": "git"
},
{
"lessThan": "75ed00055c059dedc47b5daaaa2f8a7a019138ff",
"status": "affected",
"version": "0bbeb01a4fafbf8422e5c8882d461d6ac4f71e15",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/pasid.c",
"drivers/iommu/intel/pasid.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Clear Present bit before tearing down PASID entry\n\nThe Intel VT-d Scalable Mode PASID table entry consists of 512 bits (64\nbytes). When tearing down an entry, the current implementation zeros the\nentire 64-byte structure immediately using multiple 64-bit writes.\n\nSince the IOMMU hardware may fetch these 64 bytes using multiple\ninternal transactions (e.g., four 128-bit bursts), updating or zeroing\nthe entire entry while it is active (P=1) risks a \"torn\" read. If a\nhardware fetch occurs simultaneously with the CPU zeroing the entry, the\nhardware could observe an inconsistent state, leading to unpredictable\nbehavior or spurious faults.\n\nFollow the \"Guidance to Software for Invalidations\" in the VT-d spec\n(Section 6.5.3.3) by implementing the recommended ownership handshake:\n\n1. Clear only the \u0027Present\u0027 (P) bit of the PASID entry.\n2. Use a dma_wmb() to ensure the cleared bit is visible to hardware\n before proceeding.\n3. Execute the required invalidation sequence (PASID cache, IOTLB, and\n Device-TLB flush) to ensure the hardware has released all cached\n references.\n4. Only after the flushes are complete, zero out the remaining fields\n of the PASID entry.\n\nAlso, add a dma_wmb() in pasid_set_present() to ensure that all other\nfields of the PASID entry are visible to the hardware before the Present\nbit is set."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The teardown path is reached only through local interfaces \u2014 IOMMU domain attach/detach, SVA bind/unbind via accelerator char devices, and VFIO/iommufd ioctls \u2014 plus a locally-controlled device\u0027s DMA; there is no remote/network path to this code.\nAC:H - Triggering the torn read requires the IOMMU\u0027s internal multi-burst fetch of the 64-byte entry to interleave with the CPU\u0027s eight 64-bit zeroing writes during the narrow teardown window; this sub-microsecond hardware-internal timing is beyond the attacker\u0027s control and cannot be reliably reproduced.\nPR:L - Reaching the teardown requires local access to manage an IOMMU domain or to bind/unbind a PASID on an SVA-capable accelerator (reachable by an unprivileged user granted device access), not a pre-auth or fully unauthenticated path.\nUI:N - No victim interaction is needed; the attacker drives both the device DMA and the PASID-entry teardown.\nS:C - The IOMMU enforces the DMA isolation boundary; a torn/inconsistent PASID-entry read can cause the IOMMU to mistranslate a device\u0027s DMA, allowing access outside the device\u0027s authorized memory scope \u2014 an IOMMU/DMA boundary crossing.\nC:H - Mistranslation from an inconsistent entry read could let a device (e.g., guest-assigned or SVA-bound) read host physical memory outside its domain, yielding disclosure of memory beyond its authorized scope.\nI:H - The same mistranslation could let a device perform DMA writes to host physical memory outside its assigned domain, corrupting memory across the isolation boundary.\nA:H - The torn read causes \"spurious faults\" and \"unpredictable\" IOMMU behavior, which can produce DMA fault storms or device/translation failures impacting availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:39.976Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a84d30e8d2bacd21782a6481158b7c9c552f4868"
},
{
"url": "https://git.kernel.org/stable/c/821807c167b7b48a41b95b6607c6b9f97600f7d9"
},
{
"url": "https://git.kernel.org/stable/c/949d71666e9dd19f21e7b4b53a88cd2c5b902858"
},
{
"url": "https://git.kernel.org/stable/c/75ed00055c059dedc47b5daaaa2f8a7a019138ff"
}
],
"title": "iommu/vt-d: Clear Present bit before tearing down PASID entry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45894",
"datePublished": "2026-05-27T12:17:04.866Z",
"dateReserved": "2026-05-13T15:03:33.083Z",
"dateUpdated": "2026-08-05T12:28:39.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52995 (GCVE-0-2026-52995)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-06-24 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/rds: zero per-item info buffer before handing it to visitors
rds_for_each_conn_info() and rds_walk_conn_path_info() both hand a
caller-allocated on-stack u64 buffer to a per-connection visitor and
then copy the full item_len bytes back to user space via
rds_info_copy() regardless of how much of the buffer the visitor
actually wrote.
rds_ib_conn_info_visitor() and rds6_ib_conn_info_visitor() only
write a subset of their output struct when the underlying
rds_connection is not in state RDS_CONN_UP (src/dst addr, tos, sl
and the two GIDs via explicit memsets). Several u32 fields
(max_send_wr, max_recv_wr, max_send_sge, rdma_mr_max, rdma_mr_size,
cache_allocs) and the 2-byte alignment hole between sl and
cache_allocs remain as whatever stack contents preceded the visitor
call and are then memcpy_to_user()'d out to user space.
struct rds_info_rdma_connection and struct rds6_info_rdma_connection
are the only rds_info_* structs in include/uapi/linux/rds.h that are
not marked __attribute__((packed)), so they have a real alignment
hole. The other info visitors (rds_conn_info_visitor,
rds6_conn_info_visitor, rds_tcp_tc_info, ...) write all fields of
their packed output struct today and are not known to be vulnerable,
but a future visitor that adds a conditional write-path would have
the same bug.
Reproduction on a kernel built without CONFIG_INIT_STACK_ALL_ZERO=y:
a local unprivileged user opens AF_RDS, sets SO_RDS_TRANSPORT=IB,
binds to a local address on an RDMA-capable netdev (rxe soft-RoCE on
any netdev is sufficient), sendto()'s any peer on the same subnet
(fails cleanly but installs an rds_connection in the global hash in
RDS_CONN_CONNECTING), then calls getsockopt(SOL_RDS,
RDS_INFO_IB_CONNECTIONS). The returned 68-byte item contains 26
bytes of stack garbage including kernel text/data pointers:
0..7 0a 63 00 01 0a 63 00 02 src=10.99.0.1 dst=10.99.0.2
8..39 00 ... gids (memset-zeroed)
40..47 e0 92 a3 81 ff ff ff ff kernel pointer (max_send_wr)
48..55 7f 37 b5 81 ff ff ff ff kernel pointer (rdma_mr_max)
56..59 01 00 08 00 rdma_mr_size (garbage)
60..61 00 00 tos, sl
62..63 00 00 alignment padding
64..67 18 00 00 00 cache_allocs (garbage)
Fix by zeroing the per-item buffer in both rds_for_each_conn_info()
and rds_walk_conn_path_info() before invoking the visitor. This
covers the IPv4/IPv6 IB visitors and hardens all current and future
visitors against the same class of bug.
No functional change for visitors that fully populate their output.
Changes in v2:
- retarget at the net tree (subject prefix "[PATCH net v2]",
net/rds: prefix in the title)
- pick up Reviewed-by tags from Sharath Srinivasan and
Allison Henderson
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ec16227e14141e4fd7ae76354c09dadfe2449d9e Version: ec16227e14141e4fd7ae76354c09dadfe2449d9e Version: ec16227e14141e4fd7ae76354c09dadfe2449d9e Version: ec16227e14141e4fd7ae76354c09dadfe2449d9e Version: ec16227e14141e4fd7ae76354c09dadfe2449d9e Version: ec16227e14141e4fd7ae76354c09dadfe2449d9e Version: ec16227e14141e4fd7ae76354c09dadfe2449d9e Version: ec16227e14141e4fd7ae76354c09dadfe2449d9e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rds/connection.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "81651e9d7dea1c048d2952f57632a042931d7b43",
"status": "affected",
"version": "ec16227e14141e4fd7ae76354c09dadfe2449d9e",
"versionType": "git"
},
{
"lessThan": "0797b2e6901827694aa9c34c4c72118c8c97fba1",
"status": "affected",
"version": "ec16227e14141e4fd7ae76354c09dadfe2449d9e",
"versionType": "git"
},
{
"lessThan": "5e67cc262afb384e835c3327e9d954eeaedc6a87",
"status": "affected",
"version": "ec16227e14141e4fd7ae76354c09dadfe2449d9e",
"versionType": "git"
},
{
"lessThan": "b6ba93a7b71ed443c9843eb12d27ed86f1e52694",
"status": "affected",
"version": "ec16227e14141e4fd7ae76354c09dadfe2449d9e",
"versionType": "git"
},
{
"lessThan": "c7cb9eed8215a790f052f49cdccf577720d2bb62",
"status": "affected",
"version": "ec16227e14141e4fd7ae76354c09dadfe2449d9e",
"versionType": "git"
},
{
"lessThan": "91ce1bb6e4194dc2321748f68145359dcf86e350",
"status": "affected",
"version": "ec16227e14141e4fd7ae76354c09dadfe2449d9e",
"versionType": "git"
},
{
"lessThan": "912ba2e5704fdb8bc5decda96dfc1a57838f0099",
"status": "affected",
"version": "ec16227e14141e4fd7ae76354c09dadfe2449d9e",
"versionType": "git"
},
{
"lessThan": "c88eb7e8d8397a8c1db59c425332c5a30b2a1682",
"status": "affected",
"version": "ec16227e14141e4fd7ae76354c09dadfe2449d9e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rds/connection.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: zero per-item info buffer before handing it to visitors\n\nrds_for_each_conn_info() and rds_walk_conn_path_info() both hand a\ncaller-allocated on-stack u64 buffer to a per-connection visitor and\nthen copy the full item_len bytes back to user space via\nrds_info_copy() regardless of how much of the buffer the visitor\nactually wrote.\n\nrds_ib_conn_info_visitor() and rds6_ib_conn_info_visitor() only\nwrite a subset of their output struct when the underlying\nrds_connection is not in state RDS_CONN_UP (src/dst addr, tos, sl\nand the two GIDs via explicit memsets). Several u32 fields\n(max_send_wr, max_recv_wr, max_send_sge, rdma_mr_max, rdma_mr_size,\ncache_allocs) and the 2-byte alignment hole between sl and\ncache_allocs remain as whatever stack contents preceded the visitor\ncall and are then memcpy_to_user()\u0027d out to user space.\n\nstruct rds_info_rdma_connection and struct rds6_info_rdma_connection\nare the only rds_info_* structs in include/uapi/linux/rds.h that are\nnot marked __attribute__((packed)), so they have a real alignment\nhole. The other info visitors (rds_conn_info_visitor,\nrds6_conn_info_visitor, rds_tcp_tc_info, ...) write all fields of\ntheir packed output struct today and are not known to be vulnerable,\nbut a future visitor that adds a conditional write-path would have\nthe same bug.\n\nReproduction on a kernel built without CONFIG_INIT_STACK_ALL_ZERO=y:\na local unprivileged user opens AF_RDS, sets SO_RDS_TRANSPORT=IB,\nbinds to a local address on an RDMA-capable netdev (rxe soft-RoCE on\nany netdev is sufficient), sendto()\u0027s any peer on the same subnet\n(fails cleanly but installs an rds_connection in the global hash in\nRDS_CONN_CONNECTING), then calls getsockopt(SOL_RDS,\nRDS_INFO_IB_CONNECTIONS). The returned 68-byte item contains 26\nbytes of stack garbage including kernel text/data pointers:\n\n 0..7 0a 63 00 01 0a 63 00 02 src=10.99.0.1 dst=10.99.0.2\n 8..39 00 ... gids (memset-zeroed)\n 40..47 e0 92 a3 81 ff ff ff ff kernel pointer (max_send_wr)\n 48..55 7f 37 b5 81 ff ff ff ff kernel pointer (rdma_mr_max)\n 56..59 01 00 08 00 rdma_mr_size (garbage)\n 60..61 00 00 tos, sl\n 62..63 00 00 alignment padding\n 64..67 18 00 00 00 cache_allocs (garbage)\n\nFix by zeroing the per-item buffer in both rds_for_each_conn_info()\nand rds_walk_conn_path_info() before invoking the visitor. This\ncovers the IPv4/IPv6 IB visitors and hardens all current and future\nvisitors against the same class of bug.\n\nNo functional change for visitors that fully populate their output.\n\nChanges in v2:\n- retarget at the net tree (subject prefix \"[PATCH net v2]\",\n net/rds: prefix in the title)\n- pick up Reviewed-by tags from Sharath Srinivasan and\n Allison Henderson"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-24T16:29:08.229Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/81651e9d7dea1c048d2952f57632a042931d7b43"
},
{
"url": "https://git.kernel.org/stable/c/0797b2e6901827694aa9c34c4c72118c8c97fba1"
},
{
"url": "https://git.kernel.org/stable/c/5e67cc262afb384e835c3327e9d954eeaedc6a87"
},
{
"url": "https://git.kernel.org/stable/c/b6ba93a7b71ed443c9843eb12d27ed86f1e52694"
},
{
"url": "https://git.kernel.org/stable/c/c7cb9eed8215a790f052f49cdccf577720d2bb62"
},
{
"url": "https://git.kernel.org/stable/c/91ce1bb6e4194dc2321748f68145359dcf86e350"
},
{
"url": "https://git.kernel.org/stable/c/912ba2e5704fdb8bc5decda96dfc1a57838f0099"
},
{
"url": "https://git.kernel.org/stable/c/c88eb7e8d8397a8c1db59c425332c5a30b2a1682"
}
],
"title": "net/rds: zero per-item info buffer before handing it to visitors",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52995",
"datePublished": "2026-06-24T16:29:08.229Z",
"dateReserved": "2026-06-09T07:44:35.377Z",
"dateUpdated": "2026-06-24T16:29:08.229Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46266 (GCVE-0-2026-46266)
Vulnerability from cvelistv5
Published
2026-06-03 15:50
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
Yizhou Zhao reported that simply having one RAW socket on protocol
IPPROTO_RAW (255) was dangerous.
socket(AF_INET, SOCK_RAW, 255);
A malicious incoming ICMP packet can set the protocol field to 255
and match this socket, leading to FNHE cache changes.
inner = IP(src="192.168.2.1", dst="8.8.8.8", proto=255)/Raw("TEST")
pkt = IP(src="192.168.1.1", dst="192.168.2.1")/ICMP(type=3, code=4, nexthopmtu=576)/inner
"man 7 raw" states:
A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able
to send any IP protocol that is specified in the passed header.
Receiving of all IP protocols via IPPROTO_RAW is not possible
using raw sockets.
Make sure we drop these malicious packets.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/icmp.c",
"net/ipv6/icmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "db76b75ede3810e7cf9cfea5067d4f3e0993768b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "19e42490c89bac9a388f28179e66bebbef350f99",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "531c1aec81bfe19d00af13da5531fbb8209e4bd2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "719d3932b8f6e3348ce2f0ac58e278301fc17575",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c89477ad79446867394360b29bb801010fc3ff22",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/icmp.c",
"net/ipv6/icmp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP\n\nYizhou Zhao reported that simply having one RAW socket on protocol\nIPPROTO_RAW (255) was dangerous.\n\n socket(AF_INET, SOCK_RAW, 255);\n\nA malicious incoming ICMP packet can set the protocol field to 255\nand match this socket, leading to FNHE cache changes.\n\ninner = IP(src=\"192.168.2.1\", dst=\"8.8.8.8\", proto=255)/Raw(\"TEST\")\npkt = IP(src=\"192.168.1.1\", dst=\"192.168.2.1\")/ICMP(type=3, code=4, nexthopmtu=576)/inner\n\n\"man 7 raw\" states:\n\n A protocol of IPPROTO_RAW implies enabled IP_HDRINCL and is able\n to send any IP protocol that is specified in the passed header.\n Receiving of all IP protocols via IPPROTO_RAW is not possible\n using raw sockets.\n\nMake sure we drop these malicious packets."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached when a remotely sourced ICMP error (DEST_UNREACH/FRAG_NEEDED or REDIRECT) is received and processed through icmp_rcv() \u2192 icmp_unreach()/icmp_redirect() \u2192 icmp_socket_deliver(), which is standard internet-facing IPv4 input on any host accepting ICMP.\nAC:L - Exploitation is a single, deterministic crafted ICMP packet (inner IP proto=255, attacker-chosen daddr/PMTU) matching an open IPPROTO_RAW socket; an attacker can reliably create that socket via CAP_NET_RAW in a user+network namespace (unshare -Urn) without winning a race.\nPR:N - The network trigger requires no authentication or victim credentials\u2014only delivery of forged ICMP to the target IP; the remote attacker does not need local privileges even though a local IPPROTO_RAW socket must exist on the victim (typically opened by a daemon or a co-resident userns holder).\nUI:N - No victim user action is required beyond normal network operation; the attacker sends ICMP directly to the host without tricking anyone into clicking, mounting, or opening files.\nS:U - Impact is confined to the kernel IPv4 routing/FNHE cache within the same network namespace; it does not cross a VM/hypervisor or IOMMU security boundary.\nC:N - This is a missing validation/logic bug that poisons route-cache metadata (PMTU/gateway); there is no memory read, pointer leak, or information-disclosure primitive.\nI:H - Before the fix, raw_err() unconditionally calls ipv4_sk_update_pmtu()/ipv4_sk_redirect(), letting a remote attacker inject attacker-controlled PMTU and gateway values into the system-wide FNHE exception cache for arbitrary destination addresses, altering forwarding for all local traffic to those destinations.\nA:H - Repeated forged ICMP FRAG_NEEDED packets can persistently force minimum PMTU entries in FNHE for chosen destinations, causing severe throughput collapse and connectivity failure for affected flows across the entire host or shared network namespace."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:53.523Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/db76b75ede3810e7cf9cfea5067d4f3e0993768b"
},
{
"url": "https://git.kernel.org/stable/c/19e42490c89bac9a388f28179e66bebbef350f99"
},
{
"url": "https://git.kernel.org/stable/c/531c1aec81bfe19d00af13da5531fbb8209e4bd2"
},
{
"url": "https://git.kernel.org/stable/c/719d3932b8f6e3348ce2f0ac58e278301fc17575"
},
{
"url": "https://git.kernel.org/stable/c/c89477ad79446867394360b29bb801010fc3ff22"
}
],
"title": "inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46266",
"datePublished": "2026-06-03T15:50:07.907Z",
"dateReserved": "2026-05-13T15:03:33.108Z",
"dateUpdated": "2026-08-05T12:30:53.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43480 (GCVE-0-2026-43480)
Vulnerability from cvelistv5
Published
2026-05-13 15:08
Modified
2026-05-13 15:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition
The acp3x_5682_init() function did not check the return value of
clk_get(), which could lead to dereferencing error pointers in
rt5682_clk_enable().
Fix this by:
1. Changing clk_get() to the device-managed devm_clk_get().
2. Adding proper IS_ERR() checks for both clock acquisitions.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6b8e4e7db3cd236a2cbb720360fb135087a2ac1d Version: 6b8e4e7db3cd236a2cbb720360fb135087a2ac1d Version: 6b8e4e7db3cd236a2cbb720360fb135087a2ac1d Version: 6b8e4e7db3cd236a2cbb720360fb135087a2ac1d Version: 6b8e4e7db3cd236a2cbb720360fb135087a2ac1d Version: 6b8e4e7db3cd236a2cbb720360fb135087a2ac1d Version: 6b8e4e7db3cd236a2cbb720360fb135087a2ac1d Version: 6b8e4e7db3cd236a2cbb720360fb135087a2ac1d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/amd/acp3x-rt5682-max9836.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2dc43ac8da7b2bebc5a51a3d86a6275d78f27cff",
"status": "affected",
"version": "6b8e4e7db3cd236a2cbb720360fb135087a2ac1d",
"versionType": "git"
},
{
"lessThan": "4d802f23fcbfec05134653fd001f6c7c3fd55196",
"status": "affected",
"version": "6b8e4e7db3cd236a2cbb720360fb135087a2ac1d",
"versionType": "git"
},
{
"lessThan": "2b0c4a399c8d27f20ecf17dda76751141d6dbb59",
"status": "affected",
"version": "6b8e4e7db3cd236a2cbb720360fb135087a2ac1d",
"versionType": "git"
},
{
"lessThan": "35c7624d30cb45ec336cd16ce072acc32ae351cb",
"status": "affected",
"version": "6b8e4e7db3cd236a2cbb720360fb135087a2ac1d",
"versionType": "git"
},
{
"lessThan": "33de168afdd57265a0e0c20dbd3648a2d8f7cdc4",
"status": "affected",
"version": "6b8e4e7db3cd236a2cbb720360fb135087a2ac1d",
"versionType": "git"
},
{
"lessThan": "790851ecc983c719fa2e6adb17b02f3acc1d217d",
"status": "affected",
"version": "6b8e4e7db3cd236a2cbb720360fb135087a2ac1d",
"versionType": "git"
},
{
"lessThan": "092522621901b5e6af61db04a53f5b313903c6d0",
"status": "affected",
"version": "6b8e4e7db3cd236a2cbb720360fb135087a2ac1d",
"versionType": "git"
},
{
"lessThan": "53f3a900e9a383d47af7253076e19f510c5708d0",
"status": "affected",
"version": "6b8e4e7db3cd236a2cbb720360fb135087a2ac1d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/amd/acp3x-rt5682-max9836.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition\n\nThe acp3x_5682_init() function did not check the return value of\nclk_get(), which could lead to dereferencing error pointers in\nrt5682_clk_enable().\n\nFix this by:\n1. Changing clk_get() to the device-managed devm_clk_get().\n2. Adding proper IS_ERR() checks for both clock acquisitions."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T15:08:28.517Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2dc43ac8da7b2bebc5a51a3d86a6275d78f27cff"
},
{
"url": "https://git.kernel.org/stable/c/4d802f23fcbfec05134653fd001f6c7c3fd55196"
},
{
"url": "https://git.kernel.org/stable/c/2b0c4a399c8d27f20ecf17dda76751141d6dbb59"
},
{
"url": "https://git.kernel.org/stable/c/35c7624d30cb45ec336cd16ce072acc32ae351cb"
},
{
"url": "https://git.kernel.org/stable/c/33de168afdd57265a0e0c20dbd3648a2d8f7cdc4"
},
{
"url": "https://git.kernel.org/stable/c/790851ecc983c719fa2e6adb17b02f3acc1d217d"
},
{
"url": "https://git.kernel.org/stable/c/092522621901b5e6af61db04a53f5b313903c6d0"
},
{
"url": "https://git.kernel.org/stable/c/53f3a900e9a383d47af7253076e19f510c5708d0"
}
],
"title": "ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43480",
"datePublished": "2026-05-13T15:08:28.517Z",
"dateReserved": "2026-05-01T14:12:56.012Z",
"dateUpdated": "2026-05-13T15:08:28.517Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31474 (GCVE-0-2026-31474)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-08-05 12:22
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access
to so->tx.buf. isotp_release() waits for ISOTP_IDLE via
wait_event_interruptible() and then calls kfree(so->tx.buf).
If a signal interrupts the wait_event_interruptible() inside close()
while tx.state is ISOTP_SENDING, the loop exits early and release
proceeds to force ISOTP_SHUTDOWN and continues to kfree(so->tx.buf)
while sendmsg may still be reading so->tx.buf for the final CAN frame
in isotp_fill_dataframe().
The so->tx.buf can be allocated once when the standard tx.buf length needs
to be extended. Move the kfree() of this potentially extended tx.buf to
sk_destruct time when either isotp_sendmsg() and isotp_release() are done.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.26.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.82.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.17.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-04-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Controller Area Network (CAN) ISO-TP (isotp) module. This vulnerability, known as a use-after-free, occurs when the system attempts to free a memory region while it is still being used. A local attacker could trigger this condition by sending a signal that interrupts a specific waiting process during a close operation. This can lead to memory corruption, potentially causing the system to crash (denial of service) or behave unpredictably."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-364",
"description": "Signal Handler Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T01:09:14.681Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-31474"
},
{
"name": "RHBZ#2460646",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460646"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31474.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27731"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27288"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27789"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:27731: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:27288: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:27789: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-22T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-04-22T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg()",
"workarounds": [
{
"lang": "en",
"value": "Systems which do not require it can blocklist the `can_isotp` module to prevent it from being loaded. See https://access.redhat.com/solutions/41278 for more information."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/can/isotp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cb3d6efa78460e6d50bf68806d0db66265709f64",
"status": "affected",
"version": "96d1c81e6a0478535342dff6c730adb076cd84e8",
"versionType": "git"
},
{
"lessThan": "9649d051e54413049c009638ec1dc23962c884a4",
"status": "affected",
"version": "96d1c81e6a0478535342dff6c730adb076cd84e8",
"versionType": "git"
},
{
"lessThan": "eec8a1b18a79600bd4419079dc0026c1db72a830",
"status": "affected",
"version": "96d1c81e6a0478535342dff6c730adb076cd84e8",
"versionType": "git"
},
{
"lessThan": "2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c",
"status": "affected",
"version": "96d1c81e6a0478535342dff6c730adb076cd84e8",
"versionType": "git"
},
{
"lessThan": "424e95d62110cdbc8fd12b40918f37e408e35a92",
"status": "affected",
"version": "96d1c81e6a0478535342dff6c730adb076cd84e8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/can/isotp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: fix tx.buf use-after-free in isotp_sendmsg()\n\nisotp_sendmsg() uses only cmpxchg() on so-\u003etx.state to serialize access\nto so-\u003etx.buf. isotp_release() waits for ISOTP_IDLE via\nwait_event_interruptible() and then calls kfree(so-\u003etx.buf).\n\nIf a signal interrupts the wait_event_interruptible() inside close()\nwhile tx.state is ISOTP_SENDING, the loop exits early and release\nproceeds to force ISOTP_SHUTDOWN and continues to kfree(so-\u003etx.buf)\nwhile sendmsg may still be reading so-\u003etx.buf for the final CAN frame\nin isotp_fill_dataframe().\n\nThe so-\u003etx.buf can be allocated once when the standard tx.buf length needs\nto be extended. Move the kfree() of this potentially extended tx.buf to\nsk_destruct time when either isotp_sendmsg() and isotp_release() are done."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable ISO-TP transmit path is reached through local socket syscalls such as socket/bind/sendmsg/close on an AF_CAN CAN_ISOTP socket. A CAN peer may influence flow control, but the bug requires a local process to create the socket, send the PDU, and interrupt close.\nAC:L - Once ISO-TP extended PDU buffers are available, the attacker controls the socket options, message size, close operation, and signal timing needed to hit the close-vs-transmit race. The race is between attacker-controlled local operations and in-kernel asynchronous transmit completion, so no uncontrollable external condition is required.\nPR:L - The AF_CAN CAN_ISOTP socket create, bind, setsockopt, sendmsg, and release paths do not impose a CAP_NET_ADMIN check. An unprivileged local user can reach the vulnerable code on a system with an available CAN interface or equivalent namespace/preconfigured CAN setup.\nUI:N - No victim action is needed once the attacker can run local code. The attacker can drive the send, close, and signal sequence directly.\nS:U - The issue is a kernel memory lifetime bug in the same operating-system security authority. It does not cross a VM, IOMMU, or separate sandbox boundary by itself.\nC:H - The freed tx.buf can be reused while the ISO-TP transmit path later reads from it into outgoing CAN frames, creating a kernel heap use-after-free information disclosure primitive. Under conservative kernel UAF scoring, this supports high confidentiality impact.\nI:H - This is kernel heap use-after-free memory corruption reachable by attacker-controlled timing and heap grooming. Following the required conservative UAF guidance, it is treated as potentially exploitable for high integrity impact.\nA:H - The stale freed buffer can be dereferenced asynchronously during frame construction after release, which can trigger kernel memory corruption symptoms including oops or panic. Repeated local triggering can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:22:52.871Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cb3d6efa78460e6d50bf68806d0db66265709f64"
},
{
"url": "https://git.kernel.org/stable/c/9649d051e54413049c009638ec1dc23962c884a4"
},
{
"url": "https://git.kernel.org/stable/c/eec8a1b18a79600bd4419079dc0026c1db72a830"
},
{
"url": "https://git.kernel.org/stable/c/2e62e7051eca75a7f2e3d52d62ec10d7d7aa358c"
},
{
"url": "https://git.kernel.org/stable/c/424e95d62110cdbc8fd12b40918f37e408e35a92"
}
],
"title": "can: isotp: fix tx.buf use-after-free in isotp_sendmsg()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31474",
"datePublished": "2026-04-22T13:54:03.100Z",
"dateReserved": "2026-03-09T15:48:24.098Z",
"dateUpdated": "2026-08-05T12:22:52.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31743 (GCVE-0-2026-31743)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-08-05 12:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy
Buffer size used in dma allocation and memcpy is wrong.
It can lead to undersized DMA buffer access and possible
memory corruption. use correct buffer size in dma_alloc_coherent
and memcpy.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvmem/zynqmp_nvmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2f6e5b9964d0a63a5ba84fca2642876afb70a662",
"status": "affected",
"version": "737c0c8d07b5f671c0a33cec95965fcb2d2ea893",
"versionType": "git"
},
{
"lessThan": "784ed4abded1ca4b525fa4cade8b02f8c5d2a087",
"status": "affected",
"version": "737c0c8d07b5f671c0a33cec95965fcb2d2ea893",
"versionType": "git"
},
{
"lessThan": "6c01e7f11f5e5f22285d19510a9643e2506e13c3",
"status": "affected",
"version": "737c0c8d07b5f671c0a33cec95965fcb2d2ea893",
"versionType": "git"
},
{
"lessThan": "f9b88613ff402aa6fe8fd020573cb95867ae947e",
"status": "affected",
"version": "737c0c8d07b5f671c0a33cec95965fcb2d2ea893",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvmem/zynqmp_nvmem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy\n\nBuffer size used in dma allocation and memcpy is wrong.\nIt can lead to undersized DMA buffer access and possible\nmemory corruption. use correct buffer size in dma_alloc_coherent\nand memcpy."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached locally through the nvmem sysfs binary attribute, ultimately calling zynqmp_nvmem_read/zynqmp_efuse_access. It is not reachable by network packets, adjacent wireless traffic, or mere physical attachment.\nAC:L - A local attacker can reliably trigger the bug with an aligned read of more than sizeof(size_t) bytes from an efuse offset. No race or attacker-uncontrolled timing condition is required.\nPR:L - The driver does not set root_only, so the generic nvmem sysfs attribute is world-readable, making the read-side DMA buffer overflow reachable by an unprivileged local user. The write-side bug needs root, but the lower-privilege read path is sufficient.\nUI:N - No victim action is required once the attacker has local access. The attacker directly opens and reads the sysfs nvmem file.\nS:U - The corruption affects kernel memory within the same normal-world OS security authority. Although firmware performs the efuse access, this is not a VM escape, sandbox escape, or IOMMU boundary bypass.\nC:H - The undersized coherent DMA allocation followed by copying bytes back to sysfs can read beyond the allocated buffer and expose adjacent kernel/coherent memory. Under the required tie-break rule, this memory corruption/info-leak potential is High.\nI:H - The firmware writes the requested efuse byte count into a buffer allocated with sizeof(bytes), creating an out-of-bounds DMA write into adjacent kernel/coherent memory. Out-of-bounds writes are treated as high integrity impact because they can plausibly be shaped into kernel memory corruption or control-flow compromise.\nA:H - The same out-of-bounds DMA write can corrupt kernel memory and cause an oops, panic, or hang. It can be triggered repeatedly by the local attacker through the readable sysfs path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:24:57.154Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2f6e5b9964d0a63a5ba84fca2642876afb70a662"
},
{
"url": "https://git.kernel.org/stable/c/784ed4abded1ca4b525fa4cade8b02f8c5d2a087"
},
{
"url": "https://git.kernel.org/stable/c/6c01e7f11f5e5f22285d19510a9643e2506e13c3"
},
{
"url": "https://git.kernel.org/stable/c/f9b88613ff402aa6fe8fd020573cb95867ae947e"
}
],
"title": "nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31743",
"datePublished": "2026-05-01T14:14:38.154Z",
"dateReserved": "2026-03-09T15:48:24.138Z",
"dateUpdated": "2026-08-05T12:24:57.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43232 (GCVE-0-2026-43232)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets
When the FarSync T-series card is being detached, the fst_card_info is
deallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task
may still be running or pending, leading to use-after-free bugs when the
already freed fst_card_info is accessed in fst_process_tx_work_q() or
fst_process_int_work_q().
A typical race condition is depicted below:
CPU 0 (cleanup) | CPU 1 (tasklet)
| fst_start_xmit()
fst_remove_one() | tasklet_schedule()
unregister_hdlc_device()|
| fst_process_tx_work_q() //handler
kfree(card) //free | do_bottom_half_tx()
| card-> //use
The following KASAN trace was captured:
==================================================================
BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00
Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32
...
Call Trace:
<IRQ>
dump_stack_lvl+0x55/0x70
print_report+0xcb/0x5d0
? do_bottom_half_tx+0xb88/0xd00
kasan_report+0xb8/0xf0
? do_bottom_half_tx+0xb88/0xd00
do_bottom_half_tx+0xb88/0xd00
? _raw_spin_lock_irqsave+0x85/0xe0
? __pfx__raw_spin_lock_irqsave+0x10/0x10
? __pfx___hrtimer_run_queues+0x10/0x10
fst_process_tx_work_q+0x67/0x90
tasklet_action_common+0x1fa/0x720
? hrtimer_interrupt+0x31f/0x780
handle_softirqs+0x176/0x530
__irq_exit_rcu+0xab/0xe0
sysvec_apic_timer_interrupt+0x70/0x80
...
Allocated by task 41 on cpu 3 at 72.330843s:
kasan_save_stack+0x24/0x50
kasan_save_track+0x17/0x60
__kasan_kmalloc+0x7f/0x90
fst_add_one+0x1a5/0x1cd0
local_pci_probe+0xdd/0x190
pci_device_probe+0x341/0x480
really_probe+0x1c6/0x6a0
__driver_probe_device+0x248/0x310
driver_probe_device+0x48/0x210
__device_attach_driver+0x160/0x320
bus_for_each_drv+0x101/0x190
__device_attach+0x198/0x3a0
device_initial_probe+0x78/0xa0
pci_bus_add_device+0x81/0xc0
pci_bus_add_devices+0x7e/0x190
enable_slot+0x9b9/0x1130
acpiphp_check_bridge.part.0+0x2e1/0x460
acpiphp_hotplug_notify+0x36c/0x3c0
acpi_device_hotplug+0x203/0xb10
acpi_hotplug_work_fn+0x59/0x80
...
Freed by task 41 on cpu 1 at 75.138639s:
kasan_save_stack+0x24/0x50
kasan_save_track+0x17/0x60
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x43/0x70
kfree+0x135/0x410
fst_remove_one+0x2ca/0x540
pci_device_remove+0xa6/0x1d0
device_release_driver_internal+0x364/0x530
pci_stop_bus_device+0x105/0x150
pci_stop_and_remove_bus_device+0xd/0x20
disable_slot+0x116/0x260
acpiphp_disable_and_eject_slot+0x4b/0x190
acpiphp_hotplug_notify+0x230/0x3c0
acpi_device_hotplug+0x203/0xb10
acpi_hotplug_work_fn+0x59/0x80
...
The buggy address belongs to the object at ffff88800aad1000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 28 bytes inside of
freed 1024-byte region
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x100000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000
head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88800aad1000: fa fb
---truncated---
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 51e2d1b84acac39f79cacb60e6e154ce00a9d308 Version: 998b4e54f517961d3d75144c088a24423e003005 Version: bb1715a6bfb0c57a68524732a376498a2569f016 Version: 2f623aaf9f31de968dea6169849706a2f9be444c Version: 2f623aaf9f31de968dea6169849706a2f9be444c Version: 2f623aaf9f31de968dea6169849706a2f9be444c Version: 2f623aaf9f31de968dea6169849706a2f9be444c Version: 2f623aaf9f31de968dea6169849706a2f9be444c Version: 41798a063fd4721b609e11ad839b6820f5070ca7 Version: b1fe377b43c405b169cffd1b3aa39c1dde16f3ed Version: ce9dc768767bbe73d2dd330a9075e849cb8a84d4 Version: 0c5f2c7700cb18aeab1574588d3bb9c0454bf228 Version: 024d2a7c8ee5bfe14357f20cf1bbbbcc5d228cc9 Version: 5.10.163 ≤ Version: 5.15.86 ≤ Version: 6.1.2 ≤ Version: 4.9.337 ≤ Version: 4.14.303 ≤ Version: 4.19.270 ≤ Version: 5.4.229 ≤ Version: 6.0.16 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wan/farsync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cac048ebfbb92d91d719f74b59177cb70a7633b8",
"status": "affected",
"version": "51e2d1b84acac39f79cacb60e6e154ce00a9d308",
"versionType": "git"
},
{
"lessThan": "086131807d119238cd464e5b0845e48d938dfd79",
"status": "affected",
"version": "998b4e54f517961d3d75144c088a24423e003005",
"versionType": "git"
},
{
"lessThan": "ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc",
"status": "affected",
"version": "bb1715a6bfb0c57a68524732a376498a2569f016",
"versionType": "git"
},
{
"lessThan": "337d7b4112a47984ee319171b75b73bab47e7924",
"status": "affected",
"version": "2f623aaf9f31de968dea6169849706a2f9be444c",
"versionType": "git"
},
{
"lessThan": "200bdb8d367ca9b478f9c56ebe56411604d55c81",
"status": "affected",
"version": "2f623aaf9f31de968dea6169849706a2f9be444c",
"versionType": "git"
},
{
"lessThan": "21d341fe514fd07e345ed264c9eee21cb2061ca2",
"status": "affected",
"version": "2f623aaf9f31de968dea6169849706a2f9be444c",
"versionType": "git"
},
{
"lessThan": "04edfdfdfcdefc02408ab670607261b0a0a9a02e",
"status": "affected",
"version": "2f623aaf9f31de968dea6169849706a2f9be444c",
"versionType": "git"
},
{
"lessThan": "bae8a5d2e759da2e0cba33ab2080deee96a09373",
"status": "affected",
"version": "2f623aaf9f31de968dea6169849706a2f9be444c",
"versionType": "git"
},
{
"status": "affected",
"version": "41798a063fd4721b609e11ad839b6820f5070ca7",
"versionType": "git"
},
{
"status": "affected",
"version": "b1fe377b43c405b169cffd1b3aa39c1dde16f3ed",
"versionType": "git"
},
{
"status": "affected",
"version": "ce9dc768767bbe73d2dd330a9075e849cb8a84d4",
"versionType": "git"
},
{
"status": "affected",
"version": "0c5f2c7700cb18aeab1574588d3bb9c0454bf228",
"versionType": "git"
},
{
"status": "affected",
"version": "024d2a7c8ee5bfe14357f20cf1bbbbcc5d228cc9",
"versionType": "git"
},
{
"lessThan": "5.10.252",
"status": "affected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThan": "5.15.202",
"status": "affected",
"version": "5.15.86",
"versionType": "semver"
},
{
"lessThan": "6.1.165",
"status": "affected",
"version": "6.1.2",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.337",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.303",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.270",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThan": "6.1",
"status": "affected",
"version": "6.0.16",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wan/farsync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "5.10.163",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.15.86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "6.1.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.337",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.303",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.270",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.229",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets\n\nWhen the FarSync T-series card is being detached, the fst_card_info is\ndeallocated in fst_remove_one(). However, the fst_tx_task or fst_int_task\nmay still be running or pending, leading to use-after-free bugs when the\nalready freed fst_card_info is accessed in fst_process_tx_work_q() or\nfst_process_int_work_q().\n\nA typical race condition is depicted below:\n\nCPU 0 (cleanup) | CPU 1 (tasklet)\n | fst_start_xmit()\nfst_remove_one() | tasklet_schedule()\n unregister_hdlc_device()|\n | fst_process_tx_work_q() //handler\n kfree(card) //free | do_bottom_half_tx()\n | card-\u003e //use\n\nThe following KASAN trace was captured:\n\n==================================================================\n BUG: KASAN: slab-use-after-free in do_bottom_half_tx+0xb88/0xd00\n Read of size 4 at addr ffff88800aad101c by task ksoftirqd/3/32\n ...\n Call Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x55/0x70\n print_report+0xcb/0x5d0\n ? do_bottom_half_tx+0xb88/0xd00\n kasan_report+0xb8/0xf0\n ? do_bottom_half_tx+0xb88/0xd00\n do_bottom_half_tx+0xb88/0xd00\n ? _raw_spin_lock_irqsave+0x85/0xe0\n ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n ? __pfx___hrtimer_run_queues+0x10/0x10\n fst_process_tx_work_q+0x67/0x90\n tasklet_action_common+0x1fa/0x720\n ? hrtimer_interrupt+0x31f/0x780\n handle_softirqs+0x176/0x530\n __irq_exit_rcu+0xab/0xe0\n sysvec_apic_timer_interrupt+0x70/0x80\n ...\n\n Allocated by task 41 on cpu 3 at 72.330843s:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x17/0x60\n __kasan_kmalloc+0x7f/0x90\n fst_add_one+0x1a5/0x1cd0\n local_pci_probe+0xdd/0x190\n pci_device_probe+0x341/0x480\n really_probe+0x1c6/0x6a0\n __driver_probe_device+0x248/0x310\n driver_probe_device+0x48/0x210\n __device_attach_driver+0x160/0x320\n bus_for_each_drv+0x101/0x190\n __device_attach+0x198/0x3a0\n device_initial_probe+0x78/0xa0\n pci_bus_add_device+0x81/0xc0\n pci_bus_add_devices+0x7e/0x190\n enable_slot+0x9b9/0x1130\n acpiphp_check_bridge.part.0+0x2e1/0x460\n acpiphp_hotplug_notify+0x36c/0x3c0\n acpi_device_hotplug+0x203/0xb10\n acpi_hotplug_work_fn+0x59/0x80\n ...\n\n Freed by task 41 on cpu 1 at 75.138639s:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x17/0x60\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x43/0x70\n kfree+0x135/0x410\n fst_remove_one+0x2ca/0x540\n pci_device_remove+0xa6/0x1d0\n device_release_driver_internal+0x364/0x530\n pci_stop_bus_device+0x105/0x150\n pci_stop_and_remove_bus_device+0xd/0x20\n disable_slot+0x116/0x260\n acpiphp_disable_and_eject_slot+0x4b/0x190\n acpiphp_hotplug_notify+0x230/0x3c0\n acpi_device_hotplug+0x203/0xb10\n acpi_hotplug_work_fn+0x59/0x80\n ...\n\n The buggy address belongs to the object at ffff88800aad1000\n which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 28 bytes inside of\n freed 1024-byte region\n The buggy address belongs to the physical page:\n page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xaad0\n head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n flags: 0x100000000000040(head|node=0|zone=1)\n page_type: f5(slab)\n raw: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000040 ffff888007042dc0 dead000000000122 0000000000000000\n head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000\n head: 0100000000000003 ffffea00002ab401 00000000ffffffff 00000000ffffffff\n head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ffff88800aad0f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n ffff88800aad0f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n \u003effff88800aad1000: fa fb\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable tasklets can be queued by received frames/interrupts from a remote peer on the FarSync HDLC/WAN network link. The required device detach is accounted for under UI.\nAC:L - An attacker can keep RX/interrupt work pending by continuously sending traffic, and the bug is an unsynchronized tasklet teardown rather than a condition requiring special memory layout. The race is therefore reasonably triggerable during detach.\nPR:N - The remote peer does not need local privileges or authentication to generate receive interrupts that queue the vulnerable work. Administrative privilege is only needed for the victim-side detach action, not for the attacker\u2019s network input.\nUI:R - The remote attack scenario requires another user or administrator to detach, unbind, hot-unplug, or unload the FarSync device while tasklet work is pending. Without that detach path, the freed-card use-after-free is not reached.\nS:U - The bug is within a kernel device driver and impacts kernel memory in the same security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - This is a slab use-after-free of the kmalloc-1k fst_card_info object, whose stale pointers and state are dereferenced by tasklet handlers. Kernel UAFs can be leveraged for memory disclosure, so confidentiality impact is High.\nI:H - The freed card object controls subsequent I/O, DMA/status updates, queue handling, and netdev/port state accesses. As kernel UAF memory corruption, it can plausibly be shaped into write/control-flow corruption, so integrity impact is High.\nA:H - The reported KASAN trace shows a slab-use-after-free in softirq/tasklet context, which can crash or panic the kernel. Repeated triggering during detach can therefore cause high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:45.086Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cac048ebfbb92d91d719f74b59177cb70a7633b8"
},
{
"url": "https://git.kernel.org/stable/c/086131807d119238cd464e5b0845e48d938dfd79"
},
{
"url": "https://git.kernel.org/stable/c/ae894e47e1cd5a6bf8a0423d888c45df8b2b02dc"
},
{
"url": "https://git.kernel.org/stable/c/337d7b4112a47984ee319171b75b73bab47e7924"
},
{
"url": "https://git.kernel.org/stable/c/200bdb8d367ca9b478f9c56ebe56411604d55c81"
},
{
"url": "https://git.kernel.org/stable/c/21d341fe514fd07e345ed264c9eee21cb2061ca2"
},
{
"url": "https://git.kernel.org/stable/c/04edfdfdfcdefc02408ab670607261b0a0a9a02e"
},
{
"url": "https://git.kernel.org/stable/c/bae8a5d2e759da2e0cba33ab2080deee96a09373"
}
],
"title": "net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43232",
"datePublished": "2026-05-06T11:28:28.910Z",
"dateReserved": "2026-05-01T14:12:55.995Z",
"dateUpdated": "2026-08-05T12:26:45.086Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43444 (GCVE-0-2026-43444)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-11 22:24
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Unreserve bo if queue update failed
Error handling path should unreserve bo then return failed.
(cherry picked from commit c24afed7de9ecce341825d8ab55a43a254348b33)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "781110700ada22168fbb490dd61432d23a17a5b4",
"status": "affected",
"version": "305cd109b761202d71f2f655ea369fe889ba1d01",
"versionType": "git"
},
{
"lessThan": "529c985da1b277b36dc99aad660f96dc70f3c467",
"status": "affected",
"version": "305cd109b761202d71f2f655ea369fe889ba1d01",
"versionType": "git"
},
{
"lessThan": "b2b7742c465c8e3b36dc325a48abb4b9f2aaa38b",
"status": "affected",
"version": "305cd109b761202d71f2f655ea369fe889ba1d01",
"versionType": "git"
},
{
"lessThan": "2ce75a0b7e1bfddbcb9bc8aeb2e5e7fa99971acf",
"status": "affected",
"version": "305cd109b761202d71f2f655ea369fe889ba1d01",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Unreserve bo if queue update failed\n\nError handling path should unreserve bo then return failed.\n\n(cherry picked from commit c24afed7de9ecce341825d8ab55a43a254348b33)"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:24:42.516Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/781110700ada22168fbb490dd61432d23a17a5b4"
},
{
"url": "https://git.kernel.org/stable/c/529c985da1b277b36dc99aad660f96dc70f3c467"
},
{
"url": "https://git.kernel.org/stable/c/b2b7742c465c8e3b36dc325a48abb4b9f2aaa38b"
},
{
"url": "https://git.kernel.org/stable/c/2ce75a0b7e1bfddbcb9bc8aeb2e5e7fa99971acf"
}
],
"title": "drm/amdkfd: Unreserve bo if queue update failed",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43444",
"datePublished": "2026-05-08T14:22:11.976Z",
"dateReserved": "2026-05-01T14:12:56.009Z",
"dateUpdated": "2026-05-11T22:24:42.516Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46331 (GCVE-0-2026-46331)
Vulnerability from cvelistv5
Published
2026-06-16 06:26
Modified
2026-08-24 12:06
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fix pedit partial COW leading to page cache corruption
tcf_pedit_act() computes the COW range for skb_ensure_writable()
once before the key loop using tcfp_off_max_hint, but the hint does
not account for the runtime header offset added by typed keys. This
can leave part of the write region un-COW'd.
Fix by moving skb_ensure_writable() inside the per-key loop where
the actual write offset is known, and add overflow checking on the
offset arithmetic. For negative offsets (e.g. Ethernet header edits
at ingress), use skb_cow() to COW the headroom instead. Guard
offset_valid() against INT_MIN, where negation is undefined.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: abe35bf3be51482593076d516a680d79e5fbc8e1 Version: b773640d5bb9e2acfd91e2695717af04d47aa116 Version: 8b796475fd7882663a870456466a4fb315cc1bd6 Version: 8b796475fd7882663a870456466a4fb315cc1bd6 Version: 8b796475fd7882663a870456466a4fb315cc1bd6 Version: 8b796475fd7882663a870456466a4fb315cc1bd6 Version: 8b796475fd7882663a870456466a4fb315cc1bd6 Version: 8b796475fd7882663a870456466a4fb315cc1bd6 Version: d0c38a914b0c4c21d553da801003d36979016726 Version: 2ec2dd7d51a9320151f275ddbb2b53260fb32ca1 Version: c19cc520b3d69904e9518d401ad0df7f4702aca0 Version: 5.10.117 ≤ Version: 5.15.41 ≤ Version: 4.19.244 ≤ Version: 5.4.195 ≤ Version: 5.17.9 ≤ |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-46331",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T03:55:32.379Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/sgkdev/packet_edit_meme/tree/main"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_nvidia:10::el10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "NVIDIA for RHEL 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-212.11.el10nv",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-231.13.el10nv",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-211.26.1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:6.12.0-55.82.1.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.136.1.rt7.477.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-553.136.1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.195.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-305.195.1.el8_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.197.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus_long_life:8.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-372.197.1.el8_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_tus:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.148.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.18.0-477.148.1.el8_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9",
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-687.17.1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.177.1.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::nfv"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-284.177.1.rt14.462.el9_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:9.2"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-427.134.1.el9_4",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_e4s:9.4"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-570.123.1.el9_6",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_eus:9.6"
],
"defaultStatus": "unaffected",
"packageName": "kpatch-patch",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.12::el8"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "412.86.202606251120-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.13::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.13",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "413.92.202607141229-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.14::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "414.92.202606231112-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.15::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "415.92.202606200237-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.16::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "416.94.202606230218-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.17::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.17",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "417.94.202606250942-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.18::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "418.94.202606221349-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.19::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.19.9.6.202606241344-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.20::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.20",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.20.9.6.202606241928-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.21::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.21",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.21.9.6.202606241859-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4.22::el9"
],
"defaultStatus": "affected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4.22",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.22.9.8.202606230855-0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "libkrun",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-18T04:04:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s traffic control packet editing (pedit) subsystem. In tcf_pedit_act(), the copy-on-write (COW) range for skb_ensure_writable() is computed once before iterating over edit keys, but the calculation does not account for runtime header offsets added by typed keys. This can leave part of the target write region without a proper copy-on-write, leading to an out-of-bounds write that corrupts page cache memory. A local attacker with the ability to configure traffic control rules could exploit this to escalate privileges or crash the system."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T12:06:51.076Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-46331"
},
{
"name": "RHBZ#2479492",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479492"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46331.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27709"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33666"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34048"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:40021"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28887"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28962"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29080"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34098"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29856"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29863"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29799"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29833"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29794"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27731"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27288"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27705"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27713"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27708"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27789"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33225"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27353"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33220"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27707"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27704"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27355"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33219"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33221"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33222"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33223"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33224"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27354"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27706"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:27709: NVIDIA for RHEL 10"
},
{
"lang": "en",
"value": "RHSA-2026:33666: NVIDIA for RHEL 10"
},
{
"lang": "en",
"value": "RHSA-2026:34048: Red Hat OpenShift Container Platform 4.12"
},
{
"lang": "en",
"value": "RHSA-2026:40021: Red Hat OpenShift Container Platform 4.13"
},
{
"lang": "en",
"value": "RHSA-2026:28887: Red Hat OpenShift Container Platform 4.14"
},
{
"lang": "en",
"value": "RHSA-2026:28962: Red Hat OpenShift Container Platform 4.15"
},
{
"lang": "en",
"value": "RHSA-2026:29080: Red Hat OpenShift Container Platform 4.16"
},
{
"lang": "en",
"value": "RHSA-2026:34098: Red Hat OpenShift Container Platform 4.17"
},
{
"lang": "en",
"value": "RHSA-2026:29856: Red Hat OpenShift Container Platform 4.18"
},
{
"lang": "en",
"value": "RHSA-2026:29863: Red Hat OpenShift Container Platform 4.19"
},
{
"lang": "en",
"value": "RHSA-2026:29799: Red Hat OpenShift Container Platform 4.20"
},
{
"lang": "en",
"value": "RHSA-2026:29833: Red Hat OpenShift Container Platform 4.21"
},
{
"lang": "en",
"value": "RHSA-2026:29794: Red Hat OpenShift Container Platform 4.22"
},
{
"lang": "en",
"value": "RHSA-2026:27731: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:27288: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:27705: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:27713: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:27708: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:27789: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:33225: Red Hat Enterprise Linux BaseOS (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:27353: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:33220: Red Hat Enterprise Linux BaseOS (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:27707: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)"
},
{
"lang": "en",
"value": "RHSA-2026:27704: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)"
},
{
"lang": "en",
"value": "RHSA-2026:27355: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:33219: Red Hat Enterprise Linux BaseOS E4S (v.8.8)"
},
{
"lang": "en",
"value": "RHSA-2026:33221: Red Hat Enterprise Linux BaseOS E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:33222: Red Hat Enterprise Linux BaseOS E4S (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:33223: Red Hat Enterprise Linux BaseOS EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:33224: Red Hat Enterprise Linux BaseOS (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:27354: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:27706: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-18T06:17:23.219Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-18T04:04:00.000Z",
"value": "Made public."
}
],
"title": "kernel: net/sched: act_pedit: extend the writable skb range per key",
"workarounds": [
{
"lang": "en",
"value": "See the security bulletin for a detailed mitigation procedure."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/tc_act/tc_pedit.h",
"net/sched/act_pedit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "544d857b42a1734b923040e13aa61a6fd4746cf2",
"status": "affected",
"version": "abe35bf3be51482593076d516a680d79e5fbc8e1",
"versionType": "git"
},
{
"lessThan": "d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc",
"status": "affected",
"version": "b773640d5bb9e2acfd91e2695717af04d47aa116",
"versionType": "git"
},
{
"lessThan": "a071e057518decc5e3bec89855758f5f8786f2c5",
"status": "affected",
"version": "8b796475fd7882663a870456466a4fb315cc1bd6",
"versionType": "git"
},
{
"lessThan": "b685d6ef6f07a3b5ce814565a25f39f2157538a5",
"status": "affected",
"version": "8b796475fd7882663a870456466a4fb315cc1bd6",
"versionType": "git"
},
{
"lessThan": "2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b",
"status": "affected",
"version": "8b796475fd7882663a870456466a4fb315cc1bd6",
"versionType": "git"
},
{
"lessThan": "b198ed4e52580a7238c7c7082f03906f8b310313",
"status": "affected",
"version": "8b796475fd7882663a870456466a4fb315cc1bd6",
"versionType": "git"
},
{
"lessThan": "3dee9d0c198faeb95d052c1b94c2958751a28512",
"status": "affected",
"version": "8b796475fd7882663a870456466a4fb315cc1bd6",
"versionType": "git"
},
{
"lessThan": "899ee91156e57784090c5565e4f31bd7dbffbc5a",
"status": "affected",
"version": "8b796475fd7882663a870456466a4fb315cc1bd6",
"versionType": "git"
},
{
"status": "affected",
"version": "d0c38a914b0c4c21d553da801003d36979016726",
"versionType": "git"
},
{
"status": "affected",
"version": "2ec2dd7d51a9320151f275ddbb2b53260fb32ca1",
"versionType": "git"
},
{
"status": "affected",
"version": "c19cc520b3d69904e9518d401ad0df7f4702aca0",
"versionType": "git"
},
{
"lessThan": "5.10.260",
"status": "affected",
"version": "5.10.117",
"versionType": "semver"
},
{
"lessThan": "5.15.211",
"status": "affected",
"version": "5.15.41",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.244",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.195",
"versionType": "semver"
},
{
"lessThan": "5.18",
"status": "affected",
"version": "5.17.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/tc_act/tc_pedit.h",
"net/sched/act_pedit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "5.10.117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "5.15.41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.244",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.17.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix pedit partial COW leading to page cache corruption\n\ntcf_pedit_act() computes the COW range for skb_ensure_writable()\nonce before the key loop using tcfp_off_max_hint, but the hint does\nnot account for the runtime header offset added by typed keys. This\ncan leave part of the write region un-COW\u0027d.\n\nFix by moving skb_ensure_writable() inside the per-key loop where\nthe actual write offset is known, and add overflow checking on the\noffset arithmetic. For negative offsets (e.g. Ethernet header edits\nat ingress), use skb_cow() to COW the headroom instead. Guard\noffset_valid() against INT_MIN, where negation is undefined."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable pedit action is reached through local tc/rtnetlink configuration and local packet generation, not by unauthenticated network input alone. Even if remote traffic can traverse an already configured pedit rule, creating the exploitable action is a local operation.\nAC:L - There is no attacker-uncontrolled race; the attacker can choose the pedit key, header type, offset, and traffic shape. The partial COW condition is deterministic once suitable shared or page-cache-backed skbs are generated.\nPR:L - Installing the pedit action through RTM_NEWTFILTER requires CAP_NET_ADMIN in the network namespace. With unprivileged user namespaces, a basic local user can obtain namespace CAP_NET_ADMIN, so this is Low rather than High.\nUI:N - The attacker can configure the tc action and generate the triggering traffic without requiring any victim action. No user needs to open a file, mount a filesystem, or interact with crafted data.\nS:U - The vulnerability is in the kernel networking subsystem and impacts kernel-managed memory and page cache within the same security authority. It is a standard local kernel privilege-escalation/data-corruption issue, not a VM escape or separate-scope boundary bypass.\nC:H - The bug permits corruption of shared skb/page-cache memory outside the intended COW range, which is kernel memory/data corruption. Such corruption is defensibly usable for privilege escalation, after which protected information can be read.\nI:H - The vulnerable path gives attacker-influenced writes into shared page-cache-backed packet data that should have been private. This can corrupt protected data or code pages and is defensibly a high-integrity arbitrary data modification primitive.\nA:H - Repeated page cache or kernel memory corruption can crash the kernel, corrupt critical cached files, or destabilize networking and userspace execution. A kernel crash or system-wide corruption warrants High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:25.966Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/544d857b42a1734b923040e13aa61a6fd4746cf2"
},
{
"url": "https://git.kernel.org/stable/c/d5d01d35a5a7d36f7cb679b67d9cbdd5205672dc"
},
{
"url": "https://git.kernel.org/stable/c/a071e057518decc5e3bec89855758f5f8786f2c5"
},
{
"url": "https://git.kernel.org/stable/c/b685d6ef6f07a3b5ce814565a25f39f2157538a5"
},
{
"url": "https://git.kernel.org/stable/c/2bec122b9fb91507a758ab5e3e5c4fbe7cb3f61b"
},
{
"url": "https://git.kernel.org/stable/c/b198ed4e52580a7238c7c7082f03906f8b310313"
},
{
"url": "https://git.kernel.org/stable/c/3dee9d0c198faeb95d052c1b94c2958751a28512"
},
{
"url": "https://git.kernel.org/stable/c/899ee91156e57784090c5565e4f31bd7dbffbc5a"
}
],
"title": "net/sched: fix pedit partial COW leading to page cache corruption",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46331",
"datePublished": "2026-06-16T06:26:21.066Z",
"dateReserved": "2026-05-13T15:03:33.112Z",
"dateUpdated": "2026-08-24T12:06:51.076Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31430 (GCVE-0-2026-31430)
Vulnerability from cvelistv5
Published
2026-04-20 09:43
Modified
2026-05-11 22:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
X.509: Fix out-of-bounds access when parsing extensions
Leo reports an out-of-bounds access when parsing a certificate with
empty Basic Constraints or Key Usage extension because the first byte of
the extension is read before checking its length. Fix it.
The bug can be triggered by an unprivileged user by submitting a
specially crafted certificate to the kernel through the keyrings(7) API.
Leo has demonstrated this with a proof-of-concept program responsibly
disclosed off-list.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/asymmetric_keys/x509_cert_parser.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "672b526def1f94c1be8eb11b885b803da0d8c2f1",
"status": "affected",
"version": "30eae2b037af54b24109dcaea21db46f6285c69b",
"versionType": "git"
},
{
"lessThan": "30ab358fad0c7daa1d282ec48089901b21b36a20",
"status": "affected",
"version": "30eae2b037af54b24109dcaea21db46f6285c69b",
"versionType": "git"
},
{
"lessThan": "206121294b9cf27f0589857f80d64f87e496ffb2",
"status": "affected",
"version": "30eae2b037af54b24109dcaea21db46f6285c69b",
"versionType": "git"
},
{
"lessThan": "7fb4dadc2734f4020d7543d688b8d49c8e569c61",
"status": "affected",
"version": "30eae2b037af54b24109dcaea21db46f6285c69b",
"versionType": "git"
},
{
"lessThan": "d702c3408213bb12bd570bb97204d8340d141c51",
"status": "affected",
"version": "30eae2b037af54b24109dcaea21db46f6285c69b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/asymmetric_keys/x509_cert_parser.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.135",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.135",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.82",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nX.509: Fix out-of-bounds access when parsing extensions\n\nLeo reports an out-of-bounds access when parsing a certificate with\nempty Basic Constraints or Key Usage extension because the first byte of\nthe extension is read before checking its length. Fix it.\n\nThe bug can be triggered by an unprivileged user by submitting a\nspecially crafted certificate to the kernel through the keyrings(7) API.\nLeo has demonstrated this with a proof-of-concept program responsibly\ndisclosed off-list."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:08:33.502Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/672b526def1f94c1be8eb11b885b803da0d8c2f1"
},
{
"url": "https://git.kernel.org/stable/c/30ab358fad0c7daa1d282ec48089901b21b36a20"
},
{
"url": "https://git.kernel.org/stable/c/206121294b9cf27f0589857f80d64f87e496ffb2"
},
{
"url": "https://git.kernel.org/stable/c/7fb4dadc2734f4020d7543d688b8d49c8e569c61"
},
{
"url": "https://git.kernel.org/stable/c/d702c3408213bb12bd570bb97204d8340d141c51"
}
],
"title": "X.509: Fix out-of-bounds access when parsing extensions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31430",
"datePublished": "2026-04-20T09:43:03.919Z",
"dateReserved": "2026-03-09T15:48:24.089Z",
"dateUpdated": "2026-05-11T22:08:33.502Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53148 (GCVE-0-2026-53148)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-07-15 00:44
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
thunderbolt: Clamp XDomain response data copy to allocation size
tb_xdp_properties_request() derives the per-packet copy length from
the response header without checking that it fits in the previously
allocated data buffer. A malicious peer can set its length field
larger than the declared data_length, causing memcpy to write past
the kcalloc allocation.
Clamp the per-packet copy length so that the cumulative offset
never exceeds data_len.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 Version: cdae7c07e3e3509eaabc18c1640a55dc5b99c179 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s Thunderbolt driver. A malicious peer can exploit this vulnerability by sending a specially crafted response that causes the system to write data beyond an allocated memory buffer. This out-of-bounds write can lead to memory corruption, which may allow an attacker to cause a denial of service or potentially execute arbitrary code."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T00:44:48.625Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53148"
},
{
"name": "RHBZ#2492756",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492756"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53148.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: thunderbolt: Clamp XDomain response data copy to allocation size",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/xdomain.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0b334279a82d79fb4723bd4f614305de1ab69caa",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "6021d39ccd979713b39b980286020d8f9a45efd1",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "5db10c8ad8c09f72c847dfeef3d876098257f505",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "05a43157676c243c248d1c6d9dcecbe6eba2f35d",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "fcbd0cdab92838854a5818be7ed8a097164ef6d5",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "906035d5c3784570191d259cbf9a0ac1617852b5",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
},
{
"lessThan": "322e93448d908434ae5545660fcbe8f5a7a8e141",
"status": "affected",
"version": "cdae7c07e3e3509eaabc18c1640a55dc5b99c179",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thunderbolt/xdomain.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Clamp XDomain response data copy to allocation size\n\ntb_xdp_properties_request() derives the per-packet copy length from\nthe response header without checking that it fits in the previously\nallocated data buffer. A malicious peer can set its length field\nlarger than the declared data_length, causing memcpy to write past\nthe kcalloc allocation.\n\nClamp the per-packet copy length so that the cumulative offset\nnever exceeds data_len."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:38:34.208Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0b334279a82d79fb4723bd4f614305de1ab69caa"
},
{
"url": "https://git.kernel.org/stable/c/6021d39ccd979713b39b980286020d8f9a45efd1"
},
{
"url": "https://git.kernel.org/stable/c/89ae04365e01d5ae4aae83044a8bbd2a9aaf8d0d"
},
{
"url": "https://git.kernel.org/stable/c/5db10c8ad8c09f72c847dfeef3d876098257f505"
},
{
"url": "https://git.kernel.org/stable/c/05a43157676c243c248d1c6d9dcecbe6eba2f35d"
},
{
"url": "https://git.kernel.org/stable/c/fcbd0cdab92838854a5818be7ed8a097164ef6d5"
},
{
"url": "https://git.kernel.org/stable/c/906035d5c3784570191d259cbf9a0ac1617852b5"
},
{
"url": "https://git.kernel.org/stable/c/322e93448d908434ae5545660fcbe8f5a7a8e141"
}
],
"title": "thunderbolt: Clamp XDomain response data copy to allocation size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53148",
"datePublished": "2026-06-25T08:38:34.208Z",
"dateReserved": "2026-06-09T07:44:35.387Z",
"dateUpdated": "2026-07-15T00:44:48.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43469 (GCVE-0-2026-43469)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xprtrdma: Decrement re_receiving on the early exit paths
In the event that rpcrdma_post_recvs() fails to create a work request
(due to memory allocation failure, say) or otherwise exits early, we
should decrement ep->re_receiving before returning. Otherwise we will
hang in rpcrdma_xprt_drain() as re_receiving will never reach zero and
the completion will never be triggered.
On a system with high memory pressure, this can appear as the following
hung task:
INFO: task kworker/u385:17:8393 blocked for more than 122 seconds.
Tainted: G S E 6.19.0 #3
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u385:17 state:D stack:0 pid:8393 tgid:8393 ppid:2 task_flags:0x4248060 flags:0x00080000
Workqueue: xprtiod xprt_autoclose [sunrpc]
Call Trace:
<TASK>
__schedule+0x48b/0x18b0
? ib_post_send_mad+0x247/0xae0 [ib_core]
schedule+0x27/0xf0
schedule_timeout+0x104/0x110
__wait_for_common+0x98/0x180
? __pfx_schedule_timeout+0x10/0x10
wait_for_completion+0x24/0x40
rpcrdma_xprt_disconnect+0x444/0x460 [rpcrdma]
xprt_rdma_close+0x12/0x40 [rpcrdma]
xprt_autoclose+0x5f/0x120 [sunrpc]
process_one_work+0x191/0x3e0
worker_thread+0x2e3/0x420
? __pfx_worker_thread+0x10/0x10
kthread+0x10d/0x230
? __pfx_kthread+0x10/0x10
ret_from_fork+0x273/0x2b0
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 15788d1d1077ebe029c48842c738876516d85076 Version: 15788d1d1077ebe029c48842c738876516d85076 Version: 15788d1d1077ebe029c48842c738876516d85076 Version: 15788d1d1077ebe029c48842c738876516d85076 Version: 15788d1d1077ebe029c48842c738876516d85076 Version: 15788d1d1077ebe029c48842c738876516d85076 Version: 15788d1d1077ebe029c48842c738876516d85076 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7ea69259a60a364f56cf4aa9e2eafb588d1c762b",
"status": "affected",
"version": "15788d1d1077ebe029c48842c738876516d85076",
"versionType": "git"
},
{
"lessThan": "8cb6b5d8296b1f99a8d36849901ebabfe3f749db",
"status": "affected",
"version": "15788d1d1077ebe029c48842c738876516d85076",
"versionType": "git"
},
{
"lessThan": "74c39a47856bddcde7874f2196a00143b5cd0af9",
"status": "affected",
"version": "15788d1d1077ebe029c48842c738876516d85076",
"versionType": "git"
},
{
"lessThan": "49f53ee4e25297d886f14e31f355ad1c2735ddfb",
"status": "affected",
"version": "15788d1d1077ebe029c48842c738876516d85076",
"versionType": "git"
},
{
"lessThan": "8127b5fec04757c2a41ed65bca0b3266968efd3b",
"status": "affected",
"version": "15788d1d1077ebe029c48842c738876516d85076",
"versionType": "git"
},
{
"lessThan": "dc3ebd7e2d73dbd4d317785735ffa6c4a6384ddf",
"status": "affected",
"version": "15788d1d1077ebe029c48842c738876516d85076",
"versionType": "git"
},
{
"lessThan": "7b6275c80a0c81c5f8943272292dfe67730ce849",
"status": "affected",
"version": "15788d1d1077ebe029c48842c738876516d85076",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sunrpc/xprtrdma/verbs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxprtrdma: Decrement re_receiving on the early exit paths\n\nIn the event that rpcrdma_post_recvs() fails to create a work request\n(due to memory allocation failure, say) or otherwise exits early, we\nshould decrement ep-\u003ere_receiving before returning. Otherwise we will\nhang in rpcrdma_xprt_drain() as re_receiving will never reach zero and\nthe completion will never be triggered.\n\nOn a system with high memory pressure, this can appear as the following\nhung task:\n\n INFO: task kworker/u385:17:8393 blocked for more than 122 seconds.\n Tainted: G S E 6.19.0 #3\n \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n task:kworker/u385:17 state:D stack:0 pid:8393 tgid:8393 ppid:2 task_flags:0x4248060 flags:0x00080000\n Workqueue: xprtiod xprt_autoclose [sunrpc]\n Call Trace:\n \u003cTASK\u003e\n __schedule+0x48b/0x18b0\n ? ib_post_send_mad+0x247/0xae0 [ib_core]\n schedule+0x27/0xf0\n schedule_timeout+0x104/0x110\n __wait_for_common+0x98/0x180\n ? __pfx_schedule_timeout+0x10/0x10\n wait_for_completion+0x24/0x40\n rpcrdma_xprt_disconnect+0x444/0x460 [rpcrdma]\n xprt_rdma_close+0x12/0x40 [rpcrdma]\n xprt_autoclose+0x5f/0x120 [sunrpc]\n process_one_work+0x191/0x3e0\n worker_thread+0x2e3/0x420\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x10d/0x230\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x273/0x2b0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable function is reached from the RPC-over-RDMA client receive completion path while processing network-delivered RDMA replies from an NFS/RDMA peer. A malicious or compromised remote NFS/RDMA server can influence the receive repost path via reply traffic and credit grants.\nAC:L - The trigger is a deterministic accounting bug on early exits from receive reposting, and a peer can drive reply bursts, high credit grants, and disconnect/reconnect behavior to reach the path. Although memory pressure can help expose one early exit, the rule requires choosing the higher severity option when uncertain.\nPR:N - The remote peer sending RDMA replies does not need privileges on the affected client. The client must already be using an NFS/RDMA transport, but the attacker-side protocol traffic itself is not gated by local kernel privileges.\nUI:N - In a reasonable deployed scenario, the client already has an active NFS/RDMA mount and normal RPC traffic reaches the vulnerable receive path without a further victim action. Exploitation can be driven by the remote peer during ordinary mounted filesystem operation.\nS:U - The effect is confined to the Linux kernel/RPC transport on the same host. It does not cross a separate security authority such as a VM, IOMMU, or sandbox boundary.\nC:N - The bug is a leaked receive-drain accounting reference, not memory corruption or an information disclosure primitive. The investigated paths indicate a hang in disconnect/drain handling rather than exposure of kernel memory.\nI:N - The issue does not provide data modification, arbitrary write, or control-flow manipulation. It only prevents receive-drain completion after the counter is left elevated.\nA:H - The leaked re_receiving count can make rpcrdma_xprt_drain wait forever, producing stuck xprtiod/autoclose work and hung kernel tasks. This is a kernel-level availability failure for the affected NFS/RDMA transport and can persist until recovery or reboot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:10.739Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7ea69259a60a364f56cf4aa9e2eafb588d1c762b"
},
{
"url": "https://git.kernel.org/stable/c/8cb6b5d8296b1f99a8d36849901ebabfe3f749db"
},
{
"url": "https://git.kernel.org/stable/c/74c39a47856bddcde7874f2196a00143b5cd0af9"
},
{
"url": "https://git.kernel.org/stable/c/49f53ee4e25297d886f14e31f355ad1c2735ddfb"
},
{
"url": "https://git.kernel.org/stable/c/8127b5fec04757c2a41ed65bca0b3266968efd3b"
},
{
"url": "https://git.kernel.org/stable/c/dc3ebd7e2d73dbd4d317785735ffa6c4a6384ddf"
},
{
"url": "https://git.kernel.org/stable/c/7b6275c80a0c81c5f8943272292dfe67730ce849"
}
],
"title": "xprtrdma: Decrement re_receiving on the early exit paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43469",
"datePublished": "2026-05-08T14:22:29.550Z",
"dateReserved": "2026-05-01T14:12:56.011Z",
"dateUpdated": "2026-08-05T12:28:10.739Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43086 (GCVE-0-2026-43086)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-05-11 22:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipvs: fix NULL deref in ip_vs_add_service error path
When ip_vs_bind_scheduler() succeeds in ip_vs_add_service(), the local
variable sched is set to NULL. If ip_vs_start_estimator() subsequently
fails, the out_err cleanup calls ip_vs_unbind_scheduler(svc, sched)
with sched == NULL. ip_vs_unbind_scheduler() passes the cur_sched NULL
check (because svc->scheduler was set by the successful bind) but then
dereferences the NULL sched parameter at sched->done_service, causing a
kernel panic at offset 0x30 from NULL.
Oops: general protection fault, [..] [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
RIP: 0010:ip_vs_unbind_scheduler (net/netfilter/ipvs/ip_vs_sched.c:69)
Call Trace:
<TASK>
ip_vs_add_service.isra.0 (net/netfilter/ipvs/ip_vs_ctl.c:1500)
do_ip_vs_set_ctl (net/netfilter/ipvs/ip_vs_ctl.c:2809)
nf_setsockopt (net/netfilter/nf_sockopt.c:102)
[..]
Fix by simply not clearing the local sched variable after a successful
bind. ip_vs_unbind_scheduler() already detects whether a scheduler is
installed via svc->scheduler, and keeping sched non-NULL ensures the
error path passes the correct pointer to both ip_vs_unbind_scheduler()
and ip_vs_scheduler_put().
While the bug is older, the problem popups in more recent kernels (6.2),
when the new error path is taken after the ip_vs_start_estimator() call.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_ctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "730663352c9178f33fcf5929f4a37c1f1ca5a693",
"status": "affected",
"version": "705dd34440812735ece298eb5bc153fde9544d42",
"versionType": "git"
},
{
"lessThan": "4039959315008888dd53c37674d33351817a5166",
"status": "affected",
"version": "705dd34440812735ece298eb5bc153fde9544d42",
"versionType": "git"
},
{
"lessThan": "a32dabacee111cea083ddd57a03635672e1bff29",
"status": "affected",
"version": "705dd34440812735ece298eb5bc153fde9544d42",
"versionType": "git"
},
{
"lessThan": "c2ddbe577e2ebf63f2d8fb15cdc7503af70f3e94",
"status": "affected",
"version": "705dd34440812735ece298eb5bc153fde9544d42",
"versionType": "git"
},
{
"lessThan": "9a91797e61d286805ae10a92cc48959c30800556",
"status": "affected",
"version": "705dd34440812735ece298eb5bc153fde9544d42",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipvs/ip_vs_ctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: fix NULL deref in ip_vs_add_service error path\n\nWhen ip_vs_bind_scheduler() succeeds in ip_vs_add_service(), the local\nvariable sched is set to NULL. If ip_vs_start_estimator() subsequently\nfails, the out_err cleanup calls ip_vs_unbind_scheduler(svc, sched)\nwith sched == NULL. ip_vs_unbind_scheduler() passes the cur_sched NULL\ncheck (because svc-\u003escheduler was set by the successful bind) but then\ndereferences the NULL sched parameter at sched-\u003edone_service, causing a\nkernel panic at offset 0x30 from NULL.\n\n Oops: general protection fault, [..] [#1] PREEMPT SMP KASAN NOPTI\n KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]\n RIP: 0010:ip_vs_unbind_scheduler (net/netfilter/ipvs/ip_vs_sched.c:69)\n Call Trace:\n \u003cTASK\u003e\n ip_vs_add_service.isra.0 (net/netfilter/ipvs/ip_vs_ctl.c:1500)\n do_ip_vs_set_ctl (net/netfilter/ipvs/ip_vs_ctl.c:2809)\n nf_setsockopt (net/netfilter/nf_sockopt.c:102)\n [..]\n\nFix by simply not clearing the local sched variable after a successful\nbind. ip_vs_unbind_scheduler() already detects whether a scheduler is\ninstalled via svc-\u003escheduler, and keeping sched non-NULL ensures the\nerror path passes the correct pointer to both ip_vs_unbind_scheduler()\nand ip_vs_scheduler_put().\n\nWhile the bug is older, the problem popups in more recent kernels (6.2),\nwhen the new error path is taken after the ip_vs_start_estimator() call."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:17:27.288Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/730663352c9178f33fcf5929f4a37c1f1ca5a693"
},
{
"url": "https://git.kernel.org/stable/c/4039959315008888dd53c37674d33351817a5166"
},
{
"url": "https://git.kernel.org/stable/c/a32dabacee111cea083ddd57a03635672e1bff29"
},
{
"url": "https://git.kernel.org/stable/c/c2ddbe577e2ebf63f2d8fb15cdc7503af70f3e94"
},
{
"url": "https://git.kernel.org/stable/c/9a91797e61d286805ae10a92cc48959c30800556"
}
],
"title": "ipvs: fix NULL deref in ip_vs_add_service error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43086",
"datePublished": "2026-05-06T07:40:20.631Z",
"dateReserved": "2026-05-01T14:12:55.983Z",
"dateUpdated": "2026-05-11T22:17:27.288Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31439 (GCVE-0-2026-31439)
Vulnerability from cvelistv5
Published
2026-04-22 13:53
Modified
2026-05-11 22:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: xilinx: xdma: Fix regmap init error handling
devm_regmap_init_mmio returns an ERR_PTR() upon error, not NULL.
Fix the error check and also fix the error message. Use the error code
from ERR_PTR() instead of the wrong value in ret.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dma/xilinx/xdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4b6e1da50b22e5528b9003f376a3cecccce4decc",
"status": "affected",
"version": "17ce252266c7f016ece026492c45838f852ddc79",
"versionType": "git"
},
{
"lessThan": "9787b3d9b908785b40bc3f2e6d7082fdb8fdd98a",
"status": "affected",
"version": "17ce252266c7f016ece026492c45838f852ddc79",
"versionType": "git"
},
{
"lessThan": "f27197ccfd2ecd2c71f27fd57c6d507e892ad24d",
"status": "affected",
"version": "17ce252266c7f016ece026492c45838f852ddc79",
"versionType": "git"
},
{
"lessThan": "59f6ccd0f3345be2e8a78bdef2103e93f180633a",
"status": "affected",
"version": "17ce252266c7f016ece026492c45838f852ddc79",
"versionType": "git"
},
{
"lessThan": "e0adbf74e2a0455a6bc9628726ba87bcd0b42bf8",
"status": "affected",
"version": "17ce252266c7f016ece026492c45838f852ddc79",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dma/xilinx/xdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: xilinx: xdma: Fix regmap init error handling\n\ndevm_regmap_init_mmio returns an ERR_PTR() upon error, not NULL.\nFix the error check and also fix the error message. Use the error code\nfrom ERR_PTR() instead of the wrong value in ret."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:08:43.715Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4b6e1da50b22e5528b9003f376a3cecccce4decc"
},
{
"url": "https://git.kernel.org/stable/c/9787b3d9b908785b40bc3f2e6d7082fdb8fdd98a"
},
{
"url": "https://git.kernel.org/stable/c/f27197ccfd2ecd2c71f27fd57c6d507e892ad24d"
},
{
"url": "https://git.kernel.org/stable/c/59f6ccd0f3345be2e8a78bdef2103e93f180633a"
},
{
"url": "https://git.kernel.org/stable/c/e0adbf74e2a0455a6bc9628726ba87bcd0b42bf8"
}
],
"title": "dmaengine: xilinx: xdma: Fix regmap init error handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31439",
"datePublished": "2026-04-22T13:53:37.754Z",
"dateReserved": "2026-03-09T15:48:24.090Z",
"dateUpdated": "2026-05-11T22:08:43.715Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53182 (GCVE-0-2026-53182)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-08-05 12:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: nl80211: reject oversized EMA RNR lists
nl80211_parse_rnr_elems() stores the parsed element count in a
u8-backed cfg80211_rnr_elems::cnt field and uses that count to size
the flexible array allocation.
Reject nested NL80211_ATTR_EMA_RNR_ELEMS input once the count reaches
255, before incrementing it again. This keeps the parser aligned with
the data structure it fills and matches the existing bound check used
by nl80211_parse_mbssid_elems().
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 56189d7bc30531def6b999f27940ee43c6ff2569 Version: dbbb27e183b1568d5a907ace1cd144b0709ea52a Version: dbbb27e183b1568d5a907ace1cd144b0709ea52a Version: dbbb27e183b1568d5a907ace1cd144b0709ea52a Version: dbbb27e183b1568d5a907ace1cd144b0709ea52a Version: dbbb27e183b1568d5a907ace1cd144b0709ea52a Version: 6.1.160 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/nl80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fc0ec2fc02dfe52c5821f36fbccf6a45df43f508",
"status": "affected",
"version": "56189d7bc30531def6b999f27940ee43c6ff2569",
"versionType": "git"
},
{
"lessThan": "688fcac7054abc680c0eef753f2bb772cfaf8cf7",
"status": "affected",
"version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a",
"versionType": "git"
},
{
"lessThan": "30c3fa80f423613efdda3deca4af52ff7d20e4e2",
"status": "affected",
"version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a",
"versionType": "git"
},
{
"lessThan": "265c07c09c837621730d35f02975207a1224bf05",
"status": "affected",
"version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a",
"versionType": "git"
},
{
"lessThan": "ecbf3c45add30a0857414e156bdb9c79906f0ff6",
"status": "affected",
"version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a",
"versionType": "git"
},
{
"lessThan": "4cd92957e8f8cc4ebfe8a5d4203c14c592fde6b1",
"status": "affected",
"version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a",
"versionType": "git"
},
{
"lessThan": "6.1.176",
"status": "affected",
"version": "6.1.160",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/nl80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "6.1.160",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: reject oversized EMA RNR lists\n\nnl80211_parse_rnr_elems() stores the parsed element count in a\nu8-backed cfg80211_rnr_elems::cnt field and uses that count to size\nthe flexible array allocation.\n\nReject nested NL80211_ATTR_EMA_RNR_ELEMS input once the count reaches\n255, before incrementing it again. This keeps the parser aligned with\nthe data structure it fills and matches the existing bound check used\nby nl80211_parse_mbssid_elems()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable parser is reached through local nl80211 generic-netlink commands that configure AP beacon data, not by received WiFi frames or remote network traffic.\nAC:L - An attacker who can send the command can deterministically provide 256 or more nested EMA RNR elements; there is no race or condition outside the attacker\u0027s control beyond targeting an affected AP-capable configuration.\nPR:L - The commands require CAP_NET_ADMIN via GENL_UNS_ADMIN_PERM, which is checked in the relevant network namespace; under kernel scoring guidance this is low privilege because CAP_NET_ADMIN may be available through user namespaces.\nUI:N - No victim action is required after the attacker sends the crafted nl80211 request.\nS:U - The corruption occurs inside the kernel and impacts the same kernel security authority; it is not a VM escape or other cross-scope boundary violation.\nC:H - The u8 count wrap causes an undersized flexible-array allocation followed by attacker-influenced out-of-bounds heap writes, which is memory corruption plausibly usable for kernel memory disclosure.\nI:H - The bug is a kernel heap out-of-bounds write of RNR element metadata past the allocation, making arbitrary corruption or control-flow compromise defensible.\nA:H - The same heap corruption can readily crash or panic the kernel even if not weaponized for code execution."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:33:48.954Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fc0ec2fc02dfe52c5821f36fbccf6a45df43f508"
},
{
"url": "https://git.kernel.org/stable/c/688fcac7054abc680c0eef753f2bb772cfaf8cf7"
},
{
"url": "https://git.kernel.org/stable/c/30c3fa80f423613efdda3deca4af52ff7d20e4e2"
},
{
"url": "https://git.kernel.org/stable/c/265c07c09c837621730d35f02975207a1224bf05"
},
{
"url": "https://git.kernel.org/stable/c/ecbf3c45add30a0857414e156bdb9c79906f0ff6"
},
{
"url": "https://git.kernel.org/stable/c/4cd92957e8f8cc4ebfe8a5d4203c14c592fde6b1"
}
],
"title": "wifi: nl80211: reject oversized EMA RNR lists",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53182",
"datePublished": "2026-06-25T08:38:56.654Z",
"dateReserved": "2026-06-09T07:44:35.390Z",
"dateUpdated": "2026-08-05T12:33:48.954Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43089 (GCVE-0-2026-43089)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-06-01 16:14
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm_user: fix info leak in build_mapping()
struct xfrm_usersa_id has a one-byte padding hole after the proto
field, which ends up never getting set to zero before copying out to
userspace. Fix that up by zeroing out the whole structure before
setting individual variables.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4 Version: 3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4 Version: 3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4 Version: 3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4 Version: 3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4 Version: 3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4 Version: 3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4 Version: 3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_user.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "521385cbd50ca9474396d88462fcdfa6489685d9",
"status": "affected",
"version": "3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4",
"versionType": "git"
},
{
"lessThan": "c2779ae9a3e5a044e5ccd564681511bbbcc5fc0f",
"status": "affected",
"version": "3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4",
"versionType": "git"
},
{
"lessThan": "72a8de41c3eb4dcf22bf3b674ea38fb2f75d6f32",
"status": "affected",
"version": "3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4",
"versionType": "git"
},
{
"lessThan": "d3125c541a96fb3c0fc7210112684baf22b6c24d",
"status": "affected",
"version": "3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4",
"versionType": "git"
},
{
"lessThan": "5a1a4b049ddde41466ccac0daeec326254b133f2",
"status": "affected",
"version": "3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4",
"versionType": "git"
},
{
"lessThan": "f779a6b6cdb6e12baa0663063ac59ab2a8f20c0c",
"status": "affected",
"version": "3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4",
"versionType": "git"
},
{
"lessThan": "700c9622b23c33b5933e6dcea816492c064e4e10",
"status": "affected",
"version": "3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4",
"versionType": "git"
},
{
"lessThan": "1beb76b2053b68c491b78370794b8ff63c8f8c02",
"status": "affected",
"version": "3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_user.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.29"
},
{
"lessThan": "2.6.29",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "2.6.29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.29",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm_user: fix info leak in build_mapping()\n\nstruct xfrm_usersa_id has a one-byte padding hole after the proto\nfield, which ends up never getting set to zero before copying out to\nuserspace. Fix that up by zeroing out the whole structure before\nsetting individual variables."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T16:14:29.152Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/521385cbd50ca9474396d88462fcdfa6489685d9"
},
{
"url": "https://git.kernel.org/stable/c/c2779ae9a3e5a044e5ccd564681511bbbcc5fc0f"
},
{
"url": "https://git.kernel.org/stable/c/72a8de41c3eb4dcf22bf3b674ea38fb2f75d6f32"
},
{
"url": "https://git.kernel.org/stable/c/d3125c541a96fb3c0fc7210112684baf22b6c24d"
},
{
"url": "https://git.kernel.org/stable/c/5a1a4b049ddde41466ccac0daeec326254b133f2"
},
{
"url": "https://git.kernel.org/stable/c/f779a6b6cdb6e12baa0663063ac59ab2a8f20c0c"
},
{
"url": "https://git.kernel.org/stable/c/700c9622b23c33b5933e6dcea816492c064e4e10"
},
{
"url": "https://git.kernel.org/stable/c/1beb76b2053b68c491b78370794b8ff63c8f8c02"
}
],
"title": "xfrm_user: fix info leak in build_mapping()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43089",
"datePublished": "2026-05-06T07:40:22.630Z",
"dateReserved": "2026-05-01T14:12:55.984Z",
"dateUpdated": "2026-06-01T16:14:29.152Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43107 (GCVE-0-2026-43107)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-05-11 22:17
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: account XFRMA_IF_ID in aevent size calculation
xfrm_get_ae() allocates the reply skb with xfrm_aevent_msgsize(), then
build_aevent() appends attributes including XFRMA_IF_ID when x->if_id is
set.
xfrm_aevent_msgsize() does not include space for XFRMA_IF_ID. For states
with if_id, build_aevent() can fail with -EMSGSIZE and hit BUG_ON(err < 0)
in xfrm_get_ae(), turning a malformed netlink interaction into a kernel
panic.
Account XFRMA_IF_ID in the size calculation unconditionally and replace
the BUG_ON with normal error unwinding.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_user.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2c41283d94af943a05f7f2cc1a01f0c872f3cf43",
"status": "affected",
"version": "7e6526404adedf079279aa7aa11722deaca8fe2e",
"versionType": "git"
},
{
"lessThan": "e62e322ea20be78e346e4b49f9a6b9f03313af4c",
"status": "affected",
"version": "7e6526404adedf079279aa7aa11722deaca8fe2e",
"versionType": "git"
},
{
"lessThan": "58e5735d1a5373652f405a0c16e54ac04aaab0ad",
"status": "affected",
"version": "7e6526404adedf079279aa7aa11722deaca8fe2e",
"versionType": "git"
},
{
"lessThan": "7081d46d32312f1a31f0e0e99c6835a394037599",
"status": "affected",
"version": "7e6526404adedf079279aa7aa11722deaca8fe2e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_user.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.83",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.83",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.24",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.14",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: account XFRMA_IF_ID in aevent size calculation\n\nxfrm_get_ae() allocates the reply skb with xfrm_aevent_msgsize(), then\nbuild_aevent() appends attributes including XFRMA_IF_ID when x-\u003eif_id is\nset.\n\nxfrm_aevent_msgsize() does not include space for XFRMA_IF_ID. For states\nwith if_id, build_aevent() can fail with -EMSGSIZE and hit BUG_ON(err \u003c 0)\nin xfrm_get_ae(), turning a malformed netlink interaction into a kernel\npanic.\n\nAccount XFRMA_IF_ID in the size calculation unconditionally and replace\nthe BUG_ON with normal error unwinding."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:17:52.325Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c41283d94af943a05f7f2cc1a01f0c872f3cf43"
},
{
"url": "https://git.kernel.org/stable/c/e62e322ea20be78e346e4b49f9a6b9f03313af4c"
},
{
"url": "https://git.kernel.org/stable/c/58e5735d1a5373652f405a0c16e54ac04aaab0ad"
},
{
"url": "https://git.kernel.org/stable/c/7081d46d32312f1a31f0e0e99c6835a394037599"
}
],
"title": "xfrm: account XFRMA_IF_ID in aevent size calculation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43107",
"datePublished": "2026-05-06T07:40:35.068Z",
"dateReserved": "2026-05-01T14:12:55.986Z",
"dateUpdated": "2026-05-11T22:17:52.325Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46092 (GCVE-0-2026-46092)
Vulnerability from cvelistv5
Published
2026-05-27 12:58
Modified
2026-07-16 11:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: check for PCI upstream bridge existence
pci_upstream_bridge() returns NULL if the device is on a root bus. If
8821CE is installed in the system with such a PCI topology, the probing
routine will crash. This has probably been unnoticed as 8821CE is mostly
supplied in laptops where there is a PCI-to-PCI bridge located upstream
from the device. However the card might be installed on a system with
different configuration.
Check if the bridge does exist for the specific workaround to be applied.
Found by Linux Verification Center (linuxtesting.org) with Svace static
analysis tool.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 617339466fda09916c4b4151fa5e6a9c1fdae353 Version: 24f5e38a13b5ae2b6105cda8bb47c19108e62a9a Version: 24f5e38a13b5ae2b6105cda8bb47c19108e62a9a Version: 24f5e38a13b5ae2b6105cda8bb47c19108e62a9a Version: 24f5e38a13b5ae2b6105cda8bb47c19108e62a9a Version: 24f5e38a13b5ae2b6105cda8bb47c19108e62a9a Version: 24f5e38a13b5ae2b6105cda8bb47c19108e62a9a Version: f21e8cb927fa9da49490b74ddda3856a828b82d6 Version: 5.15.17 ≤ Version: 5.16.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw88/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "959c13da6c36167ce1016d400a6104d2367f686e",
"status": "affected",
"version": "617339466fda09916c4b4151fa5e6a9c1fdae353",
"versionType": "git"
},
{
"lessThan": "3b89b4c095804c478d50376285e66700cf3c045f",
"status": "affected",
"version": "24f5e38a13b5ae2b6105cda8bb47c19108e62a9a",
"versionType": "git"
},
{
"lessThan": "cc9b6303e7ea91bc360b42c7edc1fe9ceb2f47fe",
"status": "affected",
"version": "24f5e38a13b5ae2b6105cda8bb47c19108e62a9a",
"versionType": "git"
},
{
"lessThan": "6c53d68e3bcfc8faccdd76c3383a9232b05c9ae6",
"status": "affected",
"version": "24f5e38a13b5ae2b6105cda8bb47c19108e62a9a",
"versionType": "git"
},
{
"lessThan": "000134a20bbf89b1152520a2eef71f91fdb83a5b",
"status": "affected",
"version": "24f5e38a13b5ae2b6105cda8bb47c19108e62a9a",
"versionType": "git"
},
{
"lessThan": "3bbbb56204f7359ce2139a9341b43b52a186261c",
"status": "affected",
"version": "24f5e38a13b5ae2b6105cda8bb47c19108e62a9a",
"versionType": "git"
},
{
"lessThan": "eb101d2abdcccb514ca4fccd3b278dd8267374f6",
"status": "affected",
"version": "24f5e38a13b5ae2b6105cda8bb47c19108e62a9a",
"versionType": "git"
},
{
"status": "affected",
"version": "f21e8cb927fa9da49490b74ddda3856a828b82d6",
"versionType": "git"
},
{
"lessThan": "5.15.210",
"status": "affected",
"version": "5.15.17",
"versionType": "semver"
},
{
"lessThan": "5.17",
"status": "affected",
"version": "5.16.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw88/pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.15.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: check for PCI upstream bridge existence\n\npci_upstream_bridge() returns NULL if the device is on a root bus. If\n8821CE is installed in the system with such a PCI topology, the probing\nroutine will crash. This has probably been unnoticed as 8821CE is mostly\nsupplied in laptops where there is a PCI-to-PCI bridge located upstream\nfrom the device. However the card might be installed on a system with\ndifferent configuration.\n\nCheck if the bridge does exist for the specific workaround to be applied.\n\nFound by Linux Verification Center (linuxtesting.org) with Svace static\nanalysis tool."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-16T11:13:51.937Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/959c13da6c36167ce1016d400a6104d2367f686e"
},
{
"url": "https://git.kernel.org/stable/c/3b89b4c095804c478d50376285e66700cf3c045f"
},
{
"url": "https://git.kernel.org/stable/c/cc9b6303e7ea91bc360b42c7edc1fe9ceb2f47fe"
},
{
"url": "https://git.kernel.org/stable/c/6c53d68e3bcfc8faccdd76c3383a9232b05c9ae6"
},
{
"url": "https://git.kernel.org/stable/c/000134a20bbf89b1152520a2eef71f91fdb83a5b"
},
{
"url": "https://git.kernel.org/stable/c/3bbbb56204f7359ce2139a9341b43b52a186261c"
},
{
"url": "https://git.kernel.org/stable/c/eb101d2abdcccb514ca4fccd3b278dd8267374f6"
}
],
"title": "wifi: rtw88: check for PCI upstream bridge existence",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46092",
"datePublished": "2026-05-27T12:58:37.088Z",
"dateReserved": "2026-05-13T15:03:33.097Z",
"dateUpdated": "2026-07-16T11:13:51.937Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46242 (GCVE-0-2026-46242)
Vulnerability from cvelistv5
Published
2026-05-30 12:13
Modified
2026-08-05 12:30
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
eventpoll: fix ep_remove struct eventpoll / struct file UAF
ep_remove() (via ep_remove_file()) cleared file->f_ep under
file->f_lock but then kept using @file inside the critical section
(is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).
A concurrent __fput() taking the eventpoll_release() fastpath in
that window observed the transient NULL, skipped
eventpoll_release_file() and ran to f_op->release / file_free().
For the epoll-watches-epoll case, f_op->release is
ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which
kfree()s the watched struct eventpoll. Its embedded ->refs
hlist_head is exactly where epi->fllink.pprev points, so the
subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed
kmalloc-192 memory.
In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot
backing @file could be recycled by alloc_empty_file() --
reinitializing f_lock and f_ep -- while ep_remove() is still
nominally inside that lock. The upshot is an attacker-controllable
kmem_cache_free() against the wrong slab cache.
Pin @file via epi_fget() at the top of ep_remove() and gate the
critical section on the pin succeeding. With the pin held @file
cannot reach refcount zero, which holds __fput() off and
transitively keeps the watched struct eventpoll alive across the
hlist_del_rcu() and the f_lock use, closing both UAFs.
If the pin fails @file has already reached refcount zero and its
__fput() is in flight. Because we bailed before clearing f_ep,
that path takes the eventpoll_release() slow path into
eventpoll_release_file() and blocks on ep->mtx until the waiter
side's ep_clear_and_put() drops it. The bailed epi's share of
ep->refcount stays intact, so the trailing ep_refcount_dec_and_test()
in ep_clear_and_put() cannot free the eventpoll out from under
eventpoll_release_file(); the orphaned epi is then cleaned up
there.
A successful pin also proves we are not racing
eventpoll_release_file() on this epi, so drop the now-redundant
re-check of epi->dying under f_lock. The cheap lockless
READ_ONCE(epi->dying) fast-path bailout stays.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a1f93804449d13f97dabd4b996817de4bf1ed67a Version: 58c9b016e12855286370dfb704c08498edbc857a Version: 58c9b016e12855286370dfb704c08498edbc857a Version: 58c9b016e12855286370dfb704c08498edbc857a Version: 58c9b016e12855286370dfb704c08498edbc857a Version: 58c9b016e12855286370dfb704c08498edbc857a Version: f2451def095c1743adcfcb0cb5dadc86034e162a Version: 6.1.175 ≤ Version: 5.15.209 ≤ |
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-09T00:31:40.940Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/08/14"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/eventpoll.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3e1144d2515d28e4312e663ea05eac203101491d",
"status": "affected",
"version": "a1f93804449d13f97dabd4b996817de4bf1ed67a",
"versionType": "git"
},
{
"lessThan": "2de4db145b2992da496fea6c51f9839be678ae24",
"status": "affected",
"version": "58c9b016e12855286370dfb704c08498edbc857a",
"versionType": "git"
},
{
"lessThan": "9324de74a3a59b9fde9b62ee45ebaa71458ba2e5",
"status": "affected",
"version": "58c9b016e12855286370dfb704c08498edbc857a",
"versionType": "git"
},
{
"lessThan": "ef4ca02e95363e78977ca04340d44fe3b4b2b81f",
"status": "affected",
"version": "58c9b016e12855286370dfb704c08498edbc857a",
"versionType": "git"
},
{
"lessThan": "ced39b6a8062bac5c18a1c3df85634107eb8664a",
"status": "affected",
"version": "58c9b016e12855286370dfb704c08498edbc857a",
"versionType": "git"
},
{
"lessThan": "a6dc643c69311677c574a0f17a3f4d66a5f3744b",
"status": "affected",
"version": "58c9b016e12855286370dfb704c08498edbc857a",
"versionType": "git"
},
{
"status": "affected",
"version": "f2451def095c1743adcfcb0cb5dadc86034e162a",
"versionType": "git"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.209",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/eventpoll.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.175",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.209",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: fix ep_remove struct eventpoll / struct file UAF\n\nep_remove() (via ep_remove_file()) cleared file-\u003ef_ep under\nfile-\u003ef_lock but then kept using @file inside the critical section\n(is_file_epoll(), hlist_del_rcu() through the head, spin_unlock).\nA concurrent __fput() taking the eventpoll_release() fastpath in\nthat window observed the transient NULL, skipped\neventpoll_release_file() and ran to f_op-\u003erelease / file_free().\n\nFor the epoll-watches-epoll case, f_op-\u003erelease is\nep_eventpoll_release() -\u003e ep_clear_and_put() -\u003e ep_free(), which\nkfree()s the watched struct eventpoll. Its embedded -\u003erefs\nhlist_head is exactly where epi-\u003efllink.pprev points, so the\nsubsequent hlist_del_rcu()\u0027s \"*pprev = next\" scribbles into freed\nkmalloc-192 memory.\n\nIn addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot\nbacking @file could be recycled by alloc_empty_file() --\nreinitializing f_lock and f_ep -- while ep_remove() is still\nnominally inside that lock. The upshot is an attacker-controllable\nkmem_cache_free() against the wrong slab cache.\n\nPin @file via epi_fget() at the top of ep_remove() and gate the\ncritical section on the pin succeeding. With the pin held @file\ncannot reach refcount zero, which holds __fput() off and\ntransitively keeps the watched struct eventpoll alive across the\nhlist_del_rcu() and the f_lock use, closing both UAFs.\n\nIf the pin fails @file has already reached refcount zero and its\n__fput() is in flight. Because we bailed before clearing f_ep,\nthat path takes the eventpoll_release() slow path into\neventpoll_release_file() and blocks on ep-\u003emtx until the waiter\nside\u0027s ep_clear_and_put() drops it. The bailed epi\u0027s share of\nep-\u003erefcount stays intact, so the trailing ep_refcount_dec_and_test()\nin ep_clear_and_put() cannot free the eventpoll out from under\neventpoll_release_file(); the orphaned epi is then cleaned up\nthere.\n\nA successful pin also proves we are not racing\neventpoll_release_file() on this epi, so drop the now-redundant\nre-check of epi-\u003edying under f_lock. The cheap lockless\nREAD_ONCE(epi-\u003edying) fast-path bailout stays."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local syscalls (`epoll_create1`, `epoll_ctl`, `close`) on nested epoll fds; there is no network, adjacent-radio, or physical-device path to the buggy `ep_remove`/`eventpoll_release` race.\nAC:L - An unprivileged attacker can drive both sides of the race (e.g., one thread `EPOLL_CTL_DEL` or closing the outer epoll while another closes the inner epoll fd) and retry until the transient `f_ep == NULL` window is hit, consistent with multi-threaded epoll workloads.\nPR:L - No capabilities or root are required; any local UID that may create epoll fds (including inside user namespaces/containers) can register nested epoll and trigger the concurrent remove/close paths.\nUI:N - No victim action is required beyond the attacker running their own concurrent epoll setup and close/DEL operations on the same host.\nS:U - Impact is kernel heap corruption and potential privilege escalation within the same kernel security domain, not a documented cross-boundary escape (e.g., guest-to-host or sandbox breakout).\nC:H - The bug is a use-after-free on `struct eventpoll` and potentially recycled `struct file` objects, which can be turned into arbitrary kernel memory disclosure via heap grooming and UAF reads.\nI:H - Concurrent teardown allows `hlist_del_rcu()` to write `*pprev` into freed kmalloc-192 memory and enables attacker-controllable `kmem_cache_free()` on the wrong cache, supporting arbitrary write/control-flow hijack primitives.\nA:H - The race causes invalid writes to freed memory and slab corruption, which routinely provokes kernel oops/panic or severe instability even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:30:41.557Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3e1144d2515d28e4312e663ea05eac203101491d"
},
{
"url": "https://git.kernel.org/stable/c/2de4db145b2992da496fea6c51f9839be678ae24"
},
{
"url": "https://git.kernel.org/stable/c/9324de74a3a59b9fde9b62ee45ebaa71458ba2e5"
},
{
"url": "https://git.kernel.org/stable/c/ef4ca02e95363e78977ca04340d44fe3b4b2b81f"
},
{
"url": "https://git.kernel.org/stable/c/ced39b6a8062bac5c18a1c3df85634107eb8664a"
},
{
"url": "https://git.kernel.org/stable/c/a6dc643c69311677c574a0f17a3f4d66a5f3744b"
}
],
"title": "eventpoll: fix ep_remove struct eventpoll / struct file UAF",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46242",
"datePublished": "2026-05-30T12:13:45.594Z",
"dateReserved": "2026-05-13T15:03:33.107Z",
"dateUpdated": "2026-08-05T12:30:41.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45884 (GCVE-0-2026-45884)
Vulnerability from cvelistv5
Published
2026-05-27 12:16
Modified
2026-05-27 12:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
apparmor: avoid per-cpu hold underflow in aa_get_buffer
When aa_get_buffer() pulls from the per-cpu list it unconditionally
decrements cache->hold. If hold reaches 0 while count is still non-zero,
the unsigned decrement wraps to UINT_MAX. This keeps hold non-zero for a
very long time, so aa_put_buffer() never returns buffers to the global
list, which can starve other CPUs and force repeated kmalloc(aa_g_path_max)
allocations.
Guard the decrement so hold never underflows.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"security/apparmor/lsm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "202824a1f89a9786c20a3d646a7c88d223abb1b2",
"status": "affected",
"version": "ea9bae12d02819556db63348db8bd8441eb316f2",
"versionType": "git"
},
{
"lessThan": "80c334acc6d0bee8605a358a33e69b4aea1ffb92",
"status": "affected",
"version": "ea9bae12d02819556db63348db8bd8441eb316f2",
"versionType": "git"
},
{
"lessThan": "4bcddd0f6b2e52b4c7b520e4d36a115caf5b7169",
"status": "affected",
"version": "ea9bae12d02819556db63348db8bd8441eb316f2",
"versionType": "git"
},
{
"lessThan": "640cf2f09575c9dc344b3f7be2498d31e3923ead",
"status": "affected",
"version": "ea9bae12d02819556db63348db8bd8441eb316f2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"security/apparmor/lsm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: avoid per-cpu hold underflow in aa_get_buffer\n\nWhen aa_get_buffer() pulls from the per-cpu list it unconditionally\ndecrements cache-\u003ehold. If hold reaches 0 while count is still non-zero,\nthe unsigned decrement wraps to UINT_MAX. This keeps hold non-zero for a\nvery long time, so aa_put_buffer() never returns buffers to the global\nlist, which can starve other CPUs and force repeated kmalloc(aa_g_path_max)\nallocations.\n\nGuard the decrement so hold never underflows."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:16:56.542Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/202824a1f89a9786c20a3d646a7c88d223abb1b2"
},
{
"url": "https://git.kernel.org/stable/c/80c334acc6d0bee8605a358a33e69b4aea1ffb92"
},
{
"url": "https://git.kernel.org/stable/c/4bcddd0f6b2e52b4c7b520e4d36a115caf5b7169"
},
{
"url": "https://git.kernel.org/stable/c/640cf2f09575c9dc344b3f7be2498d31e3923ead"
}
],
"title": "apparmor: avoid per-cpu hold underflow in aa_get_buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45884",
"datePublished": "2026-05-27T12:16:56.542Z",
"dateReserved": "2026-05-13T15:03:33.082Z",
"dateUpdated": "2026-05-27T12:16:56.542Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43473 (GCVE-0-2026-43473)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-05-11 22:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: mpi3mr: Add NULL checks when resetting request and reply queues
The driver encountered a crash during resource cleanup when the reply and
request queues were NULL due to freed memory. This issue occurred when the
creation of reply or request queues failed, and the driver freed the memory
first, but attempted to mem set the content of the freed memory, leading to
a system crash.
Add NULL pointer checks for reply and request queues before accessing the
reply/request memory during cleanup
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fe6db615156573d3f6a37564b8a590cb03bbaf25 Version: fe6db615156573d3f6a37564b8a590cb03bbaf25 Version: fe6db615156573d3f6a37564b8a590cb03bbaf25 Version: fe6db615156573d3f6a37564b8a590cb03bbaf25 Version: fe6db615156573d3f6a37564b8a590cb03bbaf25 Version: fe6db615156573d3f6a37564b8a590cb03bbaf25 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/mpi3mr/mpi3mr_fw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7df0296ad4e9253d12c6dbe7f120044dddc95600",
"status": "affected",
"version": "fe6db615156573d3f6a37564b8a590cb03bbaf25",
"versionType": "git"
},
{
"lessThan": "7da755e0d02e9ca035065127e108d1fed8950dc8",
"status": "affected",
"version": "fe6db615156573d3f6a37564b8a590cb03bbaf25",
"versionType": "git"
},
{
"lessThan": "78d3f201f8b609928eade53cf03a52df5415aaf7",
"status": "affected",
"version": "fe6db615156573d3f6a37564b8a590cb03bbaf25",
"versionType": "git"
},
{
"lessThan": "e978a36f332ede78eb4de037b517db16265d420d",
"status": "affected",
"version": "fe6db615156573d3f6a37564b8a590cb03bbaf25",
"versionType": "git"
},
{
"lessThan": "220d7ca70611a73d50ef8e9edac630ed1ececb7c",
"status": "affected",
"version": "fe6db615156573d3f6a37564b8a590cb03bbaf25",
"versionType": "git"
},
{
"lessThan": "fa96392ebebc8fade2b878acb14cce0f71016503",
"status": "affected",
"version": "fe6db615156573d3f6a37564b8a590cb03bbaf25",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/mpi3mr/mpi3mr_fw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Add NULL checks when resetting request and reply queues\n\nThe driver encountered a crash during resource cleanup when the reply and\nrequest queues were NULL due to freed memory. This issue occurred when the\ncreation of reply or request queues failed, and the driver freed the memory\nfirst, but attempted to mem set the content of the freed memory, leading to\na system crash.\n\nAdd NULL pointer checks for reply and request queues before accessing the\nreply/request memory during cleanup"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:25:17.395Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7df0296ad4e9253d12c6dbe7f120044dddc95600"
},
{
"url": "https://git.kernel.org/stable/c/7da755e0d02e9ca035065127e108d1fed8950dc8"
},
{
"url": "https://git.kernel.org/stable/c/78d3f201f8b609928eade53cf03a52df5415aaf7"
},
{
"url": "https://git.kernel.org/stable/c/e978a36f332ede78eb4de037b517db16265d420d"
},
{
"url": "https://git.kernel.org/stable/c/220d7ca70611a73d50ef8e9edac630ed1ececb7c"
},
{
"url": "https://git.kernel.org/stable/c/fa96392ebebc8fade2b878acb14cce0f71016503"
}
],
"title": "scsi: mpi3mr: Add NULL checks when resetting request and reply queues",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43473",
"datePublished": "2026-05-08T14:22:32.210Z",
"dateReserved": "2026-05-01T14:12:56.011Z",
"dateUpdated": "2026-05-11T22:25:17.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43190 (GCVE-0-2026-43190)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: xt_tcpmss: check remaining length before reading optlen
Quoting reporter:
In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads
op[i+1] directly without validating the remaining option length.
If the last byte of the option field is not EOL/NOP (0/1), the code attempts
to index op[i+1]. In the case where i + 1 == optlen, this causes an
out-of-bounds read, accessing memory past the optlen boundary
(either reading beyond the stack buffer _opt or the
following payload).
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_tcpmss.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f895191dc32c53eaf443b6443fe40945b2f92287",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "cd5beda7e0e32865e214f28034bb92c1cecff885",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "eaedc0bc18be46fe7f58170e967959a932c4f824",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "07a9b32eaae792ff7d0fcac14d8920c937c0a9c3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "8b300f726640c48c3edfe9c453334dd801f4b74e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5e13d0a37666955b6cfddc0f73cb40ed645b8a05",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f6c412dcfd76b0516d51aa847d8f4c7b70381b09",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "735ee8582da3d239eb0c7a53adca61b79fb228b3",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/xt_tcpmss.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_tcpmss: check remaining length before reading optlen\n\nQuoting reporter:\n In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads\n op[i+1] directly without validating the remaining option length.\n\n If the last byte of the option field is not EOL/NOP (0/1), the code attempts\n to index op[i+1]. In the case where i + 1 == optlen, this causes an\n out-of-bounds read, accessing memory past the optlen boundary\n (either reading beyond the stack buffer _opt or the\n following payload)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable match runs in IPv4/IPv6 netfilter packet-processing hooks, so a remote peer can trigger it by sending a crafted TCP packet to or through a system with a tcpmss iptables/nftables-compatible rule installed.\nAC:L - The trigger is a deterministic TCP option layout where the final option byte is neither EOL nor NOP, causing op[i+1] to be read past the remaining option length. The attacker controls the packet contents and no race or external timing condition is required.\nPR:N - The packet sender does not need credentials or local privileges to reach the rule once it is present on a firewall/router/host. Installing rules requires CAP_NET_ADMIN, including via network namespaces, but that is not required for the remote-trigger scenario.\nUI:N - No victim user action is required; packet processing occurs automatically in the kernel receive/forward/output netfilter path.\nS:U - The impact remains within the kernel/network stack security authority on the affected system. There is no VM escape, IOMMU/DMA boundary crossing, or other scope-changing boundary involved.\nC:L - The bug is a bounded one-byte out-of-bounds read beyond the TCP options buffer, potentially into adjacent stack or skb data. Because it is only a single byte and is not a broad arbitrary read primitive, confidentiality impact is Low rather than High.\nI:N - The vulnerable operation only reads op[i+1] and uses it to advance the parser; it does not write to kernel memory or packet data. I found no control-flow or data-integrity primitive from this one-byte read.\nA:H - Malformed packets can repeatedly trigger the out-of-bounds read in softirq/netfilter packet processing. On instrumented or hardened kernels this can produce a KASAN/oops/panic, so availability impact is High under highest-defensible scoring."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:26.497Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f895191dc32c53eaf443b6443fe40945b2f92287"
},
{
"url": "https://git.kernel.org/stable/c/cd5beda7e0e32865e214f28034bb92c1cecff885"
},
{
"url": "https://git.kernel.org/stable/c/eaedc0bc18be46fe7f58170e967959a932c4f824"
},
{
"url": "https://git.kernel.org/stable/c/07a9b32eaae792ff7d0fcac14d8920c937c0a9c3"
},
{
"url": "https://git.kernel.org/stable/c/8b300f726640c48c3edfe9c453334dd801f4b74e"
},
{
"url": "https://git.kernel.org/stable/c/5e13d0a37666955b6cfddc0f73cb40ed645b8a05"
},
{
"url": "https://git.kernel.org/stable/c/f6c412dcfd76b0516d51aa847d8f4c7b70381b09"
},
{
"url": "https://git.kernel.org/stable/c/735ee8582da3d239eb0c7a53adca61b79fb228b3"
}
],
"title": "netfilter: xt_tcpmss: check remaining length before reading optlen",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43190",
"datePublished": "2026-05-06T11:27:59.798Z",
"dateReserved": "2026-05-01T14:12:55.992Z",
"dateUpdated": "2026-08-05T12:26:26.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53167 (GCVE-0-2026-53167)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-07-30 12:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
FUSE_NOTIFY_RETRIEVE must be limited to uptodate folios; !uptodate folios
can contain uninitialized data.
Since FUSE_NOTIFY_RETRIEVE is intended to only return data that is already
in the page cache and not wait for data from the FUSE daemon, treat
!uptodate folios as if they weren't present.
This only has security impact on systems that don't enable automatic
zero-initialization of all page allocations via
CONFIG_INIT_ON_ALLOC_DEFAULT_ON or init_on_alloc=1.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a Version: 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a Version: 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a Version: 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a Version: 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a Version: 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a Version: 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a Version: 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/fuse/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "feafe8ccb1584254f59fbd4946d6ca7ef1e3e99c",
"status": "affected",
"version": "2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a",
"versionType": "git"
},
{
"lessThan": "651801d75ad0897dbd331b3cc6a4da3e78f60d42",
"status": "affected",
"version": "2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a",
"versionType": "git"
},
{
"lessThan": "4e14f29473eda18fb2af082dd2fd4c12139862cd",
"status": "affected",
"version": "2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a",
"versionType": "git"
},
{
"lessThan": "8bef2f840b43e0879478fe3aaa9ff2f0b80798a5",
"status": "affected",
"version": "2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a",
"versionType": "git"
},
{
"lessThan": "68a9282d5ea5b8780d59122505ad633e6daede90",
"status": "affected",
"version": "2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a",
"versionType": "git"
},
{
"lessThan": "56763afa013444a9d84ca1b74e4b7130942177ba",
"status": "affected",
"version": "2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a",
"versionType": "git"
},
{
"lessThan": "1fb8735a3a4d894f8c1f90b741a3ab1d3817f9bd",
"status": "affected",
"version": "2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a",
"versionType": "git"
},
{
"lessThan": "4e3d1b2c48ca6c55f1e9ca7f8dccc76f120f276c",
"status": "affected",
"version": "2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/fuse/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"lessThan": "2.6.36",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios\n\nFUSE_NOTIFY_RETRIEVE must be limited to uptodate folios; !uptodate folios\ncan contain uninitialized data.\nSince FUSE_NOTIFY_RETRIEVE is intended to only return data that is already\nin the page cache and not wait for data from the FUSE daemon, treat\n!uptodate folios as if they weren\u0027t present.\n\nThis only has security impact on systems that don\u0027t enable automatic\nzero-initialization of all page allocations via\nCONFIG_INIT_ON_ALLOC_DEFAULT_ON or init_on_alloc=1."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T12:57:11.720Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/feafe8ccb1584254f59fbd4946d6ca7ef1e3e99c"
},
{
"url": "https://git.kernel.org/stable/c/651801d75ad0897dbd331b3cc6a4da3e78f60d42"
},
{
"url": "https://git.kernel.org/stable/c/4e14f29473eda18fb2af082dd2fd4c12139862cd"
},
{
"url": "https://git.kernel.org/stable/c/8bef2f840b43e0879478fe3aaa9ff2f0b80798a5"
},
{
"url": "https://git.kernel.org/stable/c/68a9282d5ea5b8780d59122505ad633e6daede90"
},
{
"url": "https://git.kernel.org/stable/c/56763afa013444a9d84ca1b74e4b7130942177ba"
},
{
"url": "https://git.kernel.org/stable/c/1fb8735a3a4d894f8c1f90b741a3ab1d3817f9bd"
},
{
"url": "https://git.kernel.org/stable/c/4e3d1b2c48ca6c55f1e9ca7f8dccc76f120f276c"
},
{
"url": "https://project-zero.issues.chromium.org/issues/514653451"
}
],
"title": "fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53167",
"datePublished": "2026-06-25T08:38:46.751Z",
"dateReserved": "2026-06-09T07:44:35.389Z",
"dateUpdated": "2026-07-30T12:57:11.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43018 (GCVE-0-2026-43018)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt
hci_conn lookup and field access must be covered by hdev lock in
hci_le_remote_conn_param_req_evt, otherwise it's possible it is freed
concurrently.
Extend the hci_dev_lock critical section to cover all conn usage.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 95118dd4edfec950898a00180c6f998df0a6406d Version: 95118dd4edfec950898a00180c6f998df0a6406d Version: 95118dd4edfec950898a00180c6f998df0a6406d Version: 95118dd4edfec950898a00180c6f998df0a6406d Version: 95118dd4edfec950898a00180c6f998df0a6406d Version: 95118dd4edfec950898a00180c6f998df0a6406d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "59eecf0ffde15670e6a5e10c47be67f73d843b20",
"status": "affected",
"version": "95118dd4edfec950898a00180c6f998df0a6406d",
"versionType": "git"
},
{
"lessThan": "5fb69e1eeea9d6cba80517e9f058b56b34bc3a81",
"status": "affected",
"version": "95118dd4edfec950898a00180c6f998df0a6406d",
"versionType": "git"
},
{
"lessThan": "7cadb03be37e761130edb153544fe0770a842b19",
"status": "affected",
"version": "95118dd4edfec950898a00180c6f998df0a6406d",
"versionType": "git"
},
{
"lessThan": "1d0bdbfe3e91c11f0a704c52443a9446a10d699c",
"status": "affected",
"version": "95118dd4edfec950898a00180c6f998df0a6406d",
"versionType": "git"
},
{
"lessThan": "ea3cd36d7382d5f8309df04c275d20df139ed42c",
"status": "affected",
"version": "95118dd4edfec950898a00180c6f998df0a6406d",
"versionType": "git"
},
{
"lessThan": "b255531b27da336571411248c2a72a350662bd09",
"status": "affected",
"version": "95118dd4edfec950898a00180c6f998df0a6406d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/hci_event.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt\n\nhci_conn lookup and field access must be covered by hdev lock in\nhci_le_remote_conn_param_req_evt, otherwise it\u0027s possible it is freed\nconcurrently.\n\nExtend the hci_dev_lock critical section to cover all conn usage."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable handler processes an LE Remote Connection Parameter Request generated from Bluetooth LE link-layer traffic, so an attacker must be within Bluetooth radio range. This is adjacent-network reachability rather than IP network or local syscall access.\nAC:L - A nearby attacker can establish or use an LE connection and send connection-parameter requests, with teardown/race timing repeatable and attacker-influenced. There is no rare configuration or condition beyond normal LE controller support for this event.\nPR:N - The path is reached from Bluetooth controller events caused by a remote peer and does not require local OS privileges. The LE connection parameter request is not gated on pairing or authenticated kernel credentials.\nUI:N - In a reasonable BLE deployment where the target is connectable or accepts LE connections, the attacker can trigger the event without victim interaction. No file opening, mounting, or explicit user action is required.\nS:U - The bug is in the host kernel Bluetooth stack and impacts the same kernel security authority. It does not cross a VM, IOMMU, or separate sandbox boundary.\nC:H - This is a kernel use-after-free of an hci_conn object, with stale fields read after the object may have been freed and reused. Conservatively, kernel UAF memory corruption can be leveraged for high-impact information disclosure.\nI:H - A kernel heap UAF can be exploited through object reuse and heap shaping to corrupt data or control flow. Under the required conservative scoring, this supports high integrity impact.\nA:H - Even without full exploitation, dereferencing a freed hci_conn can cause a kernel oops or panic. Repeated adjacent Bluetooth triggering can therefore produce high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:17.496Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/59eecf0ffde15670e6a5e10c47be67f73d843b20"
},
{
"url": "https://git.kernel.org/stable/c/5fb69e1eeea9d6cba80517e9f058b56b34bc3a81"
},
{
"url": "https://git.kernel.org/stable/c/7cadb03be37e761130edb153544fe0770a842b19"
},
{
"url": "https://git.kernel.org/stable/c/1d0bdbfe3e91c11f0a704c52443a9446a10d699c"
},
{
"url": "https://git.kernel.org/stable/c/ea3cd36d7382d5f8309df04c275d20df139ed42c"
},
{
"url": "https://git.kernel.org/stable/c/b255531b27da336571411248c2a72a350662bd09"
}
],
"title": "Bluetooth: hci_event: fix potential UAF in hci_le_remote_conn_param_req_evt",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43018",
"datePublished": "2026-05-01T14:15:22.308Z",
"dateReserved": "2026-05-01T14:12:55.975Z",
"dateUpdated": "2026-08-05T12:25:17.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43437 (GCVE-0-2026-43437)
Vulnerability from cvelistv5
Published
2026-05-08 14:22
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()
In the drain loop, the local variable 'runtime' is reassigned to a
linked stream's runtime (runtime = s->runtime at line 2157). After
releasing the stream lock at line 2169, the code accesses
runtime->no_period_wakeup, runtime->rate, and runtime->buffer_size
(lines 2170-2178) — all referencing the linked stream's runtime without
any lock or refcount protecting its lifetime.
A concurrent close() on the linked stream's fd triggers
snd_pcm_release_substream() → snd_pcm_drop() → pcm_release_private()
→ snd_pcm_unlink() → snd_pcm_detach_substream() → kfree(runtime).
No synchronization prevents kfree(runtime) from completing while the
drain path dereferences the stale pointer.
Fix by caching the needed runtime fields (no_period_wakeup, rate,
buffer_size) into local variables while still holding the stream lock,
and using the cached values after the lock is released.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f2b3614cefb61ee6046a0aaee503ee37f227d310 Version: f2b3614cefb61ee6046a0aaee503ee37f227d310 Version: f2b3614cefb61ee6046a0aaee503ee37f227d310 Version: f2b3614cefb61ee6046a0aaee503ee37f227d310 Version: f2b3614cefb61ee6046a0aaee503ee37f227d310 Version: f2b3614cefb61ee6046a0aaee503ee37f227d310 Version: f2b3614cefb61ee6046a0aaee503ee37f227d310 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/pcm_native.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9baee36e8c5443411c4629afabafaff8a46a23fd",
"status": "affected",
"version": "f2b3614cefb61ee6046a0aaee503ee37f227d310",
"versionType": "git"
},
{
"lessThan": "fc71f888994569f87d5bee20b1ac6c9c1e3a7a79",
"status": "affected",
"version": "f2b3614cefb61ee6046a0aaee503ee37f227d310",
"versionType": "git"
},
{
"lessThan": "629cf09464cf98670996ea5c191dc9743e6f3f00",
"status": "affected",
"version": "f2b3614cefb61ee6046a0aaee503ee37f227d310",
"versionType": "git"
},
{
"lessThan": "ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432",
"status": "affected",
"version": "f2b3614cefb61ee6046a0aaee503ee37f227d310",
"versionType": "git"
},
{
"lessThan": "4a758e9a1f5ed722f83c4dd35f867fe811553bcb",
"status": "affected",
"version": "f2b3614cefb61ee6046a0aaee503ee37f227d310",
"versionType": "git"
},
{
"lessThan": "c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694",
"status": "affected",
"version": "f2b3614cefb61ee6046a0aaee503ee37f227d310",
"versionType": "git"
},
{
"lessThan": "9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6",
"status": "affected",
"version": "f2b3614cefb61ee6046a0aaee503ee37f227d310",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/pcm_native.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()\n\nIn the drain loop, the local variable \u0027runtime\u0027 is reassigned to a\nlinked stream\u0027s runtime (runtime = s-\u003eruntime at line 2157). After\nreleasing the stream lock at line 2169, the code accesses\nruntime-\u003eno_period_wakeup, runtime-\u003erate, and runtime-\u003ebuffer_size\n(lines 2170-2178) \u2014 all referencing the linked stream\u0027s runtime without\nany lock or refcount protecting its lifetime.\n\nA concurrent close() on the linked stream\u0027s fd triggers\nsnd_pcm_release_substream() \u2192 snd_pcm_drop() \u2192 pcm_release_private()\n\u2192 snd_pcm_unlink() \u2192 snd_pcm_detach_substream() \u2192 kfree(runtime).\nNo synchronization prevents kfree(runtime) from completing while the\ndrain path dereferences the stale pointer.\n\nFix by caching the needed runtime fields (no_period_wakeup, rate,\nbuffer_size) into local variables while still holding the stream lock,\nand using the cached values after the lock is released."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through ALSA PCM character-device operations, specifically userspace `ioctl(SNDRV_PCM_IOCTL_DRAIN)` after opening and linking PCM fds. It is not reachable by network packets or adjacent/physical input alone.\nAC:L - The attacker can control both sides of the race by opening linked PCM streams and concurrently issuing drain on one fd while closing the linked fd. The required stream state and timing are attacker-orchestrated local operations.\nPR:L - No kernel capability check gates `SNDRV_PCM_IOCTL_LINK` or `SNDRV_PCM_IOCTL_DRAIN`, but the attacker needs local access to usable ALSA PCM device files. This is basic local user/device access rather than real root/admin privilege.\nUI:N - Exploitation does not require a victim user to open media or perform any action. The attacker can trigger the vulnerable ioctl and concurrent close directly.\nS:U - The affected component is the local kernel ALSA PCM subsystem, and exploitation impacts the same kernel security authority. There is no VM, IOMMU, or other cross-scope boundary involved.\nC:H - This is a kernel heap use-after-free of `struct snd_pcm_runtime`; under the required scoring guidance, UAFs are treated as capable of enabling high-impact information disclosure. Freed runtime contents can be reclaimed or influenced before stale dereferences.\nI:H - Although the immediate stale accesses are runtime field dereferences, this is kernel heap memory corruption involving freed ALSA runtime/waitqueue state. Following the required UAF guidance and higher-severity rule, it is scored as potentially enabling arbitrary write or control-flow corruption.\nA:H - The UAF can dereference freed kernel memory during the drain wait path and can lead to kernel oops, panic, or hang. It is attacker-repeatable from local userspace once PCM device access is available."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:55.761Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9baee36e8c5443411c4629afabafaff8a46a23fd"
},
{
"url": "https://git.kernel.org/stable/c/fc71f888994569f87d5bee20b1ac6c9c1e3a7a79"
},
{
"url": "https://git.kernel.org/stable/c/629cf09464cf98670996ea5c191dc9743e6f3f00"
},
{
"url": "https://git.kernel.org/stable/c/ae8f8d30d334bad5b1b3cdb1eb8a0b771f55e432"
},
{
"url": "https://git.kernel.org/stable/c/4a758e9a1f5ed722f83c4dd35f867fe811553bcb"
},
{
"url": "https://git.kernel.org/stable/c/c2f64e05a0587a83ec42dbd6b7a7ded79b2ff694"
},
{
"url": "https://git.kernel.org/stable/c/9b1dbd69ba6f8f8c69bc7b77c2ce3b9c6ed05ba6"
}
],
"title": "ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43437",
"datePublished": "2026-05-08T14:22:07.314Z",
"dateReserved": "2026-05-01T14:12:56.009Z",
"dateUpdated": "2026-08-05T12:27:55.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53158 (GCVE-0-2026-53158)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-07-04 11:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
A NULL pointer dereference was observed on Hawi at boot when the DSP
sends a glink message before fastrpc_rpmsg_probe() has completed
initialization:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000178
pc : _raw_spin_lock_irqsave+0x34/0x8c
lr : fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc]
...
Call trace:
_raw_spin_lock_irqsave+0x34/0x8c (P)
fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc]
qcom_glink_native_rx+0x538/0x6a4
qcom_glink_smem_intr+0x14/0x24 [qcom_glink_smem]
The faulting address 0x178 corresponds to the lock variable inside
struct fastrpc_channel_ctx, confirming that cctx is NULL when
fastrpc_rpmsg_callback() attempts to take the spinlock.
There are two issues here. First, dev_set_drvdata() is called before
spin_lock_init() and idr_init(), leaving a window where the callback
can retrieve a valid cctx pointer but operate on an uninitialized
spinlock. Second, the rpmsg channel becomes live as soon as the driver
is bound, so fastrpc_rpmsg_callback() can fire before dev_set_drvdata()
is called at all, resulting in dev_get_drvdata() returning NULL.
Fix both issues by moving all cctx initialization ahead of
dev_set_drvdata() so the structure is fully initialized before it
becomes visible to the callback, and add a NULL check in
fastrpc_rpmsg_callback() as a guard against any remaining window.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 Version: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 Version: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 Version: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 Version: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 Version: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 Version: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 Version: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/misc/fastrpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a3d91218ccca1e990bfb737b5a6da23f0afba22b",
"status": "affected",
"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
"versionType": "git"
},
{
"lessThan": "0d8c64511fd45690c5326f013710efcb4f73a97e",
"status": "affected",
"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
"versionType": "git"
},
{
"lessThan": "150bf6f1193c69252580c19d3b3cd631ddce61d7",
"status": "affected",
"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
"versionType": "git"
},
{
"lessThan": "8fb4a23df5b7c02929b62e5dbc270ec7c42b8134",
"status": "affected",
"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
"versionType": "git"
},
{
"lessThan": "4bfdf0a9855df55e9e031ca6a25b855820590c70",
"status": "affected",
"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
"versionType": "git"
},
{
"lessThan": "d5de9cb5355db36438edc621dde3673e3f235767",
"status": "affected",
"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
"versionType": "git"
},
{
"lessThan": "d77583ca33299fede0c194744ef2284e7ba5b763",
"status": "affected",
"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
"versionType": "git"
},
{
"lessThan": "5401fb4fe10fac6134c308495df18ed74aebb9c4",
"status": "affected",
"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/misc/fastrpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: Fix NULL pointer dereference in rpmsg callback\n\nA NULL pointer dereference was observed on Hawi at boot when the DSP\nsends a glink message before fastrpc_rpmsg_probe() has completed\ninitialization:\n\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000178\n pc : _raw_spin_lock_irqsave+0x34/0x8c\n lr : fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc]\n ...\n Call trace:\n _raw_spin_lock_irqsave+0x34/0x8c (P)\n fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc]\n qcom_glink_native_rx+0x538/0x6a4\n qcom_glink_smem_intr+0x14/0x24 [qcom_glink_smem]\n\nThe faulting address 0x178 corresponds to the lock variable inside\nstruct fastrpc_channel_ctx, confirming that cctx is NULL when\nfastrpc_rpmsg_callback() attempts to take the spinlock.\n\nThere are two issues here. First, dev_set_drvdata() is called before\nspin_lock_init() and idr_init(), leaving a window where the callback\ncan retrieve a valid cctx pointer but operate on an uninitialized\nspinlock. Second, the rpmsg channel becomes live as soon as the driver\nis bound, so fastrpc_rpmsg_callback() can fire before dev_set_drvdata()\nis called at all, resulting in dev_get_drvdata() returning NULL.\n\nFix both issues by moving all cctx initialization ahead of\ndev_set_drvdata() so the structure is fully initialized before it\nbecomes visible to the callback, and add a NULL check in\nfastrpc_rpmsg_callback() as a guard against any remaining window."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:50:56.161Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a3d91218ccca1e990bfb737b5a6da23f0afba22b"
},
{
"url": "https://git.kernel.org/stable/c/0d8c64511fd45690c5326f013710efcb4f73a97e"
},
{
"url": "https://git.kernel.org/stable/c/150bf6f1193c69252580c19d3b3cd631ddce61d7"
},
{
"url": "https://git.kernel.org/stable/c/8fb4a23df5b7c02929b62e5dbc270ec7c42b8134"
},
{
"url": "https://git.kernel.org/stable/c/4bfdf0a9855df55e9e031ca6a25b855820590c70"
},
{
"url": "https://git.kernel.org/stable/c/d5de9cb5355db36438edc621dde3673e3f235767"
},
{
"url": "https://git.kernel.org/stable/c/d77583ca33299fede0c194744ef2284e7ba5b763"
},
{
"url": "https://git.kernel.org/stable/c/5401fb4fe10fac6134c308495df18ed74aebb9c4"
}
],
"title": "misc: fastrpc: Fix NULL pointer dereference in rpmsg callback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53158",
"datePublished": "2026-06-25T08:38:40.818Z",
"dateReserved": "2026-06-09T07:44:35.388Z",
"dateUpdated": "2026-07-04T11:50:56.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43383 (GCVE-0-2026-43383)
Vulnerability from cvelistv5
Published
2026-05-08 14:21
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/tcp-md5: Fix MAC comparison to be constant-time
To prevent timing attacks, MACs need to be compared in constant
time. Use the appropriate helper function for this.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: cfb6eeb4c860592edd123fdea908d23c6ad1c7dc Version: cfb6eeb4c860592edd123fdea908d23c6ad1c7dc Version: cfb6eeb4c860592edd123fdea908d23c6ad1c7dc Version: cfb6eeb4c860592edd123fdea908d23c6ad1c7dc Version: cfb6eeb4c860592edd123fdea908d23c6ad1c7dc Version: cfb6eeb4c860592edd123fdea908d23c6ad1c7dc Version: cfb6eeb4c860592edd123fdea908d23c6ad1c7dc Version: cfb6eeb4c860592edd123fdea908d23c6ad1c7dc |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/Kconfig",
"net/ipv4/tcp.c",
"net/ipv4/tcp_ipv4.c",
"net/ipv6/tcp_ipv6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "821c8751fdeecdeecabeb11704dd33439c9e4bbc",
"status": "affected",
"version": "cfb6eeb4c860592edd123fdea908d23c6ad1c7dc",
"versionType": "git"
},
{
"lessThan": "ff44ec94d4fc8348600a69de0a8fa1102c23bce8",
"status": "affected",
"version": "cfb6eeb4c860592edd123fdea908d23c6ad1c7dc",
"versionType": "git"
},
{
"lessThan": "345a9530756528d7ca407663d659c3c40e75c3dd",
"status": "affected",
"version": "cfb6eeb4c860592edd123fdea908d23c6ad1c7dc",
"versionType": "git"
},
{
"lessThan": "5d305a95130a8d08b9545e47f1e18d29d59866cb",
"status": "affected",
"version": "cfb6eeb4c860592edd123fdea908d23c6ad1c7dc",
"versionType": "git"
},
{
"lessThan": "02669e2a4d207068edce7e8b5fafd85822018ce6",
"status": "affected",
"version": "cfb6eeb4c860592edd123fdea908d23c6ad1c7dc",
"versionType": "git"
},
{
"lessThan": "ae3831b44f477de048287493e184fc3ff913b624",
"status": "affected",
"version": "cfb6eeb4c860592edd123fdea908d23c6ad1c7dc",
"versionType": "git"
},
{
"lessThan": "b502e97e29d791ff7a8051f29a414535739be218",
"status": "affected",
"version": "cfb6eeb4c860592edd123fdea908d23c6ad1c7dc",
"versionType": "git"
},
{
"lessThan": "46d0d6f50dab706637f4c18a470aac20a21900d3",
"status": "affected",
"version": "cfb6eeb4c860592edd123fdea908d23c6ad1c7dc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/Kconfig",
"net/ipv4/tcp.c",
"net/ipv4/tcp_ipv4.c",
"net/ipv6/tcp_ipv6.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.20"
},
{
"lessThan": "2.6.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "2.6.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tcp-md5: Fix MAC comparison to be constant-time\n\nTo prevent timing attacks, MACs need to be compared in constant\ntime. Use the appropriate helper function for this."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable comparisons are reached by remotely supplied IPv4/IPv6 TCP packets carrying the TCP MD5 option on TCP-MD5-protected sockets, including Internet-facing BGP deployments.\nAC:L - The attacker can send repeated chosen TCP segments to the verifier and use the non-constant-time comparison as a timing oracle; there is no race or memory-layout dependency beyond the target having TCP MD5 enabled/configured.\nPR:N - The vulnerable receive path is reached before successful TCP MD5 authentication, by unauthenticated network packets; no local account or kernel privilege is required.\nUI:N - No victim user action is required once a TCP-MD5-protected service such as a BGP listener/session is exposed.\nS:U - The impact remains within the same kernel/network security authority enforcing TCP authentication for the protected connection.\nC:L - The timing side channel leaks MAC comparison progress and can enable forgery of authenticated packets, potentially exposing data available through the protected TCP session, but it does not disclose kernel memory or the MD5 key directly.\nI:H - Forging valid TCP MD5 segments can bypass the transport authentication protecting BGP or similar sessions, enabling injection or manipulation of authenticated TCP/application data.\nA:H - Forged authenticated RSTs or disruptive TCP/application traffic can tear down protected routing sessions or otherwise cause significant service disruption."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:41.847Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/821c8751fdeecdeecabeb11704dd33439c9e4bbc"
},
{
"url": "https://git.kernel.org/stable/c/ff44ec94d4fc8348600a69de0a8fa1102c23bce8"
},
{
"url": "https://git.kernel.org/stable/c/345a9530756528d7ca407663d659c3c40e75c3dd"
},
{
"url": "https://git.kernel.org/stable/c/5d305a95130a8d08b9545e47f1e18d29d59866cb"
},
{
"url": "https://git.kernel.org/stable/c/02669e2a4d207068edce7e8b5fafd85822018ce6"
},
{
"url": "https://git.kernel.org/stable/c/ae3831b44f477de048287493e184fc3ff913b624"
},
{
"url": "https://git.kernel.org/stable/c/b502e97e29d791ff7a8051f29a414535739be218"
},
{
"url": "https://git.kernel.org/stable/c/46d0d6f50dab706637f4c18a470aac20a21900d3"
}
],
"title": "net/tcp-md5: Fix MAC comparison to be constant-time",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43383",
"datePublished": "2026-05-08T14:21:30.704Z",
"dateReserved": "2026-05-01T14:12:56.006Z",
"dateUpdated": "2026-08-05T12:27:41.847Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46023 (GCVE-0-2026-46023)
Vulnerability from cvelistv5
Published
2026-05-27 12:56
Modified
2026-06-14 17:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm mirror: fix integer overflow in create_dirty_log()
The argument count calculation in create_dirty_log() performs
`*args_used = 2 + param_count` before validating against argc. When a
user provides a param_count close to UINT_MAX via the device mapper
table string, this unsigned addition wraps around to a small value,
causing the subsequent `argc < *args_used` check to be bypassed.
The overflowed param_count is then passed as argc to dm_dirty_log_create(),
where it can cause out-of-bounds reads on the argv array.
Fix by comparing param_count against argc - 2 before performing the
addition, following the same pattern used by parse_features() in the
same file. Since argc >= 2 is already guaranteed, the subtraction is
safe.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-raid1.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e5e0ae3237584ebef510366c4cb3d5cc7c22b610",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "249c831183fb806c8e3b14c7c4c1d2fb68cf37fb",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ae59b3025609d5a0a39cf5b2b94e2467f6231573",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "35f6b3281efd44d19110574663bc17a610bc73b9",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "47dad9eea75d33212d3d2cea10e7ed6a1bfc0713",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "87c99a50e0fdc68a5b9b52a94d49452cd3ff02ca",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "17a08791d428885d00e510864283a7b839792368",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4c788c6f921b22f9b6c3f316c4a071c05683e7de",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-raid1.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm mirror: fix integer overflow in create_dirty_log()\n\nThe argument count calculation in create_dirty_log() performs\n`*args_used = 2 + param_count` before validating against argc. When a\nuser provides a param_count close to UINT_MAX via the device mapper\ntable string, this unsigned addition wraps around to a small value,\ncausing the subsequent `argc \u003c *args_used` check to be bypassed.\n\nThe overflowed param_count is then passed as argc to dm_dirty_log_create(),\nwhere it can cause out-of-bounds reads on the argv array.\n\nFix by comparing param_count against argc - 2 before performing the\naddition, following the same pattern used by parse_features() in the\nsame file. Since argc \u003e= 2 is already guaranteed, the subtraction is\nsafe."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:48:40.907Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e5e0ae3237584ebef510366c4cb3d5cc7c22b610"
},
{
"url": "https://git.kernel.org/stable/c/249c831183fb806c8e3b14c7c4c1d2fb68cf37fb"
},
{
"url": "https://git.kernel.org/stable/c/ae59b3025609d5a0a39cf5b2b94e2467f6231573"
},
{
"url": "https://git.kernel.org/stable/c/35f6b3281efd44d19110574663bc17a610bc73b9"
},
{
"url": "https://git.kernel.org/stable/c/47dad9eea75d33212d3d2cea10e7ed6a1bfc0713"
},
{
"url": "https://git.kernel.org/stable/c/87c99a50e0fdc68a5b9b52a94d49452cd3ff02ca"
},
{
"url": "https://git.kernel.org/stable/c/17a08791d428885d00e510864283a7b839792368"
},
{
"url": "https://git.kernel.org/stable/c/4c788c6f921b22f9b6c3f316c4a071c05683e7de"
}
],
"title": "dm mirror: fix integer overflow in create_dirty_log()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46023",
"datePublished": "2026-05-27T12:56:28.756Z",
"dateReserved": "2026-05-13T15:03:33.092Z",
"dateUpdated": "2026-06-14T17:48:40.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52953 (GCVE-0-2026-52953)
Vulnerability from cvelistv5
Published
2026-06-24 16:28
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Fix oops due to out of scope access
Below oops triggers when kill QEMU process:
Oops: general protection fault, probably for non-canonical address 0x7fffffff844eaaa7: 0000 [#1] SMP NOPTI
Call Trace:
<TASK>
do_raw_spin_lock+0xaa/0xc0
_raw_spin_lock_irqsave+0x21/0x40
domain_remove_dev_pasid+0x52/0x160
intel_nested_set_dev_pasid+0x1b9/0x1e0
__iommu_set_group_pasid+0x56/0x120
pci_dev_reset_iommu_done+0xe3/0x180
pcie_flr+0x65/0x160
__pci_reset_function_locked+0x5b/0x120
vfio_pci_core_close_device+0x63/0xe0 [vfio_pci_core]
vfio_df_close+0x4f/0xa0
vfio_df_unbind_iommufd+0x2d/0x60
vfio_device_fops_release+0x3e/0x40
__fput+0xe5/0x2c0
task_work_run+0x58/0xa0
do_exit+0x2c8/0x600
do_group_exit+0x2f/0xa0
get_signal+0x863/0x8c0
arch_do_signal_or_restart+0x24/0x100
exit_to_user_mode_loop+0x87/0x380
do_syscall_64+0x2ff/0x11e0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The global static blocked domain is a dummy domain without corresponding
dmar_domain structure, accessing beyond iommu_domain structure triggers
oops easily. Fix it by return early in domain_remove_dev_pasid() like
identity domain.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "88397fad7914ee74a7880fa5ce01f9eb6bfe0743",
"status": "affected",
"version": "7d0c9da6c1509664d96488042bacc02308ca33b2",
"versionType": "git"
},
{
"lessThan": "1e659db468476733d217c1314c1e0d9244356d6c",
"status": "affected",
"version": "7d0c9da6c1509664d96488042bacc02308ca33b2",
"versionType": "git"
},
{
"lessThan": "a6dea58d8625c06b9654c0555f101742481335c3",
"status": "affected",
"version": "7d0c9da6c1509664d96488042bacc02308ca33b2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Fix oops due to out of scope access\n\nBelow oops triggers when kill QEMU process:\n\n Oops: general protection fault, probably for non-canonical address 0x7fffffff844eaaa7: 0000 [#1] SMP NOPTI\n Call Trace:\n \u003cTASK\u003e\n do_raw_spin_lock+0xaa/0xc0\n _raw_spin_lock_irqsave+0x21/0x40\n domain_remove_dev_pasid+0x52/0x160\n intel_nested_set_dev_pasid+0x1b9/0x1e0\n __iommu_set_group_pasid+0x56/0x120\n pci_dev_reset_iommu_done+0xe3/0x180\n pcie_flr+0x65/0x160\n __pci_reset_function_locked+0x5b/0x120\n vfio_pci_core_close_device+0x63/0xe0 [vfio_pci_core]\n vfio_df_close+0x4f/0xa0\n vfio_df_unbind_iommufd+0x2d/0x60\n vfio_device_fops_release+0x3e/0x40\n __fput+0xe5/0x2c0\n task_work_run+0x58/0xa0\n do_exit+0x2c8/0x600\n do_group_exit+0x2f/0xa0\n get_signal+0x863/0x8c0\n arch_do_signal_or_restart+0x24/0x100\n exit_to_user_mode_loop+0x87/0x380\n do_syscall_64+0x2ff/0x11e0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nThe global static blocked domain is a dummy domain without corresponding\ndmar_domain structure, accessing beyond iommu_domain structure triggers\noops easily. Fix it by return early in domain_remove_dev_pasid() like\nidentity domain."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached from local VFIO/iommufd device operations, such as a QEMU process closing or resetting an assigned PCI device with PASID state. It is not reachable by unauthenticated network traffic.\nAC:L - Once an Intel VT-d system with a PASID/ATS-capable VFIO PCI device is available, the trigger is deterministic: attach a PASID domain and close or reset the device. No race or condition outside attacker control is required.\nPR:L - The attacker needs local permission to open and operate the VFIO device and iommufd, but the relevant ioctls do not require real root after device access is granted. This is low privilege rather than unauthenticated access.\nUI:N - The attacker can trigger the bug by their own process closing/exiting or issuing device reset operations. No separate victim action is required.\nS:U - The impact is within the host kernel/IOMMU management context and does not demonstrate an IOMMU bypass or VM escape. Standard local kernel impact remains unchanged scope.\nC:N - The bug is an invalid out-of-object access that oopses in the spinlock path, with no data returned to the attacker. There is no demonstrated information disclosure primitive.\nI:H - The bad cast treats the static blocked domain as a larger Intel dmar_domain and performs spinlock/list-related accesses beyond the real object. This is kernel memory corruption, so under the higher-severity rule integrity impact is High.\nA:H - The commit documents a general protection fault/oops during QEMU teardown. A local attacker with VFIO device access can crash the kernel, causing high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:03.109Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/88397fad7914ee74a7880fa5ce01f9eb6bfe0743"
},
{
"url": "https://git.kernel.org/stable/c/1e659db468476733d217c1314c1e0d9244356d6c"
},
{
"url": "https://git.kernel.org/stable/c/a6dea58d8625c06b9654c0555f101742481335c3"
}
],
"title": "iommu/vt-d: Fix oops due to out of scope access",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52953",
"datePublished": "2026-06-24T16:28:36.110Z",
"dateReserved": "2026-06-09T07:44:35.372Z",
"dateUpdated": "2026-08-05T12:32:03.109Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53143 (GCVE-0-2026-53143)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-08-20 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
The v11 MQD manager incorrectly assigned the CP-compute variants of
checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions
use sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct
v11_sdma_mqd) (512 bytes), causing a 1536-byte overflow.
During CRIU checkpoint of an SDMA queue on Navi3x:
- checkpoint_mqd() reads 2048 bytes from a 512-byte SDMA MQD buffer,
leaking 1536 bytes of adjacent GTT memory to userspace
During CRIU restore:
- restore_mqd() writes 2048 bytes into a 512-byte SDMA MQD buffer,
corrupting 1536 bytes of adjacent GTT memory (often the ring buffer
or neighboring MQDs)
This is a copy-paste regression unique to v11. All other ASIC backends
(cik, vi, v9, v10, v12) correctly use the SDMA-specific variants.
Add checkpoint_mqd_sdma() and restore_mqd_sdma() functions that properly
handle the smaller v11_sdma_mqd structure, matching the pattern used in
other MQD managers.
(cherry picked from commit 6fa41db7ffdec97d62433adf03b7b9b759af8c2c)
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unknown",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u0027s AMD KFD (Kernel Fusion Driver) component. This buffer overflow vulnerability occurs due to incorrect memory buffer handling during CRIU (Checkpoint/Restore in User-space) operations on SDMA (System Direct Memory Access) queues. A local attacker can exploit this flaw during CRIU restore operations, which can lead to memory corruption in adjacent kernel memory, potentially impacting system stability or leading to further compromise. Additionally, during CRIU checkpoint operations, this vulnerability can result in information disclosure of adjacent kernel memory to userspace."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-131",
"description": "Incorrect Calculation of Buffer Size",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T12:32:03.965Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-53143"
},
{
"name": "RHBZ#2492719",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492719"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53143.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:57251"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:57252"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:57251: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:57252: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-25T00:00:00.000Z",
"value": "Made public."
}
],
"title": "kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "16dad1fb0d783a4008de30e32d0038c393de05b1",
"status": "affected",
"version": "cc009e613de6560eb499f8bc92c80a737752cb30",
"versionType": "git"
},
{
"lessThan": "2c5b66c9b4057b385566940935ebc32f6e6ebfd2",
"status": "affected",
"version": "cc009e613de6560eb499f8bc92c80a737752cb30",
"versionType": "git"
},
{
"lessThan": "d3efcadfe3eea5b4263b8f2d4463b15c9fc46a64",
"status": "affected",
"version": "cc009e613de6560eb499f8bc92c80a737752cb30",
"versionType": "git"
},
{
"lessThan": "d02f05d30f35b036f7cbaf72de634affb5b38ec6",
"status": "affected",
"version": "cc009e613de6560eb499f8bc92c80a737752cb30",
"versionType": "git"
},
{
"lessThan": "352ea59028ea48a6fff77f19ae28f98f71946a80",
"status": "affected",
"version": "cc009e613de6560eb499f8bc92c80a737752cb30",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11\n\nThe v11 MQD manager incorrectly assigned the CP-compute variants of\ncheckpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions\nuse sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct\nv11_sdma_mqd) (512 bytes), causing a 1536-byte overflow.\n\nDuring CRIU checkpoint of an SDMA queue on Navi3x:\n- checkpoint_mqd() reads 2048 bytes from a 512-byte SDMA MQD buffer,\n leaking 1536 bytes of adjacent GTT memory to userspace\n\nDuring CRIU restore:\n- restore_mqd() writes 2048 bytes into a 512-byte SDMA MQD buffer,\n corrupting 1536 bytes of adjacent GTT memory (often the ring buffer\n or neighboring MQDs)\n\nThis is a copy-paste regression unique to v11. All other ASIC backends\n(cik, vi, v9, v10, v12) correctly use the SDMA-specific variants.\n\nAdd checkpoint_mqd_sdma() and restore_mqd_sdma() functions that properly\nhandle the smaller v11_sdma_mqd structure, matching the pattern used in\nother MQD managers.\n\n(cherry picked from commit 6fa41db7ffdec97d62433adf03b7b9b759af8c2c)"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:38:30.901Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/16dad1fb0d783a4008de30e32d0038c393de05b1"
},
{
"url": "https://git.kernel.org/stable/c/2c5b66c9b4057b385566940935ebc32f6e6ebfd2"
},
{
"url": "https://git.kernel.org/stable/c/d3efcadfe3eea5b4263b8f2d4463b15c9fc46a64"
},
{
"url": "https://git.kernel.org/stable/c/d02f05d30f35b036f7cbaf72de634affb5b38ec6"
},
{
"url": "https://git.kernel.org/stable/c/352ea59028ea48a6fff77f19ae28f98f71946a80"
}
],
"title": "drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53143",
"datePublished": "2026-06-25T08:38:30.901Z",
"dateReserved": "2026-06-09T07:44:35.387Z",
"dateUpdated": "2026-08-20T12:32:03.965Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45974 (GCVE-0-2026-45974)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-05-27 12:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found
If btrfs_search_slot_for_read() returns 1, it means we did not find any
key greater than or equals to the key we asked for, meaning we have
reached the end of the tree and therefore the path is not valid. If
this happens we need to break out of the loop and stop, instead of
continuing and accessing an invalid path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 Version: 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 Version: 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 Version: 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 Version: 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 Version: 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 Version: 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 Version: 5223cc60b40ae525ae6c94e98824129f1a5b4ae5 Version: ecce1be9f2a366990d0e75dd249fb324e83c34a9 Version: 5.9.7 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/qgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "023545e272f369d487e6a986c1e321c6e04be1da",
"status": "affected",
"version": "5223cc60b40ae525ae6c94e98824129f1a5b4ae5",
"versionType": "git"
},
{
"lessThan": "fd4913a53e3b54ad7e161847291439fe445d6356",
"status": "affected",
"version": "5223cc60b40ae525ae6c94e98824129f1a5b4ae5",
"versionType": "git"
},
{
"lessThan": "b5b8ade9da452086e78f5d519b90d3769e354853",
"status": "affected",
"version": "5223cc60b40ae525ae6c94e98824129f1a5b4ae5",
"versionType": "git"
},
{
"lessThan": "1ee1d006c9fe4d6be5527ab1c84216b80cccbe40",
"status": "affected",
"version": "5223cc60b40ae525ae6c94e98824129f1a5b4ae5",
"versionType": "git"
},
{
"lessThan": "0761447f6f51e1c7997960d8e6559337deed6729",
"status": "affected",
"version": "5223cc60b40ae525ae6c94e98824129f1a5b4ae5",
"versionType": "git"
},
{
"lessThan": "d7cf2314dd5e8661c05d076cd627eea9a7f76616",
"status": "affected",
"version": "5223cc60b40ae525ae6c94e98824129f1a5b4ae5",
"versionType": "git"
},
{
"lessThan": "b2bd557b75b760e4b9d209112bda19314bd64558",
"status": "affected",
"version": "5223cc60b40ae525ae6c94e98824129f1a5b4ae5",
"versionType": "git"
},
{
"lessThan": "ecb7c2484cfc83a93658907580035a8adf1e0a92",
"status": "affected",
"version": "5223cc60b40ae525ae6c94e98824129f1a5b4ae5",
"versionType": "git"
},
{
"status": "affected",
"version": "ecce1be9f2a366990d0e75dd249fb324e83c34a9",
"versionType": "git"
},
{
"lessThan": "5.10",
"status": "affected",
"version": "5.9.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/qgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.9.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found\n\nIf btrfs_search_slot_for_read() returns 1, it means we did not find any\nkey greater than or equals to the key we asked for, meaning we have\nreached the end of the tree and therefore the path is not valid. If\nthis happens we need to break out of the loop and stop, instead of\ncontinuing and accessing an invalid path."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:18:33.107Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/023545e272f369d487e6a986c1e321c6e04be1da"
},
{
"url": "https://git.kernel.org/stable/c/fd4913a53e3b54ad7e161847291439fe445d6356"
},
{
"url": "https://git.kernel.org/stable/c/b5b8ade9da452086e78f5d519b90d3769e354853"
},
{
"url": "https://git.kernel.org/stable/c/1ee1d006c9fe4d6be5527ab1c84216b80cccbe40"
},
{
"url": "https://git.kernel.org/stable/c/0761447f6f51e1c7997960d8e6559337deed6729"
},
{
"url": "https://git.kernel.org/stable/c/d7cf2314dd5e8661c05d076cd627eea9a7f76616"
},
{
"url": "https://git.kernel.org/stable/c/b2bd557b75b760e4b9d209112bda19314bd64558"
},
{
"url": "https://git.kernel.org/stable/c/ecb7c2484cfc83a93658907580035a8adf1e0a92"
}
],
"title": "btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45974",
"datePublished": "2026-05-27T12:18:33.107Z",
"dateReserved": "2026-05-13T15:03:33.090Z",
"dateUpdated": "2026-05-27T12:18:33.107Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43253 (GCVE-0-2026-43253)
Vulnerability from cvelistv5
Published
2026-05-06 11:28
Modified
2026-08-05 12:26
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: move wait_on_sem() out of spinlock
With iommu.strict=1, the existing completion wait path can cause soft
lockups under stressed environment, as wait_on_sem() busy-waits under the
spinlock with interrupts disabled.
Move the completion wait in iommu_completion_wait() out of the spinlock.
wait_on_sem() only polls the hardware-updated cmd_sem and does not require
iommu->lock, so holding the lock during the busy wait unnecessarily
increases contention and extends the time with interrupts disabled.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/amd/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f2f65b28d802a667119147444ec2ae33eebf9a58",
"status": "affected",
"version": "4bf5beef578e46393f11eb69dda7d17a065e05ff",
"versionType": "git"
},
{
"lessThan": "715c263119fd1b918a9fcbd8a36ea5b604a46324",
"status": "affected",
"version": "4bf5beef578e46393f11eb69dda7d17a065e05ff",
"versionType": "git"
},
{
"lessThan": "e15768e68820142077bbca402d8e902f64ade1b0",
"status": "affected",
"version": "4bf5beef578e46393f11eb69dda7d17a065e05ff",
"versionType": "git"
},
{
"lessThan": "496269d12072ecb219826485bdbec70c92a8eef5",
"status": "affected",
"version": "4bf5beef578e46393f11eb69dda7d17a065e05ff",
"versionType": "git"
},
{
"lessThan": "d2a0cac10597068567d336e85fa3cbdbe8ca62bf",
"status": "affected",
"version": "4bf5beef578e46393f11eb69dda7d17a065e05ff",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/amd/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: move wait_on_sem() out of spinlock\n\nWith iommu.strict=1, the existing completion wait path can cause soft\nlockups under stressed environment, as wait_on_sem() busy-waits under the\nspinlock with interrupts disabled.\n\nMove the completion wait in iommu_completion_wait() out of the spinlock.\nwait_on_sem() only polls the hardware-updated cmd_sem and does not require\niommu-\u003elock, so holding the lock during the busy wait unnecessarily\nincreases contention and extends the time with interrupts disabled."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On AMD systems where the IOMMU protects a PCIe NIC, received packets can drive NIC RX cleanup through DMA unmap, IOTLB sync, amd_iommu_iotlb_sync(), iommu_completion_wait(), and wait_on_sem(). A remote peer can generate this traffic without local system access.\nAC:L - Triggering requires sustained IOMMU flush pressure, but the attacker can create that pressure by sending traffic and no uncontrollable race, memory layout, or victim action is needed. The affected AMD IOMMU/translated-DMA deployment is assumed for scoring.\nPR:N - The highest reasonable path is unauthenticated network receive processing on an internet-facing server NIC. No local account, capability, or namespace access is required to cause packet-driven DMA cleanup.\nUI:N - No victim user action is required once the affected system is running and receiving network traffic. The kernel/NIC interrupt and NAPI paths process packets automatically.\nS:U - The issue causes a host-kernel availability failure within the same security authority. It does not bypass IOMMU/DMA isolation, escape a VM, or cross into another security scope.\nC:N - The bug is a busy wait under a spinlock with interrupts disabled while polling a hardware-updated command semaphore. There is no memory corruption, out-of-bounds read, or information disclosure primitive.\nI:N - The vulnerable path does not corrupt memory or provide an attacker-controlled write. It only causes excessive locked/IRQ-disabled waiting during IOMMU command completion.\nA:H - The fix and related reports describe soft lockups/RCU stalls caused by wait_on_sem() spinning while holding the IOMMU lock with interrupts disabled. Repeated triggering can hang or severely stall the kernel, so availability impact is high."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:26:53.719Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f2f65b28d802a667119147444ec2ae33eebf9a58"
},
{
"url": "https://git.kernel.org/stable/c/715c263119fd1b918a9fcbd8a36ea5b604a46324"
},
{
"url": "https://git.kernel.org/stable/c/e15768e68820142077bbca402d8e902f64ade1b0"
},
{
"url": "https://git.kernel.org/stable/c/496269d12072ecb219826485bdbec70c92a8eef5"
},
{
"url": "https://git.kernel.org/stable/c/d2a0cac10597068567d336e85fa3cbdbe8ca62bf"
}
],
"title": "iommu/amd: move wait_on_sem() out of spinlock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43253",
"datePublished": "2026-05-06T11:28:43.160Z",
"dateReserved": "2026-05-01T14:12:55.996Z",
"dateUpdated": "2026-08-05T12:26:53.719Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53168 (GCVE-0-2026-53168)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-06-25 08:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fuse: reject fuse_notify() pagecache ops on directories
The operations FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE allow the
FUSE daemon to actively write/read pagecache contents.
For directories with FOPEN_CACHE_DIR, the pagecache is used as
kernel-internal cache storage, and userspace is not supposed to have
direct access to this cache - in particular, fuse_parse_cache() will hit
WARN_ON() if the cache contains bogus data.
Reject FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE on anything other than
regular files with -EINVAL.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0 Version: 5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0 Version: 5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0 Version: 5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0 Version: 5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0 Version: 5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0 Version: 5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0 Version: 5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/fuse/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "15487f98863dc7156ed43c5be26d478beb82ba35",
"status": "affected",
"version": "5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0",
"versionType": "git"
},
{
"lessThan": "bd23fa0c16c5c86e5b7713224ffbb87d9db81cca",
"status": "affected",
"version": "5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0",
"versionType": "git"
},
{
"lessThan": "9dbf1b2fadfc6c40805631d8a8276d1639fc9ab6",
"status": "affected",
"version": "5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0",
"versionType": "git"
},
{
"lessThan": "dd92773d4d9cea010474eb08a5133c14ff6ab53a",
"status": "affected",
"version": "5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0",
"versionType": "git"
},
{
"lessThan": "99c317d7f8b7bbf3de16d20a01f363e390114cea",
"status": "affected",
"version": "5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0",
"versionType": "git"
},
{
"lessThan": "12df4cfa738aefff21756728e91056d7defb0fe6",
"status": "affected",
"version": "5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0",
"versionType": "git"
},
{
"lessThan": "e692f0cb86204dcdb9dddc0b355407eda6394a67",
"status": "affected",
"version": "5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0",
"versionType": "git"
},
{
"lessThan": "9c954499d43aefac01c5dfb57a82b13d2dcf4b94",
"status": "affected",
"version": "5d7bc7e8680c7ca4c8a4f139ce2a54ccb8131ef0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/fuse/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: reject fuse_notify() pagecache ops on directories\n\nThe operations FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE allow the\nFUSE daemon to actively write/read pagecache contents.\n\nFor directories with FOPEN_CACHE_DIR, the pagecache is used as\nkernel-internal cache storage, and userspace is not supposed to have\ndirect access to this cache - in particular, fuse_parse_cache() will hit\nWARN_ON() if the cache contains bogus data.\n\nReject FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE on anything other than\nregular files with -EINVAL."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:38:47.420Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/15487f98863dc7156ed43c5be26d478beb82ba35"
},
{
"url": "https://git.kernel.org/stable/c/bd23fa0c16c5c86e5b7713224ffbb87d9db81cca"
},
{
"url": "https://git.kernel.org/stable/c/9dbf1b2fadfc6c40805631d8a8276d1639fc9ab6"
},
{
"url": "https://git.kernel.org/stable/c/dd92773d4d9cea010474eb08a5133c14ff6ab53a"
},
{
"url": "https://git.kernel.org/stable/c/99c317d7f8b7bbf3de16d20a01f363e390114cea"
},
{
"url": "https://git.kernel.org/stable/c/12df4cfa738aefff21756728e91056d7defb0fe6"
},
{
"url": "https://git.kernel.org/stable/c/e692f0cb86204dcdb9dddc0b355407eda6394a67"
},
{
"url": "https://git.kernel.org/stable/c/9c954499d43aefac01c5dfb57a82b13d2dcf4b94"
}
],
"title": "fuse: reject fuse_notify() pagecache ops on directories",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53168",
"datePublished": "2026-06-25T08:38:47.420Z",
"dateReserved": "2026-06-09T07:44:35.389Z",
"dateUpdated": "2026-06-25T08:38:47.420Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31779 (GCVE-0-2026-31779)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-08-05 12:25
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()
The memcpy function assumes the dynamic array notif->matches is at least
as large as the number of bytes to copy. Otherwise, results->matches may
contain unwanted data. To guarantee safety, extend the validation in one
of the checks to ensure sufficient packet length.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c Version: 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c Version: 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c Version: 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c Version: 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c Version: 5ac54afd4d97ad8d94fe250c83b1924eb6d2268c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mvm/d3.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f6abac936a0dfd31d6c3e49205ec0ee75a8f887f",
"status": "affected",
"version": "5ac54afd4d97ad8d94fe250c83b1924eb6d2268c",
"versionType": "git"
},
{
"lessThan": "ffbed27ba15ef80d1c622eeedbfef03e501ae134",
"status": "affected",
"version": "5ac54afd4d97ad8d94fe250c83b1924eb6d2268c",
"versionType": "git"
},
{
"lessThan": "e67d8c626ace80b0fa2b48c8ec0a46b508c93442",
"status": "affected",
"version": "5ac54afd4d97ad8d94fe250c83b1924eb6d2268c",
"versionType": "git"
},
{
"lessThan": "dd90880eb5ec5442b37eb2b95688f4a63f4883e3",
"status": "affected",
"version": "5ac54afd4d97ad8d94fe250c83b1924eb6d2268c",
"versionType": "git"
},
{
"lessThan": "ca0e9491b98ca4c5b44204b0b3dd8062a3b5fba2",
"status": "affected",
"version": "5ac54afd4d97ad8d94fe250c83b1924eb6d2268c",
"versionType": "git"
},
{
"lessThan": "744fabc338e87b95c4d1ff7c95bc8c0f834c6d99",
"status": "affected",
"version": "5ac54afd4d97ad8d94fe250c83b1924eb6d2268c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mvm/d3.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()\n\nThe memcpy function assumes the dynamic array notif-\u003ematches is at least\nas large as the number of bytes to copy. Otherwise, results-\u003ematches may\ncontain unwanted data. To guarantee safety, extend the validation in one\nof the checks to ensure sufficient packet length.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable path is in the WiFi WoWLAN/net-detect resume flow, where adjacent wireless activity can cause firmware scan-match notifications. It is not Internet-routable and requires WiFi radio proximity.\nAC:L - Once WoWLAN net-detect is active, causing matching scan results is straightforward for an adjacent attacker with a spoofed AP/beacon. There is no race or timing requirement in the kernel handler itself.\nPR:N - An adjacent wireless attacker does not need local credentials on the target to transmit frames that cause net-detect wake processing. Any local privilege needed to configure WoWLAN is a deployment prerequisite, not attacker privilege in the highest reasonable scenario.\nUI:N - WoWLAN/net-detect processing occurs autonomously while the system is suspended and during resume. The attacker does not need a victim to open a file or perform an application-level action.\nS:U - The bug affects the Linux kernel driver handling its own device/firmware notification data. It does not cross into another security authority such as a VM host boundary.\nC:H - The flaw is an out-of-bounds read from the firmware notification buffer into saved net-detect results and is not limited to only a few bytes. Under the required high-severity rule, this supports high confidentiality impact.\nI:N - The vulnerable operation is a read and bounded copy into an appropriately sized destination buffer. I found no out-of-bounds write or direct primitive for modifying kernel data.\nA:H - The copied unintended bytes are later interpreted as match/channel metadata and can drive invalid kernel accesses while reporting net-detect results. A malformed notification can therefore plausibly cause an oops or kernel crash."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:07.828Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f6abac936a0dfd31d6c3e49205ec0ee75a8f887f"
},
{
"url": "https://git.kernel.org/stable/c/ffbed27ba15ef80d1c622eeedbfef03e501ae134"
},
{
"url": "https://git.kernel.org/stable/c/e67d8c626ace80b0fa2b48c8ec0a46b508c93442"
},
{
"url": "https://git.kernel.org/stable/c/dd90880eb5ec5442b37eb2b95688f4a63f4883e3"
},
{
"url": "https://git.kernel.org/stable/c/ca0e9491b98ca4c5b44204b0b3dd8062a3b5fba2"
},
{
"url": "https://git.kernel.org/stable/c/744fabc338e87b95c4d1ff7c95bc8c0f834c6d99"
}
],
"title": "wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31779",
"datePublished": "2026-05-01T14:15:06.506Z",
"dateReserved": "2026-03-09T15:48:24.140Z",
"dateUpdated": "2026-08-05T12:25:07.828Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46006 (GCVE-0-2026-46006)
Vulnerability from cvelistv5
Published
2026-05-27 12:56
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check
nouveau_gem_pushbuf_reloc_apply() validates each relocation with
if (r->reloc_bo_offset + 4 > nvbo->bo.base.size)
but reloc_bo_offset is __u32 (uapi/drm/nouveau_drm.h) and the integer
literal 4 promotes to unsigned int, so the addition is performed in 32
bits and wraps before the comparison against the size_t bo size.
Cast to u64 so the addition happens in 64-bit arithmetic.
[ Add Fixes: tag. - Danilo ]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a1606a9596e54da90ad6209071b357a4c1b0fa82 Version: a1606a9596e54da90ad6209071b357a4c1b0fa82 Version: a1606a9596e54da90ad6209071b357a4c1b0fa82 Version: a1606a9596e54da90ad6209071b357a4c1b0fa82 Version: a1606a9596e54da90ad6209071b357a4c1b0fa82 Version: a1606a9596e54da90ad6209071b357a4c1b0fa82 Version: a1606a9596e54da90ad6209071b357a4c1b0fa82 Version: a1606a9596e54da90ad6209071b357a4c1b0fa82 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/nouveau/nouveau_gem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3429275684f4bad42876955301f3c5c814aae909",
"status": "affected",
"version": "a1606a9596e54da90ad6209071b357a4c1b0fa82",
"versionType": "git"
},
{
"lessThan": "573a1104bd36e49c067a9dc62e7c476d5ee7e92a",
"status": "affected",
"version": "a1606a9596e54da90ad6209071b357a4c1b0fa82",
"versionType": "git"
},
{
"lessThan": "45a45184b9c0b0b26ead06e370cda2073616a7cc",
"status": "affected",
"version": "a1606a9596e54da90ad6209071b357a4c1b0fa82",
"versionType": "git"
},
{
"lessThan": "fa297e919d1680c38ab268ff952b1698dac987f6",
"status": "affected",
"version": "a1606a9596e54da90ad6209071b357a4c1b0fa82",
"versionType": "git"
},
{
"lessThan": "d749a9a0ee4014681487e7ae549901aa8c176637",
"status": "affected",
"version": "a1606a9596e54da90ad6209071b357a4c1b0fa82",
"versionType": "git"
},
{
"lessThan": "332884f5eb79dd60a7162b079d09d39208567a31",
"status": "affected",
"version": "a1606a9596e54da90ad6209071b357a4c1b0fa82",
"versionType": "git"
},
{
"lessThan": "e441d5c23ec644c8d27593db3b8928e8933512a9",
"status": "affected",
"version": "a1606a9596e54da90ad6209071b357a4c1b0fa82",
"versionType": "git"
},
{
"lessThan": "2fc87d37be1b730a149b035f9375fdb8cc5333a5",
"status": "affected",
"version": "a1606a9596e54da90ad6209071b357a4c1b0fa82",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/nouveau/nouveau_gem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.34"
},
{
"lessThan": "2.6.34",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "2.6.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.34",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: fix u32 overflow in pushbuf reloc bounds check\n\nnouveau_gem_pushbuf_reloc_apply() validates each relocation with\n\n if (r-\u003ereloc_bo_offset + 4 \u003e nvbo-\u003ebo.base.size)\n\nbut reloc_bo_offset is __u32 (uapi/drm/nouveau_drm.h) and the integer\nliteral 4 promotes to unsigned int, so the addition is performed in 32\nbits and wraps before the comparison against the size_t bo size.\n\nCast to u64 so the addition happens in 64-bit arithmetic.\n\n[ Add Fixes: tag. - Danilo ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached through the DRM_IOCTL_NOUVEAU_GEM_PUSHBUF ioctl on the local GPU device/render node; it requires local system access, not network or adjacent reachability.\nAC:L - The attacker fully controls the relocation array (reloc_bo_offset, data, presumed fields) and can deterministically set reloc_bo_offset to 0xFFFFFFFC to wrap the check and force the write; there is no race or uncontrolled condition.\nPR:L - NOUVEAU_GEM_PUSHBUF is marked DRM_RENDER_ALLOW, so it is accessible to any unprivileged local user holding the render node (no root or DRM master required).\nUI:N - The attacking process issues the ioctl itself; no action by another user or victim is needed.\nS:U - The out-of-bounds write corrupts kernel memory within the kernel\u0027s own security authority and does not cross a VM/IOMMU/sandbox boundary.\nC:H - A controlled out-of-bounds kernel write of this kind is a memory-corruption primitive that can be leveraged to corrupt adjacent structures and ultimately disclose kernel memory.\nI:H - The flaw yields an out-of-bounds write of a largely attacker-controlled 32-bit value into kernel address space, an arbitrary-write-class primitive enabling control-flow/data corruption.\nA:H - The wild write at a fixed ~4 GB offset beyond the buffer mapping almost always hits unmapped/foreign memory, causing a kernel oops or panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:06.114Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3429275684f4bad42876955301f3c5c814aae909"
},
{
"url": "https://git.kernel.org/stable/c/573a1104bd36e49c067a9dc62e7c476d5ee7e92a"
},
{
"url": "https://git.kernel.org/stable/c/45a45184b9c0b0b26ead06e370cda2073616a7cc"
},
{
"url": "https://git.kernel.org/stable/c/fa297e919d1680c38ab268ff952b1698dac987f6"
},
{
"url": "https://git.kernel.org/stable/c/d749a9a0ee4014681487e7ae549901aa8c176637"
},
{
"url": "https://git.kernel.org/stable/c/332884f5eb79dd60a7162b079d09d39208567a31"
},
{
"url": "https://git.kernel.org/stable/c/e441d5c23ec644c8d27593db3b8928e8933512a9"
},
{
"url": "https://git.kernel.org/stable/c/2fc87d37be1b730a149b035f9375fdb8cc5333a5"
}
],
"title": "drm/nouveau: fix u32 overflow in pushbuf reloc bounds check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46006",
"datePublished": "2026-05-27T12:56:05.273Z",
"dateReserved": "2026-05-13T15:03:33.092Z",
"dateUpdated": "2026-08-05T12:29:06.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31687 (GCVE-0-2026-31687)
Vulnerability from cvelistv5
Published
2026-04-27 17:32
Modified
2026-05-23 16:05
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpio: omap: do not register driver in probe()
Commit 11a78b794496 ("ARM: OMAP: MPUIO wake updates") registers the
omap_mpuio_driver from omap_mpuio_init(), which is called from
omap_gpio_probe().
However, it neither makes sense to register drivers from probe()
callbacks of other drivers, nor does the driver core allow registering
drivers with a device lock already being held.
The latter was revealed by commit dc23806a7c47 ("driver core: enforce
device_lock for driver_match_device()") leading to a potential deadlock
condition described in [1].
Additionally, the omap_mpuio_driver is never unregistered from the
driver core, even if the module is unloaded.
Hence, register the omap_mpuio_driver from the module initcall and
unregister it in module_exit().
References
| URL | Tags | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 11a78b7944963a8b052be46108d07a3ced9e2762 Version: 11a78b7944963a8b052be46108d07a3ced9e2762 Version: 11a78b7944963a8b052be46108d07a3ced9e2762 Version: 11a78b7944963a8b052be46108d07a3ced9e2762 Version: adc1796eced46b48e23ec200a219d635f33a38ee Version: 11a78b7944963a8b052be46108d07a3ced9e2762 Version: cd0e0a76e40c2e77bcfc88291d00dca22b00158e Version: 11a78b7944963a8b052be46108d07a3ced9e2762 Version: 8d76b2488eb3cc0717ab81b60622cff4a5f90f79 Version: 11a78b7944963a8b052be46108d07a3ced9e2762 Version: bc82e5f4d7dc8237ae8cabc73aa46fc93c85d98c Version: 6.6.125 ≤ Version: 6.12.72 ≤ Version: 6.18.11 ≤ Version: 6.19.1 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-omap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "57bcd3feffa79544c73a1a1872472389a391cc79",
"status": "affected",
"version": "11a78b7944963a8b052be46108d07a3ced9e2762",
"versionType": "git"
},
{
"lessThan": "86588916e1887a5edb8a9161cd7ae81e47a7ed25",
"status": "affected",
"version": "11a78b7944963a8b052be46108d07a3ced9e2762",
"versionType": "git"
},
{
"lessThan": "a29215961d833f4de33a09c3964d31ebc6083033",
"status": "affected",
"version": "11a78b7944963a8b052be46108d07a3ced9e2762",
"versionType": "git"
},
{
"lessThan": "1c04c3a4de8d4bcb9202f94c44f26c57c2572308",
"status": "affected",
"version": "11a78b7944963a8b052be46108d07a3ced9e2762",
"versionType": "git"
},
{
"lessThan": "673dafb9a86349a12a93151fd467625614dc7e12",
"status": "affected",
"version": "adc1796eced46b48e23ec200a219d635f33a38ee",
"versionType": "git"
},
{
"lessThan": "2211d77892913804d16c28c7415b82804ab1e54c",
"status": "affected",
"version": "11a78b7944963a8b052be46108d07a3ced9e2762",
"versionType": "git"
},
{
"lessThan": "a7fa9460b86f810913b6779461d0448e7c11214c",
"status": "affected",
"version": "cd0e0a76e40c2e77bcfc88291d00dca22b00158e",
"versionType": "git"
},
{
"lessThan": "32f08c3ddd6dda6cbb6c9d715de10f21dccde50f",
"status": "affected",
"version": "11a78b7944963a8b052be46108d07a3ced9e2762",
"versionType": "git"
},
{
"lessThan": "53a76425e0764421ba93bb9045d2e454667d5687",
"status": "affected",
"version": "8d76b2488eb3cc0717ab81b60622cff4a5f90f79",
"versionType": "git"
},
{
"lessThan": "730e5ebff40c852e3ea57b71bf02a4b89c69435f",
"status": "affected",
"version": "11a78b7944963a8b052be46108d07a3ced9e2762",
"versionType": "git"
},
{
"lessThan": "03db4dc9ad6eb91e640b517e00373ce877682854",
"status": "affected",
"version": "bc82e5f4d7dc8237ae8cabc73aa46fc93c85d98c",
"versionType": "git"
},
{
"lessThan": "6.6.126",
"status": "affected",
"version": "6.6.125",
"versionType": "semver"
},
{
"lessThan": "6.12.73",
"status": "affected",
"version": "6.12.72",
"versionType": "semver"
},
{
"lessThan": "6.18.12",
"status": "affected",
"version": "6.18.11",
"versionType": "semver"
},
{
"lessThan": "6.19.2",
"status": "affected",
"version": "6.19.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-omap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.22"
},
{
"lessThan": "2.6.22",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.251",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.201",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.164",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.125",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.126",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.72",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.73",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.251",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.201",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.164",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.125",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.126",
"versionStartIncluding": "6.6.125",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.72",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.73",
"versionStartIncluding": "6.12.72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.11",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.12",
"versionStartIncluding": "6.18.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.2",
"versionStartIncluding": "6.19.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: omap: do not register driver in probe()\n\nCommit 11a78b794496 (\"ARM: OMAP: MPUIO wake updates\") registers the\nomap_mpuio_driver from omap_mpuio_init(), which is called from\nomap_gpio_probe().\n\nHowever, it neither makes sense to register drivers from probe()\ncallbacks of other drivers, nor does the driver core allow registering\ndrivers with a device lock already being held.\n\nThe latter was revealed by commit dc23806a7c47 (\"driver core: enforce\ndevice_lock for driver_match_device()\") leading to a potential deadlock\ncondition described in [1].\n\nAdditionally, the omap_mpuio_driver is never unregistered from the\ndriver core, even if the module is unloaded.\n\nHence, register the omap_mpuio_driver from the module initcall and\nunregister it in module_exit()."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-23T16:05:41.824Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/57bcd3feffa79544c73a1a1872472389a391cc79"
},
{
"url": "https://git.kernel.org/stable/c/86588916e1887a5edb8a9161cd7ae81e47a7ed25"
},
{
"url": "https://git.kernel.org/stable/c/a29215961d833f4de33a09c3964d31ebc6083033"
},
{
"url": "https://git.kernel.org/stable/c/1c04c3a4de8d4bcb9202f94c44f26c57c2572308"
},
{
"url": "https://git.kernel.org/stable/c/673dafb9a86349a12a93151fd467625614dc7e12"
},
{
"url": "https://git.kernel.org/stable/c/2211d77892913804d16c28c7415b82804ab1e54c"
},
{
"url": "https://git.kernel.org/stable/c/a7fa9460b86f810913b6779461d0448e7c11214c"
},
{
"url": "https://git.kernel.org/stable/c/32f08c3ddd6dda6cbb6c9d715de10f21dccde50f"
},
{
"url": "https://git.kernel.org/stable/c/53a76425e0764421ba93bb9045d2e454667d5687"
},
{
"url": "https://git.kernel.org/stable/c/730e5ebff40c852e3ea57b71bf02a4b89c69435f"
},
{
"url": "https://git.kernel.org/stable/c/03db4dc9ad6eb91e640b517e00373ce877682854"
}
],
"title": "gpio: omap: do not register driver in probe()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31687",
"datePublished": "2026-04-27T17:32:37.227Z",
"dateReserved": "2026-03-09T15:48:24.131Z",
"dateUpdated": "2026-05-23T16:05:41.824Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31752 (GCVE-0-2026-31752)
Vulnerability from cvelistv5
Published
2026-05-01 14:14
Modified
2026-07-14 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bridge: br_nd_send: validate ND option lengths
br_nd_send() walks ND options according to option-provided lengths.
A malformed option can make the parser advance beyond the computed
option span or use a too-short source LLADDR option payload.
Validate option lengths against the remaining NS option area before
advancing, and only read source LLADDR when the option is large enough
for an Ethernet address.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ed842faeb2bd49256f00485402f3113205f91d30 Version: ed842faeb2bd49256f00485402f3113205f91d30 Version: ed842faeb2bd49256f00485402f3113205f91d30 Version: ed842faeb2bd49256f00485402f3113205f91d30 Version: ed842faeb2bd49256f00485402f3113205f91d30 Version: ed842faeb2bd49256f00485402f3113205f91d30 Version: ed842faeb2bd49256f00485402f3113205f91d30 Version: ed842faeb2bd49256f00485402f3113205f91d30 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:44.874Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/br_arp_nd_proxy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "82a42eceec7c6bdb0e0da94c0542a173b7ea57f2",
"status": "affected",
"version": "ed842faeb2bd49256f00485402f3113205f91d30",
"versionType": "git"
},
{
"lessThan": "259466f76f5a2148aff11134e68f4b4c6d52725b",
"status": "affected",
"version": "ed842faeb2bd49256f00485402f3113205f91d30",
"versionType": "git"
},
{
"lessThan": "ee02d8991fd7bd86ed6ebd0deb4aab53feb0e43a",
"status": "affected",
"version": "ed842faeb2bd49256f00485402f3113205f91d30",
"versionType": "git"
},
{
"lessThan": "e0bfd6d4dc77ab345b6c65eef0cfe9b2f69085aa",
"status": "affected",
"version": "ed842faeb2bd49256f00485402f3113205f91d30",
"versionType": "git"
},
{
"lessThan": "c49b9256bbacb6a135654aebd12e4c0e87166b7c",
"status": "affected",
"version": "ed842faeb2bd49256f00485402f3113205f91d30",
"versionType": "git"
},
{
"lessThan": "837392a38445729c22e03d3abcf33f07763efd85",
"status": "affected",
"version": "ed842faeb2bd49256f00485402f3113205f91d30",
"versionType": "git"
},
{
"lessThan": "e71303a9190496136e240c4f2872b7b0b16027a7",
"status": "affected",
"version": "ed842faeb2bd49256f00485402f3113205f91d30",
"versionType": "git"
},
{
"lessThan": "850837965af15707fd3142c1cf3c5bfaf022299b",
"status": "affected",
"version": "ed842faeb2bd49256f00485402f3113205f91d30",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/br_arp_nd_proxy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: br_nd_send: validate ND option lengths\n\nbr_nd_send() walks ND options according to option-provided lengths.\nA malformed option can make the parser advance beyond the computed\noption span or use a too-short source LLADDR option payload.\n\nValidate option lengths against the remaining NS option area before\nadvancing, and only read source LLADDR when the option is large enough\nfor an Ethernet address."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:15:07.575Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/82a42eceec7c6bdb0e0da94c0542a173b7ea57f2"
},
{
"url": "https://git.kernel.org/stable/c/259466f76f5a2148aff11134e68f4b4c6d52725b"
},
{
"url": "https://git.kernel.org/stable/c/ee02d8991fd7bd86ed6ebd0deb4aab53feb0e43a"
},
{
"url": "https://git.kernel.org/stable/c/e0bfd6d4dc77ab345b6c65eef0cfe9b2f69085aa"
},
{
"url": "https://git.kernel.org/stable/c/c49b9256bbacb6a135654aebd12e4c0e87166b7c"
},
{
"url": "https://git.kernel.org/stable/c/837392a38445729c22e03d3abcf33f07763efd85"
},
{
"url": "https://git.kernel.org/stable/c/e71303a9190496136e240c4f2872b7b0b16027a7"
},
{
"url": "https://git.kernel.org/stable/c/850837965af15707fd3142c1cf3c5bfaf022299b"
}
],
"title": "bridge: br_nd_send: validate ND option lengths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31752",
"datePublished": "2026-05-01T14:14:44.298Z",
"dateReserved": "2026-03-09T15:48:24.139Z",
"dateUpdated": "2026-07-14T12:48:44.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43339 (GCVE-0-2026-43339)
Vulnerability from cvelistv5
Published
2026-05-08 13:31
Modified
2026-08-05 12:27
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: prevent possible UaF in addrconf_permanent_addr()
The mentioned helper try to warn the user about an exceptional
condition, but the message is delivered too late, accessing the ipv6
after its possible deletion.
Reorder the statement to avoid the possible UaF; while at it, place the
warning outside the idev->lock as it needs no protection.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac Version: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac Version: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac Version: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac Version: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac Version: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac Version: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac Version: f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/addrconf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "eec49a33611f20336b357b3953df44f1a02049e8",
"status": "affected",
"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
"versionType": "git"
},
{
"lessThan": "bacc7f31085c9820922f00bc7d79756ffa13123a",
"status": "affected",
"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
"versionType": "git"
},
{
"lessThan": "7bfafa1b0cd582983ebec6bb20f0a435528fe567",
"status": "affected",
"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
"versionType": "git"
},
{
"lessThan": "7d9f2f4aabd116ca68fbdab5d8fb8dac74c2ea1e",
"status": "affected",
"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
"versionType": "git"
},
{
"lessThan": "25357b670afb5b517096da783abaa5cc4bf8359e",
"status": "affected",
"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
"versionType": "git"
},
{
"lessThan": "3cd4efb5df72843dfac892d0b3c7a4a8bd926b65",
"status": "affected",
"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
"versionType": "git"
},
{
"lessThan": "2d88ed7fa000e19c2dc0fa31b3a849e3f5bca5c1",
"status": "affected",
"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
"versionType": "git"
},
{
"lessThan": "fd63f185979b047fb22a0dfc6bd94d0cab6a6a70",
"status": "affected",
"version": "f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/addrconf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent possible UaF in addrconf_permanent_addr()\n\nThe mentioned helper try to warn the user about an exceptional\ncondition, but the message is delivered too late, accessing the ipv6\nafter its possible deletion.\n\nReorder the statement to avoid the possible UaF; while at it, place the\nwarning outside the idev-\u003elock as it needs no protection."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached through local network administration actions such as rtnetlink/sysctl-driven IPv6 address configuration and interface down/up transitions, not by remote packets.\nAC:L - A local attacker who can administer a network namespace can create the retained permanent-address state and repeatedly drive link-up restoration while inducing allocation pressure; there is no victim-controlled race required.\nPR:L - The operations require CAP_NET_ADMIN, but they are checked in the target network namespace and are reachable to an unprivileged local user via user+network namespaces on systems where those are enabled.\nUI:N - No victim user action is needed once the attacker can issue the local namespace/network configuration operations.\nS:U - The impact is within the kernel security authority; this is standard local kernel memory-safety impact rather than a cross-scope boundary such as guest-to-host escape.\nC:H - The bug dereferences a freed inet6_ifaddr and can read freed or reallocated kernel heap contents in the warning path; per the requested UAF guidance, confidentiality is High.\nI:H - Although the immediate dereference is in logging, it is a kernel heap use-after-free and the requested kernel guidance treats UAFs as potentially exploitable through heap reuse/spraying for high integrity impact.\nA:H - The freed object access can trigger a kernel fault, UAF detector report, or crash, and the local trigger can be repeated."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:27:20.671Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/eec49a33611f20336b357b3953df44f1a02049e8"
},
{
"url": "https://git.kernel.org/stable/c/bacc7f31085c9820922f00bc7d79756ffa13123a"
},
{
"url": "https://git.kernel.org/stable/c/7bfafa1b0cd582983ebec6bb20f0a435528fe567"
},
{
"url": "https://git.kernel.org/stable/c/7d9f2f4aabd116ca68fbdab5d8fb8dac74c2ea1e"
},
{
"url": "https://git.kernel.org/stable/c/25357b670afb5b517096da783abaa5cc4bf8359e"
},
{
"url": "https://git.kernel.org/stable/c/3cd4efb5df72843dfac892d0b3c7a4a8bd926b65"
},
{
"url": "https://git.kernel.org/stable/c/2d88ed7fa000e19c2dc0fa31b3a849e3f5bca5c1"
},
{
"url": "https://git.kernel.org/stable/c/fd63f185979b047fb22a0dfc6bd94d0cab6a6a70"
}
],
"title": "ipv6: prevent possible UaF in addrconf_permanent_addr()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43339",
"datePublished": "2026-05-08T13:31:24.315Z",
"dateReserved": "2026-05-01T14:12:56.003Z",
"dateUpdated": "2026-08-05T12:27:20.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46059 (GCVE-0-2026-46059)
Vulnerability from cvelistv5
Published
2026-05-27 12:57
Modified
2026-06-14 17:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN
For guests with NRIPS disabled, L1 does not provide NextRIP when running
an L2 with an injected soft interrupt, instead it advances the current RIP
before running it. KVM uses the current RIP as the NextRIP in vmcb02 to
emulate a CPU without NRIPS.
However, after L2 runs the first time, NextRIP will be updated by the CPU
and/or KVM, and the current RIP is no longer the correct value to use in
vmcb02. Hence, after save/restore, use the current RIP if and only if a
nested run is pending, otherwise use NextRIP. Give soft_int_next_rip the
same treatment, as it's the same logic, just for a narrower use case.
[sean: give soft_int_next_rip the same treatment]
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3428ed1529a1af4cce5aff6c5bd2fcc39ad726bb",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
},
{
"lessThan": "69fe1411a5ce678b4da6489b5d2282b4e1d13acf",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
},
{
"lessThan": "8d397582f6b5e9fbcf09781c7c934b4910e94a50",
"status": "affected",
"version": "cc440cdad5b7a4c1de12dace725209eb3e0cf663",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/svm/nested.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Always use NextRIP as vmcb02\u0027s NextRIP after first L2 VMRUN\n\nFor guests with NRIPS disabled, L1 does not provide NextRIP when running\nan L2 with an injected soft interrupt, instead it advances the current RIP\nbefore running it. KVM uses the current RIP as the NextRIP in vmcb02 to\nemulate a CPU without NRIPS.\n\nHowever, after L2 runs the first time, NextRIP will be updated by the CPU\nand/or KVM, and the current RIP is no longer the correct value to use in\nvmcb02. Hence, after save/restore, use the current RIP if and only if a\nnested run is pending, otherwise use NextRIP. Give soft_int_next_rip the\nsame treatment, as it\u0027s the same logic, just for a narrower use case.\n\n[sean: give soft_int_next_rip the same treatment]"
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:51:19.172Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3428ed1529a1af4cce5aff6c5bd2fcc39ad726bb"
},
{
"url": "https://git.kernel.org/stable/c/69fe1411a5ce678b4da6489b5d2282b4e1d13acf"
},
{
"url": "https://git.kernel.org/stable/c/8d397582f6b5e9fbcf09781c7c934b4910e94a50"
}
],
"title": "KVM: nSVM: Always use NextRIP as vmcb02\u0027s NextRIP after first L2 VMRUN",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46059",
"datePublished": "2026-05-27T12:57:19.928Z",
"dateReserved": "2026-05-13T15:03:33.095Z",
"dateUpdated": "2026-06-14T17:51:19.172Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43036 (GCVE-0-2026-43036)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-05-11 22:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: use skb_header_pointer() for TCPv4 GSO frag_off check
Syzbot reported a KMSAN uninit-value warning in gso_features_check()
called from netif_skb_features() [1].
gso_features_check() reads iph->frag_off to decide whether to clear
mangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr()
can rely on skb header offsets that are not always safe for direct
dereference on packets injected from PF_PACKET paths.
Use skb_header_pointer() for the TCPv4 frag_off check so the header read
is robust whether data is already linear or needs copying.
[1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f7a6cd508e9e825a2c69fa9e13d41ee156852f25",
"status": "affected",
"version": "cbc53e08a793b073e79f42ca33f1f3568703540d",
"versionType": "git"
},
{
"lessThan": "cc91202fc20a44aab4c206f12a2bfe05da936051",
"status": "affected",
"version": "cbc53e08a793b073e79f42ca33f1f3568703540d",
"versionType": "git"
},
{
"lessThan": "d970341cfa5594614c7a6634886c7688b4f5cafd",
"status": "affected",
"version": "cbc53e08a793b073e79f42ca33f1f3568703540d",
"versionType": "git"
},
{
"lessThan": "ddc748a391dd8642ba6b2e4fe22e7f2ddf84b7f0",
"status": "affected",
"version": "cbc53e08a793b073e79f42ca33f1f3568703540d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"lessThan": "4.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: use skb_header_pointer() for TCPv4 GSO frag_off check\n\nSyzbot reported a KMSAN uninit-value warning in gso_features_check()\ncalled from netif_skb_features() [1].\n\ngso_features_check() reads iph-\u003efrag_off to decide whether to clear\nmangleid_features. Accessing the IPv4 header via ip_hdr()/inner_ip_hdr()\ncan rely on skb header offsets that are not always safe for direct\ndereference on packets injected from PF_PACKET paths.\n\nUse skb_header_pointer() for the TCPv4 frag_off check so the header read\nis robust whether data is already linear or needs copying.\n\n[1] https://syzkaller.appspot.com/bug?extid=1543a7d954d9c6d00407"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:16:28.833Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f7a6cd508e9e825a2c69fa9e13d41ee156852f25"
},
{
"url": "https://git.kernel.org/stable/c/cc91202fc20a44aab4c206f12a2bfe05da936051"
},
{
"url": "https://git.kernel.org/stable/c/d970341cfa5594614c7a6634886c7688b4f5cafd"
},
{
"url": "https://git.kernel.org/stable/c/ddc748a391dd8642ba6b2e4fe22e7f2ddf84b7f0"
}
],
"title": "net: use skb_header_pointer() for TCPv4 GSO frag_off check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43036",
"datePublished": "2026-05-01T14:15:34.640Z",
"dateReserved": "2026-05-01T14:12:55.977Z",
"dateUpdated": "2026-05-11T22:16:28.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46120 (GCVE-0-2026-46120)
Vulnerability from cvelistv5
Published
2026-05-28 09:35
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ip6_gre: Use cached t->net in ip6erspan_changelink().
After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of
rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-netns
ip6gre hash via link_net. ip6erspan_changelink() was not converted in
that series and still uses dev_net(dev), which diverges from the
device's creation netns after IFLA_NET_NS_FD migration.
This re-inserts the tunnel into the wrong per-netns hash. The
original netns keeps a stale entry. When that netns is later
destroyed, ip6gre_exit_rtnl_net() walks the stale entry, producing a
slab-use-after-free reported by KASAN, followed by a kernel BUG at
net/core/dev.c (LIST_POISON1) in unregister_netdevice_many_notify().
Reachable from an unprivileged user namespace (unshare --user
--map-root-user --net).
ip6gre_changelink() earlier in the same file already uses the cached
t->net; only ip6erspan_changelink() has the wrong shape.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2d665034f239412927b1e71329f20f001c92da09 Version: 2d665034f239412927b1e71329f20f001c92da09 Version: 2d665034f239412927b1e71329f20f001c92da09 Version: 2d665034f239412927b1e71329f20f001c92da09 Version: 2d665034f239412927b1e71329f20f001c92da09 Version: 2d665034f239412927b1e71329f20f001c92da09 Version: 2d665034f239412927b1e71329f20f001c92da09 Version: 2d665034f239412927b1e71329f20f001c92da09 Version: c6d72628352c949629af619b77b042e0fb5245e7 Version: 4.16.12 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_gre.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7bd0f2b162b426b343a114e1b329f0d8d14fdc6e",
"status": "affected",
"version": "2d665034f239412927b1e71329f20f001c92da09",
"versionType": "git"
},
{
"lessThan": "01b71ff2857d3598337de11e7840a8e3ff21553c",
"status": "affected",
"version": "2d665034f239412927b1e71329f20f001c92da09",
"versionType": "git"
},
{
"lessThan": "0fcf6731706f73494245a9c0d64f93bebf95bb51",
"status": "affected",
"version": "2d665034f239412927b1e71329f20f001c92da09",
"versionType": "git"
},
{
"lessThan": "eca62bb0569de4d43a4dac06a2092a9d4ca1d702",
"status": "affected",
"version": "2d665034f239412927b1e71329f20f001c92da09",
"versionType": "git"
},
{
"lessThan": "311fdd26eb4443d43b909cc67a10f3a5fd1b21b2",
"status": "affected",
"version": "2d665034f239412927b1e71329f20f001c92da09",
"versionType": "git"
},
{
"lessThan": "e70cfb40c3a99b232cd42c6a6a10f0d8e039dc82",
"status": "affected",
"version": "2d665034f239412927b1e71329f20f001c92da09",
"versionType": "git"
},
{
"lessThan": "cf7fc624329e76c6394653d12353e1d033adea91",
"status": "affected",
"version": "2d665034f239412927b1e71329f20f001c92da09",
"versionType": "git"
},
{
"lessThan": "1d324c2f43f70c965f25c58cc3611c779adbe47e",
"status": "affected",
"version": "2d665034f239412927b1e71329f20f001c92da09",
"versionType": "git"
},
{
"status": "affected",
"version": "c6d72628352c949629af619b77b042e0fb5245e7",
"versionType": "git"
},
{
"lessThan": "4.17",
"status": "affected",
"version": "4.16.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_gre.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.16.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_gre: Use cached t-\u003enet in ip6erspan_changelink().\n\nAfter commit 5e72ce3e3980 (\"net: ipv6: Use link netns in newlink() of\nrtnl_link_ops\"), ip6erspan_newlink() correctly resolves the per-netns\nip6gre hash via link_net. ip6erspan_changelink() was not converted in\nthat series and still uses dev_net(dev), which diverges from the\ndevice\u0027s creation netns after IFLA_NET_NS_FD migration.\n\nThis re-inserts the tunnel into the wrong per-netns hash. The\noriginal netns keeps a stale entry. When that netns is later\ndestroyed, ip6gre_exit_rtnl_net() walks the stale entry, producing a\nslab-use-after-free reported by KASAN, followed by a kernel BUG at\nnet/core/dev.c (LIST_POISON1) in unregister_netdevice_many_notify().\n\nReachable from an unprivileged user namespace (unshare --user\n--map-root-user --net).\n\nip6gre_changelink() earlier in the same file already uses the cached\nt-\u003enet; only ip6erspan_changelink() has the wrong shape."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached only via local netlink operations (RTM_NEWLINK changelink, IFLA_NET_NS_FD device migration, and netns teardown), not from any remote packet path; this is a local attack surface.\nAC:L - The attacker deterministically performs every step (create erspan tunnel, migrate it to another netns, issue changelink, destroy the original netns) with no race or memory-layout condition outside their control.\nPR:L - The path nominally needs CAP_NET_ADMIN, but the fix commit explicitly states it is reachable from an unprivileged user namespace via `unshare --user --map-root-user --net`, so only a basic local user is required.\nUI:N - The entire sequence is driven by the attacker\u0027s own process; no action by any other user is needed.\nS:U - The use-after-free and resulting crash are confined to the kernel\u0027s own structures within the same security authority; no boundary such as VM/IOMMU is crossed.\nC:H - The stale hash entry yields a slab-use-after-free on the ip6_tnl/net_device object; reallocating the freed slab with attacker-controlled data enables reading kernel memory contents, treated as High.\nI:H - The use-after-free permits heap grooming and writes through the dangling pointer (e.g., the rcu list manipulation in unregister), providing an arbitrary-write/control-flow primitive, scored High.\nA:H - Exploitation reliably produces a KASAN slab-use-after-free followed by a kernel BUG (LIST_POISON1) in unregister_netdevice_many_notify(), crashing the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:51.685Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7bd0f2b162b426b343a114e1b329f0d8d14fdc6e"
},
{
"url": "https://git.kernel.org/stable/c/01b71ff2857d3598337de11e7840a8e3ff21553c"
},
{
"url": "https://git.kernel.org/stable/c/0fcf6731706f73494245a9c0d64f93bebf95bb51"
},
{
"url": "https://git.kernel.org/stable/c/eca62bb0569de4d43a4dac06a2092a9d4ca1d702"
},
{
"url": "https://git.kernel.org/stable/c/311fdd26eb4443d43b909cc67a10f3a5fd1b21b2"
},
{
"url": "https://git.kernel.org/stable/c/e70cfb40c3a99b232cd42c6a6a10f0d8e039dc82"
},
{
"url": "https://git.kernel.org/stable/c/cf7fc624329e76c6394653d12353e1d033adea91"
},
{
"url": "https://git.kernel.org/stable/c/1d324c2f43f70c965f25c58cc3611c779adbe47e"
}
],
"title": "ip6_gre: Use cached t-\u003enet in ip6erspan_changelink().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46120",
"datePublished": "2026-05-28T09:35:35.385Z",
"dateReserved": "2026-05-13T15:03:33.098Z",
"dateUpdated": "2026-08-05T12:29:51.685Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53350 (GCVE-0-2026-53350)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-07-01 13:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: wm_adsp: Fix NULL dereference when removing firmware controls
In wm_adsp_control_remove() check that the priv pointer is not NULL
before attempting to cleanup what it points to.
When cs_dsp creates a control it calls wm_adsp_control_add_cb() so that
wm_adsp can create its own private control data. There are two cases
where private data is not created:
1. The control is a SYSTEM control, so an ALSA control is not created.
2. The codec driver has registered a control_add() callback that
hides the control, so wm_adsp_control_add() is not called.
When cs_dsp_remove destroys its control list it calls
wm_adsp_control_remove() for each control. But wm_adsp_control_remove()
was attempting to cleanup the private data pointed to by cs_ctl->priv
without checking the pointer for NULL.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 0700bc2fb94c28459f57a10d2ee2c7ef4cb70862 Version: 0700bc2fb94c28459f57a10d2ee2c7ef4cb70862 Version: 0700bc2fb94c28459f57a10d2ee2c7ef4cb70862 Version: 0700bc2fb94c28459f57a10d2ee2c7ef4cb70862 Version: 0700bc2fb94c28459f57a10d2ee2c7ef4cb70862 Version: 0700bc2fb94c28459f57a10d2ee2c7ef4cb70862 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/codecs/wm_adsp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5ee9bbe2af2f373e08d3017f9aef2f2eaf29fbc3",
"status": "affected",
"version": "0700bc2fb94c28459f57a10d2ee2c7ef4cb70862",
"versionType": "git"
},
{
"lessThan": "10def23b67b42679d5b1a356e1a6f3498bd188c3",
"status": "affected",
"version": "0700bc2fb94c28459f57a10d2ee2c7ef4cb70862",
"versionType": "git"
},
{
"lessThan": "2f1be283aa777d655525d000d16474b7e7d015ea",
"status": "affected",
"version": "0700bc2fb94c28459f57a10d2ee2c7ef4cb70862",
"versionType": "git"
},
{
"lessThan": "12e579b889624ec54a201d98fdff975de556c731",
"status": "affected",
"version": "0700bc2fb94c28459f57a10d2ee2c7ef4cb70862",
"versionType": "git"
},
{
"lessThan": "6effd6f7b0ba1f5d1df702b2ef7460bcc215e9b7",
"status": "affected",
"version": "0700bc2fb94c28459f57a10d2ee2c7ef4cb70862",
"versionType": "git"
},
{
"lessThan": "7d3fb78b550301e43fdc60312aed733069694426",
"status": "affected",
"version": "0700bc2fb94c28459f57a10d2ee2c7ef4cb70862",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/codecs/wm_adsp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: wm_adsp: Fix NULL dereference when removing firmware controls\n\nIn wm_adsp_control_remove() check that the priv pointer is not NULL\nbefore attempting to cleanup what it points to.\n\nWhen cs_dsp creates a control it calls wm_adsp_control_add_cb() so that\nwm_adsp can create its own private control data. There are two cases\nwhere private data is not created:\n\n1. The control is a SYSTEM control, so an ALSA control is not created.\n\n2. The codec driver has registered a control_add() callback that\n hides the control, so wm_adsp_control_add() is not called.\n\nWhen cs_dsp_remove destroys its control list it calls\nwm_adsp_control_remove() for each control. But wm_adsp_control_remove()\nwas attempting to cleanup the private data pointed to by cs_ctl-\u003epriv\nwithout checking the pointer for NULL."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-01T13:32:27.975Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5ee9bbe2af2f373e08d3017f9aef2f2eaf29fbc3"
},
{
"url": "https://git.kernel.org/stable/c/10def23b67b42679d5b1a356e1a6f3498bd188c3"
},
{
"url": "https://git.kernel.org/stable/c/2f1be283aa777d655525d000d16474b7e7d015ea"
},
{
"url": "https://git.kernel.org/stable/c/12e579b889624ec54a201d98fdff975de556c731"
},
{
"url": "https://git.kernel.org/stable/c/6effd6f7b0ba1f5d1df702b2ef7460bcc215e9b7"
},
{
"url": "https://git.kernel.org/stable/c/7d3fb78b550301e43fdc60312aed733069694426"
}
],
"title": "ASoC: wm_adsp: Fix NULL dereference when removing firmware controls",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53350",
"datePublished": "2026-07-01T13:32:27.975Z",
"dateReserved": "2026-06-09T07:44:35.399Z",
"dateUpdated": "2026-07-01T13:32:27.975Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52922 (GCVE-0-2026-52922)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: dat: handle forward allocation error
batadv_dat_forward_data() calls pskb_copy_for_clone() to duplicate an skb
for each DHT candidate, but does not check the return value before passing
it to batadv_send_skb_prepare_unicast_4addr(). That function dereferences
the skb unconditionally, so a failed allocation triggers a NULL pointer
dereference.
Skip forwarding to the current DHT candidate on allocation failure.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 785ea1144182c341b8b85b0f8180291839d176a8 Version: 785ea1144182c341b8b85b0f8180291839d176a8 Version: 785ea1144182c341b8b85b0f8180291839d176a8 Version: 785ea1144182c341b8b85b0f8180291839d176a8 Version: 785ea1144182c341b8b85b0f8180291839d176a8 Version: 785ea1144182c341b8b85b0f8180291839d176a8 Version: 785ea1144182c341b8b85b0f8180291839d176a8 Version: 785ea1144182c341b8b85b0f8180291839d176a8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/batman-adv/distributed-arp-table.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9bcebaedfb8479cb4affb23c7a0d000ca9a20e73",
"status": "affected",
"version": "785ea1144182c341b8b85b0f8180291839d176a8",
"versionType": "git"
},
{
"lessThan": "2edb8aeb3cdda9d00ec4997252dc5bcd6f54d8ef",
"status": "affected",
"version": "785ea1144182c341b8b85b0f8180291839d176a8",
"versionType": "git"
},
{
"lessThan": "ce0c381199402a2c58f4599f4f6ed100d872d0da",
"status": "affected",
"version": "785ea1144182c341b8b85b0f8180291839d176a8",
"versionType": "git"
},
{
"lessThan": "866ac1d57040ed0b44ca732e3c66b3aa6b93011c",
"status": "affected",
"version": "785ea1144182c341b8b85b0f8180291839d176a8",
"versionType": "git"
},
{
"lessThan": "4d420d9ee70a220a2cd95aa0dd2e15acad66a505",
"status": "affected",
"version": "785ea1144182c341b8b85b0f8180291839d176a8",
"versionType": "git"
},
{
"lessThan": "9cceea8eeba710def2a5707ee00f00c74a9a1cac",
"status": "affected",
"version": "785ea1144182c341b8b85b0f8180291839d176a8",
"versionType": "git"
},
{
"lessThan": "cf48e75fc4fe0d5cc7721c82d454221d01367b93",
"status": "affected",
"version": "785ea1144182c341b8b85b0f8180291839d176a8",
"versionType": "git"
},
{
"lessThan": "2d8826a2d3657cea66fb0370f9e521575a673871",
"status": "affected",
"version": "785ea1144182c341b8b85b0f8180291839d176a8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/batman-adv/distributed-arp-table.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.142",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.142",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.92",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: dat: handle forward allocation error\n\nbatadv_dat_forward_data() calls pskb_copy_for_clone() to duplicate an skb\nfor each DHT candidate, but does not check the return value before passing\nit to batadv_send_skb_prepare_unicast_4addr(). That function dereferences\nthe skb unconditionally, so a failed allocation triggers a NULL pointer\ndereference.\n\nSkip forwarding to the current DHT candidate on allocation failure."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable DAT forwarding path is reachable through attacker-supplied batman-adv mesh traffic carrying ARP/DHCP payloads, processed in the kernel receive/network path without a local syscall. Scoring the highest defensible deployment, a remote mesh participant can send packets to the affected node.\nAC:L - The packet format checks are straightforward and DAT is enabled by default when built; the attacker can repeatedly send valid ARP/DHCP-triggering traffic toward DAT candidates. Although the NULL dereference requires `GFP_ATOMIC` allocation failure, traffic flooding can plausibly create or hit that condition, so the higher-severity AC:L is selected.\nPR:N - The receive path has no authentication or authorization gate for a peer that can transmit batman-adv mesh packets to the node. Privileges are only needed to configure the victim mesh, not to trigger the bug as a remote sender.\nUI:N - No victim user action is required after the affected batman-adv mesh is active. The attacker triggers the path by sending network traffic.\nS:U - The impact is within the vulnerable kernel instance and does not cross a separate security authority such as a hypervisor or sandbox boundary. Standard kernel availability impact is scope unchanged.\nC:N - The bug is a NULL `skb` dereference after `pskb_copy_for_clone()` failure, not a use-after-free or out-of-bounds access. The investigated path shows no attacker-controlled memory disclosure primitive.\nI:N - The NULL pointer is dereferenced immediately in skb header preparation and does not provide an attacker-controlled write or control-flow primitive. There is no evidence of memory corruption beyond the crash.\nA:H - A failed allocation leads to an unchecked NULL pointer dereference in kernel networking code. This can oops or panic the kernel, causing high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:43.495Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9bcebaedfb8479cb4affb23c7a0d000ca9a20e73"
},
{
"url": "https://git.kernel.org/stable/c/2edb8aeb3cdda9d00ec4997252dc5bcd6f54d8ef"
},
{
"url": "https://git.kernel.org/stable/c/ce0c381199402a2c58f4599f4f6ed100d872d0da"
},
{
"url": "https://git.kernel.org/stable/c/866ac1d57040ed0b44ca732e3c66b3aa6b93011c"
},
{
"url": "https://git.kernel.org/stable/c/4d420d9ee70a220a2cd95aa0dd2e15acad66a505"
},
{
"url": "https://git.kernel.org/stable/c/9cceea8eeba710def2a5707ee00f00c74a9a1cac"
},
{
"url": "https://git.kernel.org/stable/c/cf48e75fc4fe0d5cc7721c82d454221d01367b93"
},
{
"url": "https://git.kernel.org/stable/c/2d8826a2d3657cea66fb0370f9e521575a673871"
}
],
"title": "batman-adv: dat: handle forward allocation error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52922",
"datePublished": "2026-06-24T07:14:17.185Z",
"dateReserved": "2026-06-09T07:44:35.367Z",
"dateUpdated": "2026-08-05T12:31:43.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45871 (GCVE-0-2026-45871)
Vulnerability from cvelistv5
Published
2026-05-27 12:15
Modified
2026-05-27 12:15
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tpm: st33zp24: Fix missing cleanup on get_burstcount() error
get_burstcount() can return -EBUSY on timeout. When this happens,
st33zp24_send() returns directly without releasing the locality
acquired earlier.
Use goto out_err to ensure proper cleanup when get_burstcount() fails.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: bf38b8710892333cec2d8069644eb36ff435fd6f Version: bf38b8710892333cec2d8069644eb36ff435fd6f Version: bf38b8710892333cec2d8069644eb36ff435fd6f Version: bf38b8710892333cec2d8069644eb36ff435fd6f Version: bf38b8710892333cec2d8069644eb36ff435fd6f Version: bf38b8710892333cec2d8069644eb36ff435fd6f Version: bf38b8710892333cec2d8069644eb36ff435fd6f Version: bf38b8710892333cec2d8069644eb36ff435fd6f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/tpm/st33zp24/st33zp24.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e0ce3da82341fcd6194175f1837946b2a894c625",
"status": "affected",
"version": "bf38b8710892333cec2d8069644eb36ff435fd6f",
"versionType": "git"
},
{
"lessThan": "7687133509cf66ced120b667fefd21f80bf17993",
"status": "affected",
"version": "bf38b8710892333cec2d8069644eb36ff435fd6f",
"versionType": "git"
},
{
"lessThan": "1256c6dc96d1e687e6e9b63088156ed07411b00c",
"status": "affected",
"version": "bf38b8710892333cec2d8069644eb36ff435fd6f",
"versionType": "git"
},
{
"lessThan": "a51cff9be046e13e1c1b2fe45d5c48b582ec9b8c",
"status": "affected",
"version": "bf38b8710892333cec2d8069644eb36ff435fd6f",
"versionType": "git"
},
{
"lessThan": "cc09d55f519e15355de343264a22ac6682b8305e",
"status": "affected",
"version": "bf38b8710892333cec2d8069644eb36ff435fd6f",
"versionType": "git"
},
{
"lessThan": "ec15eb67fe9df87981b4829b901ec254273ca483",
"status": "affected",
"version": "bf38b8710892333cec2d8069644eb36ff435fd6f",
"versionType": "git"
},
{
"lessThan": "4fffb77d35d038f146e6192da583dbe4971d869e",
"status": "affected",
"version": "bf38b8710892333cec2d8069644eb36ff435fd6f",
"versionType": "git"
},
{
"lessThan": "3e91b44c93ad2871f89fc2a98c5e4fe6ca5db3d9",
"status": "affected",
"version": "bf38b8710892333cec2d8069644eb36ff435fd6f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/tpm/st33zp24/st33zp24.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.252",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.202",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.252",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.202",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: st33zp24: Fix missing cleanup on get_burstcount() error\n\nget_burstcount() can return -EBUSY on timeout. When this happens,\nst33zp24_send() returns directly without releasing the locality\nacquired earlier.\n\nUse goto out_err to ensure proper cleanup when get_burstcount() fails."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T12:15:51.317Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e0ce3da82341fcd6194175f1837946b2a894c625"
},
{
"url": "https://git.kernel.org/stable/c/7687133509cf66ced120b667fefd21f80bf17993"
},
{
"url": "https://git.kernel.org/stable/c/1256c6dc96d1e687e6e9b63088156ed07411b00c"
},
{
"url": "https://git.kernel.org/stable/c/a51cff9be046e13e1c1b2fe45d5c48b582ec9b8c"
},
{
"url": "https://git.kernel.org/stable/c/cc09d55f519e15355de343264a22ac6682b8305e"
},
{
"url": "https://git.kernel.org/stable/c/ec15eb67fe9df87981b4829b901ec254273ca483"
},
{
"url": "https://git.kernel.org/stable/c/4fffb77d35d038f146e6192da583dbe4971d869e"
},
{
"url": "https://git.kernel.org/stable/c/3e91b44c93ad2871f89fc2a98c5e4fe6ca5db3d9"
}
],
"title": "tpm: st33zp24: Fix missing cleanup on get_burstcount() error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45871",
"datePublished": "2026-05-27T12:15:51.317Z",
"dateReserved": "2026-05-13T15:03:33.081Z",
"dateUpdated": "2026-05-27T12:15:51.317Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53041 (GCVE-0-2026-53041)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix listxattr handling when the buffer is full
[BUG]
If an OCFS2 inode has both inline and block-based xattrs, listxattr()
can return a size larger than the caller's buffer when the inline names
consume that buffer exactly.
kernel BUG at mm/usercopy.c:102!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:usercopy_abort+0xb7/0xd0 mm/usercopy.c:102
Call Trace:
__check_heap_object+0xe3/0x120 mm/slub.c:8243
check_heap_object mm/usercopy.c:196 [inline]
__check_object_size mm/usercopy.c:250 [inline]
__check_object_size+0x5c5/0x780 mm/usercopy.c:215
check_object_size include/linux/ucopysize.h:22 [inline]
check_copy_size include/linux/ucopysize.h:59 [inline]
copy_to_user include/linux/uaccess.h:219 [inline]
listxattr+0xb0/0x170 fs/xattr.c:926
filename_listxattr fs/xattr.c:958 [inline]
path_listxattrat+0x137/0x320 fs/xattr.c:988
__do_sys_listxattr fs/xattr.c:1001 [inline]
__se_sys_listxattr fs/xattr.c:998 [inline]
__x64_sys_listxattr+0x7f/0xd0 fs/xattr.c:998
...
[CAUSE]
Commit 936b8834366e ("ocfs2: Refactor xattr list and remove
ocfs2_xattr_handler().") replaced the old per-handler list accounting
with ocfs2_xattr_list_entry(), but it kept using size == 0 to detect
probe mode.
That assumption stops being true once ocfs2_listxattr() finishes the
inline-xattr pass. If the inline names fill the caller buffer exactly,
the block-xattr pass runs with a non-NULL buffer and a remaining size of
zero. ocfs2_xattr_list_entry() then skips the bounds check, keeps
counting block names, and returns a positive size larger than the
supplied buffer.
[FIX]
Detect probe mode by testing whether the destination buffer pointer is
NULL instead of whether the remaining size is zero.
That restores the pre-refactor behavior and matches the OCFS2 getxattr
helpers. Once the remaining buffer reaches zero while more names are
left, the block-xattr pass now returns -ERANGE instead of reporting a
size larger than the allocated list buffer.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 936b8834366ec05f2a6993f73afd8348cac9718e Version: 936b8834366ec05f2a6993f73afd8348cac9718e Version: 936b8834366ec05f2a6993f73afd8348cac9718e Version: 936b8834366ec05f2a6993f73afd8348cac9718e Version: 936b8834366ec05f2a6993f73afd8348cac9718e Version: 936b8834366ec05f2a6993f73afd8348cac9718e Version: 936b8834366ec05f2a6993f73afd8348cac9718e Version: 936b8834366ec05f2a6993f73afd8348cac9718e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/xattr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a35a1c2b170b5b578b1b3fecb95694796552af9a",
"status": "affected",
"version": "936b8834366ec05f2a6993f73afd8348cac9718e",
"versionType": "git"
},
{
"lessThan": "2323084c17370304f49c84b354fe7b3edbb264fe",
"status": "affected",
"version": "936b8834366ec05f2a6993f73afd8348cac9718e",
"versionType": "git"
},
{
"lessThan": "6f702b00b8124c5d3525f19172934544826a114d",
"status": "affected",
"version": "936b8834366ec05f2a6993f73afd8348cac9718e",
"versionType": "git"
},
{
"lessThan": "d919b905939eda93393e3572900ff70dbad2b47f",
"status": "affected",
"version": "936b8834366ec05f2a6993f73afd8348cac9718e",
"versionType": "git"
},
{
"lessThan": "46e66fefb83811958127bc9ad736983ec629d82b",
"status": "affected",
"version": "936b8834366ec05f2a6993f73afd8348cac9718e",
"versionType": "git"
},
{
"lessThan": "2685df8577a38d83b367c8cf52eda9dc286959ff",
"status": "affected",
"version": "936b8834366ec05f2a6993f73afd8348cac9718e",
"versionType": "git"
},
{
"lessThan": "50033ec1350fe68abdc63b950ced7ae57364b77a",
"status": "affected",
"version": "936b8834366ec05f2a6993f73afd8348cac9718e",
"versionType": "git"
},
{
"lessThan": "d12f558e6200b3f47dbef9331ed6d115d2410e59",
"status": "affected",
"version": "936b8834366ec05f2a6993f73afd8348cac9718e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/xattr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.28"
},
{
"lessThan": "2.6.28",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "2.6.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.28",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix listxattr handling when the buffer is full\n\n[BUG]\nIf an OCFS2 inode has both inline and block-based xattrs, listxattr()\ncan return a size larger than the caller\u0027s buffer when the inline names\nconsume that buffer exactly.\n\nkernel BUG at mm/usercopy.c:102!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:usercopy_abort+0xb7/0xd0 mm/usercopy.c:102\nCall Trace:\n __check_heap_object+0xe3/0x120 mm/slub.c:8243\n check_heap_object mm/usercopy.c:196 [inline]\n __check_object_size mm/usercopy.c:250 [inline]\n __check_object_size+0x5c5/0x780 mm/usercopy.c:215\n check_object_size include/linux/ucopysize.h:22 [inline]\n check_copy_size include/linux/ucopysize.h:59 [inline]\n copy_to_user include/linux/uaccess.h:219 [inline]\n listxattr+0xb0/0x170 fs/xattr.c:926\n filename_listxattr fs/xattr.c:958 [inline]\n path_listxattrat+0x137/0x320 fs/xattr.c:988\n __do_sys_listxattr fs/xattr.c:1001 [inline]\n __se_sys_listxattr fs/xattr.c:998 [inline]\n __x64_sys_listxattr+0x7f/0xd0 fs/xattr.c:998\n ...\n\n[CAUSE]\nCommit 936b8834366e (\"ocfs2: Refactor xattr list and remove\nocfs2_xattr_handler().\") replaced the old per-handler list accounting\nwith ocfs2_xattr_list_entry(), but it kept using size == 0 to detect\nprobe mode.\n\nThat assumption stops being true once ocfs2_listxattr() finishes the\ninline-xattr pass. If the inline names fill the caller buffer exactly,\nthe block-xattr pass runs with a non-NULL buffer and a remaining size of\nzero. ocfs2_xattr_list_entry() then skips the bounds check, keeps\ncounting block names, and returns a positive size larger than the\nsupplied buffer.\n\n[FIX]\nDetect probe mode by testing whether the destination buffer pointer is\nNULL instead of whether the remaining size is zero.\n\nThat restores the pre-refactor behavior and matches the OCFS2 getxattr\nhelpers. Once the remaining buffer reaches zero while more names are\nleft, the block-xattr pass now returns -ERANGE instead of reporting a\nsize larger than the allocated list buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable OCFS2 code is reached through local `listxattr`/`llistxattr`/`flistxattr`/`listxattrat` syscalls where the caller controls the too-small buffer size. Network wrappers such as nfsd and ksmbd probe and allocate the full xattr-list size, so they do not expose the short-buffer trigger.\nAC:L - The attacker can deterministically create the needed inline-plus-block xattr layout on a writable OCFS2 file using `user.*` xattrs, then pass a buffer size that exactly fits the inline names. No race or external timing condition is required.\nPR:L - A basic local unprivileged user with access to a writable OCFS2 file or directory can create `user.*` xattrs and invoke `listxattr`. Creating/mounting the filesystem may require administrator setup, but exploitation on an affected deployed system does not require real root.\nUI:N - Once the attacker has local access to the OCFS2 path, exploitation is performed directly with syscalls. No separate victim action is needed.\nS:U - The issue affects kernel filesystem handling within the same host security authority. It is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - The bug returns a length larger than the allocated kernel xattr-list buffer, causing `copy_to_user` to attempt an out-of-bounds kernel heap read. With hardened usercopy this aborts, but without it or under weaker checking this can expose kernel memory, so confidentiality is high.\nI:N - The flaw is an oversized read/copy length and does not write beyond bounds or corrupt kernel objects. It does not provide a direct integrity modification primitive.\nA:H - On hardened-usercopy kernels the overlong `copy_to_user` triggers `usercopy_abort()` and `BUG()`, producing a kernel oops/panic. The crash is repeatable by the local attacker."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:49.657Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a35a1c2b170b5b578b1b3fecb95694796552af9a"
},
{
"url": "https://git.kernel.org/stable/c/2323084c17370304f49c84b354fe7b3edbb264fe"
},
{
"url": "https://git.kernel.org/stable/c/6f702b00b8124c5d3525f19172934544826a114d"
},
{
"url": "https://git.kernel.org/stable/c/d919b905939eda93393e3572900ff70dbad2b47f"
},
{
"url": "https://git.kernel.org/stable/c/46e66fefb83811958127bc9ad736983ec629d82b"
},
{
"url": "https://git.kernel.org/stable/c/2685df8577a38d83b367c8cf52eda9dc286959ff"
},
{
"url": "https://git.kernel.org/stable/c/50033ec1350fe68abdc63b950ced7ae57364b77a"
},
{
"url": "https://git.kernel.org/stable/c/d12f558e6200b3f47dbef9331ed6d115d2410e59"
}
],
"title": "ocfs2: fix listxattr handling when the buffer is full",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53041",
"datePublished": "2026-06-24T16:29:47.501Z",
"dateReserved": "2026-06-09T07:44:35.380Z",
"dateUpdated": "2026-08-05T12:32:49.657Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31664 (GCVE-0-2026-31664)
Vulnerability from cvelistv5
Published
2026-04-24 14:45
Modified
2026-07-14 12:48
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: clear trailing padding in build_polexpire()
build_expire() clears the trailing padding bytes of struct
xfrm_user_expire after setting the hard field via memset_after(),
but the analogous function build_polexpire() does not do this for
struct xfrm_user_polexpire.
The padding bytes after the __u8 hard field are left
uninitialized from the heap allocation, and are then sent to
userspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,
leaking kernel heap memory contents.
Add the missing memset_after() call, matching build_expire().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"adp": [
{
"affected": [
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.6",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
"vendor": "Siemens",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "V3.1.5",
"versionType": "custom"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T12:48:32.307Z",
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"shortName": "siemens-SADP"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
}
],
"x_adpType": "supplier"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_user.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a5127501c8d30b5728791b1e340284ca5c9cc4bd",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e6f4ffe8596947a595c9544e73a73adcb0568b88",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ac6985903db047eaff54db929e4bf6b06782788e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c221ed63a2769a0af8bd849dfe25740048f34ef4",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "eda30846ea54f8ed218468e5480c8305ca645e37",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b1dfd6b27df35ef4f87825aa5f607378d23ff0f2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e1af65c669ebb1666c54576614c01a7f9ffcfff6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "71a98248c63c535eaa4d4c22f099b68d902006d0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_user.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.169",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.135",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.169",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.135",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.82",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.23",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.13",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: clear trailing padding in build_polexpire()\n\nbuild_expire() clears the trailing padding bytes of struct\nxfrm_user_expire after setting the hard field via memset_after(),\nbut the analogous function build_polexpire() does not do this for\nstruct xfrm_user_polexpire.\n\nThe padding bytes after the __u8 hard field are left\nuninitialized from the heap allocation, and are then sent to\nuserspace via netlink multicast to XFRMNLGRP_EXPIRE listeners,\nleaking kernel heap memory contents.\n\nAdd the missing memset_after() call, matching build_expire()."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-01T16:13:15.231Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a5127501c8d30b5728791b1e340284ca5c9cc4bd"
},
{
"url": "https://git.kernel.org/stable/c/e6f4ffe8596947a595c9544e73a73adcb0568b88"
},
{
"url": "https://git.kernel.org/stable/c/ac6985903db047eaff54db929e4bf6b06782788e"
},
{
"url": "https://git.kernel.org/stable/c/c221ed63a2769a0af8bd849dfe25740048f34ef4"
},
{
"url": "https://git.kernel.org/stable/c/eda30846ea54f8ed218468e5480c8305ca645e37"
},
{
"url": "https://git.kernel.org/stable/c/b1dfd6b27df35ef4f87825aa5f607378d23ff0f2"
},
{
"url": "https://git.kernel.org/stable/c/e1af65c669ebb1666c54576614c01a7f9ffcfff6"
},
{
"url": "https://git.kernel.org/stable/c/71a98248c63c535eaa4d4c22f099b68d902006d0"
}
],
"title": "xfrm: clear trailing padding in build_polexpire()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31664",
"datePublished": "2026-04-24T14:45:13.922Z",
"dateReserved": "2026-03-09T15:48:24.129Z",
"dateUpdated": "2026-07-14T12:48:32.307Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53181 (GCVE-0-2026-53181)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-06-25 08:38
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vsock/vmci: fix sk_ack_backlog leak on failed handshake
When vmci_transport_recv_connecting_server() returns an error,
vmci_transport_recv_listen() calls vsock_remove_pending() but never
calls sk_acceptq_removed(). This leaves sk_ack_backlog incremented
permanently.
Repeated handshake failures (malformed packets, queue pair alloc
failure, event subscribe failure) cause sk_ack_backlog to climb
toward sk_max_ack_backlog. Once it reaches the limit the listener
permanently refuses all new connections with -ECONNREFUSED, a
silent denial of service requiring a process restart to recover.
The two existing sk_acceptq_removed() calls in af_vsock.c do not
cover this path: line 764 checks vsock_is_pending() which returns
false after vsock_remove_pending(), and line 1889 is only reached
on successful accept().
Fix by balancing sk_acceptq_added() with sk_acceptq_removed() on
the error path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 Version: d021c344051af91f42c5ba9fdedc176740cbd238 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/vmci_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "22c587aa3ab1ab5264daff3ec32136fd30436c13",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "cf7090e255d74c4b61c51f8ede9fcacdd8393b5b",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "ea0b03d52881c12a8c634ea0d6cbfa61cefdb488",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "dfd853197615d322d3a88dbcab91fc0fd2096219",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "bcb275626055df7f8f947f1a349754b4004d9a15",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "ba9ad6015937a5e46ba1a31370e3efdec8abbdcc",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "9698582a4dd9c4a05889d7db96d4c0edc9e69cac",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
},
{
"lessThan": "c05fa14db43ebef3bd862ca9d073981c0358b3f0",
"status": "affected",
"version": "d021c344051af91f42c5ba9fdedc176740cbd238",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/vmci_transport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/vmci: fix sk_ack_backlog leak on failed handshake\n\nWhen vmci_transport_recv_connecting_server() returns an error,\nvmci_transport_recv_listen() calls vsock_remove_pending() but never\ncalls sk_acceptq_removed(). This leaves sk_ack_backlog incremented\npermanently.\n\nRepeated handshake failures (malformed packets, queue pair alloc\nfailure, event subscribe failure) cause sk_ack_backlog to climb\ntoward sk_max_ack_backlog. Once it reaches the limit the listener\npermanently refuses all new connections with -ECONNREFUSED, a\nsilent denial of service requiring a process restart to recover.\n\nThe two existing sk_acceptq_removed() calls in af_vsock.c do not\ncover this path: line 764 checks vsock_is_pending() which returns\nfalse after vsock_remove_pending(), and line 1889 is only reached\non successful accept().\n\nFix by balancing sk_acceptq_added() with sk_acceptq_removed() on\nthe error path."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T08:38:55.994Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/22c587aa3ab1ab5264daff3ec32136fd30436c13"
},
{
"url": "https://git.kernel.org/stable/c/cf7090e255d74c4b61c51f8ede9fcacdd8393b5b"
},
{
"url": "https://git.kernel.org/stable/c/ea0b03d52881c12a8c634ea0d6cbfa61cefdb488"
},
{
"url": "https://git.kernel.org/stable/c/dfd853197615d322d3a88dbcab91fc0fd2096219"
},
{
"url": "https://git.kernel.org/stable/c/bcb275626055df7f8f947f1a349754b4004d9a15"
},
{
"url": "https://git.kernel.org/stable/c/ba9ad6015937a5e46ba1a31370e3efdec8abbdcc"
},
{
"url": "https://git.kernel.org/stable/c/9698582a4dd9c4a05889d7db96d4c0edc9e69cac"
},
{
"url": "https://git.kernel.org/stable/c/c05fa14db43ebef3bd862ca9d073981c0358b3f0"
}
],
"title": "vsock/vmci: fix sk_ack_backlog leak on failed handshake",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53181",
"datePublished": "2026-06-25T08:38:55.994Z",
"dateReserved": "2026-06-09T07:44:35.390Z",
"dateUpdated": "2026-06-25T08:38:55.994Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31505 (GCVE-0-2026-31505)
Vulnerability from cvelistv5
Published
2026-04-22 13:54
Modified
2026-08-05 12:23
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()
iavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the
value could change in runtime, we should use num_tx_queues instead.
Moreover iavf_get_ethtool_stats() uses num_active_queues while
iavf_get_sset_count() and iavf_get_stat_strings() use
real_num_tx_queues, which triggers out-of-bounds writes when we do
"ethtool -L" and "ethtool -S" simultaneously [1].
For example when we change channels from 1 to 8, Thread 3 could be
scheduled before Thread 2, and out-of-bounds writes could be triggered
in Thread 3:
Thread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S)
iavf_set_channels()
...
iavf_alloc_queues()
-> num_active_queues = 8
iavf_schedule_finish_config()
iavf_get_sset_count()
real_num_tx_queues: 1
-> buffer for 1 queue
iavf_get_ethtool_stats()
num_active_queues: 8
-> out-of-bounds!
iavf_finish_config()
-> real_num_tx_queues = 8
Use immutable num_tx_queues in all related functions to avoid the issue.
[1]
BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270
Write of size 8 at addr ffffc900031c9080 by task ethtool/5800
CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x6f/0xb0
print_report+0x170/0x4f3
kasan_report+0xe1/0x180
iavf_add_one_ethtool_stat+0x200/0x270
iavf_get_ethtool_stats+0x14c/0x2e0
__dev_ethtool+0x3d0c/0x5830
dev_ethtool+0x12d/0x270
dev_ioctl+0x53c/0xe30
sock_do_ioctl+0x1a9/0x270
sock_ioctl+0x3d4/0x5e0
__x64_sys_ioctl+0x137/0x1c0
do_syscall_64+0xf3/0x690
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7da0e6e36d
...
</TASK>
The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830
The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000
index:0xffff88813a013de0 pfn:0x13a013
flags: 0x200000000000000(node=0|zone=2)
raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
^
ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/iavf/iavf_ethtool.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1f931dee5b726df1940348ec31614d64bac03aa6",
"status": "affected",
"version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d",
"versionType": "git"
},
{
"lessThan": "bb85741d2dc2be207353a412f51b83697fcbefcf",
"status": "affected",
"version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d",
"versionType": "git"
},
{
"lessThan": "fdf902bf86a80bf15792a1d20a67a5302498d7f1",
"status": "affected",
"version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d",
"versionType": "git"
},
{
"lessThan": "fecacfc95f195b99c71c579a472120d0b4ed65fa",
"status": "affected",
"version": "64430f70ba6fcd5872ac190f4ae3ddee3f48f00d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/iavf/iavf_ethtool.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix out-of-bounds writes in iavf_get_ethtool_stats()\n\niavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the\nvalue could change in runtime, we should use num_tx_queues instead.\n\nMoreover iavf_get_ethtool_stats() uses num_active_queues while\niavf_get_sset_count() and iavf_get_stat_strings() use\nreal_num_tx_queues, which triggers out-of-bounds writes when we do\n\"ethtool -L\" and \"ethtool -S\" simultaneously [1].\n\nFor example when we change channels from 1 to 8, Thread 3 could be\nscheduled before Thread 2, and out-of-bounds writes could be triggered\nin Thread 3:\n\nThread 1 (ethtool -L) Thread 2 (work) Thread 3 (ethtool -S)\niavf_set_channels()\n...\niavf_alloc_queues()\n-\u003e num_active_queues = 8\niavf_schedule_finish_config()\n iavf_get_sset_count()\n real_num_tx_queues: 1\n -\u003e buffer for 1 queue\n iavf_get_ethtool_stats()\n num_active_queues: 8\n -\u003e out-of-bounds!\n iavf_finish_config()\n -\u003e real_num_tx_queues = 8\n\nUse immutable num_tx_queues in all related functions to avoid the issue.\n\n[1]\n BUG: KASAN: vmalloc-out-of-bounds in iavf_add_one_ethtool_stat+0x200/0x270\n Write of size 8 at addr ffffc900031c9080 by task ethtool/5800\n\n CPU: 1 UID: 0 PID: 5800 Comm: ethtool Not tainted 6.19.0-enjuk-08403-g8137e3db7f1c #241 PREEMPT(full)\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x6f/0xb0\n print_report+0x170/0x4f3\n kasan_report+0xe1/0x180\n iavf_add_one_ethtool_stat+0x200/0x270\n iavf_get_ethtool_stats+0x14c/0x2e0\n __dev_ethtool+0x3d0c/0x5830\n dev_ethtool+0x12d/0x270\n dev_ioctl+0x53c/0xe30\n sock_do_ioctl+0x1a9/0x270\n sock_ioctl+0x3d4/0x5e0\n __x64_sys_ioctl+0x137/0x1c0\n do_syscall_64+0xf3/0x690\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f7da0e6e36d\n ...\n \u003c/TASK\u003e\n\n The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900031c9000 allocated at __dev_ethtool+0x3cc9/0x5830\n The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000\n index:0xffff88813a013de0 pfn:0x13a013\n flags: 0x200000000000000(node=0|zone=2)\n raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000\n raw: ffff88813a013de0 0000000000000000 00000001ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n Memory state around the buggy address:\n ffffc900031c8f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900031c9000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n \u003effffc900031c9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ^\n ffffc900031c9100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900031c9180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is reached locally through `ioctl(SIOCETHTOOL)` on a socket, specifically `ETHTOOL_GSTATS` calling the iavf ethtool statistics callback. Remote packets may influence counter values but do not directly invoke the vulnerable code.\nAC:L - The bug is a race between attacker-issued channel reconfiguration and stats retrieval; the attacker can repeatedly run `ethtool -L` and `ethtool -S` to hit the window before `finish_config` updates `real_num_tx_queues`. No rare external condition is required.\nPR:L - `ETHTOOL_GSTATS` is allowed to any local user, but reliably creating the mismatched queue-count state requires `ETHTOOL_SCHANNELS`, gated by `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)`. In plausible delegated VF/container netns deployments this is a low namespace privilege rather than real init-namespace root.\nUI:N - No victim action is required when the attacker has the needed local namespace capability; the attacker can issue both ethtool operations directly. The vulnerable stats read itself is synchronous from the attacker\u2019s ioctl.\nS:U - The corruption occurs inside the same kernel security authority as the vulnerable network driver. This is standard kernel memory corruption/privilege escalation, not a VM escape or IOMMU boundary bypass.\nC:H - The flaw is an out-of-bounds kernel write in a vmalloc-backed stats buffer, which is memory corruption that can plausibly be leveraged during exploitation for information disclosure. Under the required conservative rule, this is High.\nI:H - The vulnerable function writes attacker-influenced u64 statistics past the allocated buffer when queue counts diverge. Out-of-bounds kernel writes are treated as high integrity impact because they can corrupt kernel memory and potentially enable code execution.\nA:H - The reported failure is a KASAN vmalloc-out-of-bounds write in kernel context, and the same corruption can oops or panic the kernel. The trigger can be repeated by local ethtool calls."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:23:08.072Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1f931dee5b726df1940348ec31614d64bac03aa6"
},
{
"url": "https://git.kernel.org/stable/c/bb85741d2dc2be207353a412f51b83697fcbefcf"
},
{
"url": "https://git.kernel.org/stable/c/fdf902bf86a80bf15792a1d20a67a5302498d7f1"
},
{
"url": "https://git.kernel.org/stable/c/fecacfc95f195b99c71c579a472120d0b4ed65fa"
}
],
"title": "iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31505",
"datePublished": "2026-04-22T13:54:24.524Z",
"dateReserved": "2026-03-09T15:48:24.105Z",
"dateUpdated": "2026-08-05T12:23:08.072Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43014 (GCVE-0-2026-43014)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-05-11 22:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: macb: properly unregister fixed rate clocks
The additional resources allocated with clk_register_fixed_rate() need
to be released with clk_unregister_fixed_rate(), otherwise they are lost.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 83a77e9ec4150ee4acc635638f7dedd9da523a26 Version: 83a77e9ec4150ee4acc635638f7dedd9da523a26 Version: 83a77e9ec4150ee4acc635638f7dedd9da523a26 Version: 83a77e9ec4150ee4acc635638f7dedd9da523a26 Version: 83a77e9ec4150ee4acc635638f7dedd9da523a26 Version: 83a77e9ec4150ee4acc635638f7dedd9da523a26 Version: 83a77e9ec4150ee4acc635638f7dedd9da523a26 Version: 83a77e9ec4150ee4acc635638f7dedd9da523a26 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cadence/macb_pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "54c6f0e7682433abed0304ac2f5cb71a92d4b366",
"status": "affected",
"version": "83a77e9ec4150ee4acc635638f7dedd9da523a26",
"versionType": "git"
},
{
"lessThan": "015aa24d3721a05b40935b8af78b49cadf616b8d",
"status": "affected",
"version": "83a77e9ec4150ee4acc635638f7dedd9da523a26",
"versionType": "git"
},
{
"lessThan": "ec1be2ce0d94506f11b22066fd6dc5eb4341b14f",
"status": "affected",
"version": "83a77e9ec4150ee4acc635638f7dedd9da523a26",
"versionType": "git"
},
{
"lessThan": "e1f6f47d6e60d51c3294e5b85787e9aee24c450e",
"status": "affected",
"version": "83a77e9ec4150ee4acc635638f7dedd9da523a26",
"versionType": "git"
},
{
"lessThan": "e35dbfdb1b7710f04ff5c9972ea04971d823a22d",
"status": "affected",
"version": "83a77e9ec4150ee4acc635638f7dedd9da523a26",
"versionType": "git"
},
{
"lessThan": "5392a5174df4f5a2fad2f00e8c617394d0efe031",
"status": "affected",
"version": "83a77e9ec4150ee4acc635638f7dedd9da523a26",
"versionType": "git"
},
{
"lessThan": "6ec567425c057fd850651ee09b31d059ef960e0f",
"status": "affected",
"version": "83a77e9ec4150ee4acc635638f7dedd9da523a26",
"versionType": "git"
},
{
"lessThan": "f0f367a4f459cc8118aadc43c6bba53c60d93f8d",
"status": "affected",
"version": "83a77e9ec4150ee4acc635638f7dedd9da523a26",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cadence/macb_pci.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: macb: properly unregister fixed rate clocks\n\nThe additional resources allocated with clk_register_fixed_rate() need\nto be released with clk_unregister_fixed_rate(), otherwise they are lost."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:16:02.195Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/54c6f0e7682433abed0304ac2f5cb71a92d4b366"
},
{
"url": "https://git.kernel.org/stable/c/015aa24d3721a05b40935b8af78b49cadf616b8d"
},
{
"url": "https://git.kernel.org/stable/c/ec1be2ce0d94506f11b22066fd6dc5eb4341b14f"
},
{
"url": "https://git.kernel.org/stable/c/e1f6f47d6e60d51c3294e5b85787e9aee24c450e"
},
{
"url": "https://git.kernel.org/stable/c/e35dbfdb1b7710f04ff5c9972ea04971d823a22d"
},
{
"url": "https://git.kernel.org/stable/c/5392a5174df4f5a2fad2f00e8c617394d0efe031"
},
{
"url": "https://git.kernel.org/stable/c/6ec567425c057fd850651ee09b31d059ef960e0f"
},
{
"url": "https://git.kernel.org/stable/c/f0f367a4f459cc8118aadc43c6bba53c60d93f8d"
}
],
"title": "net: macb: properly unregister fixed rate clocks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43014",
"datePublished": "2026-05-01T14:15:19.571Z",
"dateReserved": "2026-05-01T14:12:55.974Z",
"dateUpdated": "2026-05-11T22:16:02.195Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46330 (GCVE-0-2026-46330)
Vulnerability from cvelistv5
Published
2026-06-09 12:25
Modified
2026-08-05 12:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Revert "net/smc: Introduce TCP ULP support"
This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40.
As reported by Al Viro, the TCP ULP support for SMC is fundamentally
broken. The implementation attempts to convert an active TCP socket
into an SMC socket by modifying the underlying `struct file`, dentry,
and inode in-place, which violates core VFS invariants that assume
these structures are immutable for an open file, creating a risk of
use after free errors and general system instability.
Given the severity of this design flaw and the fact that cleaner
alternatives (e.g., LD_PRELOAD, BPF) exist for legacy application
transparency, the correct course of action is to remove this feature
entirely.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/smc/af_smc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6c505d95c69e27dbf28fea29dc84d2498d69515c",
"status": "affected",
"version": "d7cd421da9da2cc7b4d25b8537f66db5c8331c40",
"versionType": "git"
},
{
"lessThan": "df31a6b0a3057e66994ad6ccf5d95b9b9514f033",
"status": "affected",
"version": "d7cd421da9da2cc7b4d25b8537f66db5c8331c40",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/smc/af_smc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"net/smc: Introduce TCP ULP support\"\n\nThis reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40.\n\nAs reported by Al Viro, the TCP ULP support for SMC is fundamentally\nbroken. The implementation attempts to convert an active TCP socket\ninto an SMC socket by modifying the underlying `struct file`, dentry,\nand inode in-place, which violates core VFS invariants that assume\nthese structures are immutable for an open file, creating a risk of\nuse after free errors and general system instability.\n\nGiven the severity of this design flaw and the fact that cleaner\nalternatives (e.g., LD_PRELOAD, BPF) exist for legacy application\ntransparency, the correct course of action is to remove this feature\nentirely."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached only via the local setsockopt(TCP_ULP, \"smc\") syscall on a TCP socket owned by the caller; smc_ulp_init() is not invoked from packet receive or any remote network path. The bug is triggered exclusively through the setsockopt(2) syscall on a TCP socket owned by the attacker; smc_ulp_init() is registered as a TCP ULP handler and is invoked from do_tcp_setsockopt() \u2192 tcp_set_ulp(), not from any network packet-receive or remote protocol path.\nAC:L - On systems with CONFIG_SMC enabled, an attacker fully controls socket creation, the pre-connect setsockopt call, and subsequent close/dup/fork races needed to trigger the corrupted VFS state and resulting UAF. An attacker fully controls socket creation, the setsockopt(TCP_ULP, \"smc\") call, and subsequent lifecycle operations (close, dup, connect); once preconditions are met the VFS corruption in smc_ulp_init() is deterministic and UAF/double-free can be provoked on demand without conditions outside attacker control.\nPR:L - Any unprivileged local user who can open a TCP socket may call setsockopt(TCP_ULP); module autoload uses CAP_NET_ADMIN which is obtainable in user namespaces, and no real-root capability is required when SMC is already loaded. No real-root capability is required\u2014any unprivileged local user who can create a SOCK_STREAM TCP socket and call setsockopt on it can reach smc_ulp_init(), including via user namespaces; TCP_ULP has no CAP_NET_ADMIN gate (unlike TCP congestion control), and module autoload is only needed if SMC is not already loaded.\nUI:N - Exploitation requires no action from another user or administrator; the attacker triggers the bug directly through their own socket file descriptor. Exploitation requires no action from a victim user; a local attacker can open a socket, invoke setsockopt(TCP_ULP, \"smc\"), and trigger the corrupted VFS state through normal close/dup operations in their own process.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security boundary, not a cross-boundary escape such as guest-to-host or IOMMU bypass. Impact is confined to kernel memory corruption and privilege escalation within the same kernel security authority; this is not a VM escape, IOMMU bypass, or cross-security-boundary escape.\nC:H - The in-place swapping of file, dentry, and inode pointers breaks VFS lifetime invariants and creates use-after-free conditions that can be leveraged for arbitrary kernel memory disclosure. The in-place swapping of file, dentry, and inode pointers breaks VFS lifetime invariants and creates use-after-free conditions that can be leveraged for arbitrary kernel memory disclosure. The fix commit and Al Viro\u0027s report explicitly identify use-after-free risk from in-place modification of struct file, dentry, and inode on an open file descriptor, which can yield arbitrary kernel memory read primitives through corrupted inode/file reference counting.\nI:H - UAF and broken VFS reference counting on live file descriptors enable heap grooming and arbitrary kernel write/control-flow hijacking, not merely a bounded or cosmetic corruption.\nA:H - The design flaw causes use-after-free, double-free, and general system instability during file close/__fput paths, readily producing kernel oops/panic and complete denial of service on affected IBM Z/RoCE systems running SMC."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:31:24.893Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6c505d95c69e27dbf28fea29dc84d2498d69515c"
},
{
"url": "https://git.kernel.org/stable/c/df31a6b0a3057e66994ad6ccf5d95b9b9514f033"
}
],
"title": "Revert \"net/smc: Introduce TCP ULP support\"",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46330",
"datePublished": "2026-06-09T12:25:59.413Z",
"dateReserved": "2026-05-13T15:03:33.112Z",
"dateUpdated": "2026-08-05T12:31:24.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43032 (GCVE-0-2026-43032)
Vulnerability from cvelistv5
Published
2026-05-01 14:15
Modified
2026-05-11 22:16
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFC: pn533: bound the UART receive buffer
pn532_receive_buf() appends every incoming byte to dev->recv_skb and
only resets the buffer after pn532_uart_rx_is_frame() recognizes a
complete frame. A continuous stream of bytes without a valid PN532 frame
header therefore keeps growing the skb until skb_put_u8() hits the tail
limit.
Drop the accumulated partial frame once the fixed receive buffer is full
so malformed UART traffic cannot grow the skb past
PN532_UART_SKB_BUFF_LEN.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c656aa4c27b17a8c70da223ed5ab42145800d6b5 Version: c656aa4c27b17a8c70da223ed5ab42145800d6b5 Version: c656aa4c27b17a8c70da223ed5ab42145800d6b5 Version: c656aa4c27b17a8c70da223ed5ab42145800d6b5 Version: c656aa4c27b17a8c70da223ed5ab42145800d6b5 Version: c656aa4c27b17a8c70da223ed5ab42145800d6b5 Version: c656aa4c27b17a8c70da223ed5ab42145800d6b5 Version: c656aa4c27b17a8c70da223ed5ab42145800d6b5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nfc/pn533/uart.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8bedf1dd5640ac8997bff00bbefe241b438df397",
"status": "affected",
"version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
"versionType": "git"
},
{
"lessThan": "23e925183db26cd322597679669ad29d70ed2ada",
"status": "affected",
"version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
"versionType": "git"
},
{
"lessThan": "3adca9be14bf36b927193f05f5aea35a1a90e913",
"status": "affected",
"version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
"versionType": "git"
},
{
"lessThan": "2c1fadd221b21d8038acfe6a0f56291881d5ff76",
"status": "affected",
"version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
"versionType": "git"
},
{
"lessThan": "f48ab6ee654ecc350434e4566bc785773f412b7e",
"status": "affected",
"version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
"versionType": "git"
},
{
"lessThan": "ad2f60de5045bfb5d20ea468a97c8760c6a3a4f8",
"status": "affected",
"version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
"versionType": "git"
},
{
"lessThan": "cf2ff10183204349edfd6b972e189375fc5f1fb0",
"status": "affected",
"version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
"versionType": "git"
},
{
"lessThan": "30fe3f5f6494f827d812ff179f295a8e532709d6",
"status": "affected",
"version": "c656aa4c27b17a8c70da223ed5ab42145800d6b5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nfc/pn533/uart.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: pn533: bound the UART receive buffer\n\npn532_receive_buf() appends every incoming byte to dev-\u003erecv_skb and\nonly resets the buffer after pn532_uart_rx_is_frame() recognizes a\ncomplete frame. A continuous stream of bytes without a valid PN532 frame\nheader therefore keeps growing the skb until skb_put_u8() hits the tail\nlimit.\n\nDrop the accumulated partial frame once the fixed receive buffer is full\nso malformed UART traffic cannot grow the skb past\nPN532_UART_SKB_BUFF_LEN."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:16:23.913Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8bedf1dd5640ac8997bff00bbefe241b438df397"
},
{
"url": "https://git.kernel.org/stable/c/23e925183db26cd322597679669ad29d70ed2ada"
},
{
"url": "https://git.kernel.org/stable/c/3adca9be14bf36b927193f05f5aea35a1a90e913"
},
{
"url": "https://git.kernel.org/stable/c/2c1fadd221b21d8038acfe6a0f56291881d5ff76"
},
{
"url": "https://git.kernel.org/stable/c/f48ab6ee654ecc350434e4566bc785773f412b7e"
},
{
"url": "https://git.kernel.org/stable/c/ad2f60de5045bfb5d20ea468a97c8760c6a3a4f8"
},
{
"url": "https://git.kernel.org/stable/c/cf2ff10183204349edfd6b972e189375fc5f1fb0"
},
{
"url": "https://git.kernel.org/stable/c/30fe3f5f6494f827d812ff179f295a8e532709d6"
}
],
"title": "NFC: pn533: bound the UART receive buffer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43032",
"datePublished": "2026-05-01T14:15:31.921Z",
"dateReserved": "2026-05-01T14:12:55.977Z",
"dateUpdated": "2026-05-11T22:16:23.913Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31545 (GCVE-0-2026-31545)
Vulnerability from cvelistv5
Published
2026-04-24 14:33
Modified
2026-05-11 22:10
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFC: nxp-nci: allow GPIOs to sleep
Allow the firmware and enable GPIOs to sleep.
This fixes a `WARN_ON' and allows the driver to operate GPIOs which are
connected to I2C GPIO expanders.
-- >8 --
kernel: WARNING: CPU: 3 PID: 2636 at drivers/gpio/gpiolib.c:3880 gpiod_set_value+0x88/0x98
-- >8 --
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 43201767b44cbd873c60dbd2acd370147588cb18 Version: 43201767b44cbd873c60dbd2acd370147588cb18 Version: 43201767b44cbd873c60dbd2acd370147588cb18 Version: 43201767b44cbd873c60dbd2acd370147588cb18 Version: 43201767b44cbd873c60dbd2acd370147588cb18 Version: 43201767b44cbd873c60dbd2acd370147588cb18 Version: 43201767b44cbd873c60dbd2acd370147588cb18 Version: 43201767b44cbd873c60dbd2acd370147588cb18 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nfc/nxp-nci/i2c.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0c2320c3c860d281cbc2f49fc574c1947a6b9e2a",
"status": "affected",
"version": "43201767b44cbd873c60dbd2acd370147588cb18",
"versionType": "git"
},
{
"lessThan": "2a175bc3c338c6b2bc55004e93dd35a2467bdca2",
"status": "affected",
"version": "43201767b44cbd873c60dbd2acd370147588cb18",
"versionType": "git"
},
{
"lessThan": "c24dcac1a9d1b4fd164898df0c2f5b0adbf81a78",
"status": "affected",
"version": "43201767b44cbd873c60dbd2acd370147588cb18",
"versionType": "git"
},
{
"lessThan": "70662874f646871c2f08ef1cf2544ba9a5f71b96",
"status": "affected",
"version": "43201767b44cbd873c60dbd2acd370147588cb18",
"versionType": "git"
},
{
"lessThan": "548a1bfe591364e63bce4af7c5802bb434efdaf8",
"status": "affected",
"version": "43201767b44cbd873c60dbd2acd370147588cb18",
"versionType": "git"
},
{
"lessThan": "4de9ed2ea22d611b4149969266b45a86ea8daf35",
"status": "affected",
"version": "43201767b44cbd873c60dbd2acd370147588cb18",
"versionType": "git"
},
{
"lessThan": "783f05e560d761dee7ff602b97edb0e54f2e9727",
"status": "affected",
"version": "43201767b44cbd873c60dbd2acd370147588cb18",
"versionType": "git"
},
{
"lessThan": "55dc632ab2ac2889b15995a9eef56c753d48ebc7",
"status": "affected",
"version": "43201767b44cbd873c60dbd2acd370147588cb18",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nfc/nxp-nci/i2c.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.253",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFC: nxp-nci: allow GPIOs to sleep\n\nAllow the firmware and enable GPIOs to sleep.\n\nThis fixes a `WARN_ON\u0027 and allows the driver to operate GPIOs which are\nconnected to I2C GPIO expanders.\n\n-- \u003e8 --\nkernel: WARNING: CPU: 3 PID: 2636 at drivers/gpio/gpiolib.c:3880 gpiod_set_value+0x88/0x98\n-- \u003e8 --"
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:10:50.934Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0c2320c3c860d281cbc2f49fc574c1947a6b9e2a"
},
{
"url": "https://git.kernel.org/stable/c/2a175bc3c338c6b2bc55004e93dd35a2467bdca2"
},
{
"url": "https://git.kernel.org/stable/c/c24dcac1a9d1b4fd164898df0c2f5b0adbf81a78"
},
{
"url": "https://git.kernel.org/stable/c/70662874f646871c2f08ef1cf2544ba9a5f71b96"
},
{
"url": "https://git.kernel.org/stable/c/548a1bfe591364e63bce4af7c5802bb434efdaf8"
},
{
"url": "https://git.kernel.org/stable/c/4de9ed2ea22d611b4149969266b45a86ea8daf35"
},
{
"url": "https://git.kernel.org/stable/c/783f05e560d761dee7ff602b97edb0e54f2e9727"
},
{
"url": "https://git.kernel.org/stable/c/55dc632ab2ac2889b15995a9eef56c753d48ebc7"
}
],
"title": "NFC: nxp-nci: allow GPIOs to sleep",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31545",
"datePublished": "2026-04-24T14:33:13.885Z",
"dateReserved": "2026-03-09T15:48:24.114Z",
"dateUpdated": "2026-05-11T22:10:50.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45838 (GCVE-0-2026-45838)
Vulnerability from cvelistv5
Published
2026-05-27 09:24
Modified
2026-06-14 17:46
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: fix end-of-list detection in cgroup_storage_get_next_key()
list_next_entry() never returns NULL -- when the current element is the
last entry it wraps to the list head via container_of(). The subsequent
NULL check is therefore dead code and get_next_key() never returns
-ENOENT for the last element, instead reading storage->key from a bogus
pointer that aliases internal map fields and copying the result to
userspace.
Replace it with list_entry_is_head() so the function correctly returns
-ENOENT when there are no more entries.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: de9cbbaadba5adf88a19e46df61f7054000838f6 Version: de9cbbaadba5adf88a19e46df61f7054000838f6 Version: de9cbbaadba5adf88a19e46df61f7054000838f6 Version: de9cbbaadba5adf88a19e46df61f7054000838f6 Version: de9cbbaadba5adf88a19e46df61f7054000838f6 Version: de9cbbaadba5adf88a19e46df61f7054000838f6 Version: de9cbbaadba5adf88a19e46df61f7054000838f6 Version: de9cbbaadba5adf88a19e46df61f7054000838f6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/local_storage.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f3d9dd5e1fd52b39e25328307c6a694e994ffe3",
"status": "affected",
"version": "de9cbbaadba5adf88a19e46df61f7054000838f6",
"versionType": "git"
},
{
"lessThan": "26d3339e465e54107bd85884341d1609c5300d6a",
"status": "affected",
"version": "de9cbbaadba5adf88a19e46df61f7054000838f6",
"versionType": "git"
},
{
"lessThan": "2c88b2d96e1d4d0c7c4589a4593d4cdee6d332d6",
"status": "affected",
"version": "de9cbbaadba5adf88a19e46df61f7054000838f6",
"versionType": "git"
},
{
"lessThan": "b4b5a20bed82130da2f2818f04d52378952fbd0b",
"status": "affected",
"version": "de9cbbaadba5adf88a19e46df61f7054000838f6",
"versionType": "git"
},
{
"lessThan": "85a2f30e40f7468db732f55659bc6318874f49af",
"status": "affected",
"version": "de9cbbaadba5adf88a19e46df61f7054000838f6",
"versionType": "git"
},
{
"lessThan": "32ce55d424395904986f5066f8755f6cb9993377",
"status": "affected",
"version": "de9cbbaadba5adf88a19e46df61f7054000838f6",
"versionType": "git"
},
{
"lessThan": "fc39753b7f92e09177777e9c648afe5aa3abb81f",
"status": "affected",
"version": "de9cbbaadba5adf88a19e46df61f7054000838f6",
"versionType": "git"
},
{
"lessThan": "5828b9e5b272ecff7cf5d345128d3de7324117f7",
"status": "affected",
"version": "de9cbbaadba5adf88a19e46df61f7054000838f6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/local_storage.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.33",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix end-of-list detection in cgroup_storage_get_next_key()\n\nlist_next_entry() never returns NULL -- when the current element is the\nlast entry it wraps to the list head via container_of(). The subsequent\nNULL check is therefore dead code and get_next_key() never returns\n-ENOENT for the last element, instead reading storage-\u003ekey from a bogus\npointer that aliases internal map fields and copying the result to\nuserspace.\n\nReplace it with list_entry_is_head() so the function correctly returns\n-ENOENT when there are no more entries."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:46:05.613Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f3d9dd5e1fd52b39e25328307c6a694e994ffe3"
},
{
"url": "https://git.kernel.org/stable/c/26d3339e465e54107bd85884341d1609c5300d6a"
},
{
"url": "https://git.kernel.org/stable/c/2c88b2d96e1d4d0c7c4589a4593d4cdee6d332d6"
},
{
"url": "https://git.kernel.org/stable/c/b4b5a20bed82130da2f2818f04d52378952fbd0b"
},
{
"url": "https://git.kernel.org/stable/c/85a2f30e40f7468db732f55659bc6318874f49af"
},
{
"url": "https://git.kernel.org/stable/c/32ce55d424395904986f5066f8755f6cb9993377"
},
{
"url": "https://git.kernel.org/stable/c/fc39753b7f92e09177777e9c648afe5aa3abb81f"
},
{
"url": "https://git.kernel.org/stable/c/5828b9e5b272ecff7cf5d345128d3de7324117f7"
}
],
"title": "bpf: fix end-of-list detection in cgroup_storage_get_next_key()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45838",
"datePublished": "2026-05-27T09:24:36.561Z",
"dateReserved": "2026-05-13T15:03:33.077Z",
"dateUpdated": "2026-06-14T17:46:05.613Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-43157 (GCVE-0-2026-43157)
Vulnerability from cvelistv5
Published
2026-05-06 11:27
Modified
2026-05-11 22:18
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-af: CGX: fix bitmap leaks
The RX/TX flow-control bitmaps (rx_fc_pfvf_bmap and tx_fc_pfvf_bmap)
are allocated by cgx_lmac_init() but never freed in cgx_lmac_exit().
Unbinding and rebinding the driver therefore triggers kmemleak:
unreferenced object (size 16):
backtrace:
rvu_alloc_bitmap
cgx_probe
Free both bitmaps during teardown.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: e740003874edc13e468d19233f99787bedb4bb8e Version: e740003874edc13e468d19233f99787bedb4bb8e Version: e740003874edc13e468d19233f99787bedb4bb8e Version: e740003874edc13e468d19233f99787bedb4bb8e Version: e740003874edc13e468d19233f99787bedb4bb8e Version: e740003874edc13e468d19233f99787bedb4bb8e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/octeontx2/af/cgx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ad8a13a45c5c24d0d32de9a1c3fd58498a675ece",
"status": "affected",
"version": "e740003874edc13e468d19233f99787bedb4bb8e",
"versionType": "git"
},
{
"lessThan": "013ac469596a0b8671e62d89c89ae0bd46bbe667",
"status": "affected",
"version": "e740003874edc13e468d19233f99787bedb4bb8e",
"versionType": "git"
},
{
"lessThan": "ccef79af58b43787c25710c9da96651c6ddfe50f",
"status": "affected",
"version": "e740003874edc13e468d19233f99787bedb4bb8e",
"versionType": "git"
},
{
"lessThan": "6d389382ee655128056fbdab86baad8495ffbf33",
"status": "affected",
"version": "e740003874edc13e468d19233f99787bedb4bb8e",
"versionType": "git"
},
{
"lessThan": "ccca14bbdcc25829d355b9f4d3249f43dadb71c1",
"status": "affected",
"version": "e740003874edc13e468d19233f99787bedb4bb8e",
"versionType": "git"
},
{
"lessThan": "3def995c4ede842adf509c410e92d09a0cedc965",
"status": "affected",
"version": "e740003874edc13e468d19233f99787bedb4bb8e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/octeontx2/af/cgx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.165",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.165",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.128",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.75",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: CGX: fix bitmap leaks\n\nThe RX/TX flow-control bitmaps (rx_fc_pfvf_bmap and tx_fc_pfvf_bmap)\nare allocated by cgx_lmac_init() but never freed in cgx_lmac_exit().\nUnbinding and rebinding the driver therefore triggers kmemleak:\n\n unreferenced object (size 16):\n backtrace:\n rvu_alloc_bitmap\n cgx_probe\n\nFree both bitmaps during teardown."
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T22:18:51.830Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ad8a13a45c5c24d0d32de9a1c3fd58498a675ece"
},
{
"url": "https://git.kernel.org/stable/c/013ac469596a0b8671e62d89c89ae0bd46bbe667"
},
{
"url": "https://git.kernel.org/stable/c/ccef79af58b43787c25710c9da96651c6ddfe50f"
},
{
"url": "https://git.kernel.org/stable/c/6d389382ee655128056fbdab86baad8495ffbf33"
},
{
"url": "https://git.kernel.org/stable/c/ccca14bbdcc25829d355b9f4d3249f43dadb71c1"
},
{
"url": "https://git.kernel.org/stable/c/3def995c4ede842adf509c410e92d09a0cedc965"
}
],
"title": "octeontx2-af: CGX: fix bitmap leaks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43157",
"datePublished": "2026-05-06T11:27:37.185Z",
"dateReserved": "2026-05-01T14:12:55.990Z",
"dateUpdated": "2026-05-11T22:18:51.830Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71302 (GCVE-0-2025-71302)
Vulnerability from cvelistv5
Published
2026-05-08 13:26
Modified
2026-08-05 12:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: fix for dma-fence safe access rules
Commit 506aa8b02a8d6 ("dma-fence: Add safe access helpers and document
the rules") details the dma-fence safe access rules. The most common
culprit is that drm_sched_fence_get_timeline_name may race with
group_free_queue.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panthor/panthor_sched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ab8c0de60f16d7e0b162ccbbb35fcf1f277c97c2",
"status": "affected",
"version": "de85488138247d034eb3241840424a54d660926b",
"versionType": "git"
},
{
"lessThan": "eae60933abd11df013876f647c9edbd35ce67615",
"status": "affected",
"version": "de85488138247d034eb3241840424a54d660926b",
"versionType": "git"
},
{
"lessThan": "efe24898485c5c831e629d9c6fb9350c35cb576f",
"status": "affected",
"version": "de85488138247d034eb3241840424a54d660926b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/panthor/panthor_sched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.16",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.6",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: fix for dma-fence safe access rules\n\nCommit 506aa8b02a8d6 (\"dma-fence: Add safe access helpers and document\nthe rules\") details the dma-fence safe access rules. The most common\nculprit is that drm_sched_fence_get_timeline_name may race with\ngroup_free_queue."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An attacker reaches the flaw through DRM ioctls on a local Panthor render node and SYNC_IOC_FILE_INFO on an exported sync-file.\nAC:L - The attacker controls both sides by querying the exported fence concurrently with GROUP_DESTROY or file closure and can repeat the race while spraying reclaimed heap objects.\nPR:L - All required Panthor, syncobj, and export operations are DRM_RENDER_ALLOW; ordinary-priority groups require neither DRM master nor a capability.\nUI:N - The attacker independently creates the VM, group, job, syncobj, and sync-file and triggers teardown without victim action.\nS:U - The vulnerability compromises resources governed by the same host kernel and does not inherently cross a VM or IOMMU security boundary.\nC:H - The exported scheduler fence can outlive the freed queue, allowing the timeline callback to dereference reclaimed scheduler and name data. Heap reclamation can provide a chosen source pointer whose contents are copied through SYNC_IOC_FILE_INFO, supporting repeated kernel-memory disclosure.\nI:H - This is a kernel heap use-after-free involving surviving dma-fence references into reclaimed queue state. Under conservative UAF scoring, attacker-influenced heap reuse is treated as potentially enabling arbitrary memory modification or control-flow hijacking.\nA:H - Dereferencing a stale or attacker-influenced scheduler-name pointer can cause a kernel fault, oops, or panic, and an unprivileged attacker can trigger the condition repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:12:44.474Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ab8c0de60f16d7e0b162ccbbb35fcf1f277c97c2"
},
{
"url": "https://git.kernel.org/stable/c/eae60933abd11df013876f647c9edbd35ce67615"
},
{
"url": "https://git.kernel.org/stable/c/efe24898485c5c831e629d9c6fb9350c35cb576f"
}
],
"title": "drm/panthor: fix for dma-fence safe access rules",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-71302",
"datePublished": "2026-05-08T13:26:11.418Z",
"dateReserved": "2026-05-08T13:14:33.087Z",
"dateUpdated": "2026-08-05T12:12:44.474Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46091 (GCVE-0-2026-46091)
Vulnerability from cvelistv5
Published
2026-05-27 12:58
Modified
2026-06-19 11:59
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: rc: igorplugusb: heed coherency rules
In a control request, the USB request structure
can be subject to DMA on some HCs. Hence it must obey
the rules for DMA coherency. Allocate it separately.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b1c97193c6437a6083da67f8e97c8ee29b2f1989 Version: b1c97193c6437a6083da67f8e97c8ee29b2f1989 Version: b1c97193c6437a6083da67f8e97c8ee29b2f1989 Version: b1c97193c6437a6083da67f8e97c8ee29b2f1989 Version: b1c97193c6437a6083da67f8e97c8ee29b2f1989 Version: b1c97193c6437a6083da67f8e97c8ee29b2f1989 Version: b1c97193c6437a6083da67f8e97c8ee29b2f1989 Version: b1c97193c6437a6083da67f8e97c8ee29b2f1989 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/rc/igorplugusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bc04b8633b375af6ac8a8bb615258b80fe06cdaa",
"status": "affected",
"version": "b1c97193c6437a6083da67f8e97c8ee29b2f1989",
"versionType": "git"
},
{
"lessThan": "81f0fb813e4bf28b3ca28dc218938a32eb48f740",
"status": "affected",
"version": "b1c97193c6437a6083da67f8e97c8ee29b2f1989",
"versionType": "git"
},
{
"lessThan": "0e84aa8fc23c7578f105e3a2160f9d0aa2bed79a",
"status": "affected",
"version": "b1c97193c6437a6083da67f8e97c8ee29b2f1989",
"versionType": "git"
},
{
"lessThan": "18d6a7c9e4e63c57157e9a57dd9bf3cd38e4c45a",
"status": "affected",
"version": "b1c97193c6437a6083da67f8e97c8ee29b2f1989",
"versionType": "git"
},
{
"lessThan": "0be8fcd9005e3d3b5a61fe34b070a9663adbb4dc",
"status": "affected",
"version": "b1c97193c6437a6083da67f8e97c8ee29b2f1989",
"versionType": "git"
},
{
"lessThan": "0adac0ee2c42027d80bac02ea9b576a88f8955d3",
"status": "affected",
"version": "b1c97193c6437a6083da67f8e97c8ee29b2f1989",
"versionType": "git"
},
{
"lessThan": "a62ca67e3c72fb297dc7c86495ba8f7329d7f150",
"status": "affected",
"version": "b1c97193c6437a6083da67f8e97c8ee29b2f1989",
"versionType": "git"
},
{
"lessThan": "eac69475b01fe1e861dfe3960b57fa95671c132e",
"status": "affected",
"version": "b1c97193c6437a6083da67f8e97c8ee29b2f1989",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/rc/igorplugusb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rc: igorplugusb: heed coherency rules\n\nIn a control request, the USB request structure\ncan be subject to DMA on some HCs. Hence it must obey\nthe rules for DMA coherency. Allocate it separately."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-19T11:59:27.632Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bc04b8633b375af6ac8a8bb615258b80fe06cdaa"
},
{
"url": "https://git.kernel.org/stable/c/81f0fb813e4bf28b3ca28dc218938a32eb48f740"
},
{
"url": "https://git.kernel.org/stable/c/0e84aa8fc23c7578f105e3a2160f9d0aa2bed79a"
},
{
"url": "https://git.kernel.org/stable/c/18d6a7c9e4e63c57157e9a57dd9bf3cd38e4c45a"
},
{
"url": "https://git.kernel.org/stable/c/0be8fcd9005e3d3b5a61fe34b070a9663adbb4dc"
},
{
"url": "https://git.kernel.org/stable/c/0adac0ee2c42027d80bac02ea9b576a88f8955d3"
},
{
"url": "https://git.kernel.org/stable/c/a62ca67e3c72fb297dc7c86495ba8f7329d7f150"
},
{
"url": "https://git.kernel.org/stable/c/eac69475b01fe1e861dfe3960b57fa95671c132e"
}
],
"title": "media: rc: igorplugusb: heed coherency rules",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46091",
"datePublished": "2026-05-27T12:58:35.422Z",
"dateReserved": "2026-05-13T15:03:33.097Z",
"dateUpdated": "2026-06-19T11:59:27.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-46088 (GCVE-0-2026-46088)
Vulnerability from cvelistv5
Published
2026-05-27 12:58
Modified
2026-06-14 17:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()
snd_ctl_elem_init_enum_names() advances pointer p through the names
buffer while decrementing buf_len. If buf_len reaches zero but items
remain, the next iteration calls strnlen(p, 0).
While strnlen(p, 0) returns 0 and would hit the existing name_len == 0
error path, CONFIG_FORTIFY_SOURCE's fortified strnlen() first checks
maxlen against __builtin_dynamic_object_size(). When Clang loses track
of p's object size inside the loop, this triggers a BRK exception panic
before the return value is examined.
Add a buf_len == 0 guard at the loop entry to prevent calling fortified
strnlen() on an exhausted buffer.
Found by kernel fuzz testing through Xiaomi Smartphone.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4 Version: 8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4 Version: 8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4 Version: 8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4 Version: 8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4 Version: 8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4 Version: 8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4 Version: 8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/core/control.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "708f6ec9bcdf58bfd561409110baaf4fd3be4ea3",
"status": "affected",
"version": "8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4",
"versionType": "git"
},
{
"lessThan": "bfcbb4994da9e979c4bcfcf24aaaac69e457e48e",
"status": "affected",
"version": "8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4",
"versionType": "git"
},
{
"lessThan": "a470f7cabc4df72d9bd132f5719a8717292bb440",
"status": "affected",
"version": "8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4",
"versionType": "git"
},
{
"lessThan": "1fbe46d2b72754d8bd580e13e59ccb5d3d0e8cb0",
"status": "affected",
"version": "8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4",
"versionType": "git"
},
{
"lessThan": "8ba0214c3dd32b8ec652947e3f2bc5b8f6e6be9e",
"status": "affected",
"version": "8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4",
"versionType": "git"
},
{
"lessThan": "654c818a69c21d2bea4e8fd9eae7da865df9a5c8",
"status": "affected",
"version": "8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4",
"versionType": "git"
},
{
"lessThan": "82012fd3e78a14360fbc2f1a7491589896704f97",
"status": "affected",
"version": "8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4",
"versionType": "git"
},
{
"lessThan": "e0da8a8cac74f4b9f577979d131f0d2b88a84487",
"status": "affected",
"version": "8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/core/control.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.209",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.258",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.209",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.175",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.140",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.86",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()\n\nsnd_ctl_elem_init_enum_names() advances pointer p through the names\nbuffer while decrementing buf_len. If buf_len reaches zero but items\nremain, the next iteration calls strnlen(p, 0).\n\nWhile strnlen(p, 0) returns 0 and would hit the existing name_len == 0\nerror path, CONFIG_FORTIFY_SOURCE\u0027s fortified strnlen() first checks\nmaxlen against __builtin_dynamic_object_size(). When Clang loses track\nof p\u0027s object size inside the loop, this triggers a BRK exception panic\nbefore the return value is examined.\n\nAdd a buf_len == 0 guard at the loop entry to prevent calling fortified\nstrnlen() on an exhausted buffer.\n\nFound by kernel fuzz testing through Xiaomi Smartphone."
}
],
"providerMetadata": {
"dateUpdated": "2026-06-14T17:53:28.015Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/708f6ec9bcdf58bfd561409110baaf4fd3be4ea3"
},
{
"url": "https://git.kernel.org/stable/c/bfcbb4994da9e979c4bcfcf24aaaac69e457e48e"
},
{
"url": "https://git.kernel.org/stable/c/a470f7cabc4df72d9bd132f5719a8717292bb440"
},
{
"url": "https://git.kernel.org/stable/c/1fbe46d2b72754d8bd580e13e59ccb5d3d0e8cb0"
},
{
"url": "https://git.kernel.org/stable/c/8ba0214c3dd32b8ec652947e3f2bc5b8f6e6be9e"
},
{
"url": "https://git.kernel.org/stable/c/654c818a69c21d2bea4e8fd9eae7da865df9a5c8"
},
{
"url": "https://git.kernel.org/stable/c/82012fd3e78a14360fbc2f1a7491589896704f97"
},
{
"url": "https://git.kernel.org/stable/c/e0da8a8cac74f4b9f577979d131f0d2b88a84487"
}
],
"title": "ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46088",
"datePublished": "2026-05-27T12:58:31.895Z",
"dateReserved": "2026-05-13T15:03:33.096Z",
"dateUpdated": "2026-06-14T17:53:28.015Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…