Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0929
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian 12 bookworm versions ant\u00e9rieures \u00e0 6.1.177-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-53138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53138"
},
{
"name": "CVE-2025-23131",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-23131"
},
{
"name": "CVE-2026-53163",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53163"
},
{
"name": "CVE-2026-53327",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53327"
},
{
"name": "CVE-2026-46252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46252"
},
{
"name": "CVE-2026-53158",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53158"
},
{
"name": "CVE-2026-53139",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53139"
},
{
"name": "CVE-2026-53362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53362"
},
{
"name": "CVE-2026-23302",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23302"
},
{
"name": "CVE-2026-53157",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53157"
},
{
"name": "CVE-2026-53167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53167"
},
{
"name": "CVE-2026-23278",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23278"
},
{
"name": "CVE-2026-31451",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31451"
},
{
"name": "CVE-2026-53359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53359"
},
{
"name": "CVE-2026-23272",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23272"
},
{
"name": "CVE-2026-53325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53325"
},
{
"name": "CVE-2026-52928",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52928"
},
{
"name": "CVE-2026-53366",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53366"
}
],
"initial_release_date": "2026-07-24T00:00:00",
"last_revision_date": "2026-07-24T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0929",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-07-24T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian LTS. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian LTS",
"vendor_advisories": [
{
"published_at": "2026-07-18",
"title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00030",
"url": "https://lists.debian.org/debian-lts-announce/2026/07/msg00030.html"
}
]
}
CVE-2026-46252 (GCVE-0-2026-46252)
Vulnerability from cvelistv5
Published
2026-06-03 15:49
Modified
2026-07-04 11:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
regulator: core: fix locking in regulator_resolve_supply() error path
If late enabling of a supply regulator fails in
regulator_resolve_supply(), the code currently triggers a lockdep
warning:
WARNING: drivers/regulator/core.c:2649 at _regulator_put+0x80/0xa0, CPU#6: kworker/u32:4/596
...
Call trace:
_regulator_put+0x80/0xa0 (P)
regulator_resolve_supply+0x7cc/0xbe0
regulator_register_resolve_supply+0x28/0xb8
as the regulator_list_mutex must be held when calling _regulator_put().
To solve this, simply switch to using regulator_put().
While at it, we should also make sure that no concurrent access happens
to our rdev while we clear out the supply pointer. Add appropriate
locking to ensure that.
While the code in question will be removed altogether in a follow-up
commit, I believe it is still beneficial to have this corrected before
removal for future reference.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 36a1f1b6ddc6d1442424e29548e790633ca39c7b Version: 36a1f1b6ddc6d1442424e29548e790633ca39c7b Version: 36a1f1b6ddc6d1442424e29548e790633ca39c7b Version: 36a1f1b6ddc6d1442424e29548e790633ca39c7b Version: 36a1f1b6ddc6d1442424e29548e790633ca39c7b Version: 36a1f1b6ddc6d1442424e29548e790633ca39c7b Version: 36a1f1b6ddc6d1442424e29548e790633ca39c7b Version: 36a1f1b6ddc6d1442424e29548e790633ca39c7b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/regulator/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e77357dc2293283fc08a485b1e2e571d91d02622",
"status": "affected",
"version": "36a1f1b6ddc6d1442424e29548e790633ca39c7b",
"versionType": "git"
},
{
"lessThan": "a8a2eab1166bc33ee38ca371cff425bdb5681e47",
"status": "affected",
"version": "36a1f1b6ddc6d1442424e29548e790633ca39c7b",
"versionType": "git"
},
{
"lessThan": "60747114fd2a38739130b715e7b2d40ce848f0be",
"status": "affected",
"version": "36a1f1b6ddc6d1442424e29548e790633ca39c7b",
"versionType": "git"
},
{
"lessThan": "c84860dac7af7dc3c3e3c9ae86d65e222c2f3b0c",
"status": "affected",
"version": "36a1f1b6ddc6d1442424e29548e790633ca39c7b",
"versionType": "git"
},
{
"lessThan": "3b7fffd7a8984a1c009f668765ee7631fd6b87c8",
"status": "affected",
"version": "36a1f1b6ddc6d1442424e29548e790633ca39c7b",
"versionType": "git"
},
{
"lessThan": "bde74af8d4466213007bdd42cc85fa72c861dea7",
"status": "affected",
"version": "36a1f1b6ddc6d1442424e29548e790633ca39c7b",
"versionType": "git"
},
{
"lessThan": "c66e0db0f37290b53c57994f998bb55590364fd0",
"status": "affected",
"version": "36a1f1b6ddc6d1442424e29548e790633ca39c7b",
"versionType": "git"
},
{
"lessThan": "497330b203d2c59c5ff3fa4c34d14494d7203bc3",
"status": "affected",
"version": "36a1f1b6ddc6d1442424e29548e790633ca39c7b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/regulator/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: core: fix locking in regulator_resolve_supply() error path\n\nIf late enabling of a supply regulator fails in\nregulator_resolve_supply(), the code currently triggers a lockdep\nwarning:\n\n WARNING: drivers/regulator/core.c:2649 at _regulator_put+0x80/0xa0, CPU#6: kworker/u32:4/596\n ...\n Call trace:\n _regulator_put+0x80/0xa0 (P)\n regulator_resolve_supply+0x7cc/0xbe0\n regulator_register_resolve_supply+0x28/0xb8\n\nas the regulator_list_mutex must be held when calling _regulator_put().\n\nTo solve this, simply switch to using regulator_put().\n\nWhile at it, we should also make sure that no concurrent access happens\nto our rdev while we clear out the supply pointer. Add appropriate\nlocking to ensure that.\n\nWhile the code in question will be removed altogether in a follow-up\ncommit, I believe it is still beneficial to have this corrected before\nremoval for future reference."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:50:44.068Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e77357dc2293283fc08a485b1e2e571d91d02622"
},
{
"url": "https://git.kernel.org/stable/c/a8a2eab1166bc33ee38ca371cff425bdb5681e47"
},
{
"url": "https://git.kernel.org/stable/c/60747114fd2a38739130b715e7b2d40ce848f0be"
},
{
"url": "https://git.kernel.org/stable/c/c84860dac7af7dc3c3e3c9ae86d65e222c2f3b0c"
},
{
"url": "https://git.kernel.org/stable/c/3b7fffd7a8984a1c009f668765ee7631fd6b87c8"
},
{
"url": "https://git.kernel.org/stable/c/bde74af8d4466213007bdd42cc85fa72c861dea7"
},
{
"url": "https://git.kernel.org/stable/c/c66e0db0f37290b53c57994f998bb55590364fd0"
},
{
"url": "https://git.kernel.org/stable/c/497330b203d2c59c5ff3fa4c34d14494d7203bc3"
}
],
"title": "regulator: core: fix locking in regulator_resolve_supply() error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46252",
"datePublished": "2026-06-03T15:49:48.784Z",
"dateReserved": "2026-05-13T15:03:33.107Z",
"dateUpdated": "2026-07-04T11:50:44.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31451 (GCVE-0-2026-31451)
Vulnerability from cvelistv5
Published
2026-04-22 13:53
Modified
2026-07-04 11:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio
Replace BUG_ON() with proper error handling when inline data size
exceeds PAGE_SIZE. This prevents kernel panic and allows the system to
continue running while properly reporting the filesystem corruption.
The error is logged via ext4_error_inode(), the buffer head is released
to prevent memory leak, and -EFSCORRUPTED is returned to indicate
filesystem corruption.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 46c7f254543dedcf134ad05091ed2b935a9a597d Version: 46c7f254543dedcf134ad05091ed2b935a9a597d Version: 46c7f254543dedcf134ad05091ed2b935a9a597d Version: 46c7f254543dedcf134ad05091ed2b935a9a597d Version: 46c7f254543dedcf134ad05091ed2b935a9a597d Version: 46c7f254543dedcf134ad05091ed2b935a9a597d Version: 46c7f254543dedcf134ad05091ed2b935a9a597d Version: 46c7f254543dedcf134ad05091ed2b935a9a597d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/inline.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3462a3f0716d27af51896dc8688bcf0628fb17ee",
"status": "affected",
"version": "46c7f254543dedcf134ad05091ed2b935a9a597d",
"versionType": "git"
},
{
"lessThan": "636e8d85a36ab6c31aafd04ee66a69b18eebee7b",
"status": "affected",
"version": "46c7f254543dedcf134ad05091ed2b935a9a597d",
"versionType": "git"
},
{
"lessThan": "af25a6affeac4919e8d8c5cccc01a9d53478447e",
"status": "affected",
"version": "46c7f254543dedcf134ad05091ed2b935a9a597d",
"versionType": "git"
},
{
"lessThan": "65c6c30ce6362c1c684568744ea510c921a756cd",
"status": "affected",
"version": "46c7f254543dedcf134ad05091ed2b935a9a597d",
"versionType": "git"
},
{
"lessThan": "d4b3f370c3d8f7ce565d4a718572c9f7c12f77ed",
"status": "affected",
"version": "46c7f254543dedcf134ad05091ed2b935a9a597d",
"versionType": "git"
},
{
"lessThan": "823849a26af089ffc5dfdd2ae4b9d446b46a0cda",
"status": "affected",
"version": "46c7f254543dedcf134ad05091ed2b935a9a597d",
"versionType": "git"
},
{
"lessThan": "a7d600e04732a7d29b107c91fe3aec64cf6ce7f2",
"status": "affected",
"version": "46c7f254543dedcf134ad05091ed2b935a9a597d",
"versionType": "git"
},
{
"lessThan": "356227096eb66e41b23caf7045e6304877322edf",
"status": "affected",
"version": "46c7f254543dedcf134ad05091ed2b935a9a597d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/inline.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.131",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.80",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.21",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.131",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.80",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.21",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.11",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: replace BUG_ON with proper error handling in ext4_read_inline_folio\n\nReplace BUG_ON() with proper error handling when inline data size\nexceeds PAGE_SIZE. This prevents kernel panic and allows the system to\ncontinue running while properly reporting the filesystem corruption.\n\nThe error is logged via ext4_error_inode(), the buffer head is released\nto prevent memory leak, and -EFSCORRUPTED is returned to indicate\nfilesystem corruption."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:50:31.661Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3462a3f0716d27af51896dc8688bcf0628fb17ee"
},
{
"url": "https://git.kernel.org/stable/c/636e8d85a36ab6c31aafd04ee66a69b18eebee7b"
},
{
"url": "https://git.kernel.org/stable/c/af25a6affeac4919e8d8c5cccc01a9d53478447e"
},
{
"url": "https://git.kernel.org/stable/c/65c6c30ce6362c1c684568744ea510c921a756cd"
},
{
"url": "https://git.kernel.org/stable/c/d4b3f370c3d8f7ce565d4a718572c9f7c12f77ed"
},
{
"url": "https://git.kernel.org/stable/c/823849a26af089ffc5dfdd2ae4b9d446b46a0cda"
},
{
"url": "https://git.kernel.org/stable/c/a7d600e04732a7d29b107c91fe3aec64cf6ce7f2"
},
{
"url": "https://git.kernel.org/stable/c/356227096eb66e41b23caf7045e6304877322edf"
}
],
"title": "ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-31451",
"datePublished": "2026-04-22T13:53:46.243Z",
"dateReserved": "2026-03-09T15:48:24.091Z",
"dateUpdated": "2026-07-04T11:50:31.661Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53167 (GCVE-0-2026-53167)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-07-30 12:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
FUSE_NOTIFY_RETRIEVE must be limited to uptodate folios; !uptodate folios
can contain uninitialized data.
Since FUSE_NOTIFY_RETRIEVE is intended to only return data that is already
in the page cache and not wait for data from the FUSE daemon, treat
!uptodate folios as if they weren't present.
This only has security impact on systems that don't enable automatic
zero-initialization of all page allocations via
CONFIG_INIT_ON_ALLOC_DEFAULT_ON or init_on_alloc=1.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a Version: 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a Version: 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a Version: 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a Version: 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a Version: 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a Version: 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a Version: 2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/fuse/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "feafe8ccb1584254f59fbd4946d6ca7ef1e3e99c",
"status": "affected",
"version": "2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a",
"versionType": "git"
},
{
"lessThan": "651801d75ad0897dbd331b3cc6a4da3e78f60d42",
"status": "affected",
"version": "2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a",
"versionType": "git"
},
{
"lessThan": "4e14f29473eda18fb2af082dd2fd4c12139862cd",
"status": "affected",
"version": "2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a",
"versionType": "git"
},
{
"lessThan": "8bef2f840b43e0879478fe3aaa9ff2f0b80798a5",
"status": "affected",
"version": "2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a",
"versionType": "git"
},
{
"lessThan": "68a9282d5ea5b8780d59122505ad633e6daede90",
"status": "affected",
"version": "2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a",
"versionType": "git"
},
{
"lessThan": "56763afa013444a9d84ca1b74e4b7130942177ba",
"status": "affected",
"version": "2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a",
"versionType": "git"
},
{
"lessThan": "1fb8735a3a4d894f8c1f90b741a3ab1d3817f9bd",
"status": "affected",
"version": "2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a",
"versionType": "git"
},
{
"lessThan": "4e3d1b2c48ca6c55f1e9ca7f8dccc76f120f276c",
"status": "affected",
"version": "2d45ba381a74a743eeaa2b06c7c5c0d2bf73ba1a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/fuse/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"lessThan": "2.6.36",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios\n\nFUSE_NOTIFY_RETRIEVE must be limited to uptodate folios; !uptodate folios\ncan contain uninitialized data.\nSince FUSE_NOTIFY_RETRIEVE is intended to only return data that is already\nin the page cache and not wait for data from the FUSE daemon, treat\n!uptodate folios as if they weren\u0027t present.\n\nThis only has security impact on systems that don\u0027t enable automatic\nzero-initialization of all page allocations via\nCONFIG_INIT_ON_ALLOC_DEFAULT_ON or init_on_alloc=1."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-30T12:57:11.720Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/feafe8ccb1584254f59fbd4946d6ca7ef1e3e99c"
},
{
"url": "https://git.kernel.org/stable/c/651801d75ad0897dbd331b3cc6a4da3e78f60d42"
},
{
"url": "https://git.kernel.org/stable/c/4e14f29473eda18fb2af082dd2fd4c12139862cd"
},
{
"url": "https://git.kernel.org/stable/c/8bef2f840b43e0879478fe3aaa9ff2f0b80798a5"
},
{
"url": "https://git.kernel.org/stable/c/68a9282d5ea5b8780d59122505ad633e6daede90"
},
{
"url": "https://git.kernel.org/stable/c/56763afa013444a9d84ca1b74e4b7130942177ba"
},
{
"url": "https://git.kernel.org/stable/c/1fb8735a3a4d894f8c1f90b741a3ab1d3817f9bd"
},
{
"url": "https://git.kernel.org/stable/c/4e3d1b2c48ca6c55f1e9ca7f8dccc76f120f276c"
},
{
"url": "https://project-zero.issues.chromium.org/issues/514653451"
}
],
"title": "fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53167",
"datePublished": "2026-06-25T08:38:46.751Z",
"dateReserved": "2026-06-09T07:44:35.389Z",
"dateUpdated": "2026-07-30T12:57:11.720Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23272 (GCVE-0-2026-23272)
Vulnerability from cvelistv5
Published
2026-03-20 08:08
Modified
2026-08-05 12:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: unconditionally bump set->nelems before insertion
In case that the set is full, a new element gets published then removed
without waiting for the RCU grace period, while RCU reader can be
walking over it already.
To address this issue, add the element transaction even if set is full,
but toggle the set_full flag to report -ENFILE so the abort path safely
unwinds the set to its previous state.
As for element updates, decrement set->nelems to restore it.
A simpler fix is to call synchronize_rcu() in the error path.
However, with a large batch adding elements to already maxed-out set,
this could cause noticeable slowdown of such batches.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 35d0ac9070ef619e3bf44324375878a1c540387b Version: 35d0ac9070ef619e3bf44324375878a1c540387b Version: 35d0ac9070ef619e3bf44324375878a1c540387b Version: 35d0ac9070ef619e3bf44324375878a1c540387b Version: 35d0ac9070ef619e3bf44324375878a1c540387b Version: 35d0ac9070ef619e3bf44324375878a1c540387b Version: fefdd79403e89b0c673965343b92e2e01e2713a8 Version: 4.9.33 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_tables_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "25fcaef7948912652905e96922f36583a84fffed",
"status": "affected",
"version": "35d0ac9070ef619e3bf44324375878a1c540387b",
"versionType": "git"
},
{
"lessThan": "e3ccb11fc8249759d23326038c8db987ddaabc77",
"status": "affected",
"version": "35d0ac9070ef619e3bf44324375878a1c540387b",
"versionType": "git"
},
{
"lessThan": "86bc4b1a0f672d47ac19f9022432cb6a2e01cb33",
"status": "affected",
"version": "35d0ac9070ef619e3bf44324375878a1c540387b",
"versionType": "git"
},
{
"lessThan": "6826131c7674329335ca25df2550163eb8a1fd0c",
"status": "affected",
"version": "35d0ac9070ef619e3bf44324375878a1c540387b",
"versionType": "git"
},
{
"lessThan": "ccb8c8f3c1127cf34d18c737309897c68046bf21",
"status": "affected",
"version": "35d0ac9070ef619e3bf44324375878a1c540387b",
"versionType": "git"
},
{
"lessThan": "def602e498a4f951da95c95b1b8ce8ae68aa733a",
"status": "affected",
"version": "35d0ac9070ef619e3bf44324375878a1c540387b",
"versionType": "git"
},
{
"status": "affected",
"version": "fefdd79403e89b0c673965343b92e2e01e2713a8",
"versionType": "git"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.33",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_tables_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.141",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.91",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unconditionally bump set-\u003enelems before insertion\n\nIn case that the set is full, a new element gets published then removed\nwithout waiting for the RCU grace period, while RCU reader can be\nwalking over it already.\n\nTo address this issue, add the element transaction even if set is full,\nbut toggle the set_full flag to report -ENFILE so the abort path safely\nunwinds the set to its previous state.\n\nAs for element updates, decrement set-\u003enelems to restore it.\n\nA simpler fix is to call synchronize_rcu() in the error path.\nHowever, with a large batch adding elements to already maxed-out set,\nthis could cause noticeable slowdown of such batches."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - nftables is accessed via nfnetlink sockets which require local system access (netlink socket). This is not remotely reachable.\nAC:L - The attacker controls the conditions: they fill the set to maximum, then insert another element to trigger the UAF. While the RCU reader race exists, the attacker controls both the insertion and can arrange for concurrent lookups, making the race reliably triggerable.\nPR:L - nfnetlink requires CAP_NET_ADMIN, but nftables is per-network-namespace and reachable via user namespaces (unshare -Urn), so an unprivileged local user can obtain CAP_NET_ADMIN in a new namespace.\nUI:N - No user interaction is needed. The attacker can trigger this entirely through their own netlink socket operations.\nS:U - The vulnerability operates within the kernel\u0027s security authority. There is no crossing of a security boundary like VM escape or sandbox escape.\nC:H - This is a use-after-free where an RCU reader accesses freed memory. The freed memory can be reclaimed and filled with attacker-controlled data via heap spraying, enabling arbitrary kernel memory reads.\nI:H - Use-after-free in the kernel enables heap spraying and type confusion, allowing arbitrary write primitives and control flow hijacking for code execution.\nA:H - The UAF can cause kernel crashes (oops/panic) when RCU readers access freed or corrupted memory. Even without full exploitation, the bug reliably causes availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:21:02.795Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/25fcaef7948912652905e96922f36583a84fffed"
},
{
"url": "https://git.kernel.org/stable/c/e3ccb11fc8249759d23326038c8db987ddaabc77"
},
{
"url": "https://git.kernel.org/stable/c/86bc4b1a0f672d47ac19f9022432cb6a2e01cb33"
},
{
"url": "https://git.kernel.org/stable/c/6826131c7674329335ca25df2550163eb8a1fd0c"
},
{
"url": "https://git.kernel.org/stable/c/ccb8c8f3c1127cf34d18c737309897c68046bf21"
},
{
"url": "https://git.kernel.org/stable/c/def602e498a4f951da95c95b1b8ce8ae68aa733a"
}
],
"title": "netfilter: nf_tables: unconditionally bump set-\u003enelems before insertion",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23272",
"datePublished": "2026-03-20T08:08:52.946Z",
"dateReserved": "2026-01-13T15:37:45.991Z",
"dateUpdated": "2026-08-05T12:21:02.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53138 (GCVE-0-2026-53138)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-07-04 11:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd/display: Bound VBIOS record-chain walk loops
[Why & How]
All record-chain walk loops in bios_parser.c and bios_parser2.c use
for(;;) and only terminate on a 0xFF record_type sentinel or zero
record_size. A malformed VBIOS image missing the terminator record
causes unbounded iteration at probe time, potentially hundreds of
thousands of iterations with record_size=1. In the final iterations
near the BIOS image boundary, struct casts beyond the 2-byte header
validated by GET_IMAGE can also read out of bounds.
Cap all 14 record-chain walk loops to BIOS_MAX_NUM_RECORD (256)
iterations. The atombios.h defines up to 22 distinct record types
and atomfirmware.h has 13. Assuming an average of less than 10
records per type (which is reasonable since most are connector-
based) 256 is a generous upper bound.
(cherry picked from commit 95700a3d660287ed657d6892f7be9ffc0e294a93)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c Version: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c Version: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c Version: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c Version: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c Version: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c Version: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c Version: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/bios/bios_parser.c",
"drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c",
"drivers/gpu/drm/amd/display/dc/bios/bios_parser_helper.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e94f5323c41f32a74160378c3b19850d1f203ad5",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
},
{
"lessThan": "04e271a952b8863bbafc99bd51aca4c32bff0e0d",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
},
{
"lessThan": "6723188c42ca3b34a9fce634d7a0ecc9ccd5cd56",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
},
{
"lessThan": "499c6b43a79dd684bddbd18fe8b2235aa2764db4",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
},
{
"lessThan": "6173cfea2f916e01c4f98e29cd654384a05e32a3",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
},
{
"lessThan": "0e56f460bddb397fa9a8e6faf7ae7eaa86953eb1",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
},
{
"lessThan": "2645e3caf7e013189da9c6ff621d006cca5a538b",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
},
{
"lessThan": "ff287df16a1a58aca78b08d1f3ee09fc44da0351",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/bios/bios_parser.c",
"drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c",
"drivers/gpu/drm/amd/display/dc/bios/bios_parser_helper.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Bound VBIOS record-chain walk loops\n\n[Why \u0026 How]\nAll record-chain walk loops in bios_parser.c and bios_parser2.c use\nfor(;;) and only terminate on a 0xFF record_type sentinel or zero\nrecord_size. A malformed VBIOS image missing the terminator record\ncauses unbounded iteration at probe time, potentially hundreds of\nthousands of iterations with record_size=1. In the final iterations\nnear the BIOS image boundary, struct casts beyond the 2-byte header\nvalidated by GET_IMAGE can also read out of bounds.\n\nCap all 14 record-chain walk loops to BIOS_MAX_NUM_RECORD (256)\niterations. The atombios.h defines up to 22 distinct record types\nand atomfirmware.h has 13. Assuming an average of less than 10\nrecords per type (which is reasonable since most are connector-\nbased) 256 is a generous upper bound.\n\n(cherry picked from commit 95700a3d660287ed657d6892f7be9ffc0e294a93)"
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:50:51.199Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e94f5323c41f32a74160378c3b19850d1f203ad5"
},
{
"url": "https://git.kernel.org/stable/c/04e271a952b8863bbafc99bd51aca4c32bff0e0d"
},
{
"url": "https://git.kernel.org/stable/c/6723188c42ca3b34a9fce634d7a0ecc9ccd5cd56"
},
{
"url": "https://git.kernel.org/stable/c/499c6b43a79dd684bddbd18fe8b2235aa2764db4"
},
{
"url": "https://git.kernel.org/stable/c/6173cfea2f916e01c4f98e29cd654384a05e32a3"
},
{
"url": "https://git.kernel.org/stable/c/0e56f460bddb397fa9a8e6faf7ae7eaa86953eb1"
},
{
"url": "https://git.kernel.org/stable/c/2645e3caf7e013189da9c6ff621d006cca5a538b"
},
{
"url": "https://git.kernel.org/stable/c/ff287df16a1a58aca78b08d1f3ee09fc44da0351"
}
],
"title": "drm/amd/display: Bound VBIOS record-chain walk loops",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53138",
"datePublished": "2026-06-25T08:38:26.859Z",
"dateReserved": "2026-06-09T07:44:35.387Z",
"dateUpdated": "2026-07-04T11:50:51.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53362 (GCVE-0-2026-53362)
Vulnerability from cvelistv5
Published
2026-07-04 11:56
Modified
2026-08-28 16:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: account for fraggap on the paged allocation path
In __ip6_append_data(), when the paged-allocation branch is taken
(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are
computed as
alloclen = fragheaderlen + transhdrlen;
pagedlen = datalen - transhdrlen;
datalen already includes fraggap (datalen = length + fraggap). When
fraggap is non-zero, this is not the first skb and transhdrlen is zero.
The fraggap bytes carried over from the previous skb are copied just past
the fragment headers in the new skb's linear area. The linear area is
therefore undersized by fraggap bytes while pagedlen is overstated by the
same amount, and the copy writes past skb->end into the trailing
skb_shared_info.
An unprivileged user can trigger this via a UDPv6 socket using
MSG_MORE together with MSG_SPLICE_PAGES.
The bad accounting was introduced by commit 773ba4fe9104 ("ipv6:
avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix
__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative
copy value caused -EINVAL to be returned. That later commit allowed
MSG_SPLICE_PAGES to proceed in this case, making the corruption
triggerable.
The non-paged branch sets alloclen to fraglen, which already accounts
for fraggap because datalen does. Bring the paged branch in line by
adding fraggap to alloclen and subtracting it from pagedlen.
After this adjustment, copy no longer collapses to -fraggap on the
paged path, so remove the stale comment describing that old arithmetic.
Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES
case, remove the MSG_SPLICE_PAGES exception from the negative copy check.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 Version: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 Version: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 Version: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 Version: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 Version: 773ba4fe9104a64a54d1c00f0fb6ffb95def2b03 |
||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53362",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T03:55:26.491246Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-08-27",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122 Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:52:44.062Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "14200d435af9a9eeb444f529fc2f689a236b7962",
"status": "affected",
"version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03",
"versionType": "git"
},
{
"lessThan": "65fb14cbebb0cd0eff903a22d33537ddc8b95769",
"status": "affected",
"version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03",
"versionType": "git"
},
{
"lessThan": "46f201f8b4c39633a1fa3dc12459f506d470993d",
"status": "affected",
"version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03",
"versionType": "git"
},
{
"lessThan": "6374fb9edf72c67a118a2c214a0dddd04c921e0a",
"status": "affected",
"version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03",
"versionType": "git"
},
{
"lessThan": "e9eacf19281ea2498b36291b56c9606118c2d74e",
"status": "affected",
"version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03",
"versionType": "git"
},
{
"lessThan": "736b380e28d0480c7bc3e022f1950f31fe53a7c5",
"status": "affected",
"version": "773ba4fe9104a64a54d1c00f0fb6ffb95def2b03",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ip6_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: account for fraggap on the paged allocation path\n\nIn __ip6_append_data(), when the paged-allocation branch is taken\n(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are\ncomputed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap (datalen = length + fraggap). When\nfraggap is non-zero, this is not the first skb and transhdrlen is zero.\nThe fraggap bytes carried over from the previous skb are copied just past\nthe fragment headers in the new skb\u0027s linear area. The linear area is\ntherefore undersized by fraggap bytes while pagedlen is overstated by the\nsame amount, and the copy writes past skb-\u003eend into the trailing\nskb_shared_info.\n\nAn unprivileged user can trigger this via a UDPv6 socket using\nMSG_MORE together with MSG_SPLICE_PAGES.\n\nThe bad accounting was introduced by commit 773ba4fe9104 (\"ipv6:\navoid partial copy for zc\"). Before commit ce650a166335 (\"udp6: Fix\n__ip6_append_data()\u0027s handling of MSG_SPLICE_PAGES\"), the negative\ncopy value caused -EINVAL to be returned. That later commit allowed\nMSG_SPLICE_PAGES to proceed in this case, making the corruption\ntriggerable.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic.\nSince a negative copy is no longer expected for a valid MSG_SPLICE_PAGES\ncase, remove the MSG_SPLICE_PAGES exception from the negative copy check."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is IPv6 transmit skb construction reached by a local process using splice/send operations on an AF_INET6 UDP socket. Received network packets do not enter this path, and a remote peer cannot directly set MSG_SPLICE_PAGES.\nAC:L - No race is required; the attacker controls the UDPv6 socket, MSG_MORE/splice sequence, and send sizes needed to create a nonzero fraggap on the paged allocation path. NETIF_F_SG is common on plausible IPv6 interfaces, so the trigger conditions are not unusually restrictive.\nPR:L - Creating a SOCK_DGRAM IPv6 UDP socket and using splice into it requires only an unprivileged local user. The CAP_NET_RAW check in inet6_create applies to SOCK_RAW, not this UDP datagram path.\nUI:N - The attacker directly invokes the local syscalls and socket operations needed to trigger the bug. No victim user action is required.\nS:U - The corruption occurs within the kernel networking stack and impacts the same kernel security authority. It is not a VM escape, IOMMU/DMA bypass, or cross-scope boundary violation.\nC:H - The bug is an out-of-bounds write into skb_shared_info, which contains fragment metadata and pointers used later by networking code. Such attacker-controlled kernel memory corruption can plausibly be leveraged for information disclosure, so confidentiality is High.\nI:H - The fraggap bytes come from attacker-controlled skb data and are copied past skb-\u003eend into skb_shared_info. This is an out-of-bounds write to kernel metadata and is scored as High integrity impact.\nA:H - Corrupting skb_shared_info can readily crash or panic the kernel during skb handling, checksum, transmit, or cleanup. The vulnerability is therefore a High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:29.351Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/14200d435af9a9eeb444f529fc2f689a236b7962"
},
{
"url": "https://git.kernel.org/stable/c/65fb14cbebb0cd0eff903a22d33537ddc8b95769"
},
{
"url": "https://git.kernel.org/stable/c/46f201f8b4c39633a1fa3dc12459f506d470993d"
},
{
"url": "https://git.kernel.org/stable/c/6374fb9edf72c67a118a2c214a0dddd04c921e0a"
},
{
"url": "https://git.kernel.org/stable/c/e9eacf19281ea2498b36291b56c9606118c2d74e"
},
{
"url": "https://git.kernel.org/stable/c/736b380e28d0480c7bc3e022f1950f31fe53a7c5"
}
],
"title": "ipv6: account for fraggap on the paged allocation path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53362",
"datePublished": "2026-07-04T11:56:35.864Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-08-28T16:52:44.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53158 (GCVE-0-2026-53158)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-07-04 11:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
misc: fastrpc: Fix NULL pointer dereference in rpmsg callback
A NULL pointer dereference was observed on Hawi at boot when the DSP
sends a glink message before fastrpc_rpmsg_probe() has completed
initialization:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000178
pc : _raw_spin_lock_irqsave+0x34/0x8c
lr : fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc]
...
Call trace:
_raw_spin_lock_irqsave+0x34/0x8c (P)
fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc]
qcom_glink_native_rx+0x538/0x6a4
qcom_glink_smem_intr+0x14/0x24 [qcom_glink_smem]
The faulting address 0x178 corresponds to the lock variable inside
struct fastrpc_channel_ctx, confirming that cctx is NULL when
fastrpc_rpmsg_callback() attempts to take the spinlock.
There are two issues here. First, dev_set_drvdata() is called before
spin_lock_init() and idr_init(), leaving a window where the callback
can retrieve a valid cctx pointer but operate on an uninitialized
spinlock. Second, the rpmsg channel becomes live as soon as the driver
is bound, so fastrpc_rpmsg_callback() can fire before dev_set_drvdata()
is called at all, resulting in dev_get_drvdata() returning NULL.
Fix both issues by moving all cctx initialization ahead of
dev_set_drvdata() so the structure is fully initialized before it
becomes visible to the callback, and add a NULL check in
fastrpc_rpmsg_callback() as a guard against any remaining window.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 Version: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 Version: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 Version: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 Version: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 Version: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 Version: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 Version: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/misc/fastrpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a3d91218ccca1e990bfb737b5a6da23f0afba22b",
"status": "affected",
"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
"versionType": "git"
},
{
"lessThan": "0d8c64511fd45690c5326f013710efcb4f73a97e",
"status": "affected",
"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
"versionType": "git"
},
{
"lessThan": "150bf6f1193c69252580c19d3b3cd631ddce61d7",
"status": "affected",
"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
"versionType": "git"
},
{
"lessThan": "8fb4a23df5b7c02929b62e5dbc270ec7c42b8134",
"status": "affected",
"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
"versionType": "git"
},
{
"lessThan": "4bfdf0a9855df55e9e031ca6a25b855820590c70",
"status": "affected",
"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
"versionType": "git"
},
{
"lessThan": "d5de9cb5355db36438edc621dde3673e3f235767",
"status": "affected",
"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
"versionType": "git"
},
{
"lessThan": "d77583ca33299fede0c194744ef2284e7ba5b763",
"status": "affected",
"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
"versionType": "git"
},
{
"lessThan": "5401fb4fe10fac6134c308495df18ed74aebb9c4",
"status": "affected",
"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/misc/fastrpc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.1"
},
{
"lessThan": "5.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.94",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.94",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: Fix NULL pointer dereference in rpmsg callback\n\nA NULL pointer dereference was observed on Hawi at boot when the DSP\nsends a glink message before fastrpc_rpmsg_probe() has completed\ninitialization:\n\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000178\n pc : _raw_spin_lock_irqsave+0x34/0x8c\n lr : fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc]\n ...\n Call trace:\n _raw_spin_lock_irqsave+0x34/0x8c (P)\n fastrpc_rpmsg_callback+0x3c/0xcc [fastrpc]\n qcom_glink_native_rx+0x538/0x6a4\n qcom_glink_smem_intr+0x14/0x24 [qcom_glink_smem]\n\nThe faulting address 0x178 corresponds to the lock variable inside\nstruct fastrpc_channel_ctx, confirming that cctx is NULL when\nfastrpc_rpmsg_callback() attempts to take the spinlock.\n\nThere are two issues here. First, dev_set_drvdata() is called before\nspin_lock_init() and idr_init(), leaving a window where the callback\ncan retrieve a valid cctx pointer but operate on an uninitialized\nspinlock. Second, the rpmsg channel becomes live as soon as the driver\nis bound, so fastrpc_rpmsg_callback() can fire before dev_set_drvdata()\nis called at all, resulting in dev_get_drvdata() returning NULL.\n\nFix both issues by moving all cctx initialization ahead of\ndev_set_drvdata() so the structure is fully initialized before it\nbecomes visible to the callback, and add a NULL check in\nfastrpc_rpmsg_callback() as a guard against any remaining window."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:50:56.161Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a3d91218ccca1e990bfb737b5a6da23f0afba22b"
},
{
"url": "https://git.kernel.org/stable/c/0d8c64511fd45690c5326f013710efcb4f73a97e"
},
{
"url": "https://git.kernel.org/stable/c/150bf6f1193c69252580c19d3b3cd631ddce61d7"
},
{
"url": "https://git.kernel.org/stable/c/8fb4a23df5b7c02929b62e5dbc270ec7c42b8134"
},
{
"url": "https://git.kernel.org/stable/c/4bfdf0a9855df55e9e031ca6a25b855820590c70"
},
{
"url": "https://git.kernel.org/stable/c/d5de9cb5355db36438edc621dde3673e3f235767"
},
{
"url": "https://git.kernel.org/stable/c/d77583ca33299fede0c194744ef2284e7ba5b763"
},
{
"url": "https://git.kernel.org/stable/c/5401fb4fe10fac6134c308495df18ed74aebb9c4"
}
],
"title": "misc: fastrpc: Fix NULL pointer dereference in rpmsg callback",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53158",
"datePublished": "2026-06-25T08:38:40.818Z",
"dateReserved": "2026-06-09T07:44:35.388Z",
"dateUpdated": "2026-07-04T11:50:56.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23302 (GCVE-0-2026-23302)
Vulnerability from cvelistv5
Published
2026-03-25 10:26
Modified
2026-07-04 11:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: annotate data-races around sk->sk_{data_ready,write_space}
skmsg (and probably other layers) are changing these pointers
while other cpus might read them concurrently.
Add corresponding READ_ONCE()/WRITE_ONCE() annotations
for UDP, TCP and AF_UNIX.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 604326b41a6fb9b4a78b6179335decee0365cd8c Version: 604326b41a6fb9b4a78b6179335decee0365cd8c Version: 604326b41a6fb9b4a78b6179335decee0365cd8c Version: 604326b41a6fb9b4a78b6179335decee0365cd8c Version: 604326b41a6fb9b4a78b6179335decee0365cd8c Version: 604326b41a6fb9b4a78b6179335decee0365cd8c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/skmsg.c",
"net/ipv4/tcp.c",
"net/ipv4/tcp_bpf.c",
"net/ipv4/tcp_input.c",
"net/ipv4/tcp_minisocks.c",
"net/ipv4/udp.c",
"net/ipv4/udp_bpf.c",
"net/unix/af_unix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "279f2b67d1c44ee139bd3fdb221850daa9358449",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "7ad01905831c815520f1b0486336a03bb7420465",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "c494448bb522bbbb63096540eb2319101a0480ab",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "f17c1c4acbe2bd702abce73a847a04a196fab2c5",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "27fccdbcbbfc4651b6f66756e6fa3f52e051ec23",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
},
{
"lessThan": "2ef2b20cf4e04ac8a6ba68493f8780776ff84300",
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/skmsg.c",
"net/ipv4/tcp.c",
"net/ipv4/tcp_bpf.c",
"net/ipv4/tcp_input.c",
"net/ipv4/tcp_minisocks.c",
"net/ipv4/udp.c",
"net/ipv4/udp_bpf.c",
"net/unix/af_unix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.82",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.82",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.17",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.7",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: annotate data-races around sk-\u003esk_{data_ready,write_space}\n\nskmsg (and probably other layers) are changing these pointers\nwhile other cpus might read them concurrently.\n\nAdd corresponding READ_ONCE()/WRITE_ONCE() annotations\nfor UDP, TCP and AF_UNIX."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:50:29.536Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/279f2b67d1c44ee139bd3fdb221850daa9358449"
},
{
"url": "https://git.kernel.org/stable/c/7ad01905831c815520f1b0486336a03bb7420465"
},
{
"url": "https://git.kernel.org/stable/c/c494448bb522bbbb63096540eb2319101a0480ab"
},
{
"url": "https://git.kernel.org/stable/c/f17c1c4acbe2bd702abce73a847a04a196fab2c5"
},
{
"url": "https://git.kernel.org/stable/c/27fccdbcbbfc4651b6f66756e6fa3f52e051ec23"
},
{
"url": "https://git.kernel.org/stable/c/2ef2b20cf4e04ac8a6ba68493f8780776ff84300"
}
],
"title": "net: annotate data-races around sk-\u003esk_{data_ready,write_space}",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23302",
"datePublished": "2026-03-25T10:26:57.470Z",
"dateReserved": "2026-01-13T15:37:45.993Z",
"dateUpdated": "2026-07-04T11:50:29.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53325 (GCVE-0-2026-53325)
Vulnerability from cvelistv5
Published
2026-06-29 04:53
Modified
2026-08-17 04:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
agp/amd64: Fix broken error propagation in agp_amd64_probe()
A NULL pointer dereference was observed in the AMD64 AGP driver when
running in a virtualized environment (e.g. qemu/kvm) without a physical
AMD northbridge. The crash occurs in amd64_fetch_size() when attempting
to dereference the pointer returned by node_to_amd_nb(0).
The root cause of this crash is broken error propagation in
agp_amd64_probe(): When no AMD northbridges are found, cache_nbs()
correctly returns -ENODEV. However, the probe function erroneously
checks the return value against exactly -1, rather than < 0.
As a result, the hardware absence error is masked, allowing the driver
to improperly proceed with initialization. It eventually calls
agp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware
does not exist, node_to_amd_nb(0) returns NULL, leading to a General
Protection Fault (GPF) when accessing its ->misc member.
Fix the issue by correcting the error check in agp_amd64_probe() to
abort properly when cache_nbs() returns any negative error code. This
prevents the driver from erroneously proceeding without hardware, thereby
avoiding the subsequent NULL pointer dereference at its source.
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 Version: a32073bffc656ca4bde6002b6cf7c1a8e0e22712 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/agp/amd64-agp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ce800993af477fc24187349c6a20d3073140b759",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
},
{
"lessThan": "1d7d45050e14083c1de1460c93f4063c1f0bca7b",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
},
{
"lessThan": "3e844a63668d1c3d10a9d347d7ebf161b2f91c84",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
},
{
"lessThan": "eb045714bc6a2bbb0befb7a31b996a196e188869",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
},
{
"lessThan": "564b3b3f6565313eb6fa5355ffd037d6fb27897f",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
},
{
"lessThan": "53483a9f4ee9eeb18aa866ec16cce79e136987e1",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
},
{
"lessThan": "0aa9b27c454c53074cde592eaceb442d30341585",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
},
{
"lessThan": "cefe535a60a2e00e09f4b2689b0c8ffc6912459a",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
},
{
"lessThan": "b08472db93b1ccff84a7adec5779d47f0e9d3a30",
"status": "affected",
"version": "a32073bffc656ca4bde6002b6cf7c1a8e0e22712",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/agp/amd64-agp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"lessThan": "2.6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.14",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.2",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nagp/amd64: Fix broken error propagation in agp_amd64_probe()\n\nA NULL pointer dereference was observed in the AMD64 AGP driver when\nrunning in a virtualized environment (e.g. qemu/kvm) without a physical\nAMD northbridge. The crash occurs in amd64_fetch_size() when attempting\nto dereference the pointer returned by node_to_amd_nb(0).\n\nThe root cause of this crash is broken error propagation in\nagp_amd64_probe(): When no AMD northbridges are found, cache_nbs()\ncorrectly returns -ENODEV. However, the probe function erroneously\nchecks the return value against exactly -1, rather than \u003c 0.\n\nAs a result, the hardware absence error is masked, allowing the driver\nto improperly proceed with initialization. It eventually calls\nagp_add_bridge(), which invokes amd64_fetch_size(). Since the hardware\ndoes not exist, node_to_amd_nb(0) returns NULL, leading to a General\nProtection Fault (GPF) when accessing its -\u003emisc member.\n\nFix the issue by correcting the error check in agp_amd64_probe() to\nabort properly when cache_nbs() returns any negative error code. This\nprevents the driver from erroneously proceeding without hardware, thereby\navoiding the subsequent NULL pointer dereference at its source."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:26.049Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ce800993af477fc24187349c6a20d3073140b759"
},
{
"url": "https://git.kernel.org/stable/c/1d7d45050e14083c1de1460c93f4063c1f0bca7b"
},
{
"url": "https://git.kernel.org/stable/c/3e844a63668d1c3d10a9d347d7ebf161b2f91c84"
},
{
"url": "https://git.kernel.org/stable/c/eb045714bc6a2bbb0befb7a31b996a196e188869"
},
{
"url": "https://git.kernel.org/stable/c/564b3b3f6565313eb6fa5355ffd037d6fb27897f"
},
{
"url": "https://git.kernel.org/stable/c/53483a9f4ee9eeb18aa866ec16cce79e136987e1"
},
{
"url": "https://git.kernel.org/stable/c/0aa9b27c454c53074cde592eaceb442d30341585"
},
{
"url": "https://git.kernel.org/stable/c/cefe535a60a2e00e09f4b2689b0c8ffc6912459a"
},
{
"url": "https://git.kernel.org/stable/c/b08472db93b1ccff84a7adec5779d47f0e9d3a30"
}
],
"title": "agp/amd64: Fix broken error propagation in agp_amd64_probe()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53325",
"datePublished": "2026-06-29T04:53:35.833Z",
"dateReserved": "2026-06-09T07:44:35.398Z",
"dateUpdated": "2026-08-17T04:50:26.049Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53359 (GCVE-0-2026-53359)
Vulnerability from cvelistv5
Published
2026-07-04 11:51
Modified
2026-08-17 04:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: Fix shadow paging use-after-free due to unexpected role
Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due
to unexpected GFN") fixed a shadow paging mismatch between stored and
computed GFNs; the bug could be triggered by changing a PDE mapping from
outside the guest, and then deleting a memslot. The rmap_remove()
call would miss entries created after the PDE change because the GFN
of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.
A similar hole however remains if the modified PDE points to a non-leaf
page. In this case the gfn can be made to match, but the role does not
match: the original large 2MB page creates a kvm_mmu_page with direct=1,
while the new 4KB needs a kvm_mmu_page with direct=0. However,
kvm_mmu_get_child_sp() does not compare the role, and therefore reuses
the page.
The next step is installing a leaf (4KB) SPTE on the new path which
records an rmap entry under the gfn resolved by the walk. But when
that child is zapped its parent kvm_mmu_page has direct=1 and
kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as
sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[]
in older kernels). It therefore fails to remove the recorded entry.
When the memslot is dropped the shadow page is freed but the rmap
entry survives, as in the scenario that was already fixed. Code that
later walks that gfn (dirty logging, MMU notifier invalidation, and
so on) dereferences an sptep that lies in the freed page, causing the
use-after-free.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2032a93d66fa282ba0f2ea9152eeff9511fa9a96 Version: 2032a93d66fa282ba0f2ea9152eeff9511fa9a96 Version: 2032a93d66fa282ba0f2ea9152eeff9511fa9a96 Version: 2032a93d66fa282ba0f2ea9152eeff9511fa9a96 Version: 2032a93d66fa282ba0f2ea9152eeff9511fa9a96 Version: 2032a93d66fa282ba0f2ea9152eeff9511fa9a96 |
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-06T18:38:14.568Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/06/7"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53359",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-08T03:56:43.137575Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T18:22:55.066Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/V4bel/Januscape/blob/main/assets/write-up.md"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/mmu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b1337aae5e194324e4810d561764e7793f8b3864",
"status": "affected",
"version": "2032a93d66fa282ba0f2ea9152eeff9511fa9a96",
"versionType": "git"
},
{
"lessThan": "9291654d69e08542de37755cebe4d5b02c3170d1",
"status": "affected",
"version": "2032a93d66fa282ba0f2ea9152eeff9511fa9a96",
"versionType": "git"
},
{
"lessThan": "2ad3afa40ac6aa340dada122f9abfa46c0a6eb35",
"status": "affected",
"version": "2032a93d66fa282ba0f2ea9152eeff9511fa9a96",
"versionType": "git"
},
{
"lessThan": "5e470998a23e4c3d89ed24e8172cb22747e61efa",
"status": "affected",
"version": "2032a93d66fa282ba0f2ea9152eeff9511fa9a96",
"versionType": "git"
},
{
"lessThan": "1ae7d5a6db6c190ce183e3098ca0e0846e14d462",
"status": "affected",
"version": "2032a93d66fa282ba0f2ea9152eeff9511fa9a96",
"versionType": "git"
},
{
"lessThan": "81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb",
"status": "affected",
"version": "2032a93d66fa282ba0f2ea9152eeff9511fa9a96",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/kvm/mmu/mmu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"lessThan": "2.6.36",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Fix shadow paging use-after-free due to unexpected role\n\nCommit 0cb2af2ea66ad (\"KVM: x86: Fix shadow paging use-after-free due\nto unexpected GFN\") fixed a shadow paging mismatch between stored and\ncomputed GFNs; the bug could be triggered by changing a PDE mapping from\noutside the guest, and then deleting a memslot. The rmap_remove()\ncall would miss entries created after the PDE change because the GFN\nof the leaf SPTE does not match the GFN of the struct kvm_mmu_page.\n\nA similar hole however remains if the modified PDE points to a non-leaf\npage. In this case the gfn can be made to match, but the role does not\nmatch: the original large 2MB page creates a kvm_mmu_page with direct=1,\nwhile the new 4KB needs a kvm_mmu_page with direct=0. However,\nkvm_mmu_get_child_sp() does not compare the role, and therefore reuses\nthe page.\n\nThe next step is installing a leaf (4KB) SPTE on the new path which\nrecords an rmap entry under the gfn resolved by the walk. But when\nthat child is zapped its parent kvm_mmu_page has direct=1 and\nkvm_mmu_page_get_gfn() computes the gfn for the 4KB page as\nsp-\u003egfn + index instead of using sp-\u003eshadowed_translation[] (or sp-\u003egfns[]\nin older kernels). It therefore fails to remove the recorded entry.\n\nWhen the memslot is dropped the shadow page is freed but the rmap\nentry survives, as in the scenario that was already fixed. Code that\nlater walks that gfn (dirty logging, MMU notifier invalidation, and\nso on) dereferences an sptep that lies in the freed page, causing the\nuse-after-free."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through local KVM guest execution/KVM ioctls and shadow-MMU page fault handling, not by network packets or adjacent/physical input. In the highest reasonable scenario, an attacker runs code in a guest on an x86 KVM host with shadow paging/nested virtualization exposed.\nAC:L - The bug is a deterministic role-confusion/use-after-free in shadow page reuse, and the attacker can drive the guest mapping changes and later rmap walks needed to hit it. No condition outside attacker influence is required once the vulnerable KVM configuration is present.\nPR:L - The attacker needs the ability to run code in a KVM guest or otherwise access KVM VM execution interfaces, but does not need host root or administrative privileges. This is low privilege relative to the host security boundary.\nUI:N - No victim user action is required after the attacker-controlled guest or KVM workload is running. The trigger is caused by guest execution and KVM memory-management operations.\nS:C - This is a KVM guest-to-host escape class vulnerability, crossing from the guest security authority into the host kernel/hypervisor. Compromise can affect resources outside the guest\u2019s own scope.\nC:H - The stale rmap entry dereferences an SPTE pointer in freed shadow-page memory, creating a kernel use-after-free. Such memory corruption can be leveraged for host kernel information disclosure and arbitrary memory access.\nI:H - The use-after-free can corrupt host kernel shadow-MMU/rmap state and provides a plausible path to host kernel code execution or arbitrary modification. Public analysis treats this as a KVM escape class issue, so high integrity impact is defensible.\nA:H - At minimum, walking the stale rmap can dereference freed memory and crash or panic the host kernel. A malicious guest can repeatedly trigger the condition, causing high availability impact to the host and colocated guests."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:28.262Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b1337aae5e194324e4810d561764e7793f8b3864"
},
{
"url": "https://git.kernel.org/stable/c/9291654d69e08542de37755cebe4d5b02c3170d1"
},
{
"url": "https://git.kernel.org/stable/c/2ad3afa40ac6aa340dada122f9abfa46c0a6eb35"
},
{
"url": "https://git.kernel.org/stable/c/5e470998a23e4c3d89ed24e8172cb22747e61efa"
},
{
"url": "https://git.kernel.org/stable/c/1ae7d5a6db6c190ce183e3098ca0e0846e14d462"
},
{
"url": "https://git.kernel.org/stable/c/81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb"
}
],
"title": "KVM: x86: Fix shadow paging use-after-free due to unexpected role",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53359",
"datePublished": "2026-07-04T11:51:49.052Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-08-17T04:50:28.262Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53366 (GCVE-0-2026-53366)
Vulnerability from cvelistv5
Published
2026-07-16 05:13
Modified
2026-08-17 04:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: account for fraggap on the paged allocation path
In __ip_append_data(), when the paged-allocation branch is taken,
alloclen and pagedlen are computed as
alloclen = fragheaderlen + transhdrlen;
pagedlen = datalen - transhdrlen;
datalen already includes fraggap, but the fraggap bytes carried over
from the previous skb are copied into the new skb's linear area at
offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The
linear area is therefore undersized by fraggap bytes while pagedlen is
overstated by the same amount.
The non-paged branch sets alloclen to fraglen, which already accounts
for fraggap because datalen does. Bring the paged branch in line by
adding fraggap to alloclen and subtracting it from pagedlen.
After this adjustment, copy no longer collapses to -fraggap on the
paged path, so remove the stale comment describing that old arithmetic.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8eb77cc73977d88787b37c92831b1c242e035396 Version: 8eb77cc73977d88787b37c92831b1c242e035396 Version: 8eb77cc73977d88787b37c92831b1c242e035396 Version: 8eb77cc73977d88787b37c92831b1c242e035396 Version: 8eb77cc73977d88787b37c92831b1c242e035396 Version: 8eb77cc73977d88787b37c92831b1c242e035396 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/ip_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5c6375bced6147ec2e460ee3b653f4860d5ecdc2",
"status": "affected",
"version": "8eb77cc73977d88787b37c92831b1c242e035396",
"versionType": "git"
},
{
"lessThan": "ce494707a9c07f27c219ca67f3e138061f53d9b3",
"status": "affected",
"version": "8eb77cc73977d88787b37c92831b1c242e035396",
"versionType": "git"
},
{
"lessThan": "a9c24eda24bd15f432e37824e6fc440977cb241c",
"status": "affected",
"version": "8eb77cc73977d88787b37c92831b1c242e035396",
"versionType": "git"
},
{
"lessThan": "77798d7be6ef71e72fb6fc8a2901bf74ebc9706f",
"status": "affected",
"version": "8eb77cc73977d88787b37c92831b1c242e035396",
"versionType": "git"
},
{
"lessThan": "c04d9ece23deb9e26c19f9ca215e98b3295aa1bb",
"status": "affected",
"version": "8eb77cc73977d88787b37c92831b1c242e035396",
"versionType": "git"
},
{
"lessThan": "eca856950f7cb1a221e02b99d758409f2c5cec42",
"status": "affected",
"version": "8eb77cc73977d88787b37c92831b1c242e035396",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/ip_output.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: account for fraggap on the paged allocation path\n\nIn __ip_append_data(), when the paged-allocation branch is taken,\nalloclen and pagedlen are computed as\n\n\talloclen = fragheaderlen + transhdrlen;\n\tpagedlen = datalen - transhdrlen;\n\ndatalen already includes fraggap, but the fraggap bytes carried over\nfrom the previous skb are copied into the new skb\u0027s linear area at\noffset transhdrlen by the subsequent skb_copy_and_csum_bits(). The\nlinear area is therefore undersized by fraggap bytes while pagedlen is\noverstated by the same amount.\n\nThe non-paged branch sets alloclen to fraglen, which already accounts\nfor fraggap because datalen does. Bring the paged branch in line by\nadding fraggap to alloclen and subtracting it from pagedlen.\n\nAfter this adjustment, copy no longer collapses to -fraggap on the\npaged path, so remove the stale comment describing that old arithmetic."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached while a local process constructs outgoing IPv4 UDP/raw/ping datagrams through sendmsg/splice/sendfile-style socket paths. I did not find a defensible received-packet or unauthenticated remote path that supplies the required cork/MSG_MORE-style fraggap conditions.\nAC:L - The attacker can choose UDP socket options/flags, payload sizes, corking/MSG_MORE behavior, and splice/zerocopy-style paged sends to reach the fraggap paged-allocation path. There is no race or external timing condition required.\nPR:L - A normal unprivileged local user can create IPv4 UDP sockets and use UDP_CORK/MSG_MORE/splice or related paged send paths; raw sockets are CAP_NET_RAW-gated but are not needed for the strongest local trigger. This is therefore basic local user privilege, not real administrator privilege.\nUI:N - No victim interaction is required once the attacker can run the local send/splice sequence. The vulnerable skb construction happens synchronously in the attacker-driven socket send path.\nS:U - The impact is within the same kernel security authority as the vulnerable IPv4 networking code. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug under-allocates/accounting for the linear skb area and can copy attacker-controlled fraggap bytes past skb-\u003eend into trailing skb_shared_info metadata. Kernel memory corruption of this kind is reasonably capable of being developed into information disclosure, so the higher severity confidentiality value is appropriate.\nI:H - The copied fraggap bytes corrupt kernel skb metadata past the intended buffer boundary. This is an out-of-bounds write in kernel heap/networking structures and is scored as high integrity impact.\nA:H - The corrupted skb metadata can crash or destabilize the kernel networking stack, and related negative-copy accounting can also produce severe send-path failure behavior. Kernel crash or oops potential is high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:30.453Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5c6375bced6147ec2e460ee3b653f4860d5ecdc2"
},
{
"url": "https://git.kernel.org/stable/c/ce494707a9c07f27c219ca67f3e138061f53d9b3"
},
{
"url": "https://git.kernel.org/stable/c/a9c24eda24bd15f432e37824e6fc440977cb241c"
},
{
"url": "https://git.kernel.org/stable/c/77798d7be6ef71e72fb6fc8a2901bf74ebc9706f"
},
{
"url": "https://git.kernel.org/stable/c/c04d9ece23deb9e26c19f9ca215e98b3295aa1bb"
},
{
"url": "https://git.kernel.org/stable/c/eca856950f7cb1a221e02b99d758409f2c5cec42"
}
],
"title": "ipv4: account for fraggap on the paged allocation path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53366",
"datePublished": "2026-07-16T05:13:40.893Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-08-17T04:50:30.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-23131 (GCVE-0-2025-23131)
Vulnerability from cvelistv5
Published
2025-04-16 14:13
Modified
2026-07-04 11:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
dlm: prevent NPD when writing a positive value to event_done
do_uevent returns the value written to event_done. In case it is a
positive value, new_lockspace would undo all the work, and lockspace
would not be set. __dlm_new_lockspace, however, would treat that
positive value as a success due to commit 8511a2728ab8 ("dlm: fix use
count with multiple joins").
Down the line, device_create_lockspace would pass that NULL lockspace to
dlm_find_lockspace_local, leading to a NULL pointer dereference.
Treating such positive values as successes prevents the problem. Given
this has been broken for so long, this is unlikely to break userspace
expectations.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8511a2728ab82cab398e39d019f5cf1246021c1c Version: 8511a2728ab82cab398e39d019f5cf1246021c1c Version: 8511a2728ab82cab398e39d019f5cf1246021c1c Version: 8511a2728ab82cab398e39d019f5cf1246021c1c Version: 8511a2728ab82cab398e39d019f5cf1246021c1c Version: 8511a2728ab82cab398e39d019f5cf1246021c1c Version: 8511a2728ab82cab398e39d019f5cf1246021c1c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/dlm/lockspace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a1c41aebb184d9228a440dcb6761224e65b0e49a",
"status": "affected",
"version": "8511a2728ab82cab398e39d019f5cf1246021c1c",
"versionType": "git"
},
{
"lessThan": "ee28d99d789b077565cbe0377374d1e826c64d93",
"status": "affected",
"version": "8511a2728ab82cab398e39d019f5cf1246021c1c",
"versionType": "git"
},
{
"lessThan": "c7837e2c96559663c33f43da403d9cf3cf77cfa7",
"status": "affected",
"version": "8511a2728ab82cab398e39d019f5cf1246021c1c",
"versionType": "git"
},
{
"lessThan": "7109d69bec6edce546dc870e66bd2b668a3d5549",
"status": "affected",
"version": "8511a2728ab82cab398e39d019f5cf1246021c1c",
"versionType": "git"
},
{
"lessThan": "10b7a59814765d18d43555c9cef4eb3048b7e8a3",
"status": "affected",
"version": "8511a2728ab82cab398e39d019f5cf1246021c1c",
"versionType": "git"
},
{
"lessThan": "b73c4ad4d387fe5bc988145bd9f1bc0de76afd5c",
"status": "affected",
"version": "8511a2728ab82cab398e39d019f5cf1246021c1c",
"versionType": "git"
},
{
"lessThan": "8e2bad543eca5c25cd02cbc63d72557934d45f13",
"status": "affected",
"version": "8511a2728ab82cab398e39d019f5cf1246021c1c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/dlm/lockspace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.14.*",
"status": "unaffected",
"version": "6.14.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.15",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14.2",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.15",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: prevent NPD when writing a positive value to event_done\n\ndo_uevent returns the value written to event_done. In case it is a\npositive value, new_lockspace would undo all the work, and lockspace\nwould not be set. __dlm_new_lockspace, however, would treat that\npositive value as a success due to commit 8511a2728ab8 (\"dlm: fix use\ncount with multiple joins\").\n\nDown the line, device_create_lockspace would pass that NULL lockspace to\ndlm_find_lockspace_local, leading to a NULL pointer dereference.\n\nTreating such positive values as successes prevents the problem. Given\nthis has been broken for so long, this is unlikely to break userspace\nexpectations."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:50:23.610Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a1c41aebb184d9228a440dcb6761224e65b0e49a"
},
{
"url": "https://git.kernel.org/stable/c/ee28d99d789b077565cbe0377374d1e826c64d93"
},
{
"url": "https://git.kernel.org/stable/c/c7837e2c96559663c33f43da403d9cf3cf77cfa7"
},
{
"url": "https://git.kernel.org/stable/c/7109d69bec6edce546dc870e66bd2b668a3d5549"
},
{
"url": "https://git.kernel.org/stable/c/10b7a59814765d18d43555c9cef4eb3048b7e8a3"
},
{
"url": "https://git.kernel.org/stable/c/b73c4ad4d387fe5bc988145bd9f1bc0de76afd5c"
},
{
"url": "https://git.kernel.org/stable/c/8e2bad543eca5c25cd02cbc63d72557934d45f13"
}
],
"title": "dlm: prevent NPD when writing a positive value to event_done",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-23131",
"datePublished": "2025-04-16T14:13:13.056Z",
"dateReserved": "2025-01-11T14:28:41.511Z",
"dateUpdated": "2026-07-04T11:50:23.610Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53139 (GCVE-0-2026-53139)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-07-04 11:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/v3d: Skip CSD when it has zeroed workgroups
A compute shader dispatch encodes its workgroup counts in the CFG0..CFG2
registers. Kicking off a dispatch with a zero count in any of the three
dimensions is invalid. First, the hardware will process 0 as 65536,
while the user-space driver exposes a maximum of 65535. Over that, a
submission with a zeroed workgroup dimension should be a no-op.
These zeroed counts can reach the dispatch path through an indirect CSD
job, whose workgroup counts are only known once the indirect buffer is
read and may legitimately be zero, but such scenario should only result in
a no-op.
Overwrite the indirect CSD job workgroup counts with the indirect BO
ones, even if they are zeroed, and don't submit the job to the hardware
when any of the workgroup counts is zero, so the job completes immediately
instead of running the shader.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d223f98f02099b002903b9b22b56febae16ef80d Version: d223f98f02099b002903b9b22b56febae16ef80d Version: d223f98f02099b002903b9b22b56febae16ef80d Version: d223f98f02099b002903b9b22b56febae16ef80d Version: d223f98f02099b002903b9b22b56febae16ef80d Version: d223f98f02099b002903b9b22b56febae16ef80d Version: d223f98f02099b002903b9b22b56febae16ef80d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/v3d/v3d_sched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b3a8dd72b0d008ff142880b4dbe5ca37dcf962b4",
"status": "affected",
"version": "d223f98f02099b002903b9b22b56febae16ef80d",
"versionType": "git"
},
{
"lessThan": "8b51c5406ad748c3d5575b66b6009b5dbbc08b80",
"status": "affected",
"version": "d223f98f02099b002903b9b22b56febae16ef80d",
"versionType": "git"
},
{
"lessThan": "abb069fdf51a9ddabcc1ed125dafe54e2089900b",
"status": "affected",
"version": "d223f98f02099b002903b9b22b56febae16ef80d",
"versionType": "git"
},
{
"lessThan": "ad166139d123dc162e8636f0c7962516d04074e1",
"status": "affected",
"version": "d223f98f02099b002903b9b22b56febae16ef80d",
"versionType": "git"
},
{
"lessThan": "9655b56b6de918e1c22b92f3880ae41b052cbd00",
"status": "affected",
"version": "d223f98f02099b002903b9b22b56febae16ef80d",
"versionType": "git"
},
{
"lessThan": "11e6432836394e00d39e468cd514f9ddb66f1e49",
"status": "affected",
"version": "d223f98f02099b002903b9b22b56febae16ef80d",
"versionType": "git"
},
{
"lessThan": "7f93fad5ea0affc9e1505dd0f7596c0fdb496213",
"status": "affected",
"version": "d223f98f02099b002903b9b22b56febae16ef80d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/v3d/v3d_sched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/v3d: Skip CSD when it has zeroed workgroups\n\nA compute shader dispatch encodes its workgroup counts in the CFG0..CFG2\nregisters. Kicking off a dispatch with a zero count in any of the three\ndimensions is invalid. First, the hardware will process 0 as 65536,\nwhile the user-space driver exposes a maximum of 65535. Over that, a\nsubmission with a zeroed workgroup dimension should be a no-op.\n\nThese zeroed counts can reach the dispatch path through an indirect CSD\njob, whose workgroup counts are only known once the indirect buffer is\nread and may legitimately be zero, but such scenario should only result in\na no-op.\n\nOverwrite the indirect CSD job workgroup counts with the indirect BO\nones, even if they are zeroed, and don\u0027t submit the job to the hardware\nwhen any of the workgroup counts is zero, so the job completes immediately\ninstead of running the shader."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:50:52.146Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b3a8dd72b0d008ff142880b4dbe5ca37dcf962b4"
},
{
"url": "https://git.kernel.org/stable/c/8b51c5406ad748c3d5575b66b6009b5dbbc08b80"
},
{
"url": "https://git.kernel.org/stable/c/abb069fdf51a9ddabcc1ed125dafe54e2089900b"
},
{
"url": "https://git.kernel.org/stable/c/ad166139d123dc162e8636f0c7962516d04074e1"
},
{
"url": "https://git.kernel.org/stable/c/9655b56b6de918e1c22b92f3880ae41b052cbd00"
},
{
"url": "https://git.kernel.org/stable/c/11e6432836394e00d39e468cd514f9ddb66f1e49"
},
{
"url": "https://git.kernel.org/stable/c/7f93fad5ea0affc9e1505dd0f7596c0fdb496213"
}
],
"title": "drm/v3d: Skip CSD when it has zeroed workgroups",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53139",
"datePublished": "2026-06-25T08:38:27.738Z",
"dateReserved": "2026-06-09T07:44:35.387Z",
"dateUpdated": "2026-07-04T11:50:52.146Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23278 (GCVE-0-2026-23278)
Vulnerability from cvelistv5
Published
2026-03-20 08:08
Modified
2026-08-05 12:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: always walk all pending catchall elements
During transaction processing we might have more than one catchall element:
1 live catchall element and 1 pending element that is coming as part of the
new batch.
If the map holding the catchall elements is also going away, its
required to toggle all catchall elements and not just the first viable
candidate.
Otherwise, we get:
WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404
RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables]
[..]
__nft_set_elem_destroy+0x106/0x380 [nf_tables]
nf_tables_abort_release+0x348/0x8d0 [nf_tables]
nf_tables_abort+0xcf2/0x3ac0 [nf_tables]
nfnetlink_rcv_batch+0x9c9/0x20e0 [..]
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d60be2da67d172aecf866302c91ea11533eca4d9 Version: 628bd3e49cba1c066228e23d71a852c23e26da73 Version: 628bd3e49cba1c066228e23d71a852c23e26da73 Version: 628bd3e49cba1c066228e23d71a852c23e26da73 Version: 628bd3e49cba1c066228e23d71a852c23e26da73 Version: 628bd3e49cba1c066228e23d71a852c23e26da73 Version: bc9f791d2593f17e39f87c6e2b3a36549a3705b1 Version: 3c7ec098e3b588434a8b07ea9b5b36f04cef1f50 Version: a136b7942ad2a50de708f76ea299ccb45ac7a7f9 Version: 25aa2ad37c2162be1c0bc4fe6397f7e4c13f00f8 Version: dc7cdf8cbcbf8b13de1df93f356ec04cdeef5c41 Version: 6.1.36 ≤ Version: 4.19.316 ≤ Version: 5.4.262 ≤ Version: 5.10.188 ≤ Version: 5.15.121 ≤ Version: 6.3.10 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_tables_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c4d4e86fda707d89eaba80e343321737375f8582",
"status": "affected",
"version": "d60be2da67d172aecf866302c91ea11533eca4d9",
"versionType": "git"
},
{
"lessThan": "4830fb44d12f586f3f544609e086933649a9175a",
"status": "affected",
"version": "628bd3e49cba1c066228e23d71a852c23e26da73",
"versionType": "git"
},
{
"lessThan": "eb0948fa13298212c5f8b30ee48efdae4389ab09",
"status": "affected",
"version": "628bd3e49cba1c066228e23d71a852c23e26da73",
"versionType": "git"
},
{
"lessThan": "de47a88c6b807910f05703fb6605f7efdaa11417",
"status": "affected",
"version": "628bd3e49cba1c066228e23d71a852c23e26da73",
"versionType": "git"
},
{
"lessThan": "77c26b5056d693ffe5e9f040e946251cdb55ae55",
"status": "affected",
"version": "628bd3e49cba1c066228e23d71a852c23e26da73",
"versionType": "git"
},
{
"lessThan": "7cb9a23d7ae40a702577d3d8bacb7026f04ac2a9",
"status": "affected",
"version": "628bd3e49cba1c066228e23d71a852c23e26da73",
"versionType": "git"
},
{
"status": "affected",
"version": "bc9f791d2593f17e39f87c6e2b3a36549a3705b1",
"versionType": "git"
},
{
"status": "affected",
"version": "3c7ec098e3b588434a8b07ea9b5b36f04cef1f50",
"versionType": "git"
},
{
"status": "affected",
"version": "a136b7942ad2a50de708f76ea299ccb45ac7a7f9",
"versionType": "git"
},
{
"status": "affected",
"version": "25aa2ad37c2162be1c0bc4fe6397f7e4c13f00f8",
"versionType": "git"
},
{
"status": "affected",
"version": "dc7cdf8cbcbf8b13de1df93f356ec04cdeef5c41",
"versionType": "git"
},
{
"lessThan": "6.1.177",
"status": "affected",
"version": "6.1.36",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.316",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.262",
"versionType": "semver"
},
{
"lessThan": "5.11",
"status": "affected",
"version": "5.10.188",
"versionType": "semver"
},
{
"lessThan": "5.16",
"status": "affected",
"version": "5.15.121",
"versionType": "semver"
},
{
"lessThan": "6.4",
"status": "affected",
"version": "6.3.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_tables_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "6.1.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.19",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.9",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.316",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.262",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.188",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: always walk all pending catchall elements\n\nDuring transaction processing we might have more than one catchall element:\n1 live catchall element and 1 pending element that is coming as part of the\nnew batch.\n\nIf the map holding the catchall elements is also going away, its\nrequired to toggle all catchall elements and not just the first viable\ncandidate.\n\nOtherwise, we get:\n WARNING: ./include/net/netfilter/nf_tables.h:1281 at nft_data_release+0xb7/0xe0 [nf_tables], CPU#2: nft/1404\n RIP: 0010:nft_data_release+0xb7/0xe0 [nf_tables]\n [..]\n __nft_set_elem_destroy+0x106/0x380 [nf_tables]\n nf_tables_abort_release+0x348/0x8d0 [nf_tables]\n nf_tables_abort+0xcf2/0x3ac0 [nf_tables]\n nfnetlink_rcv_batch+0x9c9/0x20e0 [..]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "nf_tables catchall element walk breaks early, leaving second catchall element\u0027s chain references improperly toggled during abort. Leads to chain use-count underflow and UAF. Deterministic logic error reachable via unprivileged user namespaces."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:21:07.131Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c4d4e86fda707d89eaba80e343321737375f8582"
},
{
"url": "https://git.kernel.org/stable/c/4830fb44d12f586f3f544609e086933649a9175a"
},
{
"url": "https://git.kernel.org/stable/c/eb0948fa13298212c5f8b30ee48efdae4389ab09"
},
{
"url": "https://git.kernel.org/stable/c/de47a88c6b807910f05703fb6605f7efdaa11417"
},
{
"url": "https://git.kernel.org/stable/c/77c26b5056d693ffe5e9f040e946251cdb55ae55"
},
{
"url": "https://git.kernel.org/stable/c/7cb9a23d7ae40a702577d3d8bacb7026f04ac2a9"
}
],
"title": "netfilter: nf_tables: always walk all pending catchall elements",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23278",
"datePublished": "2026-03-20T08:08:58.566Z",
"dateReserved": "2026-01-13T15:37:45.991Z",
"dateUpdated": "2026-08-05T12:21:07.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53157 (GCVE-0-2026-53157)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-07-04 11:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: phonet: free phonet_device after RCU grace period
phonet_device_destroy() removes a phonet_device from the per-net device
list with list_del_rcu(), but frees it immediately. RCU readers walking
the same list can still hold a pointer to the object after it has been
removed, leading to a slab-use-after-free.
Use kfree_rcu(), matching the lifetime rule already used by
phonet_address_del() for the same object type.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: eeb74a9d45f781ec6f47b9e0a75a6a427b53f165 Version: eeb74a9d45f781ec6f47b9e0a75a6a427b53f165 Version: eeb74a9d45f781ec6f47b9e0a75a6a427b53f165 Version: eeb74a9d45f781ec6f47b9e0a75a6a427b53f165 Version: eeb74a9d45f781ec6f47b9e0a75a6a427b53f165 Version: eeb74a9d45f781ec6f47b9e0a75a6a427b53f165 Version: eeb74a9d45f781ec6f47b9e0a75a6a427b53f165 Version: eeb74a9d45f781ec6f47b9e0a75a6a427b53f165 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/phonet/pn_dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d59794337ea496042288c7c68356d9b9ca7f46a9",
"status": "affected",
"version": "eeb74a9d45f781ec6f47b9e0a75a6a427b53f165",
"versionType": "git"
},
{
"lessThan": "6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763",
"status": "affected",
"version": "eeb74a9d45f781ec6f47b9e0a75a6a427b53f165",
"versionType": "git"
},
{
"lessThan": "2ec8011cce0cd0fc7a5068585d867fc08d508578",
"status": "affected",
"version": "eeb74a9d45f781ec6f47b9e0a75a6a427b53f165",
"versionType": "git"
},
{
"lessThan": "09c9b92c2010481160245244ea8fa1d06d5d4ae0",
"status": "affected",
"version": "eeb74a9d45f781ec6f47b9e0a75a6a427b53f165",
"versionType": "git"
},
{
"lessThan": "bd2ab4d800fc26814d89328d87b5f97ef6aa906a",
"status": "affected",
"version": "eeb74a9d45f781ec6f47b9e0a75a6a427b53f165",
"versionType": "git"
},
{
"lessThan": "52b8f5ef82c886f7cd24617915e4b1579ddfd001",
"status": "affected",
"version": "eeb74a9d45f781ec6f47b9e0a75a6a427b53f165",
"versionType": "git"
},
{
"lessThan": "bff309ea51f1395c1ef8be8b75ce62d28a319113",
"status": "affected",
"version": "eeb74a9d45f781ec6f47b9e0a75a6a427b53f165",
"versionType": "git"
},
{
"lessThan": "71de0177b28da751f407581a4515cf4d762f6296",
"status": "affected",
"version": "eeb74a9d45f781ec6f47b9e0a75a6a427b53f165",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/phonet/pn_dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.33"
},
{
"lessThan": "2.6.33",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.260",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.260",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phonet: free phonet_device after RCU grace period\n\nphonet_device_destroy() removes a phonet_device from the per-net device\nlist with list_del_rcu(), but frees it immediately. RCU readers walking\nthe same list can still hold a pointer to the object after it has been\nremoved, leading to a slab-use-after-free.\n\nUse kfree_rcu(), matching the lifetime rule already used by\nphonet_address_del() for the same object type."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:50:55.214Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d59794337ea496042288c7c68356d9b9ca7f46a9"
},
{
"url": "https://git.kernel.org/stable/c/6cd7067d6e4b0b2033ba2f918ecbd54dc2af3763"
},
{
"url": "https://git.kernel.org/stable/c/2ec8011cce0cd0fc7a5068585d867fc08d508578"
},
{
"url": "https://git.kernel.org/stable/c/09c9b92c2010481160245244ea8fa1d06d5d4ae0"
},
{
"url": "https://git.kernel.org/stable/c/bd2ab4d800fc26814d89328d87b5f97ef6aa906a"
},
{
"url": "https://git.kernel.org/stable/c/52b8f5ef82c886f7cd24617915e4b1579ddfd001"
},
{
"url": "https://git.kernel.org/stable/c/bff309ea51f1395c1ef8be8b75ce62d28a319113"
},
{
"url": "https://git.kernel.org/stable/c/71de0177b28da751f407581a4515cf4d762f6296"
}
],
"title": "net: phonet: free phonet_device after RCU grace period",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53157",
"datePublished": "2026-06-25T08:38:40.132Z",
"dateReserved": "2026-06-09T07:44:35.388Z",
"dateUpdated": "2026-07-04T11:50:55.214Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53327 (GCVE-0-2026-53327)
Vulnerability from cvelistv5
Published
2026-07-01 13:32
Modified
2026-07-04 11:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
debugobjects: Do not fill_pool() if pi_blocked_on
On RT enabled kernels, fill_pool() ends up calling rtlock_lock(), which
asserts if current::pi_blocked_on is set, because a task can obviously only
block on one lock as otherwise the priority inheritenace chain gets
corrupted.
Prevent this by expanding the conditional to take current::pi_blocked_on
into account.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 4bedcc28469a24fe481a8a31b3584e6070457ddb Version: 4bedcc28469a24fe481a8a31b3584e6070457ddb Version: 4bedcc28469a24fe481a8a31b3584e6070457ddb Version: 4bedcc28469a24fe481a8a31b3584e6070457ddb Version: 4bedcc28469a24fe481a8a31b3584e6070457ddb Version: 4bedcc28469a24fe481a8a31b3584e6070457ddb |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"lib/debugobjects.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8a680d54f1adf3e3aa815578684556716fda6f0c",
"status": "affected",
"version": "4bedcc28469a24fe481a8a31b3584e6070457ddb",
"versionType": "git"
},
{
"lessThan": "a3383df76f0d7a597066df018409eb9e5e698064",
"status": "affected",
"version": "4bedcc28469a24fe481a8a31b3584e6070457ddb",
"versionType": "git"
},
{
"lessThan": "3f6a3b24ab7b9d51f6f4778254bef0e5847beb55",
"status": "affected",
"version": "4bedcc28469a24fe481a8a31b3584e6070457ddb",
"versionType": "git"
},
{
"lessThan": "3a408cae608d9c075dd3a9e5cfc03b3cb0726863",
"status": "affected",
"version": "4bedcc28469a24fe481a8a31b3584e6070457ddb",
"versionType": "git"
},
{
"lessThan": "33bee10644f8fff3b1a0187ad5ad34513e5e8e72",
"status": "affected",
"version": "4bedcc28469a24fe481a8a31b3584e6070457ddb",
"versionType": "git"
},
{
"lessThan": "5f41161059fd0f1bbf18c90f3180e38cc45a14eb",
"status": "affected",
"version": "4bedcc28469a24fe481a8a31b3584e6070457ddb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"lib/debugobjects.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.95",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.37",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.37",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndebugobjects: Do not fill_pool() if pi_blocked_on\n\nOn RT enabled kernels, fill_pool() ends up calling rtlock_lock(), which\nasserts if current::pi_blocked_on is set, because a task can obviously only\nblock on one lock as otherwise the priority inheritenace chain gets\ncorrupted.\n\nPrevent this by expanding the conditional to take current::pi_blocked_on\ninto account."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:51:05.892Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8a680d54f1adf3e3aa815578684556716fda6f0c"
},
{
"url": "https://git.kernel.org/stable/c/a3383df76f0d7a597066df018409eb9e5e698064"
},
{
"url": "https://git.kernel.org/stable/c/3f6a3b24ab7b9d51f6f4778254bef0e5847beb55"
},
{
"url": "https://git.kernel.org/stable/c/3a408cae608d9c075dd3a9e5cfc03b3cb0726863"
},
{
"url": "https://git.kernel.org/stable/c/33bee10644f8fff3b1a0187ad5ad34513e5e8e72"
},
{
"url": "https://git.kernel.org/stable/c/5f41161059fd0f1bbf18c90f3180e38cc45a14eb"
}
],
"title": "debugobjects: Do not fill_pool() if pi_blocked_on",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53327",
"datePublished": "2026-07-01T13:32:13.493Z",
"dateReserved": "2026-06-09T07:44:35.398Z",
"dateUpdated": "2026-07-04T11:51:05.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-52928 (GCVE-0-2026-52928)
Vulnerability from cvelistv5
Published
2026-06-24 07:14
Modified
2026-07-04 11:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Reject SIOCATMARK on non-stream sockets
SIOCATMARK reports whether the receive queue is at the urgent mark for
MSG_OOB.
In AF_UNIX, MSG_OOB is supported only for SOCK_STREAM sockets.
SOCK_DGRAM and SOCK_SEQPACKET reject MSG_OOB in sendmsg() and recvmsg(),
so they should not support SIOCATMARK either.
Return -EOPNOTSUPP for non-stream sockets before checking the receive
queue.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 314001f0bf927015e459c9d387d62a231fe93af3 Version: 314001f0bf927015e459c9d387d62a231fe93af3 Version: 314001f0bf927015e459c9d387d62a231fe93af3 Version: 314001f0bf927015e459c9d387d62a231fe93af3 Version: 314001f0bf927015e459c9d387d62a231fe93af3 Version: 314001f0bf927015e459c9d387d62a231fe93af3 Version: 314001f0bf927015e459c9d387d62a231fe93af3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/unix/af_unix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ec123873fdc83e7244c8ed6d17b8f8ea6c416a67",
"status": "affected",
"version": "314001f0bf927015e459c9d387d62a231fe93af3",
"versionType": "git"
},
{
"lessThan": "f085971de6d6b8ef946a5e0bcd73ff24509a0f85",
"status": "affected",
"version": "314001f0bf927015e459c9d387d62a231fe93af3",
"versionType": "git"
},
{
"lessThan": "b741c9c6ef59f17c1f104ddf1217ef77f79ed29b",
"status": "affected",
"version": "314001f0bf927015e459c9d387d62a231fe93af3",
"versionType": "git"
},
{
"lessThan": "645b1ed3259af38b7814242a420bc2081bdd1eb6",
"status": "affected",
"version": "314001f0bf927015e459c9d387d62a231fe93af3",
"versionType": "git"
},
{
"lessThan": "c34c41446acf6c0d13b5b06c809be11e0f7f2729",
"status": "affected",
"version": "314001f0bf927015e459c9d387d62a231fe93af3",
"versionType": "git"
},
{
"lessThan": "3147ddf5a41c20c45c2eb69e00b62f10f822056a",
"status": "affected",
"version": "314001f0bf927015e459c9d387d62a231fe93af3",
"versionType": "git"
},
{
"lessThan": "d119775f2bad827edc28071c061fdd4a91f889a5",
"status": "affected",
"version": "314001f0bf927015e459c9d387d62a231fe93af3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/unix/af_unix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.211",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.144",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.88",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.211",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.88",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.30",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.7",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Reject SIOCATMARK on non-stream sockets\n\nSIOCATMARK reports whether the receive queue is at the urgent mark for\nMSG_OOB.\n\nIn AF_UNIX, MSG_OOB is supported only for SOCK_STREAM sockets.\nSOCK_DGRAM and SOCK_SEQPACKET reject MSG_OOB in sendmsg() and recvmsg(),\nso they should not support SIOCATMARK either.\n\nReturn -EOPNOTSUPP for non-stream sockets before checking the receive\nqueue."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-04T11:50:47.159Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ec123873fdc83e7244c8ed6d17b8f8ea6c416a67"
},
{
"url": "https://git.kernel.org/stable/c/f085971de6d6b8ef946a5e0bcd73ff24509a0f85"
},
{
"url": "https://git.kernel.org/stable/c/b741c9c6ef59f17c1f104ddf1217ef77f79ed29b"
},
{
"url": "https://git.kernel.org/stable/c/645b1ed3259af38b7814242a420bc2081bdd1eb6"
},
{
"url": "https://git.kernel.org/stable/c/c34c41446acf6c0d13b5b06c809be11e0f7f2729"
},
{
"url": "https://git.kernel.org/stable/c/3147ddf5a41c20c45c2eb69e00b62f10f822056a"
},
{
"url": "https://git.kernel.org/stable/c/d119775f2bad827edc28071c061fdd4a91f889a5"
}
],
"title": "af_unix: Reject SIOCATMARK on non-stream sockets",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-52928",
"datePublished": "2026-06-24T07:14:21.367Z",
"dateReserved": "2026-06-09T07:44:35.368Z",
"dateUpdated": "2026-07-04T11:50:47.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53163 (GCVE-0-2026-53163)
Vulnerability from cvelistv5
Published
2026-06-25 08:38
Modified
2026-07-24 14:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
syzbot triggered the following splat in remove_waiter() via
FUTEX_CMP_REQUEUE_PI:
KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f]
class_raw_spinlock_constructor
remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561
rt_mutex_start_proxy_lock+0x103/0x120
futex_requeue+0x10e4/0x20d0
__x64_sys_futex+0x34f/0x4d0
task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection,
leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead
of current in remove_waiter()") made this fatal.
Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter()
upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock
return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock()
(where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to
account for try_to_take_rt_mutex().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f3fa3424bceb128d2be4b3745506b22844b87db7 Version: 838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd Version: d8cce4773c2b23d819baf5abedc62f7b430e8745 Version: 8a1fc8d698ac5e5916e3082a0f74450d71f9611f Version: 6d52dfcb2a5db86e346cf51f8fcf2071b8085166 Version: 3fb7394a837740770f0d6b4b30567e60786a63f2 Version: 88614876370aac8ad1050ad785a4c095ba17ac11 Version: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/locking/rtmutex.c",
"kernel/locking/rtmutex_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bfbc047ceb42c0e1fac8f3a155d4548a8bbe76b1",
"status": "affected",
"version": "f3fa3424bceb128d2be4b3745506b22844b87db7",
"versionType": "git"
},
{
"lessThan": "4ffacf76a457b7ca8ac05f5df8740b0d8f53574a",
"status": "affected",
"version": "838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd",
"versionType": "git"
},
{
"lessThan": "4afda3a1da02129568a3a2f1898aa13e6763bcba",
"status": "affected",
"version": "d8cce4773c2b23d819baf5abedc62f7b430e8745",
"versionType": "git"
},
{
"lessThan": "6707d7e0b71748cb3cd95bad81dae5fe1b3c8f48",
"status": "affected",
"version": "8a1fc8d698ac5e5916e3082a0f74450d71f9611f",
"versionType": "git"
},
{
"lessThan": "5799f9bd7fee40370b93ab1ddf001cdc7017c14d",
"status": "affected",
"version": "6d52dfcb2a5db86e346cf51f8fcf2071b8085166",
"versionType": "git"
},
{
"lessThan": "a388e3dfaf9538a680de5ed43a8ebb5dd45b6e53",
"status": "affected",
"version": "3fb7394a837740770f0d6b4b30567e60786a63f2",
"versionType": "git"
},
{
"lessThan": "55363fa0a04524d11efeaadee734d2db1756ed27",
"status": "affected",
"version": "88614876370aac8ad1050ad785a4c095ba17ac11",
"versionType": "git"
},
{
"lessThan": "40a25d59e85b3c8709ac2424d44f65610467871e",
"status": "affected",
"version": "3bfdc63936dd4773109b7b8c280c0f3b5ae7d349",
"versionType": "git"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/locking/rtmutex.c",
"kernel/locking/rtmutex_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6.1.177",
"status": "affected",
"version": "6.1.175",
"versionType": "semver"
},
{
"lessThan": "6.6.144",
"status": "affected",
"version": "6.6.140",
"versionType": "semver"
},
{
"lessThan": "6.12.95",
"status": "affected",
"version": "6.12.86",
"versionType": "semver"
},
{
"lessThan": "6.18.36",
"status": "affected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThan": "7.0.13",
"status": "affected",
"version": "7.0.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.177",
"versionStartIncluding": "6.1.175",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.144",
"versionStartIncluding": "6.6.140",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.95",
"versionStartIncluding": "6.12.86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "6.18.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "7.0.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/rtmutex: Skip remove_waiter() when waiter is not enqueued\n\nsyzbot triggered the following splat in remove_waiter() via\nFUTEX_CMP_REQUEUE_PI:\n\n KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f]\n class_raw_spinlock_constructor\n remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561\n rt_mutex_start_proxy_lock+0x103/0x120\n futex_requeue+0x10e4/0x20d0\n __x64_sys_futex+0x34f/0x4d0\n\ntask_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection,\nleaving waiter-\u003etask nil, where 3bfdc63936dd (\"rtmutex: Use waiter::task instead\nof current in remove_waiter()\") made this fatal.\n\nFurthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter()\nupon a successfully grabbing the rtmutex. 1a1fb985f2e2 (\"futex: Handle early deadlock\nreturn correctly\"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock()\n(where \u0027ret\u0027 was only ever 0 or \u003c 0) into the wrapper. Tighten this check to\naccount for try_to_take_rt_mutex()."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:33:48.972Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bfbc047ceb42c0e1fac8f3a155d4548a8bbe76b1"
},
{
"url": "https://git.kernel.org/stable/c/4ffacf76a457b7ca8ac05f5df8740b0d8f53574a"
},
{
"url": "https://git.kernel.org/stable/c/4afda3a1da02129568a3a2f1898aa13e6763bcba"
},
{
"url": "https://git.kernel.org/stable/c/6707d7e0b71748cb3cd95bad81dae5fe1b3c8f48"
},
{
"url": "https://git.kernel.org/stable/c/5799f9bd7fee40370b93ab1ddf001cdc7017c14d"
},
{
"url": "https://git.kernel.org/stable/c/a388e3dfaf9538a680de5ed43a8ebb5dd45b6e53"
},
{
"url": "https://git.kernel.org/stable/c/55363fa0a04524d11efeaadee734d2db1756ed27"
},
{
"url": "https://git.kernel.org/stable/c/40a25d59e85b3c8709ac2424d44f65610467871e"
}
],
"title": "locking/rtmutex: Skip remove_waiter() when waiter is not enqueued",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53163",
"datePublished": "2026-06-25T08:38:44.108Z",
"dateReserved": "2026-06-09T07:44:35.388Z",
"dateUpdated": "2026-07-24T14:33:48.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…