Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0930
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian trixie versions ant\u00e9rieures \u00e0 6.12.96-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-53027",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53027"
},
{
"name": "CVE-2026-63818",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63818"
},
{
"name": "CVE-2026-53399",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53399"
},
{
"name": "CVE-2025-21807",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21807"
},
{
"name": "CVE-2026-64189",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64189"
},
{
"name": "CVE-2026-63815",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63815"
},
{
"name": "CVE-2026-63816",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63816"
},
{
"name": "CVE-2026-53402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53402"
},
{
"name": "CVE-2026-53392",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53392"
},
{
"name": "CVE-2026-64187",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64187"
},
{
"name": "CVE-2026-53226",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53226"
},
{
"name": "CVE-2026-46093",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46093"
}
],
"initial_release_date": "2026-07-24T00:00:00",
"last_revision_date": "2026-07-24T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0930",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-07-24T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian",
"vendor_advisories": [
{
"published_at": "2026-07-21",
"title": "Bulletin de s\u00e9curit\u00e9 Debian msg00304",
"url": "https://lists.debian.org/debian-security-announce/2026/msg00304.html"
}
]
}
CVE-2026-46093 (GCVE-0-2026-46093)
Vulnerability from cvelistv5
Published
2026-05-27 12:58
Modified
2026-08-05 12:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/vmalloc: take vmap_purge_lock in shrinker
decay_va_pool_node() can be invoked concurrently from two paths:
__purge_vmap_area_lazy() when pools are being purged, and the shrinker via
vmap_node_shrink_scan().
However, decay_va_pool_node() is not safe to run concurrently, and the
shrinker path currently lacks serialization, leading to races and possible
leaks.
Protect decay_va_pool_node() by taking vmap_purge_lock in the shrinker
path to ensure serialization with purge users.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/vmalloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c15ff206ba78820bf2873d0c668a882e99f4b631",
"status": "affected",
"version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
"versionType": "git"
},
{
"lessThan": "687ccdf582169cd680aeaf24cc953807c4cd4345",
"status": "affected",
"version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
"versionType": "git"
},
{
"lessThan": "12f2341b4c235d5593a433abac201c1c6725787f",
"status": "affected",
"version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
"versionType": "git"
},
{
"lessThan": "ec05f51f1e65bce95528543eb73fda56fd201d94",
"status": "affected",
"version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/vmalloc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.27",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.27",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.4",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: take vmap_purge_lock in shrinker\n\ndecay_va_pool_node() can be invoked concurrently from two paths:\n__purge_vmap_area_lazy() when pools are being purged, and the shrinker via\nvmap_node_shrink_scan().\n\nHowever, decay_va_pool_node() is not safe to run concurrently, and the\nshrinker path currently lacks serialization, leading to races and possible\nleaks.\n\nProtect decay_va_pool_node() by taking vmap_purge_lock in the shrinker\npath to ensure serialization with purge users."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable race is in core MM internals (vmap pool decay) reached only via local memory-management activity \u2014 inducing vmalloc/vfree churn (purge path) and memory pressure (shrinker path). No network-delivered data reaches the vulnerable function.\nAC:L - An unprivileged attacker controls both sides: one thread forces direct reclaim (shrinker\u2192decay) while another drives vmalloc/vfree churn past the lazy-free threshold (purge\u2192decay), and both can loop indefinitely to repeatedly attempt and win the narrow race.\nPR:L - Any unprivileged local process can allocate/free memory and induce reclaim; no capabilities or root are required to drive either racing path.\nUI:N - The race is triggered entirely by the attacker\u0027s own memory activity; no victim action is needed.\nS:U - The corruption stays within the kernel\u0027s own memory-management structures and does not cross into another security authority (no VM/IOMMU boundary escape).\nC:H - The data race corrupts the vmap pool linked list and free-area tree metadata; per kernel guidance, allocator memory corruption can be leveraged to read freed/adjacent kernel memory.\nI:H - Concurrent unserialized list_replace_init plus double-merge of vmap_area objects into the global free tree corrupts kernel free-list/tree state, a write/corruption primitive over allocator metadata.\nA:H - Corrupted lists and inconsistent len accounting (and the documented leaks) cause kernel crashes/oops and resource exhaustion when the corrupted pool is subsequently traversed or reused."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:29:35.424Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c15ff206ba78820bf2873d0c668a882e99f4b631"
},
{
"url": "https://git.kernel.org/stable/c/687ccdf582169cd680aeaf24cc953807c4cd4345"
},
{
"url": "https://git.kernel.org/stable/c/12f2341b4c235d5593a433abac201c1c6725787f"
},
{
"url": "https://git.kernel.org/stable/c/ec05f51f1e65bce95528543eb73fda56fd201d94"
}
],
"title": "mm/vmalloc: take vmap_purge_lock in shrinker",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-46093",
"datePublished": "2026-05-27T12:58:43.458Z",
"dateReserved": "2026-05-13T15:03:33.097Z",
"dateUpdated": "2026-08-05T12:29:35.424Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63816 (GCVE-0-2026-63816)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-08-17 04:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode
- ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE) - shrink
- f2fs_gc
- gc_data_segment
- ra_data_block(cow_inode)
- mapping = F2FS_I(inode)->atomic_inode->i_mapping
: f2fs_is_cow_file(cow_inode) is true
- f2fs_evict_inode(atomic_inode)
- clear_inode_flag(fi->cow_inode, FI_COW_FILE)
- F2FS_I(fi->cow_inode)->atomic_inode = NULL
...
- truncate_inode_pages_final(atomic_inode)
- f2fs_grab_cache_folio(mapping)
: create folio in atomic_inode->mapping
- clear_inode(atomic_inode)
- BUG_ON(atomic_inode->i_data.nrpages)
We need to add a reference on fi->atomic_inode before using its mapping
field during garbage collection, otherwise, it will cause UAF issue.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3db1de0e582c358dd013f3703cd55b5fe4076436 Version: 3db1de0e582c358dd013f3703cd55b5fe4076436 Version: 3db1de0e582c358dd013f3703cd55b5fe4076436 Version: 3db1de0e582c358dd013f3703cd55b5fe4076436 Version: 3db1de0e582c358dd013f3703cd55b5fe4076436 Version: 6db52f1944417c2601182a591a704e2f119c5215 Version: 5.18.18 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/gc.c",
"fs/f2fs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7d3ae21783e5914c1761ac7d63f882d3d70800e9",
"status": "affected",
"version": "3db1de0e582c358dd013f3703cd55b5fe4076436",
"versionType": "git"
},
{
"lessThan": "56038756aae68312df00d4aa1d97e51ef3aca725",
"status": "affected",
"version": "3db1de0e582c358dd013f3703cd55b5fe4076436",
"versionType": "git"
},
{
"lessThan": "a499f77c06050a28c897bdbd86cd2f0721ae0743",
"status": "affected",
"version": "3db1de0e582c358dd013f3703cd55b5fe4076436",
"versionType": "git"
},
{
"lessThan": "a805fec35c201c59643ddcde713bce4051c8ee27",
"status": "affected",
"version": "3db1de0e582c358dd013f3703cd55b5fe4076436",
"versionType": "git"
},
{
"lessThan": "e0288584baa5dc41df4a829a023c4c1b33fe53d7",
"status": "affected",
"version": "3db1de0e582c358dd013f3703cd55b5fe4076436",
"versionType": "git"
},
{
"status": "affected",
"version": "6db52f1944417c2601182a591a704e2f119c5215",
"versionType": "git"
},
{
"lessThan": "5.19",
"status": "affected",
"version": "5.18.18",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/gc.c",
"fs/f2fs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.18.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode\n\n- ioctl(F2FS_IOC_GARBAGE_COLLECT_RANGE)\t\t- shrink\n - f2fs_gc\n - gc_data_segment\n - ra_data_block(cow_inode)\n - mapping = F2FS_I(inode)-\u003eatomic_inode-\u003ei_mapping\n : f2fs_is_cow_file(cow_inode) is true\n\t\t\t\t\t\t - f2fs_evict_inode(atomic_inode)\n\t\t\t\t\t\t - clear_inode_flag(fi-\u003ecow_inode, FI_COW_FILE)\n\t\t\t\t\t\t - F2FS_I(fi-\u003ecow_inode)-\u003eatomic_inode = NULL\n\t\t\t\t\t\t ...\n\t\t\t\t\t\t - truncate_inode_pages_final(atomic_inode)\n - f2fs_grab_cache_folio(mapping)\n : create folio in atomic_inode-\u003emapping\n\t\t\t\t\t\t - clear_inode(atomic_inode)\n\t\t\t\t\t\t - BUG_ON(atomic_inode-\u003ei_data.nrpages)\n\nWe need to add a reference on fi-\u003eatomic_inode before using its mapping\nfield during garbage collection, otherwise, it will cause UAF issue."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local access through filesystem syscalls and ioctls (atomic-write ioctls, file I/O, close/evict) on an F2FS mount; there is no network-facing entry point to the vulnerable GC path.\nAC:L - The attacker controls both sides of the race by running concurrent threads that perform atomic writes/commits/closes while filling the filesystem or driving writes to trigger background or foreground GC via f2fs_balance_fs and the f2fs_gc kthread.\nPR:L - No real root is required; an unprivileged local user with write access to their own files on F2FS can use atomic-write ioctls and normal I/O to reach the bug, while GC runs automatically without CAP_SYS_ADMIN.\nUI:N - The attacker can trigger the full exploit chain on files they own without any separate victim user performing actions; atomic-write setup, GC pressure, and inode eviction are all orchestrated by the attacker process.\nS:U - Impact is kernel memory corruption and potential local privilege escalation within the same kernel security boundary, not a cross-VM or cross-container escape to a different security authority.\nC:H - This is a use-after-free on a live inode address_space; the freed atomic_inode can be reused or read through stale mapping pointers, enabling arbitrary kernel memory disclosure primitives.\nI:H - UAF on inode mapping during folio allocation allows heap corruption and control of freed object contents, which is exploitable for arbitrary kernel write and local privilege escalation.\nA:H - The race reliably leads to kernel BUG_ON in clear_inode when nrpages is nonzero, and UAF corruption can cause kernel oops or panic even before full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:51:23.480Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7d3ae21783e5914c1761ac7d63f882d3d70800e9"
},
{
"url": "https://git.kernel.org/stable/c/56038756aae68312df00d4aa1d97e51ef3aca725"
},
{
"url": "https://git.kernel.org/stable/c/a499f77c06050a28c897bdbd86cd2f0721ae0743"
},
{
"url": "https://git.kernel.org/stable/c/a805fec35c201c59643ddcde713bce4051c8ee27"
},
{
"url": "https://git.kernel.org/stable/c/e0288584baa5dc41df4a829a023c4c1b33fe53d7"
}
],
"title": "f2fs: atomic: fix UAF issue on f2fs_inode_info.atomic_inode",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63816",
"datePublished": "2026-07-19T12:02:15.907Z",
"dateReserved": "2026-07-19T07:54:57.014Z",
"dateUpdated": "2026-08-17T04:51:23.480Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53399 (GCVE-0-2026-53399)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-08-17 04:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfsd: release layout stid on setlease failure
nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via
idr_alloc_cyclic() under cl_lock before returning to
nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then
fails, the error path frees the layout stateid directly with
kmem_cache_free() without ever calling idr_remove(), leaving the
IDR slot pointing at freed slab memory. Any subsequent IDR walker
(states_show, client teardown) dereferences the dangling pointer.
The correct teardown for an IDR-published stid is nfs4_put_stid(),
which removes the IDR slot under cl_lock, dispatches sc_free
(nfsd4_free_layout_stateid) to release ls->ls_file via
nfsd4_close_layout(), and drops the nfs4_file reference in its
tail.
A second issue blocks that switch: nfsd4_free_layout_stateid()
unconditionally inspects ls->ls_fence_work via
delayed_work_pending() under ls_lock, but
INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only
after the setlease call. On the setlease-failure path the
destructor would touch an uninitialized delayed_work.
nfsd4_alloc_layout_stateid()
nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */
nfsd4_layout_setlease() /* fails */
nfs4_put_stid()
nfsd4_free_layout_stateid()
delayed_work_pending(&ls->ls_fence_work) /* needs INIT */
nfsd4_close_layout() /* nfsd_file_put(ls->ls_file) */
put_nfs4_file()
Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK
initialization above the nfsd4_layout_setlease() call, and replace
the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup
with a single nfs4_put_stid(stp).
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c5c707f96fc9a6e5a57ca5baac892673270abe3d Version: c5c707f96fc9a6e5a57ca5baac892673270abe3d Version: c5c707f96fc9a6e5a57ca5baac892673270abe3d Version: c5c707f96fc9a6e5a57ca5baac892673270abe3d Version: c5c707f96fc9a6e5a57ca5baac892673270abe3d Version: c5c707f96fc9a6e5a57ca5baac892673270abe3d Version: c5c707f96fc9a6e5a57ca5baac892673270abe3d Version: c5c707f96fc9a6e5a57ca5baac892673270abe3d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4layouts.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d788ef40a7517d22c97ab01700e4ae4c611b6f2f",
"status": "affected",
"version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
"versionType": "git"
},
{
"lessThan": "2e0a5d6d62600b8c614d1b55e50ef94035d6adf9",
"status": "affected",
"version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
"versionType": "git"
},
{
"lessThan": "7bbb7ce74051c8be4b69ff44ce3db370600dae61",
"status": "affected",
"version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
"versionType": "git"
},
{
"lessThan": "48a586e382e4db1dbf958d44b63e081df5f8ed04",
"status": "affected",
"version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
"versionType": "git"
},
{
"lessThan": "d369e5edfaaf83a448016e2f1da392b2174be801",
"status": "affected",
"version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
"versionType": "git"
},
{
"lessThan": "8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd",
"status": "affected",
"version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
"versionType": "git"
},
{
"lessThan": "83c2b7797742339bb768f83935f7ca33950db138",
"status": "affected",
"version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
"versionType": "git"
},
{
"lessThan": "30d55c8aabb261bc3f427d6b9aae7ef6206063f9",
"status": "affected",
"version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4layouts.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release layout stid on setlease failure\n\nnfs4_alloc_stid() publishes the new stid into cl-\u003ecl_stateids via\nidr_alloc_cyclic() under cl_lock before returning to\nnfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then\nfails, the error path frees the layout stateid directly with\nkmem_cache_free() without ever calling idr_remove(), leaving the\nIDR slot pointing at freed slab memory. Any subsequent IDR walker\n(states_show, client teardown) dereferences the dangling pointer.\n\nThe correct teardown for an IDR-published stid is nfs4_put_stid(),\nwhich removes the IDR slot under cl_lock, dispatches sc_free\n(nfsd4_free_layout_stateid) to release ls-\u003els_file via\nnfsd4_close_layout(), and drops the nfs4_file reference in its\ntail.\n\nA second issue blocks that switch: nfsd4_free_layout_stateid()\nunconditionally inspects ls-\u003els_fence_work via\ndelayed_work_pending() under ls_lock, but\nINIT_DELAYED_WORK(\u0026ls-\u003els_fence_work, ...) currently runs only\nafter the setlease call. On the setlease-failure path the\ndestructor would touch an uninitialized delayed_work.\n\n nfsd4_alloc_layout_stateid()\n nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */\n nfsd4_layout_setlease() /* fails */\n nfs4_put_stid()\n nfsd4_free_layout_stateid()\n delayed_work_pending(\u0026ls-\u003els_fence_work) /* needs INIT */\n nfsd4_close_layout() /* nfsd_file_put(ls-\u003els_file) */\n put_nfs4_file()\n\nFix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK\ninitialization above the nfsd4_layout_setlease() call, and replace\nthe manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup\nwith a single nfs4_put_stid(stp)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is reached through nfsd\u0027s NFSv4 OP_LAYOUTGET handler, which processes attacker-controlled RPC compounds over the network on TCP port 2049.\nAC:L - An authenticated NFS client can reliably trigger the fault by issuing LAYOUTGET on block/SCSI pNFS exports so that nfsd4_layout_setlease() fails (e.g., -ENOMEM or -EINVAL), and can retry, spray the slab, and race concurrent compounds to exploit the dangling IDR entry.\nPR:N - Exploitation requires only the ability to act as a remote NFSv4 client against an export with pNFS enabled, not local shell access or elevated privileges on the Linux host.\nUI:N - No end-user or administrator action on the server is required; the vulnerability is triggered entirely through malicious NFS protocol traffic from a network client.\nS:U - Impact is confined to kernel memory corruption and nfsd state within the same kernel security boundary, not a cross-boundary escape such as VM or container breakout.\nC:H - The IDR retains a pointer to freed layout stateid slab memory, creating a use-after-free that can be leveraged for arbitrary kernel memory reads after heap reuse.\nI:H - UAF on the layout stateid object enables controlled slab reuse and corruption of adjacent kernel structures, supporting arbitrary write or control-flow hijack primitives.\nA:H - Dereferencing the dangling IDR pointer during state iteration or stateid lookup can cause kernel oops/panic, and UAF exploitation can crash or hang the server."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:51.453Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d788ef40a7517d22c97ab01700e4ae4c611b6f2f"
},
{
"url": "https://git.kernel.org/stable/c/2e0a5d6d62600b8c614d1b55e50ef94035d6adf9"
},
{
"url": "https://git.kernel.org/stable/c/7bbb7ce74051c8be4b69ff44ce3db370600dae61"
},
{
"url": "https://git.kernel.org/stable/c/48a586e382e4db1dbf958d44b63e081df5f8ed04"
},
{
"url": "https://git.kernel.org/stable/c/d369e5edfaaf83a448016e2f1da392b2174be801"
},
{
"url": "https://git.kernel.org/stable/c/8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd"
},
{
"url": "https://git.kernel.org/stable/c/83c2b7797742339bb768f83935f7ca33950db138"
},
{
"url": "https://git.kernel.org/stable/c/30d55c8aabb261bc3f427d6b9aae7ef6206063f9"
}
],
"title": "nfsd: release layout stid on setlease failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53399",
"datePublished": "2026-07-19T12:02:00.055Z",
"dateReserved": "2026-06-09T07:44:35.402Z",
"dateUpdated": "2026-08-17T04:50:51.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63815 (GCVE-0-2026-63815)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-08-17 04:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
When the flexible_inline_xattr feature is enabled, do_read_inode() loads
the on-disk i_inline_xattr_size unconditionally:
if (f2fs_sb_has_flexible_inline_xattr(sbi))
fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size);
but sanity_check_inode() only range-checks it when the inode also has the
FI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline
data but not FI_INLINE_XATTR -- the normal layout for an inline
directory -- therefore keeps a fully attacker-controlled
i_inline_xattr_size from a crafted image.
get_inline_xattr_addrs() returns that value with no flag gating, so it
feeds the inode geometry:
MAX_INLINE_DATA() = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1)
NR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...)
addrs_per_page() = CUR_ADDRS_PER_INODE - i_inline_xattr_size
A large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY()
negative, so make_dentry_ptr_inline() sets d->max (int) to a negative
value. The inline directory walk then compares an unsigned long bit_pos
against that negative d->max, which is promoted to a huge unsigned bound,
and reads far past the inline area:
while (bit_pos < d->max) /* fs/f2fs/dir.c */
... test_bit_le(bit_pos, d->bitmap) / d->dentry[bit_pos] ...
Mounting a crafted image and reading such a directory triggers an
out-of-bounds read in f2fs_fill_dentries(); the same underflow also
corrupts ADDRS_PER_INODE for regular files.
Validate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the
flexible_inline_xattr feature is enabled -- i.e. whenever the value is
loaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE
bound gated on inodes that actually carry an inline xattr, so legitimate
inodes with i_inline_xattr_size == 0 are still accepted.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6afc662e68b5f988282ff20afd58a89b1c279dca Version: 6afc662e68b5f988282ff20afd58a89b1c279dca Version: 6afc662e68b5f988282ff20afd58a89b1c279dca Version: 6afc662e68b5f988282ff20afd58a89b1c279dca Version: 6afc662e68b5f988282ff20afd58a89b1c279dca Version: 6afc662e68b5f988282ff20afd58a89b1c279dca Version: 6afc662e68b5f988282ff20afd58a89b1c279dca Version: 6afc662e68b5f988282ff20afd58a89b1c279dca |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3c8d6b4093aea40a20596f452289e7c22d84e6d5",
"status": "affected",
"version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
"versionType": "git"
},
{
"lessThan": "a08ee30dcbeff6b97df75c38c2589603ddde53a6",
"status": "affected",
"version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
"versionType": "git"
},
{
"lessThan": "c3e05522daae4e7348a1ea81eeb321d25aa0fd3b",
"status": "affected",
"version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
"versionType": "git"
},
{
"lessThan": "76e1a05cf6d4051931d7fa4ead51a05786a62918",
"status": "affected",
"version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
"versionType": "git"
},
{
"lessThan": "2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706",
"status": "affected",
"version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
"versionType": "git"
},
{
"lessThan": "4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d",
"status": "affected",
"version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
"versionType": "git"
},
{
"lessThan": "16bc237ce3c483b75575abea53cfb639745311ed",
"status": "affected",
"version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
"versionType": "git"
},
{
"lessThan": "378acf3cf19b6af6cba55e8dd1154c4e1504bae8",
"status": "affected",
"version": "6afc662e68b5f988282ff20afd58a89b1c279dca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: bound i_inline_xattr_size for non-inline-xattr inodes\n\nWhen the flexible_inline_xattr feature is enabled, do_read_inode() loads\nthe on-disk i_inline_xattr_size unconditionally:\n\n\tif (f2fs_sb_has_flexible_inline_xattr(sbi))\n\t\tfi-\u003ei_inline_xattr_size = le16_to_cpu(ri-\u003ei_inline_xattr_size);\n\nbut sanity_check_inode() only range-checks it when the inode also has the\nFI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline\ndata but not FI_INLINE_XATTR -- the normal layout for an inline\ndirectory -- therefore keeps a fully attacker-controlled\ni_inline_xattr_size from a crafted image.\n\nget_inline_xattr_addrs() returns that value with no flag gating, so it\nfeeds the inode geometry:\n\n\tMAX_INLINE_DATA() = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1)\n\tNR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...)\n\taddrs_per_page() = CUR_ADDRS_PER_INODE - i_inline_xattr_size\n\nA large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY()\nnegative, so make_dentry_ptr_inline() sets d-\u003emax (int) to a negative\nvalue. The inline directory walk then compares an unsigned long bit_pos\nagainst that negative d-\u003emax, which is promoted to a huge unsigned bound,\nand reads far past the inline area:\n\n\twhile (bit_pos \u003c d-\u003emax)\t\t/* fs/f2fs/dir.c */\n\t\t... test_bit_le(bit_pos, d-\u003ebitmap) / d-\u003edentry[bit_pos] ...\n\nMounting a crafted image and reading such a directory triggers an\nout-of-bounds read in f2fs_fill_dentries(); the same underflow also\ncorrupts ADDRS_PER_INODE for regular files.\n\nValidate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the\nflexible_inline_xattr feature is enabled -- i.e. whenever the value is\nloaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE\nbound gated on inodes that actually carry an inline xattr, so legitimate\ninodes with i_inline_xattr_size == 0 are still accepted."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local syscalls (mount on a block/loop device, then getdents/lookup on an inline directory); f2fs is not reachable via a network-facing in-kernel protocol handler.\nAC:L - The attacker fully controls the on-disk inode fields in a crafted f2fs image and can reliably trigger the bug by mounting that image and reading the directory; no race or rare runtime state is required.\nPR:N - An attacker can craft a malicious f2fs image offline with no privileges on the target system; exploitation is triggered when the image is mounted and its inline directory is read, including by privileged auto-mount services on shared/kiosk systems.\nUI:N - No victim user action beyond the attacker\u0027s own mount and directory read is required; an attacker with user-namespace mount capability can self-trigger without involving another user.\nS:U - Impact is kernel memory corruption and information disclosure within the same kernel security boundary, not a cross-boundary escape such as guest-to-host VM breakout.\nC:H - The corrupted geometry drives out-of-bounds reads via test_bit_le(), dentry, and filename pointer accesses far beyond the inline data area, enabling kernel memory disclosure.\nI:H - Integer underflow in inode geometry also corrupts ADDRS_PER_INODE/addrs_per_page calculations for regular files, creating memory corruption that can be leveraged for out-of-bounds writes and further exploitation.\nA:H - Reading far past the inline area can cause kernel oops or panic, and the corrupted address calculations can crash or destabilize the kernel during subsequent file operations."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:51:22.389Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3c8d6b4093aea40a20596f452289e7c22d84e6d5"
},
{
"url": "https://git.kernel.org/stable/c/a08ee30dcbeff6b97df75c38c2589603ddde53a6"
},
{
"url": "https://git.kernel.org/stable/c/c3e05522daae4e7348a1ea81eeb321d25aa0fd3b"
},
{
"url": "https://git.kernel.org/stable/c/76e1a05cf6d4051931d7fa4ead51a05786a62918"
},
{
"url": "https://git.kernel.org/stable/c/2a9f9791653ba5ed3fb45bbffa8d63a7cd5cf706"
},
{
"url": "https://git.kernel.org/stable/c/4ce2d52f680c1d8bfdad7cce05b815ea7ca9790d"
},
{
"url": "https://git.kernel.org/stable/c/16bc237ce3c483b75575abea53cfb639745311ed"
},
{
"url": "https://git.kernel.org/stable/c/378acf3cf19b6af6cba55e8dd1154c4e1504bae8"
}
],
"title": "f2fs: bound i_inline_xattr_size for non-inline-xattr inodes",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63815",
"datePublished": "2026-07-19T12:02:15.345Z",
"dateReserved": "2026-07-19T07:54:57.014Z",
"dateUpdated": "2026-08-17T04:51:22.389Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64189 (GCVE-0-2026-64189)
Vulnerability from cvelistv5
Published
2026-07-20 16:27
Modified
2026-08-17 04:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: fix race between dump and ip_set_list resize
The release path of ip_set_dump_do() and ip_set_dump_done() read
inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw()
of the array pointer. These run from netlink_recvmsg() without the nfnl
mutex and without an RCU read-side critical section.
A concurrent ip_set_create() can grow the array: it publishes the new
array, calls synchronize_net() and then kvfree()s the old one. Since the
dump paths read the array outside any RCU reader, synchronize_net() does
not wait for them and the old array can be freed while they still index
into it, causing a use-after-free.
The dumped set itself stays pinned via set->ref_netlink, so only the
array load needs protecting. Take rcu_read_lock() around it, matching
ip_set_get_byname() and __ip_set_put_byindex().
BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)
Read of size 8 at addr ffff88800b5c4018 by task exploit/150
Call Trace:
...
kasan_report (mm/kasan/report.c:595)
ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)
netlink_dump (net/netlink/af_netlink.c:2325)
netlink_recvmsg (net/netlink/af_netlink.c:1976)
sock_recvmsg (net/socket.c:1159)
__sys_recvfrom (net/socket.c:2315)
...
Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x02d6...d0-0x02d6...d7]
RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698)
Kernel panic - not syncing: Fatal exception
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 Version: 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 Version: 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 Version: 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 Version: 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 Version: 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 Version: 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 Version: 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 Version: 2f6bf7917f55f9dae913193e49672b3598620eab Version: 4.19.5 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipset/ip_set_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a7a299277959683204d73333c32c092fd69327d4",
"status": "affected",
"version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
"versionType": "git"
},
{
"lessThan": "1bc67c3fc98e9fc07032cc56afcdbc690c47d11e",
"status": "affected",
"version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
"versionType": "git"
},
{
"lessThan": "e8a9976b61f1bc4aa7fd25fa26726dfdf2adf710",
"status": "affected",
"version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
"versionType": "git"
},
{
"lessThan": "96fbafc20ebd9a613736c2998b89c539fe3042f5",
"status": "affected",
"version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
"versionType": "git"
},
{
"lessThan": "ff86ea9b7fdf70564e60436fbee68c96bc459943",
"status": "affected",
"version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
"versionType": "git"
},
{
"lessThan": "81d54c766337b923eec26da0a13406760b091093",
"status": "affected",
"version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
"versionType": "git"
},
{
"lessThan": "e8ee198bbc04a32d336e79160fde980e0235b39f",
"status": "affected",
"version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
"versionType": "git"
},
{
"lessThan": "7cd9103283b26b917360ec99d7d2f2d761bcf1ab",
"status": "affected",
"version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
"versionType": "git"
},
{
"status": "affected",
"version": "2f6bf7917f55f9dae913193e49672b3598620eab",
"versionType": "git"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/ipset/ip_set_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: fix race between dump and ip_set_list resize\n\nThe release path of ip_set_dump_do() and ip_set_dump_done() read\ninst-\u003eip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw()\nof the array pointer. These run from netlink_recvmsg() without the nfnl\nmutex and without an RCU read-side critical section.\n\nA concurrent ip_set_create() can grow the array: it publishes the new\narray, calls synchronize_net() and then kvfree()s the old one. Since the\ndump paths read the array outside any RCU reader, synchronize_net() does\nnot wait for them and the old array can be freed while they still index\ninto it, causing a use-after-free.\n\nThe dumped set itself stays pinned via set-\u003eref_netlink, so only the\narray load needs protecting. Take rcu_read_lock() around it, matching\nip_set_get_byname() and __ip_set_put_byindex().\n\n BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)\n Read of size 8 at addr ffff88800b5c4018 by task exploit/150\n Call Trace:\n ...\n kasan_report (mm/kasan/report.c:595)\n ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)\n netlink_dump (net/netlink/af_netlink.c:2325)\n netlink_recvmsg (net/netlink/af_netlink.c:1976)\n sock_recvmsg (net/socket.c:1159)\n __sys_recvfrom (net/socket.c:2315)\n ...\n Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI\n KASAN: maybe wild-memory-access in range [0x02d6...d0-0x02d6...d7]\n RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698)\n Kernel panic - not syncing: Fatal exception"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable dump and resize paths are reached through local NETLINK_NETFILTER send and receive syscalls, not through remotely received packets.\nAC:L - The attacker controls both sides by issuing an ipset dump and concurrent CREATE requests that grow ip_set_list, and can repeat the race without any victim-controlled condition.\nPR:L - NFNETLINK requires CAP_NET_ADMIN in the network namespace\u0027s owning user namespace, which an unprivileged user can obtain through user and network namespaces on deployments permitting unprivileged user namespaces.\nUI:N - After obtaining local execution, the attacker can trigger both racing operations without any action by another user.\nS:U - Exploitation compromises the kernel of the same host and constitutes standard local privilege escalation rather than crossing a VM, hypervisor, or IOMMU boundary.\nC:H - Reclaiming the freed array can make the loaded struct ip_set pointer attacker-influenced, after which variant-pointer dereferences can enable kernel code execution and arbitrary memory disclosure.\nI:H - The release path performs an indirect uref callback and decrements ref_netlink through the stale pointer, providing control-flow and kernel-memory-write opportunities after heap reclamation.\nA:H - The reported use-after-free produced a general-protection fault and kernel panic, and an attacker can trigger the race repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:51:49.683Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a7a299277959683204d73333c32c092fd69327d4"
},
{
"url": "https://git.kernel.org/stable/c/1bc67c3fc98e9fc07032cc56afcdbc690c47d11e"
},
{
"url": "https://git.kernel.org/stable/c/e8a9976b61f1bc4aa7fd25fa26726dfdf2adf710"
},
{
"url": "https://git.kernel.org/stable/c/96fbafc20ebd9a613736c2998b89c539fe3042f5"
},
{
"url": "https://git.kernel.org/stable/c/ff86ea9b7fdf70564e60436fbee68c96bc459943"
},
{
"url": "https://git.kernel.org/stable/c/81d54c766337b923eec26da0a13406760b091093"
},
{
"url": "https://git.kernel.org/stable/c/e8ee198bbc04a32d336e79160fde980e0235b39f"
},
{
"url": "https://git.kernel.org/stable/c/7cd9103283b26b917360ec99d7d2f2d761bcf1ab"
}
],
"title": "netfilter: ipset: fix race between dump and ip_set_list resize",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64189",
"datePublished": "2026-07-20T16:27:47.767Z",
"dateReserved": "2026-07-19T07:54:57.040Z",
"dateUpdated": "2026-08-17T04:51:49.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64187 (GCVE-0-2026-64187)
Vulnerability from cvelistv5
Published
2026-07-20 16:27
Modified
2026-08-17 04:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: fail recovery on a committed log item with no regions
If the first op of a transaction is a bare transaction header
(len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans()
adds an item but no region, leaving it on r_itemq with ri_cnt == 0 and
ri_buf == NULL.
The header can be split across op records, so later ops may still add
regions; the item is only invalid if the transaction commits with none.
The runtime commit path never emits such a transaction, so this only
happens on a crafted log. It came from an AI-assisted code audit of the
recovery parser.
xlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads
*(unsigned short *)item->ri_buf[0].iov_base and faults on the NULL
ri_buf. Reject it there, before the commit handlers that also read
ri_buf[0].
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836)
xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043)
xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501)
xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244)
xlog_recover (fs/xfs/xfs_log_recover.c:3493)
xfs_log_mount (fs/xfs/xfs_log.c:618)
xfs_mountfs (fs/xfs/xfs_mount.c:1034)
xfs_fs_fill_super (fs/xfs/xfs_super.c:1938)
vfs_get_tree (fs/super.c:1695)
path_mount (fs/namespace.c:4161)
__x64_sys_mount (fs/namespace.c:4367)
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 89cebc8477290b152618ffa110bbeae340d50900 Version: 89cebc8477290b152618ffa110bbeae340d50900 Version: 89cebc8477290b152618ffa110bbeae340d50900 Version: 89cebc8477290b152618ffa110bbeae340d50900 Version: 89cebc8477290b152618ffa110bbeae340d50900 Version: 89cebc8477290b152618ffa110bbeae340d50900 Version: 89cebc8477290b152618ffa110bbeae340d50900 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_log_recover.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5105426424ad6981db827cc1ada835a488fab035",
"status": "affected",
"version": "89cebc8477290b152618ffa110bbeae340d50900",
"versionType": "git"
},
{
"lessThan": "226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4",
"status": "affected",
"version": "89cebc8477290b152618ffa110bbeae340d50900",
"versionType": "git"
},
{
"lessThan": "d0ae7ec3aa61db5140b107f0a63e017f63e56a96",
"status": "affected",
"version": "89cebc8477290b152618ffa110bbeae340d50900",
"versionType": "git"
},
{
"lessThan": "d50b1fd066d66ceb548ba43e332cfe8a47e5e55a",
"status": "affected",
"version": "89cebc8477290b152618ffa110bbeae340d50900",
"versionType": "git"
},
{
"lessThan": "d98f22d2e11e0a36493aeb25b2933571ee90d9a4",
"status": "affected",
"version": "89cebc8477290b152618ffa110bbeae340d50900",
"versionType": "git"
},
{
"lessThan": "cccbabeb9a18fcb978d76d6047f2b59214aa7749",
"status": "affected",
"version": "89cebc8477290b152618ffa110bbeae340d50900",
"versionType": "git"
},
{
"lessThan": "2094dab19d45c487285617b7b68913d0cc0c1211",
"status": "affected",
"version": "89cebc8477290b152618ffa110bbeae340d50900",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_log_recover.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: fail recovery on a committed log item with no regions\n\nIf the first op of a transaction is a bare transaction header\n(len == sizeof(struct xfs_trans_header)), xlog_recover_add_to_trans()\nadds an item but no region, leaving it on r_itemq with ri_cnt == 0 and\nri_buf == NULL.\n\nThe header can be split across op records, so later ops may still add\nregions; the item is only invalid if the transaction commits with none.\nThe runtime commit path never emits such a transaction, so this only\nhappens on a crafted log. It came from an AI-assisted code audit of the\nrecovery parser.\n\nxlog_recover_reorder_trans() calls ITEM_TYPE() on the item, which reads\n*(unsigned short *)item-\u003eri_buf[0].iov_base and faults on the NULL\nri_buf. Reject it there, before the commit handlers that also read\nri_buf[0].\n\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:xlog_recover_reorder_trans (fs/xfs/xfs_log_recover.c:1836)\n xlog_recover_commit_trans (fs/xfs/xfs_log_recover.c:2043)\n xlog_recover_process_data (fs/xfs/xfs_log_recover.c:2501)\n xlog_do_recovery_pass (fs/xfs/xfs_log_recover.c:3244)\n xlog_recover (fs/xfs/xfs_log_recover.c:3493)\n xfs_log_mount (fs/xfs/xfs_log.c:618)\n xfs_mountfs (fs/xfs/xfs_mount.c:1034)\n xfs_fs_fill_super (fs/xfs/xfs_super.c:1938)\n vfs_get_tree (fs/super.c:1695)\n path_mount (fs/namespace.c:4161)\n __x64_sys_mount (fs/namespace.c:4367)"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:51:48.578Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5105426424ad6981db827cc1ada835a488fab035"
},
{
"url": "https://git.kernel.org/stable/c/226a3c8bea7163c39fe0a1c0ffc7ab7410ef3ba4"
},
{
"url": "https://git.kernel.org/stable/c/d0ae7ec3aa61db5140b107f0a63e017f63e56a96"
},
{
"url": "https://git.kernel.org/stable/c/d50b1fd066d66ceb548ba43e332cfe8a47e5e55a"
},
{
"url": "https://git.kernel.org/stable/c/d98f22d2e11e0a36493aeb25b2933571ee90d9a4"
},
{
"url": "https://git.kernel.org/stable/c/cccbabeb9a18fcb978d76d6047f2b59214aa7749"
},
{
"url": "https://git.kernel.org/stable/c/2094dab19d45c487285617b7b68913d0cc0c1211"
}
],
"title": "xfs: fail recovery on a committed log item with no regions",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64187",
"datePublished": "2026-07-20T16:27:46.653Z",
"dateReserved": "2026-07-19T07:54:57.040Z",
"dateUpdated": "2026-08-17T04:51:48.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-21807 (GCVE-0-2025-21807)
Vulnerability from cvelistv5
Published
2025-02-27 20:00
Modified
2026-07-18 15:00
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
block: fix queue freeze vs limits lock order in sysfs store methods
queue_attr_store() always freezes a device queue before calling the
attribute store operation. For attributes that control queue limits, the
store operation will also lock the queue limits with a call to
queue_limits_start_update(). However, some drivers (e.g. SCSI sd) may
need to issue commands to a device to obtain limit values from the
hardware with the queue limits locked. This creates a potential ABBA
deadlock situation if a user attempts to modify a limit (thus freezing
the device queue) while the device driver starts a revalidation of the
device queue limits.
Avoid such deadlock by not freezing the queue before calling the
->store_limit() method in struct queue_sysfs_entry and instead use the
queue_limits_commit_update_frozen helper to freeze the queue after taking
the limits lock.
This also removes taking the sysfs lock for the store_limit method as
it doesn't protect anything here, but creates even more nesting.
Hopefully it will go away from the actual sysfs methods entirely soon.
(commit log adapted from a similar patch from Damien Le Moal)
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/blk-sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1645cd7fd42c236c952e9228badcac4fea1829ea",
"status": "affected",
"version": "0327ca9d53bfbb0918867313049bba7046900f73",
"versionType": "git"
},
{
"lessThan": "8985da5481562e96b95e94ed8e5cc9b6565eb82b",
"status": "affected",
"version": "0327ca9d53bfbb0918867313049bba7046900f73",
"versionType": "git"
},
{
"lessThan": "c99f66e4084a62a2cc401c4704a84328aeddc9ec",
"status": "affected",
"version": "0327ca9d53bfbb0918867313049bba7046900f73",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/blk-sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"lessThan": "6.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.13.*",
"status": "unaffected",
"version": "6.13.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.14",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.2",
"versionStartIncluding": "6.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14",
"versionStartIncluding": "6.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock: fix queue freeze vs limits lock order in sysfs store methods\n\nqueue_attr_store() always freezes a device queue before calling the\nattribute store operation. For attributes that control queue limits, the\nstore operation will also lock the queue limits with a call to\nqueue_limits_start_update(). However, some drivers (e.g. SCSI sd) may\nneed to issue commands to a device to obtain limit values from the\nhardware with the queue limits locked. This creates a potential ABBA\ndeadlock situation if a user attempts to modify a limit (thus freezing\nthe device queue) while the device driver starts a revalidation of the\ndevice queue limits.\n\nAvoid such deadlock by not freezing the queue before calling the\n-\u003estore_limit() method in struct queue_sysfs_entry and instead use the\nqueue_limits_commit_update_frozen helper to freeze the queue after taking\nthe limits lock.\n\nThis also removes taking the sysfs lock for the store_limit method as\nit doesn\u0027t protect anything here, but creates even more nesting.\nHopefully it will go away from the actual sysfs methods entirely soon.\n\n(commit log adapted from a similar patch from Damien Le Moal)"
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T15:00:42.201Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1645cd7fd42c236c952e9228badcac4fea1829ea"
},
{
"url": "https://git.kernel.org/stable/c/8985da5481562e96b95e94ed8e5cc9b6565eb82b"
},
{
"url": "https://git.kernel.org/stable/c/c99f66e4084a62a2cc401c4704a84328aeddc9ec"
}
],
"title": "block: fix queue freeze vs limits lock order in sysfs store methods",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-21807",
"datePublished": "2025-02-27T20:00:59.560Z",
"dateReserved": "2024-12-29T08:45:45.772Z",
"dateUpdated": "2026-07-18T15:00:42.201Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63818 (GCVE-0-2026-63818)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-08-17 04:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: validate orphan inode entry count
f2fs_recover_orphan_inodes() trusts the orphan block entry_count when
replaying orphan inodes from the checkpoint pack. A corrupted entry_count
larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the
ino[] array and interpret footer or following data as inode numbers.
On a crafted image, mounting an unpatched kernel can drive orphan recovery
into f2fs_bug_on() and panic the kernel. Validate entry_count before
consuming entries so corrupted checkpoint data fails the mount with
-EFSCORRUPTED and requests fsck instead.
Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be
recorded in the superblock s_errors[] field. This gives fsck a persistent
hint even though mount-time orphan recovery failure may leave no chance to
persist SBI_NEED_FSCK through a checkpoint.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 127e670abfa7fa150f6550d620ded930f5bdb4e7 Version: 127e670abfa7fa150f6550d620ded930f5bdb4e7 Version: 127e670abfa7fa150f6550d620ded930f5bdb4e7 Version: 127e670abfa7fa150f6550d620ded930f5bdb4e7 Version: 127e670abfa7fa150f6550d620ded930f5bdb4e7 Version: 127e670abfa7fa150f6550d620ded930f5bdb4e7 Version: 127e670abfa7fa150f6550d620ded930f5bdb4e7 Version: 127e670abfa7fa150f6550d620ded930f5bdb4e7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/checkpoint.c",
"include/linux/f2fs_fs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "210c210c92d78fdf5051bc55c5c69044b1a2150a",
"status": "affected",
"version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
"versionType": "git"
},
{
"lessThan": "ad101d15716f5a24d1fa82a849f80430c805a3dd",
"status": "affected",
"version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
"versionType": "git"
},
{
"lessThan": "d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70",
"status": "affected",
"version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
"versionType": "git"
},
{
"lessThan": "d2f236196d542ccd8505736e41c3a1d3f0305f6f",
"status": "affected",
"version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
"versionType": "git"
},
{
"lessThan": "550511a2470f6d204fa07b331f048bd2d3c51280",
"status": "affected",
"version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
"versionType": "git"
},
{
"lessThan": "8aad54746c251f2c2370118df766c0c82e2d2091",
"status": "affected",
"version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
"versionType": "git"
},
{
"lessThan": "2e12381d4495dc8b0ff042c6856022b2e359835c",
"status": "affected",
"version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
"versionType": "git"
},
{
"lessThan": "846c499a65816d13f1186e3090e825e8bb8bcb8b",
"status": "affected",
"version": "127e670abfa7fa150f6550d620ded930f5bdb4e7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/checkpoint.c",
"include/linux/f2fs_fs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: validate orphan inode entry count\n\nf2fs_recover_orphan_inodes() trusts the orphan block entry_count when\nreplaying orphan inodes from the checkpoint pack. A corrupted entry_count\nlarger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the\nino[] array and interpret footer or following data as inode numbers.\n\nOn a crafted image, mounting an unpatched kernel can drive orphan recovery\ninto f2fs_bug_on() and panic the kernel. Validate entry_count before\nconsuming entries so corrupted checkpoint data fails the mount with\n-EFSCORRUPTED and requests fsck instead.\n\nSet ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be\nrecorded in the superblock s_errors[] field. This gives fsck a persistent\nhint even though mount-time orphan recovery failure may leave no chance to\npersist SBI_NEED_FSCK through a checkpoint."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code runs only during F2FS mount via the mount syscall path (fs_context \u2192 get_tree_bdev \u2192 f2fs_fill_super \u2192 f2fs_recover_orphan_inodes); it is not reachable from network protocols or device drivers.\nAC:L - An attacker fully controls the crafted on-disk orphan block including entry_count and ino[] contents, so triggering the bug is reliable once a victim or privileged auto-mount path mounts the image; no race or rare layout dependency is required.\nPR:N - The attacker needs no privileges on the victim system\u2014only a malicious F2FS image delivered via removable media, downloaded disk image, or similar that a privileged mount/auto-mount daemon later processes.\nUI:N - No victim interaction is required when the attacker mounts their own crafted image (e.g., loop mount in a user namespace with CAP_SYS_ADMIN), and automated privileged mount paths can process attacker-supplied media without further user action.\nS:U - Impact is confined to kernel/filesystem integrity and availability on the host mounting the image; it does not cross a VM, container, or IOMMU security boundary.\nC:H - The unchecked loop indexes past ino[F2FS_ORPHANS_PER_BLOCK-1] into the block footer and beyond the 4 KiB orphan block, constituting an out-of-bounds read of attacker-influenced metadata that can leak kernel-adjacent memory contents.\nI:H - Misinterpreted inode numbers are passed to recover_orphan_inode(), which clear_nlink() and iput() (truncating data) on matching real inodes, enabling deliberate destruction of filesystem contents from a crafted image.\nA:H - Crafted entry_count values drive f2fs_bug_on() on -ENOENT (kernel BUG/panic with CONFIG_F2FS_CHECK_FS, or WARN/oops otherwise) and can hang or crash the system during mount via unbounded orphan recovery iteration."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:51:25.680Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/210c210c92d78fdf5051bc55c5c69044b1a2150a"
},
{
"url": "https://git.kernel.org/stable/c/ad101d15716f5a24d1fa82a849f80430c805a3dd"
},
{
"url": "https://git.kernel.org/stable/c/d18c81f5d0ecd5796aa47d66d98f2dd54d8d0f70"
},
{
"url": "https://git.kernel.org/stable/c/d2f236196d542ccd8505736e41c3a1d3f0305f6f"
},
{
"url": "https://git.kernel.org/stable/c/550511a2470f6d204fa07b331f048bd2d3c51280"
},
{
"url": "https://git.kernel.org/stable/c/8aad54746c251f2c2370118df766c0c82e2d2091"
},
{
"url": "https://git.kernel.org/stable/c/2e12381d4495dc8b0ff042c6856022b2e359835c"
},
{
"url": "https://git.kernel.org/stable/c/846c499a65816d13f1186e3090e825e8bb8bcb8b"
}
],
"title": "f2fs: validate orphan inode entry count",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63818",
"datePublished": "2026-07-19T12:02:17.022Z",
"dateReserved": "2026-07-19T07:54:57.014Z",
"dateUpdated": "2026-08-17T04:51:25.680Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53027 (GCVE-0-2026-53027)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-07-24 14:33
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()
When a compressed or sparse attribute has its clusters frame-aligned,
vcn is rounded down to the frame start using cmask, which can result
in vcn != vcn0. In this case, vcn and vcn0 may reside in different
attribute segments.
The code already handles the case where vcn is in a different segment
by loading its runs before allocation. However, it fails to load runs
for vcn0 when vcn0 resides in a different segment than vcn. This causes
run_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was
never loaded into the in-memory run list, triggering the WARN_ON(1).
Fix this by adding a missing check for vcn0 after the existing vcn
segment check. If vcn0 falls outside the current segment range
[svcn, evcn1), find and load the attribute segment containing vcn0
before performing the run lookup.
The following scenario triggers the bug:
attr_data_get_block_locked()
vcn = vcn0 & cmask <- vcn != vcn0 after frame alignment
load runs for vcn segment <- vcn0 segment not loaded!
attr_allocate_clusters() <- allocation succeeds
run_lookup_entry(vcn0) <- vcn0 not in run -> SPARSE_LCN
WARN_ON(1) <- bug fires here!
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c380b52f6c5702cc4bdda5e6d456d6c19a201a0b Version: c380b52f6c5702cc4bdda5e6d456d6c19a201a0b Version: c380b52f6c5702cc4bdda5e6d456d6c19a201a0b Version: c380b52f6c5702cc4bdda5e6d456d6c19a201a0b Version: c380b52f6c5702cc4bdda5e6d456d6c19a201a0b Version: 406a037d93b769bca248476bd14bbe548dc1ec35 Version: 6.1.132 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/attrib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ea59d9dbc5504e29d420ac4aab774cbce39b0e69",
"status": "affected",
"version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
"versionType": "git"
},
{
"lessThan": "d68a14450783ecc5fddae957ac4e1c546dfcfb73",
"status": "affected",
"version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
"versionType": "git"
},
{
"lessThan": "08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147",
"status": "affected",
"version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
"versionType": "git"
},
{
"lessThan": "2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54",
"status": "affected",
"version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
"versionType": "git"
},
{
"lessThan": "d7ea8495fd307b58f8867acd81a1b40075b1d3ba",
"status": "affected",
"version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
"versionType": "git"
},
{
"status": "affected",
"version": "406a037d93b769bca248476bd14bbe548dc1ec35",
"versionType": "git"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.132",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/attrib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.132",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()\n\nWhen a compressed or sparse attribute has its clusters frame-aligned,\nvcn is rounded down to the frame start using cmask, which can result\nin vcn != vcn0. In this case, vcn and vcn0 may reside in different\nattribute segments.\n\nThe code already handles the case where vcn is in a different segment\nby loading its runs before allocation. However, it fails to load runs\nfor vcn0 when vcn0 resides in a different segment than vcn. This causes\nrun_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was\nnever loaded into the in-memory run list, triggering the WARN_ON(1).\n\nFix this by adding a missing check for vcn0 after the existing vcn\nsegment check. If vcn0 falls outside the current segment range\n[svcn, evcn1), find and load the attribute segment containing vcn0\nbefore performing the run lookup.\n\nThe following scenario triggers the bug:\n attr_data_get_block_locked()\n vcn = vcn0 \u0026 cmask \u003c- vcn != vcn0 after frame alignment\n load runs for vcn segment \u003c- vcn0 segment not loaded!\n attr_allocate_clusters() \u003c- allocation succeeds\n run_lookup_entry(vcn0) \u003c- vcn0 not in run -\u003e SPARSE_LCN\n WARN_ON(1) \u003c- bug fires here!"
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:33:47.674Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ea59d9dbc5504e29d420ac4aab774cbce39b0e69"
},
{
"url": "https://git.kernel.org/stable/c/d68a14450783ecc5fddae957ac4e1c546dfcfb73"
},
{
"url": "https://git.kernel.org/stable/c/08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147"
},
{
"url": "https://git.kernel.org/stable/c/2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54"
},
{
"url": "https://git.kernel.org/stable/c/d7ea8495fd307b58f8867acd81a1b40075b1d3ba"
}
],
"title": "fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53027",
"datePublished": "2026-06-24T16:29:35.740Z",
"dateReserved": "2026-06-09T07:44:35.379Z",
"dateUpdated": "2026-07-24T14:33:47.674Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53226 (GCVE-0-2026-53226)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-07-18 15:00
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpio: rockchip: fix generic IRQ chip leak on remove
The driver allocates domain generic chips using
irq_alloc_domain_generic_chips() during probe. However, on driver
remove/teardown, the generic chips are not automatically freed when the
IRQ domain is removed because the domain flags do not include
IRQ_DOMAIN_FLAG_DESTROY_GC.
This causes both the domain generic chips structure and the associated
generic chips to be leaked. Additionally, the generic chips remain on
the global gc_list and may later be visited by generic IRQ chip suspend,
resume, or shutdown callbacks after the GPIO bank has been removed,
potentially resulting in a use-after-free and kernel crash.
Fix the resource leak by explicitly calling
irq_domain_remove_generic_chips() before removing the IRQ domain in
rockchip_gpio_remove().
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-rockchip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "50c7a6d2bf179588ba2daee97be93d19c96a94af",
"status": "affected",
"version": "936ee2675eee1faca0dcdfa79165c7990422e0fc",
"versionType": "git"
},
{
"lessThan": "bace7b99bfa555fe833aee8827b8004c43666d02",
"status": "affected",
"version": "936ee2675eee1faca0dcdfa79165c7990422e0fc",
"versionType": "git"
},
{
"lessThan": "1f34ea5f6114011092d9a5c8b901ad6741144a1d",
"status": "affected",
"version": "936ee2675eee1faca0dcdfa79165c7990422e0fc",
"versionType": "git"
},
{
"lessThan": "1c1e0fc88d6ef65bf15d517853251f75ab9d18c3",
"status": "affected",
"version": "936ee2675eee1faca0dcdfa79165c7990422e0fc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-rockchip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.36",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.36",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: rockchip: fix generic IRQ chip leak on remove\n\nThe driver allocates domain generic chips using\nirq_alloc_domain_generic_chips() during probe. However, on driver\nremove/teardown, the generic chips are not automatically freed when the\nIRQ domain is removed because the domain flags do not include\nIRQ_DOMAIN_FLAG_DESTROY_GC.\n\nThis causes both the domain generic chips structure and the associated\ngeneric chips to be leaked. Additionally, the generic chips remain on\nthe global gc_list and may later be visited by generic IRQ chip suspend,\nresume, or shutdown callbacks after the GPIO bank has been removed,\npotentially resulting in a use-after-free and kernel crash.\n\nFix the resource leak by explicitly calling\nirq_domain_remove_generic_chips() before removing the IRQ domain in\nrockchip_gpio_remove()."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-18T15:00:47.412Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/50c7a6d2bf179588ba2daee97be93d19c96a94af"
},
{
"url": "https://git.kernel.org/stable/c/bace7b99bfa555fe833aee8827b8004c43666d02"
},
{
"url": "https://git.kernel.org/stable/c/1f34ea5f6114011092d9a5c8b901ad6741144a1d"
},
{
"url": "https://git.kernel.org/stable/c/1c1e0fc88d6ef65bf15d517853251f75ab9d18c3"
}
],
"title": "gpio: rockchip: fix generic IRQ chip leak on remove",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53226",
"datePublished": "2026-06-25T08:39:26.567Z",
"dateReserved": "2026-06-09T07:44:35.392Z",
"dateUpdated": "2026-07-18T15:00:47.412Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53392 (GCVE-0-2026-53392)
Vulnerability from cvelistv5
Published
2026-07-19 12:01
Modified
2026-08-17 04:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
NFSv4/flexfiles: reject zero filehandle version count
ff_layout_alloc_lseg() decodes the filehandle-version array count
from the flexfiles layout body. The value is used as the count for
kzalloc_objs(), and the current code only rejects NULL.
A zero count yields ZERO_SIZE_PTR, which can be stored in
dss_info->fh_versions even though later flexfiles paths assume that at
least one filehandle version exists.
Reject fh_count == 0 before the allocation, matching the existing zero
version_count validation in the flexfiles GETDEVICEINFO parser.
A QEMU/KASAN run with a malformed flexfiles layout hit:
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750
ff_layout_encode_layoutreturn+0x683/0x970
nfs4_xdr_enc_layoutreturn+0x278/0x3a0
Kernel panic - not syncing: Fatal exception
The patched kernel rejects the malformed layout without KASAN/oops/panic,
and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d67ae825a59d639e4d8b82413af84d854617a87e Version: d67ae825a59d639e4d8b82413af84d854617a87e Version: d67ae825a59d639e4d8b82413af84d854617a87e Version: d67ae825a59d639e4d8b82413af84d854617a87e Version: d67ae825a59d639e4d8b82413af84d854617a87e Version: d67ae825a59d639e4d8b82413af84d854617a87e Version: d67ae825a59d639e4d8b82413af84d854617a87e Version: d67ae825a59d639e4d8b82413af84d854617a87e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfs/flexfilelayout/flexfilelayout.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9033591535c066726f5b505126ccb4068b98fa4f",
"status": "affected",
"version": "d67ae825a59d639e4d8b82413af84d854617a87e",
"versionType": "git"
},
{
"lessThan": "18cc6d57a14fa65ab2a2b52279f549041c4bc9cf",
"status": "affected",
"version": "d67ae825a59d639e4d8b82413af84d854617a87e",
"versionType": "git"
},
{
"lessThan": "be7829715e341b42846437dd9e721005db59f0cc",
"status": "affected",
"version": "d67ae825a59d639e4d8b82413af84d854617a87e",
"versionType": "git"
},
{
"lessThan": "eeabb9020721db6bc132e68eeae380b8d4fb4b04",
"status": "affected",
"version": "d67ae825a59d639e4d8b82413af84d854617a87e",
"versionType": "git"
},
{
"lessThan": "7779c85028a0676fb190cde4f0c540f4f8e97761",
"status": "affected",
"version": "d67ae825a59d639e4d8b82413af84d854617a87e",
"versionType": "git"
},
{
"lessThan": "d8c90c7cc061265d5f2813a1f5c82ef2f4707e67",
"status": "affected",
"version": "d67ae825a59d639e4d8b82413af84d854617a87e",
"versionType": "git"
},
{
"lessThan": "2131ed64b767ffa8bcdb3677d90f3964e39aabc8",
"status": "affected",
"version": "d67ae825a59d639e4d8b82413af84d854617a87e",
"versionType": "git"
},
{
"lessThan": "2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2",
"status": "affected",
"version": "d67ae825a59d639e4d8b82413af84d854617a87e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfs/flexfilelayout/flexfilelayout.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.38",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.38",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFSv4/flexfiles: reject zero filehandle version count\n\nff_layout_alloc_lseg() decodes the filehandle-version array count\nfrom the flexfiles layout body. The value is used as the count for\nkzalloc_objs(), and the current code only rejects NULL.\n\nA zero count yields ZERO_SIZE_PTR, which can be stored in\ndss_info-\u003efh_versions even though later flexfiles paths assume that at\nleast one filehandle version exists.\n\nReject fh_count == 0 before the allocation, matching the existing zero\nversion_count validation in the flexfiles GETDEVICEINFO parser.\n\nA QEMU/KASAN run with a malformed flexfiles layout hit:\n\n KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]\n RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750\n ff_layout_encode_layoutreturn+0x683/0x970\n nfs4_xdr_enc_layoutreturn+0x278/0x3a0\n Kernel panic - not syncing: Fatal exception\n\nThe patched kernel rejects the malformed layout without KASAN/oops/panic,\nand a valid fh_count=1 regression still opens, reads, and unmounts cleanly."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is in the NFSv4 pNFS flexfiles client parsing a malicious LAYOUTGET layout blob from the server over NFS/RPC; a remote attacker who controls or MITMs the NFS server delivers the crafted fh_count=0 response over the network.\nAC:L - Once a client is using flexfiles pNFS, the attacker fully controls the layout XDR and can set fh_count=0 to deterministically store ZERO_SIZE_PTR; a later I/O, layoutstats, or LAYOUTRETURN path dereferences fh_versions[0] and panics without races or special heap layout.\nPR:N - Exploitation requires no privileges on the victim host; the attacker only needs to be the (or impersonate) the NFS server sending protocol responses after normal client connection/authentication.\nUI:N - After an NFS pNFS flexfiles mount is established (common in enterprise/HPC NAS deployments), triggering the malformed layout and subsequent kernel panic requires no further victim action beyond routine file access on the already-mounted share.\nS:U - Impact is a kernel oops/panic on the NFS client host; it does not cross a VM, container, or IOMMU security boundary to affect a different authority.\nC:N - The failure mode is a NULL-pointer dereference at ZERO_SIZE_PTR (0x10) when accessing fh_versions[0]; KASAN confirms a faulting dereference with no successful out-of-bounds read or information leak to userspace.\nI:N - There is no memory corruption or successful write primitive\u2014only an invalid-pointer dereference that crashes the kernel before any integrity-changing operation completes.\nA:H - A confirmed KASAN null-ptr-deref in ff_layout_encode_ff_layoutupdate during LAYOUTRETURN encoding causes a fatal kernel exception/panic, fully denying availability of the client system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:43.747Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9033591535c066726f5b505126ccb4068b98fa4f"
},
{
"url": "https://git.kernel.org/stable/c/18cc6d57a14fa65ab2a2b52279f549041c4bc9cf"
},
{
"url": "https://git.kernel.org/stable/c/be7829715e341b42846437dd9e721005db59f0cc"
},
{
"url": "https://git.kernel.org/stable/c/eeabb9020721db6bc132e68eeae380b8d4fb4b04"
},
{
"url": "https://git.kernel.org/stable/c/7779c85028a0676fb190cde4f0c540f4f8e97761"
},
{
"url": "https://git.kernel.org/stable/c/d8c90c7cc061265d5f2813a1f5c82ef2f4707e67"
},
{
"url": "https://git.kernel.org/stable/c/2131ed64b767ffa8bcdb3677d90f3964e39aabc8"
},
{
"url": "https://git.kernel.org/stable/c/2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2"
}
],
"title": "NFSv4/flexfiles: reject zero filehandle version count",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53392",
"datePublished": "2026-07-19T12:01:56.101Z",
"dateReserved": "2026-06-09T07:44:35.402Z",
"dateUpdated": "2026-08-17T04:50:43.747Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53402 (GCVE-0-2026-53402)
Vulnerability from cvelistv5
Published
2026-07-19 12:02
Modified
2026-08-17 04:50
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
When fbcon_do_set_font() fails (e.g., due to a memory allocation failure
inside vc_resize() under heavy memory pressure), it jumps to the `err_out`
label to roll back the console state. However, the current rollback logic
forgets to restore the `hi_font` state, leading to a severe state machine
corruption.
Earlier in the function, `set_vc_hi_font()` might be called to change
`vc->vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`
subsequently fails, the `err_out` path restores `vc_font.charcount`
but entirely skips rolling back the `vc_hi_font_mask` and the screen
buffer.
This mismatch leaves the terminal in a desynchronized state. Because
`vc_hi_font_mask` remains set, the VT subsystem will still accept
character indices greater than 255 from userspace and write them to the
screen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will
then use these inflated indices to access the reverted, 256-character
font array, leading to a deterministic out-of-bounds read and potential
kernel memory disclosure.
Fix this by adding the missing rollback logic for the `hi_font` mask
and screen buffer in the error path.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 868749a7456dc48e93887a8474194e2ee6d6c21f Version: ebd6f886aa2447fcfcdce5450c9e1028e1d681bb Version: a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 Version: a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 Version: a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 Version: a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 Version: a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 Version: a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 Version: f08ccb792d3eaf1dc62d8cbf6a30d6522329f660 Version: 5.10.249 ≤ Version: 5.15.64 ≤ Version: 5.19.6 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbcon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cb016bcb40c81e7b19c4ae6143babb366dae8e20",
"status": "affected",
"version": "868749a7456dc48e93887a8474194e2ee6d6c21f",
"versionType": "git"
},
{
"lessThan": "ac562193c36696513ae196171892e9338475c4bc",
"status": "affected",
"version": "ebd6f886aa2447fcfcdce5450c9e1028e1d681bb",
"versionType": "git"
},
{
"lessThan": "3618a4c5b2591cfa83efe74f5b18c2d02b35c3f5",
"status": "affected",
"version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
"versionType": "git"
},
{
"lessThan": "a7a526fbc847f07ad3a503c7382189be5ab68574",
"status": "affected",
"version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
"versionType": "git"
},
{
"lessThan": "b5bb2c696e140c399cb874def2feedf61dee27d6",
"status": "affected",
"version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
"versionType": "git"
},
{
"lessThan": "076b1aa65f77a49bce5a48a4a55a397cfcafa2b8",
"status": "affected",
"version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
"versionType": "git"
},
{
"lessThan": "39815715cbcfabb16fc8c5f4a23deeda20f5df62",
"status": "affected",
"version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
"versionType": "git"
},
{
"lessThan": "8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2",
"status": "affected",
"version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
"versionType": "git"
},
{
"status": "affected",
"version": "f08ccb792d3eaf1dc62d8cbf6a30d6522329f660",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.249",
"versionType": "semver"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.64",
"versionType": "semver"
},
{
"lessThan": "5.20",
"status": "affected",
"version": "5.19.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/video/fbdev/core/fbcon.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.96",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.249",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.96",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.3",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.19.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()\n\nWhen fbcon_do_set_font() fails (e.g., due to a memory allocation failure\ninside vc_resize() under heavy memory pressure), it jumps to the `err_out`\nlabel to roll back the console state. However, the current rollback logic\nforgets to restore the `hi_font` state, leading to a severe state machine\ncorruption.\n\nEarlier in the function, `set_vc_hi_font()` might be called to change\n`vc-\u003evc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`\nsubsequently fails, the `err_out` path restores `vc_font.charcount`\nbut entirely skips rolling back the `vc_hi_font_mask` and the screen\nbuffer.\n\nThis mismatch leaves the terminal in a desynchronized state. Because\n`vc_hi_font_mask` remains set, the VT subsystem will still accept\ncharacter indices greater than 255 from userspace and write them to the\nscreen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will\nthen use these inflated indices to access the reverted, 256-character\nfont array, leading to a deterministic out-of-bounds read and potential\nkernel memory disclosure.\n\nFix this by adding the missing rollback logic for the `hi_font` mask\nand screen buffer in the error path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached only through the KDFONTOP ioctl on a framebuffer-console virtual terminal (/dev/ttyN), which is a local syscall path with no network or physical-access vector.\nAC:L - An attacker who controls a session on an fbcon-backed VT can reliably trigger the bug by issuing a font-change ioctl with different dimensions and a 256\u2194512 glyph transition, then inducing vc_resize() failure through self-controlled memory pressure; no race or victim-dependent timing is required.\nPR:L - KDFONTOP font-set operations require only that the caller owns the controlling TTY (current-\u003esignal-\u003etty == tty), which any unprivileged local user with a console or VT session has; CAP_SYS_TTY_CONFIG is not required on that path.\nUI:N - Exploitation requires only the attacker\u0027s own ioctl and memory-pressure actions on their TTY; no action by another user or administrator is needed.\nS:U - Impact is confined to kernel memory disclosure and potential kernel crash within the same kernel security authority; there is no VM escape, sandbox escape, or cross-security-boundary effect.\nC:H - The desynchronized hi_font_mask causes deterministic out-of-bounds reads from the kernel font glyph buffer during fbcon rendering (e.g., bit_cursor and rotated putcs paths), enabling disclosure of adjacent kernel memory.\nI:N - The flaw is an out-of-bounds read with console state desynchronization; it does not provide an arbitrary kernel write, code execution, or other data-modification primitive.\nA:H - Out-of-bounds reads from kernel font data can cause kernel page faults and oopses, consistent with the prior syzkaller-reported fbcon font/resize failure class that produced unhandled page faults."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:50:55.659Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cb016bcb40c81e7b19c4ae6143babb366dae8e20"
},
{
"url": "https://git.kernel.org/stable/c/ac562193c36696513ae196171892e9338475c4bc"
},
{
"url": "https://git.kernel.org/stable/c/3618a4c5b2591cfa83efe74f5b18c2d02b35c3f5"
},
{
"url": "https://git.kernel.org/stable/c/a7a526fbc847f07ad3a503c7382189be5ab68574"
},
{
"url": "https://git.kernel.org/stable/c/b5bb2c696e140c399cb874def2feedf61dee27d6"
},
{
"url": "https://git.kernel.org/stable/c/076b1aa65f77a49bce5a48a4a55a397cfcafa2b8"
},
{
"url": "https://git.kernel.org/stable/c/39815715cbcfabb16fc8c5f4a23deeda20f5df62"
},
{
"url": "https://git.kernel.org/stable/c/8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2"
}
],
"title": "fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53402",
"datePublished": "2026-07-19T12:02:01.795Z",
"dateReserved": "2026-06-09T07:44:35.403Z",
"dateUpdated": "2026-08-17T04:50:55.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…