{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/extents.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "77e407967cd872cd75d7e4a691908e49c8e6b4d4",
              "status": "affected",
              "version": "b8a8684502a0fc852afa0056c6bb2a9273f6fcc0",
              "versionType": "git"
            },
            {
              "lessThan": "37555690f39f78ef69af347d9aff897e07445949",
              "status": "affected",
              "version": "b8a8684502a0fc852afa0056c6bb2a9273f6fcc0",
              "versionType": "git"
            },
            {
              "lessThan": "67cdb7bd7442bd3cdc6d6088bbb2df9be2fe936c",
              "status": "affected",
              "version": "b8a8684502a0fc852afa0056c6bb2a9273f6fcc0",
              "versionType": "git"
            },
            {
              "lessThan": "2920ec61c98b9476781359f05b94da84e80f54d4",
              "status": "affected",
              "version": "b8a8684502a0fc852afa0056c6bb2a9273f6fcc0",
              "versionType": "git"
            },
            {
              "lessThan": "2698731d25823267c29190cb578da9296a0c0d7b",
              "status": "affected",
              "version": "b8a8684502a0fc852afa0056c6bb2a9273f6fcc0",
              "versionType": "git"
            },
            {
              "lessThan": "716e7439a5a9b18c3ff882c2f8c834b9ced1aaec",
              "status": "affected",
              "version": "b8a8684502a0fc852afa0056c6bb2a9273f6fcc0",
              "versionType": "git"
            },
            {
              "lessThan": "feaf2a80e78f89ee8a3464126077ba8683b62791",
              "status": "affected",
              "version": "b8a8684502a0fc852afa0056c6bb2a9273f6fcc0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/extents.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.15"
            },
            {
              "lessThan": "3.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.17",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: don\u0027t set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O\n\nWhen allocating blocks during within-EOF DIO and writeback with\ndioread_nolock enabled, EXT4_GET_BLOCKS_PRE_IO was set to split an\nexisting large unwritten extent. However, EXT4_GET_BLOCKS_CONVERT was\nset when calling ext4_split_convert_extents(), which may potentially\nresult in stale data issues.\n\nAssume we have an unwritten extent, and then DIO writes the second half.\n\n   [UUUUUUUUUUUUUUUU] on-disk extent        U: unwritten extent\n   [UUUUUUUUUUUUUUUU] extent status tree\n            |\u003c-   -\u003e| ----\u003e dio write this range\n\nFirst, ext4_iomap_alloc() call ext4_map_blocks() with\nEXT4_GET_BLOCKS_PRE_IO, EXT4_GET_BLOCKS_UNWRIT_EXT and\nEXT4_GET_BLOCKS_CREATE flags set. ext4_map_blocks() find this extent and\ncall ext4_split_convert_extents() with EXT4_GET_BLOCKS_CONVERT and the\nabove flags set.\n\nThen, ext4_split_convert_extents() calls ext4_split_extent() with\nEXT4_EXT_MAY_ZEROOUT, EXT4_EXT_MARK_UNWRIT2 and EXT4_EXT_DATA_VALID2\nflags set, and it calls ext4_split_extent_at() to split the second half\nwith EXT4_EXT_DATA_VALID2, EXT4_EXT_MARK_UNWRIT1, EXT4_EXT_MAY_ZEROOUT\nand EXT4_EXT_MARK_UNWRIT2 flags set. However, ext4_split_extent_at()\nfailed to insert extent since a temporary lack -ENOSPC. It zeroes out\nthe first half but convert the entire on-disk extent to written since\nthe EXT4_EXT_DATA_VALID2 flag set, but left the second half as unwritten\nin the extent status tree.\n\n   [0000000000SSSSSS]  data                S: stale data, 0: zeroed\n   [WWWWWWWWWWWWWWWW]  on-disk extent      W: written extent\n   [WWWWWWWWWWUUUUUU]  extent status tree\n\nFinally, if the DIO failed to write data to the disk, the stale data in\nthe second half will be exposed once the cached extent entry is gone.\n\nFix this issue by not passing EXT4_GET_BLOCKS_CONVERT when splitting\nan unwritten extent before submitting I/O, and make\next4_split_convert_extents() to zero out the entire extent range\nto zero for this case, and also mark the extent in the extent status\ntree for consistency."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:18:43.844Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/77e407967cd872cd75d7e4a691908e49c8e6b4d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/37555690f39f78ef69af347d9aff897e07445949"
        },
        {
          "url": "https://git.kernel.org/stable/c/67cdb7bd7442bd3cdc6d6088bbb2df9be2fe936c"
        },
        {
          "url": "https://git.kernel.org/stable/c/2920ec61c98b9476781359f05b94da84e80f54d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2698731d25823267c29190cb578da9296a0c0d7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/716e7439a5a9b18c3ff882c2f8c834b9ced1aaec"
        },
        {
          "url": "https://git.kernel.org/stable/c/feaf2a80e78f89ee8a3464126077ba8683b62791"
        }
      ],
      "title": "ext4: don\u0027t set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45985",
    "datePublished": "2026-05-27T12:18:43.844Z",
    "dateReserved": "2026-05-13T15:03:33.090Z",
    "dateUpdated": "2026-05-27T12:18:43.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "30bb2ec6695d62f63db4aa6179c4626834ed0cd6",
              "status": "affected",
              "version": "235c67634230b0f9ad8c0185272fed36c892b1c4",
              "versionType": "git"
            },
            {
              "lessThan": "183182235f6d53bac62c6c39014738a54a68dfa6",
              "status": "affected",
              "version": "235c67634230b0f9ad8c0185272fed36c892b1c4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED\n\n[Why]\ndcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with\nDC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_START takes fpregs_lock(),\nwhich disables local softirqs.\n\nThe DML1 path through dcn32_enable_phantom_plane() calls kvzalloc() to\nallocate ~335 KiB for dc_plane_state. This triggers the vmalloc path,\nwhich calls BUG_ON(in_interrupt()) because it\u0027s invoked within the\nFPU-enabled (softirq disabled) region, leading to a kernel crash.\n\n[How]\nWrap the dc_state_create_phantom_plane() call with the\nDC_RUN_WITH_PREEMPTION_ENABLED() macro to allow preemption during\nthis memory allocation.\n\n(cherry picked from commit 885ccbef7b94a8b38f69c4211c679021aa27ad11)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-26T19:40:46.328Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/30bb2ec6695d62f63db4aa6179c4626834ed0cd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/183182235f6d53bac62c6c39014738a54a68dfa6"
        }
      ],
      "title": "drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53285",
    "datePublished": "2026-06-26T19:40:46.328Z",
    "dateReserved": "2026-06-09T07:44:35.396Z",
    "dateUpdated": "2026-06-26T19:40:46.328Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "58059335e46537de682db84984f7716c813208c4",
              "status": "affected",
              "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2",
              "versionType": "git"
            },
            {
              "lessThan": "92a8cb1806adefb263cf096eab6705705cf7eee1",
              "status": "affected",
              "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2",
              "versionType": "git"
            },
            {
              "lessThan": "65d114b5270b62aefb820ecd6c3b7caeea8f895d",
              "status": "affected",
              "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2",
              "versionType": "git"
            },
            {
              "lessThan": "af9e89d8dd39530c8bd14c33ddf6b502df1071b6",
              "status": "affected",
              "version": "98d7ca374ba4b39e7535613d40e159f09ca14da2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Preserve id of register in sync_linked_regs()\n\nsync_linked_regs() copies the id of known_reg to reg when propagating\nbounds of known_reg to reg using the off of known_reg, but when\nknown_reg was linked to reg like:\n\nknown_reg = reg         ; both known_reg and reg get same id\nknown_reg += 4          ; known_reg gets off = 4, and its id gets BPF_ADD_CONST\n\nnow when a call to sync_linked_regs() happens, let\u0027s say with the following:\n\nif known_reg \u003e= 10 goto pc+2\n\nknown_reg\u0027s new bounds are propagated to reg but now reg gets\nBPF_ADD_CONST from the copy.\n\nThis means if another link to reg is created like:\n\nanother_reg = reg       ; another_reg should get the id of reg but\n                          assign_scalar_id_before_mov() sees\n                          BPF_ADD_CONST on reg and assigns a new id to it.\n\nAs reg has a new id now, known_reg\u0027s link to reg is broken. If we find\nnew bounds for known_reg, they will not be propagated to reg.\n\nThis can be seen in the selftest added in the next commit:\n\n0: (85) call bpf_get_prandom_u32#7    ; R0=scalar()\n1: (57) r0 \u0026= 255                     ; R0=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))\n2: (bf) r1 = r0                       ; R0=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) R1=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff))\n3: (07) r1 += 4                       ; R1=scalar(id=1+4,smin=umin=smin32=umin32=4,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))\n4: (a5) if r1 \u003c 0xa goto pc+4         ; R1=scalar(id=1+4,smin=umin=smin32=umin32=10,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))\n5: (bf) r2 = r0                       ; R0=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=255) R2=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=255)\n6: (a5) if r1 \u003c 0xe goto pc+2         ; R1=scalar(id=1+4,smin=umin=smin32=umin32=14,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff))\n7: (35) if r0 \u003e= 0xa goto pc+1        ; R0=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=9,var_off=(0x0; 0xf))\n8: (37) r0 /= 0\ndiv by zero\n\nWhen 4 is verified, r1\u0027s bounds are propagated to r0 but r0 also gets\nBPF_ADD_CONST (bug).\nWhen 5 is verified, r0 gets a new id (2) and its link with r1 is broken.\n\nAfter 6 we know r1 has bounds [14, 259] and therefore r0 should have\nbounds [10, 255], therefore the branch at 7 is always taken. But because\nr0\u0027s id was changed to 2, r1\u0027s new bounds are not propagated to r0.\nThe verifier still thinks r0 has bounds [6, 255] before 7 and execution\ncan reach div by zero.\n\nFix this by preserving id in sync_linked_regs() like off and subreg_def."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the BPF verifier, reached only by loading a crafted BPF program via the bpf() syscall from a local process; remote data never reaches this code.\nAC:L - The attacker writes the exact BPF instruction sequence that deterministically triggers the broken link in sync_linked_regs(); no race or uncontrolled condition is involved.\nPR:L - The verifier runs for all program loads, and socket-filter/cgroup-skb programs are loadable without CAP_BPF when unprivileged_bpf_disabled=0 (a supported default), so any unprivileged local user can reach it.\nUI:N - The attacker loads and runs their own program; no victim action is required.\nS:U - Impact is confined to the kernel\u0027s own security authority \u2014 standard local privilege escalation, no crossing into a separate VM/IOMMU boundary.\nC:H - The verifier can be made to believe a register holds a wrong value, allowing a verified-as-safe out-of-bounds read primitive over kernel memory, yielding arbitrary kernel memory disclosure.\nI:H - The same false-bounds primitive enables an out-of-bounds write the verifier \"proved\" safe, giving an arbitrary kernel write usable for privilege escalation and code-flow hijacking.\nA:H - The resulting out-of-bounds accesses on attacker-controlled values readily corrupt kernel memory and panic/crash the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:47.803Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/58059335e46537de682db84984f7716c813208c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/92a8cb1806adefb263cf096eab6705705cf7eee1"
        },
        {
          "url": "https://git.kernel.org/stable/c/65d114b5270b62aefb820ecd6c3b7caeea8f895d"
        },
        {
          "url": "https://git.kernel.org/stable/c/af9e89d8dd39530c8bd14c33ddf6b502df1071b6"
        }
      ],
      "title": "bpf: Preserve id of register in sync_linked_regs()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45933",
    "datePublished": "2026-05-27T12:17:51.127Z",
    "dateReserved": "2026-05-13T15:03:33.086Z",
    "dateUpdated": "2026-08-05T12:28:47.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/bcache/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "81f44ed8c3f54abb7561ece774ea4cca5070b2f2",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "f50e7c325ab1207fe941555bcff659f6d7050572",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "9467d360be70e6ee55b0c1cd2a1f1424f57b5b85",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "add4982510f3b7c318a2dd7438bdc9c63171e753",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "2d6965581e164fa2ba3f7652ddae5535f6336576",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "4f71c8ba2dc009042493021d94a9718fbe2ebf27",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            },
            {
              "lessThan": "fec114a98b8735ee89c75216c45a78e28be0f128",
              "status": "affected",
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/bcache/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.1",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix cached_dev.sb_bio use-after-free and crash\n\nIn our production environment, we have received multiple crash reports\nregarding libceph, which have caught our attention:\n\n```\n[6888366.280350] Call Trace:\n[6888366.280452]  blk_update_request+0x14e/0x370\n[6888366.280561]  blk_mq_end_request+0x1a/0x130\n[6888366.280671]  rbd_img_handle_request+0x1a0/0x1b0 [rbd]\n[6888366.280792]  rbd_obj_handle_request+0x32/0x40 [rbd]\n[6888366.280903]  __complete_request+0x22/0x70 [libceph]\n[6888366.281032]  osd_dispatch+0x15e/0xb40 [libceph]\n[6888366.281164]  ? inet_recvmsg+0x5b/0xd0\n[6888366.281272]  ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]\n[6888366.281405]  ceph_con_process_message+0x79/0x140 [libceph]\n[6888366.281534]  ceph_con_v1_try_read+0x5d7/0xf30 [libceph]\n[6888366.281661]  ceph_con_workfn+0x329/0x680 [libceph]\n```\n\nAfter analyzing the coredump file, we found that the address of\ndc-\u003esb_bio has been freed. We know that cached_dev is only freed when it\nis stopped.\n\nSince sb_bio is a part of struct cached_dev, rather than an alloc every\ntime.  If the device is stopped while writing to the superblock, the\nreleased address will be accessed at endio.\n\nThis patch hopes to wait for sb_write to complete in cached_dev_free.\n\nIt should be noted that we analyzed the cause of the problem, then tell\nall details to the QWEN and adopted the modifications it made."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:42:06.405Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/81f44ed8c3f54abb7561ece774ea4cca5070b2f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/f50e7c325ab1207fe941555bcff659f6d7050572"
        },
        {
          "url": "https://git.kernel.org/stable/c/9467d360be70e6ee55b0c1cd2a1f1424f57b5b85"
        },
        {
          "url": "https://git.kernel.org/stable/c/47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/add4982510f3b7c318a2dd7438bdc9c63171e753"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d6965581e164fa2ba3f7652ddae5535f6336576"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f71c8ba2dc009042493021d94a9718fbe2ebf27"
        },
        {
          "url": "https://git.kernel.org/stable/c/383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/fec114a98b8735ee89c75216c45a78e28be0f128"
        }
      ],
      "title": "bcache: fix cached_dev.sb_bio use-after-free and crash",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31580",
    "datePublished": "2026-04-24T14:42:10.874Z",
    "dateReserved": "2026-03-09T15:48:24.119Z",
    "dateUpdated": "2026-06-14T17:42:06.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-dw-dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b8188ff3cfaa5621212b08473488cdbe41f86531",
              "status": "affected",
              "version": "bdbdf0f06337d3661b64c0288c291cb06624065e",
              "versionType": "git"
            },
            {
              "lessThan": "aae4a47073b12c23eb1d2c5401bda442fbe27bd1",
              "status": "affected",
              "version": "bdbdf0f06337d3661b64c0288c291cb06624065e",
              "versionType": "git"
            },
            {
              "lessThan": "184f5aaf72f1f1c73e66bae0b8d28e81c2f2a72f",
              "status": "affected",
              "version": "bdbdf0f06337d3661b64c0288c291cb06624065e",
              "versionType": "git"
            },
            {
              "lessThan": "3b46d61890632c8f8b117147b6923bff4b42ccb7",
              "status": "affected",
              "version": "bdbdf0f06337d3661b64c0288c291cb06624065e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/spi/spi-dw-dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-dw-dma: fix print error log when wait finish transaction\n\nIf an error occurs, the device may not have a current message. In this\ncase, the system will crash.\n\nIn this case, it\u0027s better to use dev from the struct ctlr (struct spi_controller*)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T16:11:44.450Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b8188ff3cfaa5621212b08473488cdbe41f86531"
        },
        {
          "url": "https://git.kernel.org/stable/c/aae4a47073b12c23eb1d2c5401bda442fbe27bd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/184f5aaf72f1f1c73e66bae0b8d28e81c2f2a72f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b46d61890632c8f8b117147b6923bff4b42ccb7"
        }
      ],
      "title": "spi: spi-dw-dma: fix print error log when wait finish transaction",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31560",
    "datePublished": "2026-04-24T14:35:42.634Z",
    "dateReserved": "2026-03-09T15:48:24.116Z",
    "dateUpdated": "2026-06-01T16:11:44.450Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4idmap.c",
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b9abb760db20504240a7147f27934d900cd80b23",
              "status": "affected",
              "version": "2f425878b6a71571341dcd3f9e9d1a6f6355da9c",
              "versionType": "git"
            },
            {
              "lessThan": "3a72c7dedc99b321e0f267e4e999e5baf07c4593",
              "status": "affected",
              "version": "2f425878b6a71571341dcd3f9e9d1a6f6355da9c",
              "versionType": "git"
            },
            {
              "lessThan": "99e17b20fddac19a228d213e00f6b9e1c10daff9",
              "status": "affected",
              "version": "2f425878b6a71571341dcd3f9e9d1a6f6355da9c",
              "versionType": "git"
            },
            {
              "lessThan": "243f71ed873ff3feeb6f9b5cb145d63f7188b4c4",
              "status": "affected",
              "version": "2f425878b6a71571341dcd3f9e9d1a6f6355da9c",
              "versionType": "git"
            },
            {
              "lessThan": "063a6f22478ef929625000a2caf54667725c1dfd",
              "status": "affected",
              "version": "2f425878b6a71571341dcd3f9e9d1a6f6355da9c",
              "versionType": "git"
            },
            {
              "lessThan": "d75ec4504a4340b033b15cad0303988b3089dd93",
              "status": "affected",
              "version": "2f425878b6a71571341dcd3f9e9d1a6f6355da9c",
              "versionType": "git"
            },
            {
              "lessThan": "8dff54fe88c0dcd4c55bff9fc2fa6ca968290826",
              "status": "affected",
              "version": "2f425878b6a71571341dcd3f9e9d1a6f6355da9c",
              "versionType": "git"
            },
            {
              "lessThan": "f9c206cdc4266caad6a9a7f46341420a10f03ccb",
              "status": "affected",
              "version": "2f425878b6a71571341dcd3f9e9d1a6f6355da9c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4idmap.c",
            "fs/nfsd/nfs4proc.c",
            "fs/nfsd/nfs4xdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: never defer requests during idmap lookup\n\nDuring v4 request compound arg decoding, some ops (e.g. SETATTR)\ncan trigger idmap lookup upcalls. When those upcall responses get\ndelayed beyond the allowed time limit, cache_check() will mark the\nrequest for deferral and cause it to be dropped.\n\nThis prevents nfs4svc_encode_compoundres from being executed, and\nthus the session slot flag NFSD4_SLOT_INUSE never gets cleared.\nSubsequent client requests will fail with NFSERR_JUKEBOX, given\nthat the slot will be marked as in-use, making the SEQUENCE op\nfail.\n\nFix this by making sure that the RQ_USEDEFERRAL flag is always\nclear during nfs4svc_decode_compoundargs(), since no v4 request\nshould ever be deferred."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:18:41.619Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b9abb760db20504240a7147f27934d900cd80b23"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a72c7dedc99b321e0f267e4e999e5baf07c4593"
        },
        {
          "url": "https://git.kernel.org/stable/c/99e17b20fddac19a228d213e00f6b9e1c10daff9"
        },
        {
          "url": "https://git.kernel.org/stable/c/243f71ed873ff3feeb6f9b5cb145d63f7188b4c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/063a6f22478ef929625000a2caf54667725c1dfd"
        },
        {
          "url": "https://git.kernel.org/stable/c/d75ec4504a4340b033b15cad0303988b3089dd93"
        },
        {
          "url": "https://git.kernel.org/stable/c/8dff54fe88c0dcd4c55bff9fc2fa6ca968290826"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9c206cdc4266caad6a9a7f46341420a10f03ccb"
        }
      ],
      "title": "nfsd: never defer requests during idmap lookup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45983",
    "datePublished": "2026-05-27T12:18:41.619Z",
    "dateReserved": "2026-05-13T15:03:33.090Z",
    "dateUpdated": "2026-05-27T12:18:41.619Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_bitwise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9baa08d6b6b096fad70049533f0d705d85fdc979",
              "status": "affected",
              "version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
              "versionType": "git"
            },
            {
              "lessThan": "4fccea585631621c975883911a08d15b6671f7dc",
              "status": "affected",
              "version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
              "versionType": "git"
            },
            {
              "lessThan": "9ad26c272405f53834871cc2e46b9b5393a666c3",
              "status": "affected",
              "version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
              "versionType": "git"
            },
            {
              "lessThan": "bffef0acec9c3b837a785248a893137fb7f26c95",
              "status": "affected",
              "version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
              "versionType": "git"
            },
            {
              "lessThan": "ca24f1243ad1a4d12d6a23876bbbe3ed02099853",
              "status": "affected",
              "version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
              "versionType": "git"
            },
            {
              "lessThan": "6f820139d16a4c9865a145d4a9cf9c92cc632c14",
              "status": "affected",
              "version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
              "versionType": "git"
            },
            {
              "lessThan": "f370205974f171a5868c13ff30d7642fed46e47b",
              "status": "affected",
              "version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
              "versionType": "git"
            },
            {
              "lessThan": "fe11e5c40817b84abaa5d83bfb6586d8412bfd07",
              "status": "affected",
              "version": "567d746b55bc66d3800c9ae91d50f0c5deb2fd93",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_bitwise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: reject zero shift in nft_bitwise\n\nReject zero shift operands for nft_bitwise left and right shift\nexpressions during initialization.\n\nThe carry propagation logic computes the carry from the adjacent 32-bit\nword using BITS_PER_TYPE(u32) - shift. A zero shift operand turns this\ninto a 32-bit shift, which is undefined behaviour.\n\nReject zero shift operands in the control plane, alongside the existing\ncheck for values greater than or equal to 32, so malformed rules never\nreach the packet path."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:54:30.068Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9baa08d6b6b096fad70049533f0d705d85fdc979"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fccea585631621c975883911a08d15b6671f7dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ad26c272405f53834871cc2e46b9b5393a666c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/bffef0acec9c3b837a785248a893137fb7f26c95"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca24f1243ad1a4d12d6a23876bbbe3ed02099853"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f820139d16a4c9865a145d4a9cf9c92cc632c14"
        },
        {
          "url": "https://git.kernel.org/stable/c/f370205974f171a5868c13ff30d7642fed46e47b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe11e5c40817b84abaa5d83bfb6586d8412bfd07"
        }
      ],
      "title": "netfilter: reject zero shift in nft_bitwise",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46101",
    "datePublished": "2026-05-27T12:59:08.220Z",
    "dateReserved": "2026-05-13T15:03:33.097Z",
    "dateUpdated": "2026-06-14T17:54:30.068Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/marvell/mwifiex/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c3508895450cca4aeaf5dbadbb5e582363005264",
              "status": "affected",
              "version": "4636187da60b6e33526050235c610409d9cc00e8",
              "versionType": "git"
            },
            {
              "lessThan": "1958a92599b2653d730ccb6f5685fc3fbed21812",
              "status": "affected",
              "version": "4636187da60b6e33526050235c610409d9cc00e8",
              "versionType": "git"
            },
            {
              "lessThan": "a88f5391dc68f78cae5eb6a8cd341cafee795d3d",
              "status": "affected",
              "version": "4636187da60b6e33526050235c610409d9cc00e8",
              "versionType": "git"
            },
            {
              "lessThan": "11869ce402d95519d49b25a2a97741f68d69d103",
              "status": "affected",
              "version": "4636187da60b6e33526050235c610409d9cc00e8",
              "versionType": "git"
            },
            {
              "lessThan": "63fe3389b3e092d6c0eeea9fc0318e7918b16618",
              "status": "affected",
              "version": "4636187da60b6e33526050235c610409d9cc00e8",
              "versionType": "git"
            },
            {
              "lessThan": "4e179a60a60c0a5aea245e8e67768343c0f070b8",
              "status": "affected",
              "version": "4636187da60b6e33526050235c610409d9cc00e8",
              "versionType": "git"
            },
            {
              "lessThan": "030abbae49cf9fd1fba7aa08e15ec81efbeb78cf",
              "status": "affected",
              "version": "4636187da60b6e33526050235c610409d9cc00e8",
              "versionType": "git"
            },
            {
              "lessThan": "ae5e95d4157481693be2317e3ffcd84e36010cbb",
              "status": "affected",
              "version": "4636187da60b6e33526050235c610409d9cc00e8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/marvell/mwifiex/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()\n\nThe mwifiex_adapter_cleanup() function uses timer_delete()\n(non-synchronous) for the wakeup_timer before the adapter structure is\nfreed. This is incorrect because timer_delete() does not wait for any\nrunning timer callback to complete.\n\nIf the wakeup_timer callback (wakeup_timer_fn) is executing when\nmwifiex_adapter_cleanup() is called, the callback will continue to\naccess adapter fields (adapter-\u003ehw_status, adapter-\u003eif_ops.card_reset,\netc.) which may be freed by mwifiex_free_adapter() called later in the\nmwifiex_remove_card() path.\n\nUse timer_delete_sync() instead to ensure any running timer callback has\ncompleted before returning."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-19T11:59:16.626Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c3508895450cca4aeaf5dbadbb5e582363005264"
        },
        {
          "url": "https://git.kernel.org/stable/c/1958a92599b2653d730ccb6f5685fc3fbed21812"
        },
        {
          "url": "https://git.kernel.org/stable/c/a88f5391dc68f78cae5eb6a8cd341cafee795d3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/11869ce402d95519d49b25a2a97741f68d69d103"
        },
        {
          "url": "https://git.kernel.org/stable/c/63fe3389b3e092d6c0eeea9fc0318e7918b16618"
        },
        {
          "url": "https://git.kernel.org/stable/c/4e179a60a60c0a5aea245e8e67768343c0f070b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/030abbae49cf9fd1fba7aa08e15ec81efbeb78cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae5e95d4157481693be2317e3ffcd84e36010cbb"
        }
      ],
      "title": "wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46069",
    "datePublished": "2026-05-27T12:57:50.213Z",
    "dateReserved": "2026-05-13T15:03:33.095Z",
    "dateUpdated": "2026-06-19T11:59:16.626Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/nested.c",
            "arch/x86/kvm/svm/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a3f0981a5a0e0bd51ad74cc7d9eed32294b24002",
              "status": "affected",
              "version": "d20c796ca3709801f8a7fa36e8770a3dd8ebd34e",
              "versionType": "git"
            },
            {
              "lessThan": "9efe23568806d1cd06f7d146f9b3037b8d585a9f",
              "status": "affected",
              "version": "d20c796ca3709801f8a7fa36e8770a3dd8ebd34e",
              "versionType": "git"
            },
            {
              "lessThan": "b53ab5167a81537777ac780bbd93d32613aa3bda",
              "status": "affected",
              "version": "d20c796ca3709801f8a7fa36e8770a3dd8ebd34e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/x86/kvm/svm/nested.c",
            "arch/x86/kvm/svm/svm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: nSVM: Avoid clearing VMCB_LBR in vmcb12\n\nsvm_copy_lbrs() always marks VMCB_LBR dirty in the destination VMCB.\nHowever, nested_svm_vmexit() uses it to copy LBRs to vmcb12, and\nclearing clean bits in vmcb12 is not architecturally defined.\n\nMove vmcb_mark_dirty() to callers and drop it for vmcb12.\n\nThis also facilitates incoming refactoring that does not pass the entire\nVMCB to svm_copy_lbrs()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:52:10.514Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a3f0981a5a0e0bd51ad74cc7d9eed32294b24002"
        },
        {
          "url": "https://git.kernel.org/stable/c/9efe23568806d1cd06f7d146f9b3037b8d585a9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b53ab5167a81537777ac780bbd93d32613aa3bda"
        }
      ],
      "title": "KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46071",
    "datePublished": "2026-05-27T12:57:57.316Z",
    "dateReserved": "2026-05-13T15:03:33.095Z",
    "dateUpdated": "2026-06-14T17:52:10.514Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/exit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3d6fb8a7690c23e3213c4b008f64d89a44b98737",
              "status": "affected",
              "version": "7f80a2fd7db9a55894fd841915236aca611291b5",
              "versionType": "git"
            },
            {
              "lessThan": "640b4c00fb0e2920327435f6176cbefc3c546165",
              "status": "affected",
              "version": "7f80a2fd7db9a55894fd841915236aca611291b5",
              "versionType": "git"
            },
            {
              "lessThan": "7b2800ba5f5f77a8ee7f4cbadb19cf1264597a34",
              "status": "affected",
              "version": "7f80a2fd7db9a55894fd841915236aca611291b5",
              "versionType": "git"
            },
            {
              "lessThan": "6f49f94f3b11fe8bff1bf2a054143789e76aaf17",
              "status": "affected",
              "version": "7f80a2fd7db9a55894fd841915236aca611291b5",
              "versionType": "git"
            },
            {
              "lessThan": "9756b3db5db6c2f5eccb32dddbd88eb4c54f575e",
              "status": "affected",
              "version": "7f80a2fd7db9a55894fd841915236aca611291b5",
              "versionType": "git"
            },
            {
              "lessThan": "c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891",
              "status": "affected",
              "version": "7f80a2fd7db9a55894fd841915236aca611291b5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/exit.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexit: prevent preemption of oopsing TASK_DEAD task\n\nWhen an already-exiting task oopses, make_task_dead() currently calls\ndo_task_dead() with preemption enabled.  That is forbidden:\ndo_task_dead() calls __schedule(), which has a comment saying \"WARNING:\nmust be called with preemption disabled!\".\n\nIf an oopsing task is preempted in do_task_dead(), between becoming\nTASK_DEAD and entering the scheduler explicitly, bad things happen:\nfinish_task_switch() assumes that once the scheduler has switched away\nfrom a TASK_DEAD task, the task can never run again and its stack is no\nlonger needed; but that assumption apparently doesn\u0027t hold if the dead\ntask was preempted (the SM_PREEMPT case).\n\nThis means that the scheduler ends up repeatedly dropping references on\nthe dead task\u0027s stack, which can lead to use-after-free or double-free\nof the entire task stack; in other words, two tasks can end up running\non the same stack, resulting in various kinds of memory corruption.\n\n(This does not just affect \"recursively oopsing\" tasks; it is enough to\noops once during task exit, for example in a file_operations::release\nhandler)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is in the kernel task-exit/scheduler path (`make_task_dead` \u2192 `do_task_dead`) of a local process; it is triggered by a task oopsing during its own exit, with no remote network reachability.\nAC:L - Exploitation depends on a preemption-timing window between `set_special_state(TASK_DEAD)` and `__schedule()`, but the attacker can repeatedly spawn exiting+faulting tasks and generate CPU load to induce preemption, making the race winnable; per the uncertainty rule the higher-severity value is chosen.\nPR:L - Any unprivileged local user can spawn processes that exit and fault on the exit path; no real-root or init-namespace privilege is required.\nUI:N - The attacker triggers their own process exit and fault; no action by another user is needed.\nS:U - The use-after-free/double-free corrupts kernel task-stack memory within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The double-free/UAF of the task stack lets two tasks run on the same stack, giving the attacker control over freed memory contents and thus an arbitrary kernel-memory read primitive.\nI:H - The same task-stack UAF/double-free yields an arbitrary write / control-flow-hijack primitive (heap spray, overlapping stacks), enabling privilege escalation.\nA:H - The repeated reference drops cause double-free/use-after-free memory corruption that reliably leads to kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:11.089Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3d6fb8a7690c23e3213c4b008f64d89a44b98737"
        },
        {
          "url": "https://git.kernel.org/stable/c/640b4c00fb0e2920327435f6176cbefc3c546165"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b2800ba5f5f77a8ee7f4cbadb19cf1264597a34"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f49f94f3b11fe8bff1bf2a054143789e76aaf17"
        },
        {
          "url": "https://git.kernel.org/stable/c/9756b3db5db6c2f5eccb32dddbd88eb4c54f575e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891"
        },
        {
          "url": "https://project-zero.issues.chromium.org/issues/510793286"
        }
      ],
      "title": "exit: prevent preemption of oopsing TASK_DEAD task",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46173",
    "datePublished": "2026-05-28T09:36:27.892Z",
    "dateReserved": "2026-05-13T15:03:33.103Z",
    "dateUpdated": "2026-08-05T12:30:11.089Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid1.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c94fd6e8a71efd047ff36930e840f3c25679e136",
              "status": "affected",
              "version": "97894f7d3c2966164516a8a5109674763d3a55e1",
              "versionType": "git"
            },
            {
              "lessThan": "ec10e3dc93994b87adf7c759a4639fe34013989a",
              "status": "affected",
              "version": "97894f7d3c2966164516a8a5109674763d3a55e1",
              "versionType": "git"
            },
            {
              "lessThan": "b37588b0282a2b3cdda9db1d53712745ce66dea0",
              "status": "affected",
              "version": "97894f7d3c2966164516a8a5109674763d3a55e1",
              "versionType": "git"
            },
            {
              "lessThan": "6abc7d5dcf0ee0f85e16e41c87fbd06231f28753",
              "status": "affected",
              "version": "97894f7d3c2966164516a8a5109674763d3a55e1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid1.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid1: fix memory leak in raid1_run()\n\nraid1_run() calls setup_conf() which registers a thread via\nmd_register_thread(). If raid1_set_limits() fails, the previously\nregistered thread is not unregistered, resulting in a memory leak\nof the md_thread structure and the thread resource itself.\n\nAdd md_unregister_thread() to the error path to properly cleanup\nthe thread, which aligns with the error handling logic of other paths\nin this function.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:16:59.751Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c94fd6e8a71efd047ff36930e840f3c25679e136"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec10e3dc93994b87adf7c759a4639fe34013989a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b37588b0282a2b3cdda9db1d53712745ce66dea0"
        },
        {
          "url": "https://git.kernel.org/stable/c/6abc7d5dcf0ee0f85e16e41c87fbd06231f28753"
        }
      ],
      "title": "md/raid1: fix memory leak in raid1_run()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45888",
    "datePublished": "2026-05-27T12:16:59.751Z",
    "dateReserved": "2026-05-13T15:03:33.082Z",
    "dateUpdated": "2026-05-27T12:16:59.751Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71089",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-16T16:19:59.752068Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-16T16:20:14.545Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommu-sva.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b34289505180a83607fcfdce14b5a290d0528476",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            },
            {
              "lessThan": "7cad37e358970af1bb49030ff01f06a69fa7d985",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            },
            {
              "lessThan": "240cd7f2812cc25496b12063d11c823618f364e9",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            },
            {
              "lessThan": "c2c3f1a3fd74ef16cf115f0c558616a13a8471b4",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            },
            {
              "lessThan": "c341dee80b5df49a936182341b36395c831c2661",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            },
            {
              "lessThan": "72f98ef9a4be30d2a60136dd6faee376f780d06c",
              "status": "affected",
              "version": "26b25a2b98e45aeb40eedcedc586ad5034cbd984",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommu-sva.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.200",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.200",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.163",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.4",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu: disable SVA when CONFIG_X86 is set\n\nPatch series \"Fix stale IOTLB entries for kernel address space\", v7.\n\nThis proposes a fix for a security vulnerability related to IOMMU Shared\nVirtual Addressing (SVA).  In an SVA context, an IOMMU can cache kernel\npage table entries.  When a kernel page table page is freed and\nreallocated for another purpose, the IOMMU might still hold stale,\nincorrect entries.  This can be exploited to cause a use-after-free or\nwrite-after-free condition, potentially leading to privilege escalation or\ndata corruption.\n\nThis solution introduces a deferred freeing mechanism for kernel page\ntable pages, which provides a safe window to notify the IOMMU to\ninvalidate its caches before the page is reused.\n\n\nThis patch (of 8):\n\nIn the IOMMU Shared Virtual Addressing (SVA) context, the IOMMU hardware\nshares and walks the CPU\u0027s page tables.  The x86 architecture maps the\nkernel\u0027s virtual address space into the upper portion of every process\u0027s\npage table.  Consequently, in an SVA context, the IOMMU hardware can walk\nand cache kernel page table entries.\n\nThe Linux kernel currently lacks a notification mechanism for kernel page\ntable changes, specifically when page table pages are freed and reused. \nThe IOMMU driver is only notified of changes to user virtual address\nmappings.  This can cause the IOMMU\u0027s internal caches to retain stale\nentries for kernel VA.\n\nUse-After-Free (UAF) and Write-After-Free (WAF) conditions arise when\nkernel page table pages are freed and later reallocated.  The IOMMU could\nmisinterpret the new data as valid page table entries.  The IOMMU might\nthen walk into attacker-controlled memory, leading to arbitrary physical\nmemory DMA access or privilege escalation.  This is also a\nWrite-After-Free issue, as the IOMMU will potentially continue to write\nAccessed and Dirty bits to the freed memory while attempting to walk the\nstale page tables.\n\nCurrently, SVA contexts are unprivileged and cannot access kernel\nmappings.  However, the IOMMU will still walk kernel-only page tables all\nthe way down to the leaf entries, where it realizes the mapping is for the\nkernel and errors out.  This means the IOMMU still caches these\nintermediate page table entries, making the described vulnerability a real\nconcern.\n\nDisable SVA on x86 architecture until the IOMMU can receive notification\nto flush the paging cache before freeing the CPU kernel page table pages."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "IOMMU SVA stale kernel page table entries enable arbitrary physical memory DMA access. IOMMU caches kernel page table entries that become stale when freed and reallocated, allowing walk into attacker-controlled memory. Scope Changed as it breaks IOMMU hardware isolation boundary."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:58.679Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b34289505180a83607fcfdce14b5a290d0528476"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cad37e358970af1bb49030ff01f06a69fa7d985"
        },
        {
          "url": "https://git.kernel.org/stable/c/240cd7f2812cc25496b12063d11c823618f364e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2c3f1a3fd74ef16cf115f0c558616a13a8471b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c341dee80b5df49a936182341b36395c831c2661"
        },
        {
          "url": "https://git.kernel.org/stable/c/72f98ef9a4be30d2a60136dd6faee376f780d06c"
        }
      ],
      "title": "iommu: disable SVA when CONFIG_X86 is set",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71089",
    "datePublished": "2026-01-13T15:34:51.079Z",
    "dateReserved": "2026-01-13T15:30:19.649Z",
    "dateUpdated": "2026-08-05T12:11:58.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufshcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a6a894413b043704b77a6294c379c93b1477e48d",
              "status": "affected",
              "version": "06701a545e9a3c4e007cff6872a074bf97c40619",
              "versionType": "git"
            },
            {
              "lessThan": "2fcc2fc21cae7a0cbe73053f7fc70680ce2a7f69",
              "status": "affected",
              "version": "6bf999e0eb41850d5c857102535d5c53b2ede224",
              "versionType": "git"
            },
            {
              "lessThan": "b17211b512cbf0e07de27e1932428ee6c20df910",
              "status": "affected",
              "version": "6bf999e0eb41850d5c857102535d5c53b2ede224",
              "versionType": "git"
            },
            {
              "lessThan": "c387a8f1d3713f6b0415ece8485042d0f134b91a",
              "status": "affected",
              "version": "6bf999e0eb41850d5c857102535d5c53b2ede224",
              "versionType": "git"
            },
            {
              "lessThan": "b0bd84c39289ef6a6c3827dd52c875659291970a",
              "status": "affected",
              "version": "6bf999e0eb41850d5c857102535d5c53b2ede224",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.130",
              "status": "affected",
              "version": "6.6.81",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufshcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "6.6.81",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend\n\nIn __ufshcd_wl_suspend(), cancel_delayed_work_sync() is called to cancel\nthe UFS RTC work, but it is placed after ufshcd_vops_suspend(hba, pm_op,\nPOST_CHANGE). This creates a race condition where ufshcd_rtc_work() can\nstill be running while ufshcd_vops_suspend() is executing. When\nUFSHCD_CAP_CLK_GATING is not supported, the condition\n!hba-\u003eclk_gating.active_reqs is always true, causing ufshcd_update_rtc()\nto be executed. Since ufshcd_vops_suspend() typically performs clock\ngating operations, executing ufshcd_update_rtc() at that moment triggers\nan SError. The kernel panic trace is as follows:\n\nKernel panic - not syncing: Asynchronous SError Interrupt\nCall trace:\n dump_backtrace+0xec/0x128\n show_stack+0x18/0x28\n dump_stack_lvl+0x40/0xa0\n dump_stack+0x18/0x24\n panic+0x148/0x374\n nmi_panic+0x3c/0x8c\n arm64_serror_panic+0x64/0x8c\n do_serror+0xc4/0xc8\n el1h_64_error_handler+0x34/0x4c\n el1h_64_error+0x68/0x6c\n el1_interrupt+0x20/0x58\n el1h_64_irq_handler+0x18/0x24\n el1h_64_irq+0x68/0x6c\n ktime_get+0xc4/0x12c\n ufshcd_mcq_sq_stop+0x4c/0xec\n ufshcd_mcq_sq_cleanup+0x64/0x1dc\n ufshcd_clear_cmd+0x38/0x134\n ufshcd_issue_dev_cmd+0x298/0x4d0\n ufshcd_exec_dev_cmd+0x1a4/0x1c4\n ufshcd_query_attr+0xbc/0x19c\n ufshcd_rtc_work+0x10c/0x1c8\n process_scheduled_works+0x1c4/0x45c\n worker_thread+0x32c/0x3e8\n kthread+0x120/0x1d8\n ret_from_fork+0x10/0x20\n\nFix this by moving cancel_delayed_work_sync() before the call to\nufshcd_vops_suspend(hba, pm_op, PRE_CHANGE), ensuring the UFS RTC work is\nfully completed or cancelled at that point."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:06:57.367Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a6a894413b043704b77a6294c379c93b1477e48d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2fcc2fc21cae7a0cbe73053f7fc70680ce2a7f69"
        },
        {
          "url": "https://git.kernel.org/stable/c/b17211b512cbf0e07de27e1932428ee6c20df910"
        },
        {
          "url": "https://git.kernel.org/stable/c/c387a8f1d3713f6b0415ece8485042d0f134b91a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0bd84c39289ef6a6c3827dd52c875659291970a"
        }
      ],
      "title": "scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43415",
    "datePublished": "2026-05-08T14:21:52.293Z",
    "dateReserved": "2026-05-01T14:12:56.008Z",
    "dateUpdated": "2026-05-23T16:06:57.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_conn.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d41093723e47255d7d74df86e2736711c1b8486e",
              "status": "affected",
              "version": "eca0ae4aea66914515e5e3098ea051b518ee5316",
              "versionType": "git"
            },
            {
              "lessThan": "6823f730bf195fc296d9edd09e2ca94bc1ff5584",
              "status": "affected",
              "version": "eca0ae4aea66914515e5e3098ea051b518ee5316",
              "versionType": "git"
            },
            {
              "lessThan": "1750a2df0eab61dc421a7afae74abdd239a44b85",
              "status": "affected",
              "version": "eca0ae4aea66914515e5e3098ea051b518ee5316",
              "versionType": "git"
            },
            {
              "lessThan": "dc34f8d8240f25dd137dc2758ebbcc75e3779142",
              "status": "affected",
              "version": "eca0ae4aea66914515e5e3098ea051b518ee5316",
              "versionType": "git"
            },
            {
              "lessThan": "f8eaf92c57ad99358dd372580d5ff87623343a72",
              "status": "affected",
              "version": "eca0ae4aea66914515e5e3098ea051b518ee5316",
              "versionType": "git"
            },
            {
              "lessThan": "0beddb0c380bed5f5b8e61ddbe14635bb73d0b41",
              "status": "affected",
              "version": "eca0ae4aea66914515e5e3098ea051b518ee5316",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_conn.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.90",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.32",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: fix potential UAF in create_big_sync\n\nAdd hci_conn_valid() check in create_big_sync() to detect stale\nconnections before proceeding with BIG creation. Handle the\nresulting -ECANCELED in create_big_complete() and re-validate the\nconnection under hci_dev_lock() before dereferencing, matching the\npattern used by create_le_conn_complete() and create_pa_complete().\n\nKeep the hci_conn object alive across the async boundary by taking\na reference via hci_conn_get() when queueing create_big_sync(), and\ndropping it in the completion callback. The refcount and the lock\nare complementary: the refcount keeps the object allocated, while\nhci_dev_lock() serializes hci_conn_hash_del()\u0027s list_del_rcu() on\nhdev-\u003econn_hash, as required by hci_conn_del().\n\nhci_conn_put() is called outside hci_dev_unlock() so the final put\n(which resolves to kfree() via bt_link_release) does not run under\nhdev-\u003elock, though the release path would be safe either way.\n\nWithout this, create_big_complete() would unconditionally\ndereference the conn pointer on error, causing a use-after-free\nvia hci_connect_cfm() and hci_conn_del()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached only through a local ISO socket connect() syscall (BTPROTO_ISO \u2192 iso_connect_bis \u2192 hci_connect_bis); BIG broadcast setup is locally initiated and requires no Bluetooth peer or over-the-air frame, so the attacker needs local system access.\nAC:L - This is a use-after-free where the attacker controls both sides of the race \u2014 initiating the async create_big work via connect() and freeing the conn (e.g., closing the socket) \u2014 and can retry at will, so the condition is within attacker control.\nPR:L - Creating and connecting an ISO socket requires no capability check (iso_sock_create/bt_sock_create perform none), so any unprivileged local user can reach the path on systems where the ISO/BIS feature is enabled.\nUI:N - The attacker performs all steps (open socket, connect, race a teardown); no victim interaction is required.\nS:U - The use-after-free is contained within the kernel\u0027s own memory/security authority and does not cross into another security boundary such as a VM or IOMMU domain.\nC:H - A UAF of the hci_conn object gives the attacker control over the freed object\u0027s contents, enabling kernel-memory disclosure (e.g., leaking pointers/data placed in the reclaimed allocation).\nI:H - The freed hci_conn is dereferenced and written via hci_connect_cfm() and hci_conn_del() (including list_del_rcu on conn_hash), so heap grooming of the freed slab yields an arbitrary-write/control-flow primitive.\nA:H - Dereferencing and deleting a freed hci_conn reliably causes memory corruption leading to a kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:28:01.615Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d41093723e47255d7d74df86e2736711c1b8486e"
        },
        {
          "url": "https://git.kernel.org/stable/c/6823f730bf195fc296d9edd09e2ca94bc1ff5584"
        },
        {
          "url": "https://git.kernel.org/stable/c/1750a2df0eab61dc421a7afae74abdd239a44b85"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc34f8d8240f25dd137dc2758ebbcc75e3779142"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8eaf92c57ad99358dd372580d5ff87623343a72"
        },
        {
          "url": "https://git.kernel.org/stable/c/0beddb0c380bed5f5b8e61ddbe14635bb73d0b41"
        }
      ],
      "title": "Bluetooth: hci_conn: fix potential UAF in create_big_sync",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46111",
    "datePublished": "2026-05-28T09:35:19.970Z",
    "dateReserved": "2026-05-13T15:03:33.098Z",
    "dateUpdated": "2026-08-19T16:28:01.615Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/vmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c15ff206ba78820bf2873d0c668a882e99f4b631",
              "status": "affected",
              "version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
              "versionType": "git"
            },
            {
              "lessThan": "687ccdf582169cd680aeaf24cc953807c4cd4345",
              "status": "affected",
              "version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
              "versionType": "git"
            },
            {
              "lessThan": "12f2341b4c235d5593a433abac201c1c6725787f",
              "status": "affected",
              "version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
              "versionType": "git"
            },
            {
              "lessThan": "ec05f51f1e65bce95528543eb73fda56fd201d94",
              "status": "affected",
              "version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/vmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: take vmap_purge_lock in shrinker\n\ndecay_va_pool_node() can be invoked concurrently from two paths:\n__purge_vmap_area_lazy() when pools are being purged, and the shrinker via\nvmap_node_shrink_scan().\n\nHowever, decay_va_pool_node() is not safe to run concurrently, and the\nshrinker path currently lacks serialization, leading to races and possible\nleaks.\n\nProtect decay_va_pool_node() by taking vmap_purge_lock in the shrinker\npath to ensure serialization with purge users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable race is in core MM internals (vmap pool decay) reached only via local memory-management activity \u2014 inducing vmalloc/vfree churn (purge path) and memory pressure (shrinker path). No network-delivered data reaches the vulnerable function.\nAC:L - An unprivileged attacker controls both sides: one thread forces direct reclaim (shrinker\u2192decay) while another drives vmalloc/vfree churn past the lazy-free threshold (purge\u2192decay), and both can loop indefinitely to repeatedly attempt and win the narrow race.\nPR:L - Any unprivileged local process can allocate/free memory and induce reclaim; no capabilities or root are required to drive either racing path.\nUI:N - The race is triggered entirely by the attacker\u0027s own memory activity; no victim action is needed.\nS:U - The corruption stays within the kernel\u0027s own memory-management structures and does not cross into another security authority (no VM/IOMMU boundary escape).\nC:H - The data race corrupts the vmap pool linked list and free-area tree metadata; per kernel guidance, allocator memory corruption can be leveraged to read freed/adjacent kernel memory.\nI:H - Concurrent unserialized list_replace_init plus double-merge of vmap_area objects into the global free tree corrupts kernel free-list/tree state, a write/corruption primitive over allocator metadata.\nA:H - Corrupted lists and inconsistent len accounting (and the documented leaks) cause kernel crashes/oops and resource exhaustion when the corrupted pool is subsequently traversed or reused."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:35.424Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c15ff206ba78820bf2873d0c668a882e99f4b631"
        },
        {
          "url": "https://git.kernel.org/stable/c/687ccdf582169cd680aeaf24cc953807c4cd4345"
        },
        {
          "url": "https://git.kernel.org/stable/c/12f2341b4c235d5593a433abac201c1c6725787f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec05f51f1e65bce95528543eb73fda56fd201d94"
        }
      ],
      "title": "mm/vmalloc: take vmap_purge_lock in shrinker",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46093",
    "datePublished": "2026-05-27T12:58:43.458Z",
    "dateReserved": "2026-05-13T15:03:33.097Z",
    "dateUpdated": "2026-08-05T12:29:35.424Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/mon_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ee5588e2bc41acb73f6676c0520420c107cd0140",
              "status": "affected",
              "version": "a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c",
              "versionType": "git"
            },
            {
              "lessThan": "86f7060cd638d6eb042e8ed780fb83a59ca0dcb3",
              "status": "affected",
              "version": "a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c",
              "versionType": "git"
            },
            {
              "lessThan": "5f2806684b05bd24d05c091083b8e2517ba8ffac",
              "status": "affected",
              "version": "a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c",
              "versionType": "git"
            },
            {
              "lessThan": "b268984ae88cb0dcd7a8e8263962c748448e26e8",
              "status": "affected",
              "version": "a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c",
              "versionType": "git"
            },
            {
              "lessThan": "ba0a4df8c563536857dcbf7b4dbd0f2a15f57ace",
              "status": "affected",
              "version": "a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c",
              "versionType": "git"
            },
            {
              "lessThan": "08bc6173fd611ad5a40f472bf5f15b92aea0fe40",
              "status": "affected",
              "version": "a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c",
              "versionType": "git"
            },
            {
              "lessThan": "770444611f047dbfd4517ec0bc1b179d40c2f346",
              "status": "affected",
              "version": "a5cbd5fc22d5043a8a76e15d75d031fe24d1f69c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/mon_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Use u32 for non-negative values in ceph_monmap_decode()\n\nThis patch fixes unnecessary implicit conversions that change signedness\nof blob_len and num_mon in ceph_monmap_decode().\nCurrently blob_len and num_mon are (signed) int variables. They are used\nto hold values that are always non-negative and get assigned in\nceph_decode_32_safe(), which is meant to assign u32 values. Both\nvariables are subsequently used as unsigned values, and the value of\nnum_mon is further assigned to monmap-\u003enum_mon, which is of type u32.\nTherefore, both variables should be of type u32. This is especially\nrelevant for num_mon. If the value read from the incoming message is\nvery large, it is interpreted as a negative value, and the check for\nnum_mon \u003e CEPH_MAX_MON does not catch it. This leads to the attempt to\nallocate a very large chunk of memory for monmap, which will most likely\nfail. In this case, an unnecessary attempt to allocate memory is\nperformed, and -ENOMEM is returned instead of -EINVAL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable decoder processes CEPH_MSG_MON_MAP data received over the Ceph monitor TCP connection from a remote peer.\nAC:L - Triggering requires sending a single malformed monmap with a large u32 num_mon value; there is no race or condition outside the attacker\u0027s control once they control the monitor-side message stream.\nPR:N - The attacker needs no privileges on the vulnerable host; a malicious or compromised Ceph monitor endpoint can supply the crafted network message.\nUI:N - Although Ceph clients are initially created by mount or RBD setup, monitor map updates are received asynchronously over an established session and do not require further victim action.\nS:U - The impact remains within the kernel/Ceph client security authority and does not cross a VM, sandbox, or hardware isolation boundary.\nC:N - The signedness bug causes an oversized allocation attempt that fails; the investigated path does not expose kernel memory or create a read primitive.\nI:N - The allocation is overflow-safe and fails before the monmap is installed or populated, so there is no demonstrated memory corruption or data modification primitive.\nA:H - A crafted monmap can repeatedly force huge kernel allocation attempts and prevent the client from obtaining or refreshing a valid monitor map, denying Ceph storage availability in affected deployments."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:48.288Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ee5588e2bc41acb73f6676c0520420c107cd0140"
        },
        {
          "url": "https://git.kernel.org/stable/c/86f7060cd638d6eb042e8ed780fb83a59ca0dcb3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f2806684b05bd24d05c091083b8e2517ba8ffac"
        },
        {
          "url": "https://git.kernel.org/stable/c/b268984ae88cb0dcd7a8e8263962c748448e26e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba0a4df8c563536857dcbf7b4dbd0f2a15f57ace"
        },
        {
          "url": "https://git.kernel.org/stable/c/08bc6173fd611ad5a40f472bf5f15b92aea0fe40"
        },
        {
          "url": "https://git.kernel.org/stable/c/770444611f047dbfd4517ec0bc1b179d40c2f346"
        }
      ],
      "title": "libceph: Use u32 for non-negative values in ceph_monmap_decode()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43405",
    "datePublished": "2026-05-08T14:21:45.581Z",
    "dateReserved": "2026-05-01T14:12:56.007Z",
    "dateUpdated": "2026-08-05T12:27:48.288Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7f35a4f7fd574f5889bb2e4b397e14cbb83f6da",
              "status": "affected",
              "version": "f87271d21dd4ee83857ca11b94e7b4952749bbae",
              "versionType": "git"
            },
            {
              "lessThan": "3f26ecbd9cde621dd94be7ef252c7210b965a5c7",
              "status": "affected",
              "version": "ab4eedb790cae44313759b50fe47da285e2519d5",
              "versionType": "git"
            },
            {
              "lessThan": "d008460de352e534f6721de829b093368564ec66",
              "status": "affected",
              "version": "ab4eedb790cae44313759b50fe47da285e2519d5",
              "versionType": "git"
            },
            {
              "lessThan": "00fdebbbc557a2fc21321ff2eaa22fd70c078608",
              "status": "affected",
              "version": "ab4eedb790cae44313759b50fe47da285e2519d5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "efc30877bd4bc85fefe98d80af60fafc86e5775e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "18ab6b6078fa8191ca30a3065d57bf35d5635761",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.88",
              "status": "affected",
              "version": "6.12.20",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.84",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14",
              "status": "affected",
              "version": "6.13.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/l2cap_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "6.12.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.84",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix deadlock in l2cap_conn_del()\n\nl2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer\nand id_addr_timer while holding conn-\u003elock. However, the work functions\nl2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire\nconn-\u003elock, creating a potential AB-BA deadlock if the work is already\nexecuting when l2cap_conn_del() takes the lock.\n\nMove the work cancellations before acquiring conn-\u003elock and use\ndisable_delayed_work_sync() to additionally prevent the works from\nbeing rearmed after cancellation, consistent with the pattern used in\nhci_conn_del()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:05:12.236Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7f35a4f7fd574f5889bb2e4b397e14cbb83f6da"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f26ecbd9cde621dd94be7ef252c7210b965a5c7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d008460de352e534f6721de829b093368564ec66"
        },
        {
          "url": "https://git.kernel.org/stable/c/00fdebbbc557a2fc21321ff2eaa22fd70c078608"
        }
      ],
      "title": "Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31499",
    "datePublished": "2026-04-22T13:54:20.384Z",
    "dateReserved": "2026-03-09T15:48:24.104Z",
    "dateUpdated": "2026-05-23T16:05:12.236Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:49:12.974Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2094a7cf91b71367b649f991aacc7b579f793d0b",
              "status": "affected",
              "version": "a0478d7e888028f85fa7785ea838ce0ca09398e2",
              "versionType": "git"
            },
            {
              "lessThan": "ed71cf465c75f5688b07a35d373cd1d6b589c8ea",
              "status": "affected",
              "version": "2156d9e9f2e483c8c3906c0ea57ea312c1424235",
              "versionType": "git"
            },
            {
              "lessThan": "33670f780e0120c3dacda188c512bbffe0b6044c",
              "status": "affected",
              "version": "041e2f945f82fdbd6fff577b79c33469430297aa",
              "versionType": "git"
            },
            {
              "lessThan": "a98b78116a27e2a57b696b569b2cb431c95cf9b6",
              "status": "affected",
              "version": "864e3396976ef41de6cc7bc366276bf4e084fff2",
              "versionType": "git"
            },
            {
              "lessThan": "732fdeb2987c94b439d51f5cb9addddc2fc48c42",
              "status": "affected",
              "version": "864e3396976ef41de6cc7bc366276bf4e084fff2",
              "versionType": "git"
            },
            {
              "lessThan": "c4336a07eb6b2526dc2b62928b5104b41a7f81f5",
              "status": "affected",
              "version": "864e3396976ef41de6cc7bc366276bf4e084fff2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "794ddbb7b63b6828c75967b9bcd43b086716e7a1",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.168",
              "status": "affected",
              "version": "6.1.149",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.134",
              "status": "affected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.81",
              "status": "affected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThan": "6.17",
              "status": "affected",
              "version": "6.16.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "6.1.149",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "6.6.103",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "6.12.44",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.16.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: correctly handle tunneled traffic on IPV6_CSUM GSO fallback\n\nNETIF_F_IPV6_CSUM only advertises support for checksum offload of\npackets without IPv6 extension headers. Packets with extension\nheaders must fall back onto software checksumming. Since TSO\ndepends on checksum offload, those must revert to GSO.\n\nThe below commit introduces that fallback. It always checks\nnetwork header length. For tunneled packets, the inner header length\nmust be checked instead. Extend the check accordingly.\n\nA special case is tunneled packets without inner IP protocol. Such as\nRFC 6951 SCTP in UDP. Those are not standard IPv6 followed by\ntransport header either, so also must revert to the software GSO path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is reachable through the network transmit stack when remotely supplied traffic is forwarded or tunneled by an affected Linux system. A remote peer can trigger the bad GSO/offload decision by sending suitable IPv6 tunneled traffic with extension headers through a preconfigured tunnel/router deployment.\nAC:L - There is no race or probabilistic condition; once the affected tunnel and NETIF_F_IPV6_CSUM-capable egress device are present, crafted large/GSO-eligible IPv6 traffic deterministically reaches the flawed feature check. The attacker controls the packet shape needed to hit the fallback error.\nPR:N - For the network forwarding/tunnel scenario, the attacker does not need local credentials or administrative privileges on the vulnerable host. Tunnel setup requires CAP_NET_ADMIN, but exploitation of an already deployed tunnel path is pre-authenticated network traffic.\nUI:N - No victim user action is required. The vulnerable code runs automatically during packet forwarding/transmission.\nS:U - The bug affects the kernel networking stack and availability of traffic handled by the same system. It does not cross a distinct security authority such as a guest-to-host or IOMMU boundary.\nC:N - The bug is a checksum/GSO feature-selection error and does not expose kernel memory or packet contents beyond normal transmission. No information disclosure primitive was identified.\nI:N - The issue can cause incorrect checksum/offload handling for affected packets, but it does not provide an attacker with a meaningful unauthorized data modification primitive. The practical effect is packet loss or malformed traffic rather than controlled integrity compromise.\nA:H - The related failure mode is repeated bad offload handling, warnings, packet drops, and collapse of affected tunnel throughput. A remote attacker can repeatedly trigger loss of availability for the vulnerable network path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:38.181Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2094a7cf91b71367b649f991aacc7b579f793d0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed71cf465c75f5688b07a35d373cd1d6b589c8ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/33670f780e0120c3dacda188c512bbffe0b6044c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a98b78116a27e2a57b696b569b2cb431c95cf9b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/732fdeb2987c94b439d51f5cb9addddc2fc48c42"
        },
        {
          "url": "https://git.kernel.org/stable/c/c4336a07eb6b2526dc2b62928b5104b41a7f81f5"
        }
      ],
      "title": "net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43057",
    "datePublished": "2026-05-01T14:15:49.551Z",
    "dateReserved": "2026-05-01T14:12:55.981Z",
    "dateUpdated": "2026-08-05T12:25:38.181Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/notify/fsnotify.c",
            "fs/notify/mark.c",
            "include/linux/fsnotify_backend.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a24765332e129c1916d5a6615418b75599b8fcdc",
              "status": "affected",
              "version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
              "versionType": "git"
            },
            {
              "lessThan": "4a7611ad653785fcdea5ff5f4441e2b7d05b7f11",
              "status": "affected",
              "version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
              "versionType": "git"
            },
            {
              "lessThan": "04bb66be92f48ed13c3faf1139d892df228789bc",
              "status": "affected",
              "version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
              "versionType": "git"
            },
            {
              "lessThan": "895ebbedf88318607c24acc0f591c74b165e1d0a",
              "status": "affected",
              "version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
              "versionType": "git"
            },
            {
              "lessThan": "f130790f1acc8399f32652846c875a251efd040f",
              "status": "affected",
              "version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
              "versionType": "git"
            },
            {
              "lessThan": "7baa02b0ae9d17ec5f08836d8ea88ce1927d0678",
              "status": "affected",
              "version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
              "versionType": "git"
            },
            {
              "lessThan": "b7b24b28c8cd55844cab908f4f39dded638d5538",
              "status": "affected",
              "version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
              "versionType": "git"
            },
            {
              "lessThan": "7746e3bd4cc19b5092e00d32d676e329bfcb6900",
              "status": "affected",
              "version": "abc77577a669f424c5d0c185b9994f2621c52aa4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/notify/fsnotify.c",
            "fs/notify/mark.c",
            "include/linux/fsnotify_backend.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfanotify: fix false positive on permission events\n\nfsnotify_get_mark_safe() may return false for a mark on an unrelated group,\nwhich results in bypassing the permission check.\n\nFix by skipping over detached marks that are not in the current group."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code runs in the context of a local file operation (open/read/exec) that triggers the fanotify permission event; the attacker bypasses the control by performing local file ops plus churning a local inotify watch. The fully-controllable, reliable attack is local (a remote file-server scenario would lose attacker control of the race).\nAC:L - The attacker controls both sides of the race \u2014 the lifecycle of the unrelated (unprivileged inotify) mark and the retried file operation \u2014 and each open() is a fresh permission event, so with unlimited retries the bypass is reliably reachable.\nPR:L - Exploitation only needs an unprivileged local account: creating an inotify watch on the parent directory and opening/executing the target file require no capabilities (the privileged CAP_SYS_ADMIN fanotify group is the victim control, not the attacker).\nUI:N - The attacker performs all actions (inotify churn plus repeated file access) with no interaction from any other user.\nS:U - The flaw and its impact are both mediated entirely within the kernel\u0027s own access-control path; no boundary to a separately-managed security authority (VM, IOMMU) is crossed.\nC:H - Bypassing FAN_ACCESS_PERM/FAN_OPEN_PERM lets read access to files the policy (AV/sandbox/EDR) would deny proceed; via targeted retries the attacker can force disclosure of chosen protected files, approaching total loss of confidentiality of protected resources.\nI:H - Bypassing FAN_OPEN_PERM/FAN_OPEN_EXEC_PERM lets writes to protected files and execution of binaries the policy would block proceed, allowing modification of protected resources and execution of disallowed code.\nA:N - The bug is fail-open (it only allows operations that should be blocked); it causes no crash, hang, or resource exhaustion, so availability is unaffected."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:03.577Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a24765332e129c1916d5a6615418b75599b8fcdc"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a7611ad653785fcdea5ff5f4441e2b7d05b7f11"
        },
        {
          "url": "https://git.kernel.org/stable/c/04bb66be92f48ed13c3faf1139d892df228789bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/895ebbedf88318607c24acc0f591c74b165e1d0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f130790f1acc8399f32652846c875a251efd040f"
        },
        {
          "url": "https://git.kernel.org/stable/c/7baa02b0ae9d17ec5f08836d8ea88ce1927d0678"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7b24b28c8cd55844cab908f4f39dded638d5538"
        },
        {
          "url": "https://git.kernel.org/stable/c/7746e3bd4cc19b5092e00d32d676e329bfcb6900"
        }
      ],
      "title": "fanotify: fix false positive on permission events",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46150",
    "datePublished": "2026-05-28T09:36:06.494Z",
    "dateReserved": "2026-05-13T15:03:33.101Z",
    "dateUpdated": "2026-08-05T12:30:03.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "11718976c53a258c4d107aa05d68773379d0006f",
              "status": "affected",
              "version": "3766a840e093d30e1a2522f650d8a6ac892a8719",
              "versionType": "git"
            },
            {
              "lessThan": "c10fe9471f3aa352bb9d9329d0b25e28e0672243",
              "status": "affected",
              "version": "3766a840e093d30e1a2522f650d8a6ac892a8719",
              "versionType": "git"
            },
            {
              "lessThan": "0481be9f12d8324789ccebf1e5fd0704b6e3fc99",
              "status": "affected",
              "version": "3766a840e093d30e1a2522f650d8a6ac892a8719",
              "versionType": "git"
            },
            {
              "lessThan": "878a4b73c11111ff5f820730f59a7f8c6fd59374",
              "status": "affected",
              "version": "3766a840e093d30e1a2522f650d8a6ac892a8719",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c9a3c3e2bffe43304fcda9190d17f6b327e538b4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9437d60dd00f3caa15e71f84dd5eb3404b141372",
              "versionType": "git"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/display/dc/hwss/dce110/dce110_hwseq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix dsc eDP issue\n\n[why]\nNeed to add function hook check before use"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:06:41.400Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/11718976c53a258c4d107aa05d68773379d0006f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c10fe9471f3aa352bb9d9329d0b25e28e0672243"
        },
        {
          "url": "https://git.kernel.org/stable/c/0481be9f12d8324789ccebf1e5fd0704b6e3fc99"
        },
        {
          "url": "https://git.kernel.org/stable/c/878a4b73c11111ff5f820730f59a7f8c6fd59374"
        }
      ],
      "title": "drm/amd/display: Fix dsc eDP issue",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43320",
    "datePublished": "2026-05-08T13:26:14.930Z",
    "dateReserved": "2026-05-01T14:12:56.001Z",
    "dateUpdated": "2026-05-23T16:06:41.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/vgic/vgic-init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b7493f48c3dba75674a4ee505b4afa8fe5102457",
              "status": "affected",
              "version": "b3aa9283c0c505b5cfd25f7d6cfd720de2adc807",
              "versionType": "git"
            },
            {
              "lessThan": "a24f1d80fbcdbf8b2a7044a00fa12b3972b4c31c",
              "status": "affected",
              "version": "b3aa9283c0c505b5cfd25f7d6cfd720de2adc807",
              "versionType": "git"
            },
            {
              "lessThan": "ac6769c8f948dff33265c50e524aebf9aa6f1be0",
              "status": "affected",
              "version": "b3aa9283c0c505b5cfd25f7d6cfd720de2adc807",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kvm/vgic/vgic-init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Eagerly init vgic dist/redist on vgic creation\n\nIf vgic_allocate_private_irqs_locked() fails for any odd reason,\nwe exit kvm_vgic_create() early, leaving dist-\u003erd_regions uninitialised.\n\nkvm_vgic_dist_destroy() then comes along and walks into the weeds\ntrying to free the RDs. Got to love this stuff.\n\nSolve it by moving all the static initialisation early, and make\nsure that if we fail halfway, we\u0027re in a reasonable shape to\nperform the rest of the teardown. While at it, reset the vgic model\non failure, just in case..."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:22:53.725Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b7493f48c3dba75674a4ee505b4afa8fe5102457"
        },
        {
          "url": "https://git.kernel.org/stable/c/a24f1d80fbcdbf8b2a7044a00fa12b3972b4c31c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac6769c8f948dff33265c50e524aebf9aa6f1be0"
        }
      ],
      "title": "KVM: arm64: Eagerly init vgic dist/redist on vgic creation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43351",
    "datePublished": "2026-05-08T14:21:08.868Z",
    "dateReserved": "2026-05-01T14:12:56.003Z",
    "dateUpdated": "2026-05-11T22:22:53.725Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/resize.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7eafcf507fbd68f3276c00f6c02ef155ad69f79b",
              "status": "affected",
              "version": "10995aa2451afa20b721cc7de856cae1a13dba57",
              "versionType": "git"
            },
            {
              "lessThan": "fabfa6b81bd386154d7e59f8cd8f760f9e68b48c",
              "status": "affected",
              "version": "10995aa2451afa20b721cc7de856cae1a13dba57",
              "versionType": "git"
            },
            {
              "lessThan": "b328d8e7c437d0f026ba2c13788af6eae77700f1",
              "status": "affected",
              "version": "10995aa2451afa20b721cc7de856cae1a13dba57",
              "versionType": "git"
            },
            {
              "lessThan": "6575f9fbf084502b7118a628425bf7866666498d",
              "status": "affected",
              "version": "10995aa2451afa20b721cc7de856cae1a13dba57",
              "versionType": "git"
            },
            {
              "lessThan": "911b557dd7817460881fd51a03069b539c674d0e",
              "status": "affected",
              "version": "10995aa2451afa20b721cc7de856cae1a13dba57",
              "versionType": "git"
            },
            {
              "lessThan": "e384a850a3370d89a7a446cdeccd964bfba2a302",
              "status": "affected",
              "version": "10995aa2451afa20b721cc7de856cae1a13dba57",
              "versionType": "git"
            },
            {
              "lessThan": "10fb72c47aac446f12a4ccd962c7daa60cc890a1",
              "status": "affected",
              "version": "10995aa2451afa20b721cc7de856cae1a13dba57",
              "versionType": "git"
            },
            {
              "lessThan": "41c6e9bc3a09539deab43957a3211d902a4818f0",
              "status": "affected",
              "version": "10995aa2451afa20b721cc7de856cae1a13dba57",
              "versionType": "git"
            },
            {
              "lessThan": "4a1c0ddc6e7bcf2e9db0eeaab9340dcfe97f448f",
              "status": "affected",
              "version": "10995aa2451afa20b721cc7de856cae1a13dba57",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/resize.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.1",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: handle invalid dinode in ocfs2_group_extend\n\n[BUG]\nkernel BUG at fs/ocfs2/resize.c:308!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:ocfs2_group_extend+0x10aa/0x1ae0 fs/ocfs2/resize.c:308\nCode: 8b8520ff ffff83f8 860f8580 030000e8 5cc3c1fe\nCall Trace:\n ...\n ocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583\n x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n ...\n\n[CAUSE]\nocfs2_group_extend() assumes that the global bitmap inode block\nreturned from ocfs2_inode_lock() has already been validated and\nBUG_ONs when the signature is not a dinode. That assumption is too\nstrong for crafted filesystems because the JBD2-managed buffer path\ncan bypass structural validation and return an invalid dinode to the\nresize ioctl.\n\n[FIX]\nValidate the dinode explicitly in ocfs2_group_extend(). If the global\nbitmap buffer does not contain a valid dinode, report filesystem\ncorruption with ocfs2_error() and fail the resize operation instead of\ncrashing the kernel."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:42:37.033Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7eafcf507fbd68f3276c00f6c02ef155ad69f79b"
        },
        {
          "url": "https://git.kernel.org/stable/c/fabfa6b81bd386154d7e59f8cd8f760f9e68b48c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b328d8e7c437d0f026ba2c13788af6eae77700f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/6575f9fbf084502b7118a628425bf7866666498d"
        },
        {
          "url": "https://git.kernel.org/stable/c/911b557dd7817460881fd51a03069b539c674d0e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e384a850a3370d89a7a446cdeccd964bfba2a302"
        },
        {
          "url": "https://git.kernel.org/stable/c/10fb72c47aac446f12a4ccd962c7daa60cc890a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/41c6e9bc3a09539deab43957a3211d902a4818f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a1c0ddc6e7bcf2e9db0eeaab9340dcfe97f448f"
        }
      ],
      "title": "ocfs2: handle invalid dinode in ocfs2_group_extend",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31596",
    "datePublished": "2026-04-24T14:42:22.003Z",
    "dateReserved": "2026-03-09T15:48:24.121Z",
    "dateUpdated": "2026-06-14T17:42:37.033Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nfnetlink_log.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "296f18e1c3a87c915a92ed27832d5040a22d1072",
              "status": "affected",
              "version": "29c5d4afba51c71cfeadd3f74f3c42e064483fb0",
              "versionType": "git"
            },
            {
              "lessThan": "9e2182865de781c41ab16b7985e9d26dcefea867",
              "status": "affected",
              "version": "29c5d4afba51c71cfeadd3f74f3c42e064483fb0",
              "versionType": "git"
            },
            {
              "lessThan": "57cc509d82b46150a11dcecc8b25eaa177eda34d",
              "status": "affected",
              "version": "29c5d4afba51c71cfeadd3f74f3c42e064483fb0",
              "versionType": "git"
            },
            {
              "lessThan": "368c22aea490f6f50df831b4f9e3623787686c5b",
              "status": "affected",
              "version": "29c5d4afba51c71cfeadd3f74f3c42e064483fb0",
              "versionType": "git"
            },
            {
              "lessThan": "d1399632ba255d2e02c757af5d9f5d9279ce168c",
              "status": "affected",
              "version": "29c5d4afba51c71cfeadd3f74f3c42e064483fb0",
              "versionType": "git"
            },
            {
              "lessThan": "d552bcfca323d175664d7444989b04f55666978a",
              "status": "affected",
              "version": "29c5d4afba51c71cfeadd3f74f3c42e064483fb0",
              "versionType": "git"
            },
            {
              "lessThan": "15d209bccf9273b4a8b4e579ba0e92d065b6ec8c",
              "status": "affected",
              "version": "29c5d4afba51c71cfeadd3f74f3c42e064483fb0",
              "versionType": "git"
            },
            {
              "lessThan": "1f3083aec8836213da441270cdb1ab612dd82cf4",
              "status": "affected",
              "version": "29c5d4afba51c71cfeadd3f74f3c42e064483fb0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nfnetlink_log.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.23"
            },
            {
              "lessThan": "2.6.23",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.23",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator\n\nWhen batching multiple NFLOG messages (inst-\u003eqlen \u003e 1), __nfulnl_send()\nappends an NLMSG_DONE terminator with sizeof(struct nfgenmsg) payload via\nnlmsg_put(), but never initializes the nfgenmsg bytes. The nlmsg_put()\nhelper only zeroes alignment padding after the payload, not the payload\nitself, so four bytes of stale kernel heap data are leaked to userspace\nin the NLMSG_DONE message body.\n\nUse nfnl_msg_put() to build the NLMSG_DONE terminator, which initializes\nthe nfgenmsg payload via nfnl_fill_hdr(), consistent with how\n__build_packet_message() already constructs NFULNL_MSG_PACKET headers."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T16:14:26.215Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/296f18e1c3a87c915a92ed27832d5040a22d1072"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e2182865de781c41ab16b7985e9d26dcefea867"
        },
        {
          "url": "https://git.kernel.org/stable/c/57cc509d82b46150a11dcecc8b25eaa177eda34d"
        },
        {
          "url": "https://git.kernel.org/stable/c/368c22aea490f6f50df831b4f9e3623787686c5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1399632ba255d2e02c757af5d9f5d9279ce168c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d552bcfca323d175664d7444989b04f55666978a"
        },
        {
          "url": "https://git.kernel.org/stable/c/15d209bccf9273b4a8b4e579ba0e92d065b6ec8c"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f3083aec8836213da441270cdb1ab612dd82cf4"
        }
      ],
      "title": "netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43085",
    "datePublished": "2026-05-06T07:40:19.915Z",
    "dateReserved": "2026-05-01T14:12:55.983Z",
    "dateUpdated": "2026-06-01T16:14:26.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_h323_asn1.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041",
              "status": "affected",
              "version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
              "versionType": "git"
            },
            {
              "lessThan": "2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a",
              "status": "affected",
              "version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
              "versionType": "git"
            },
            {
              "lessThan": "81f2fc5b0d0cf4696146f00f837596d10b92dead",
              "status": "affected",
              "version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
              "versionType": "git"
            },
            {
              "lessThan": "7ef82863d42261817a6394c6c881bd6757a70f16",
              "status": "affected",
              "version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
              "versionType": "git"
            },
            {
              "lessThan": "53d32735d77ab56cc3fc7bd53a7d099418f19be1",
              "status": "affected",
              "version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
              "versionType": "git"
            },
            {
              "lessThan": "f0a83d0a4b7c127d32ac06d607a9214937716129",
              "status": "affected",
              "version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
              "versionType": "git"
            },
            {
              "lessThan": "35f1943d242e1b9f0b6e91c0c93bfb293a9f8224",
              "status": "affected",
              "version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
              "versionType": "git"
            },
            {
              "lessThan": "baed0d9ba91d4f390da12d5039128ee897253d60",
              "status": "affected",
              "version": "ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_h323_asn1.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_h323: fix OOB read in decode_choice()\n\nIn decode_choice(), the boundary check before get_len() uses the\nvariable `len`, which is still 0 from its initialization at the top of\nthe function:\n\n    unsigned int type, ext, len = 0;\n    ...\n    if (ext || (son-\u003eattr \u0026 OPEN)) {\n        BYTE_ALIGN(bs);\n        if (nf_h323_error_boundary(bs, len, 0))  /* len is 0 here */\n            return H323_ERROR_BOUND;\n        len = get_len(bs);                        /* OOB read */\n\nWhen the bitstream is exactly consumed (bs-\u003ecur == bs-\u003eend), the check\nnf_h323_error_boundary(bs, 0, 0) evaluates to (bs-\u003ecur + 0 \u003e bs-\u003eend),\nwhich is false.  The subsequent get_len() call then dereferences\n*bs-\u003ecur++, reading 1 byte past the end of the buffer.  If that byte\nhas bit 7 set, get_len() reads a second byte as well.\n\nThis can be triggered remotely by sending a crafted Q.931 SETUP message\nwith a User-User Information Element containing exactly 2 bytes of\nPER-encoded data ({0x08, 0x00}) to port 1720 through a firewall with\nthe nf_conntrack_h323 helper active.  The decoder fully consumes the\nPER buffer before reaching this code path, resulting in a 1-2 byte\nheap-buffer-overflow read confirmed by AddressSanitizer.\n\nFix this by checking for 2 bytes (the maximum that get_len() may read)\ninstead of the uninitialized `len`.  This matches the pattern used at\nevery other get_len() call site in the same file, where the caller\nchecks for 2 bytes of available data before calling get_len()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable H.323 conntrack Q.931 helper processes TCP/1720 network traffic, and the fix explicitly documents remote triggering with a crafted Q.931 SETUP User-User IE through a firewall with the helper active.\nAC:L - The trigger is a deterministic malformed PER buffer of exact length; no race, heap grooming, or victim-controlled timing is required beyond the helper being active.\nPR:N - The attacker only sends network packets to a system/firewall where the H.323 helper is configured; the Q.931 parsing path has no authentication or attacker privilege check.\nUI:N - No victim user action is needed once the helper is active; packet receipt alone drives conntrack into the decoder.\nS:U - The impact remains within the kernel/network filtering security authority and does not cross a VM, IOMMU, or other separate security boundary.\nC:L - The bug performs a strictly bounded 1-2 byte out-of-bounds heap read via get_len(), so any confidentiality impact is limited rather than arbitrary memory disclosure.\nI:N - The vulnerable operation is read-only, and the subsequent bounds check returns an error; there is no out-of-bounds write or structure corruption.\nA:H - The remotely triggerable kernel heap out-of-bounds read is reachable repeatedly from packet processing and can cause sanitizer/oops/panic-style kernel failure on affected deployments."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:26:46.159Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a"
        },
        {
          "url": "https://git.kernel.org/stable/c/81f2fc5b0d0cf4696146f00f837596d10b92dead"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ef82863d42261817a6394c6c881bd6757a70f16"
        },
        {
          "url": "https://git.kernel.org/stable/c/53d32735d77ab56cc3fc7bd53a7d099418f19be1"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0a83d0a4b7c127d32ac06d607a9214937716129"
        },
        {
          "url": "https://git.kernel.org/stable/c/35f1943d242e1b9f0b6e91c0c93bfb293a9f8224"
        },
        {
          "url": "https://git.kernel.org/stable/c/baed0d9ba91d4f390da12d5039128ee897253d60"
        }
      ],
      "title": "netfilter: nf_conntrack_h323: fix OOB read in decode_choice()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43233",
    "datePublished": "2026-05-06T11:28:29.565Z",
    "dateReserved": "2026-05-01T14:12:55.995Z",
    "dateUpdated": "2026-08-05T12:26:46.159Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2249983d971e6839b36284e6610390b2c217dfa1",
              "status": "affected",
              "version": "10c6021a609deb95f23f0cc2f89aa9d4bffb14c7",
              "versionType": "git"
            },
            {
              "lessThan": "ae356d5eb1331d678985799f893e436314834a87",
              "status": "affected",
              "version": "9af149ca9d0dab6e59e813519d309eff62499864",
              "versionType": "git"
            },
            {
              "lessThan": "965d6162dd88cc7cc193cf7f5bfc132d8bbf0523",
              "status": "affected",
              "version": "8fc3d7b23d139e3cbc944c15d99b3cdbed797d2d",
              "versionType": "git"
            },
            {
              "lessThan": "42fe37c90184cd1568838b84b488934c3671c963",
              "status": "affected",
              "version": "2941155d9a5ae098b480d551f3a5f8605d4f9af5",
              "versionType": "git"
            },
            {
              "lessThan": "cac2106bb9a2180b288079b49ed626414fb5bc45",
              "status": "affected",
              "version": "43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24",
              "versionType": "git"
            },
            {
              "lessThan": "1cdff2937c618f81058422bbdc4974a3e7ec9379",
              "status": "affected",
              "version": "43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24",
              "versionType": "git"
            },
            {
              "lessThan": "7d96f3120a7fb7210d21b520c5b6f495da6ba436",
              "status": "affected",
              "version": "43806c3d5b9bb7d74ba4e33a6a8a41ac988bde24",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ed7bcd9f617e4107ac0813c516e72e6b8f6029bd",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.209",
              "status": "affected",
              "version": "5.15.189",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.175",
              "status": "affected",
              "version": "6.1.146",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.140",
              "status": "affected",
              "version": "6.6.99",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.86",
              "status": "affected",
              "version": "6.12.39",
              "versionType": "semver"
            },
            {
              "lessThan": "6.16",
              "status": "affected",
              "version": "6.15.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid10.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.15.189",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "6.1.146",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "6.6.99",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "6.12.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.15.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid10: fix deadlock with check operation and nowait requests\n\nWhen an array check is running it will raise the barrier at which point\nnormal requests will become blocked and increment the nr_pending value to\nsignal there is work pending inside of wait_barrier(). NOWAIT requests\ndo not block and so will return immediately with an error, and additionally\ndo not increment nr_pending in wait_barrier(). Upstream change commit\n43806c3d5b9b (\"raid10: cleanup memleak at raid10_make_request\") added a\ncall to raid_end_bio_io() to fix a memory leak when NOWAIT requests hit\nthis condition. raid_end_bio_io() eventually calls allow_barrier() and\nit will unconditionally do an atomic_dec_and_test(\u0026conf-\u003enr_pending) even\nthough the corresponding increment on nr_pending didn\u0027t happen in the\nNOWAIT case.\n\nThis can be easily seen by starting a check operation while an application\nis doing nowait IO on the same array. This results in a deadlocked state\ndue to nr_pending value underflowing and so the md resync thread gets stuck\nwaiting for nr_pending to == 0.\n\nOutput of r10conf state of the array when we hit this condition:\n\ncrash\u003e struct r10conf\n\tbarrier = 1,\n        nr_pending = {\n          counter = -41\n        },\n        nr_waiting = 15,\n        nr_queued = 0,\n\nExample of md_sync thread stuck waiting on raise_barrier() and other\nrequests stuck in wait_barrier():\n\nmd1_resync\n[\u003c0\u003e] raise_barrier+0xce/0x1c0\n[\u003c0\u003e] raid10_sync_request+0x1ca/0x1ed0\n[\u003c0\u003e] md_do_sync+0x779/0x1110\n[\u003c0\u003e] md_thread+0x90/0x160\n[\u003c0\u003e] kthread+0xbe/0xf0\n[\u003c0\u003e] ret_from_fork+0x34/0x50\n[\u003c0\u003e] ret_from_fork_asm+0x1a/0x30\n\nkworker/u1040:2+flush-253:4\n[\u003c0\u003e] wait_barrier+0x1de/0x220\n[\u003c0\u003e] regular_request_wait+0x30/0x180\n[\u003c0\u003e] raid10_make_request+0x261/0x1000\n[\u003c0\u003e] md_handle_request+0x13b/0x230\n[\u003c0\u003e] __submit_bio+0x107/0x1f0\n[\u003c0\u003e] submit_bio_noacct_nocheck+0x16f/0x390\n[\u003c0\u003e] ext4_io_submit+0x24/0x40\n[\u003c0\u003e] ext4_do_writepages+0x254/0xc80\n[\u003c0\u003e] ext4_writepages+0x84/0x120\n[\u003c0\u003e] do_writepages+0x7a/0x260\n[\u003c0\u003e] __writeback_single_inode+0x3d/0x300\n[\u003c0\u003e] writeback_sb_inodes+0x1dd/0x470\n[\u003c0\u003e] __writeback_inodes_wb+0x4c/0xe0\n[\u003c0\u003e] wb_writeback+0x18b/0x2d0\n[\u003c0\u003e] wb_workfn+0x2a1/0x400\n[\u003c0\u003e] process_one_work+0x149/0x330\n[\u003c0\u003e] worker_thread+0x2d2/0x410\n[\u003c0\u003e] kthread+0xbe/0xf0\n[\u003c0\u003e] ret_from_fork+0x34/0x50\n[\u003c0\u003e] ret_from_fork_asm+0x1a/0x30"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:50:41.899Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2249983d971e6839b36284e6610390b2c217dfa1"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae356d5eb1331d678985799f893e436314834a87"
        },
        {
          "url": "https://git.kernel.org/stable/c/965d6162dd88cc7cc193cf7f5bfc132d8bbf0523"
        },
        {
          "url": "https://git.kernel.org/stable/c/42fe37c90184cd1568838b84b488934c3671c963"
        },
        {
          "url": "https://git.kernel.org/stable/c/cac2106bb9a2180b288079b49ed626414fb5bc45"
        },
        {
          "url": "https://git.kernel.org/stable/c/1cdff2937c618f81058422bbdc4974a3e7ec9379"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d96f3120a7fb7210d21b520c5b6f495da6ba436"
        }
      ],
      "title": "md/raid10: fix deadlock with check operation and nowait requests",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46050",
    "datePublished": "2026-05-27T12:57:06.732Z",
    "dateReserved": "2026-05-13T15:03:33.094Z",
    "dateUpdated": "2026-06-14T17:50:41.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a88b3293b556f4d8fba11db9a8061a6b0d3b69e6",
              "status": "affected",
              "version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
              "versionType": "git"
            },
            {
              "lessThan": "a03cdcedb2cbcc42551dc3e4746929e93c5352d5",
              "status": "affected",
              "version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
              "versionType": "git"
            },
            {
              "lessThan": "580f92f27cb8724bcc4be98ee89890eab524a2ae",
              "status": "affected",
              "version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
              "versionType": "git"
            },
            {
              "lessThan": "d0c8c4fbd22d260fe28530260656c5fb3c20ce84",
              "status": "affected",
              "version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
              "versionType": "git"
            },
            {
              "lessThan": "8a2126c5afe89f8ceeb60a3afb9f075b736194cd",
              "status": "affected",
              "version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
              "versionType": "git"
            },
            {
              "lessThan": "02e1b5c4d3b4c658b72c145427cded1bba613fc1",
              "status": "affected",
              "version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
              "versionType": "git"
            },
            {
              "lessThan": "5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6",
              "status": "affected",
              "version": "07dd0a7aae7f72af7cec18909581c2bb570edddc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "95a936364f2685e9e040c6b179b553604d96de22",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "fba2cf348d9eb50b2049a73cc09313dab6d293f1",
              "versionType": "git"
            },
            {
              "lessThan": "5.8",
              "status": "affected",
              "version": "5.7.15",
              "versionType": "semver"
            },
            {
              "lessThan": "5.9",
              "status": "affected",
              "version": "5.8.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.7.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.8.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mvpp2: refill RX buffers before XDP or skb use\n\nThe RX error path returns the current descriptor buffer to the hardware\nBM pool. That is only valid while the driver still owns the buffer.\n\nmvpp2_rx_refill() can fail after the current buffer has been handed to\nXDP or attached to an skb. In those cases mvpp2_run_xdp() may have\nrecycled, redirected, or queued the page for XDP_TX, and an skb free also\nretires the data buffer. Returning such a buffer to BM lets hardware DMA\ninto memory that is no longer owned by the RX ring.\n\nRefill the BM pool before handing the current buffer to XDP or to the\nskb. If the allocation fails there, drop the packet and return the\nstill-owned current buffer to BM, preserving the pool depth. Once the\nrefill succeeds, later local drops retire/free the current buffer instead\nof returning it to BM."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable `mvpp2_rx()` path is reached by packets received on the network interface, including remotely routed traffic to an internet-facing mvpp2-based system.\nAC:L - Triggering requires RX traffic and refill allocation failure, which a high-rate remote packet stream can plausibly induce through RX pressure; no attacker-uncontrolled race or authentication state is required.\nPR:N - No privileges are needed to send packets to the interface, and the normal skb receive path is affected without requiring XDP setup or local administrative actions.\nUI:N - Exploitation is driven by network packet reception and does not require any victim user action.\nS:U - The corruption occurs within the host kernel/driver memory management domain and does not inherently cross a VM, IOMMU, or separate security authority boundary.\nC:H - The bug lets hardware DMA attacker-controlled packet data into memory no longer owned by the RX ring, creating a kernel memory corruption primitive that can be leveraged for disclosure.\nI:H - Returning a freed or retired buffer to the hardware BM pool can produce attacker-controlled DMA writes into reused kernel memory, supporting arbitrary corruption or code execution.\nA:H - The same memory corruption can crash or panic the kernel, and it can be repeatedly triggered with network traffic under RX/refill pressure."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:34:11.464Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a88b3293b556f4d8fba11db9a8061a6b0d3b69e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a03cdcedb2cbcc42551dc3e4746929e93c5352d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/580f92f27cb8724bcc4be98ee89890eab524a2ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0c8c4fbd22d260fe28530260656c5fb3c20ce84"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a2126c5afe89f8ceeb60a3afb9f075b736194cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/02e1b5c4d3b4c658b72c145427cded1bba613fc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e8e2a9624df72fca7c736b2966b2cbf6c9c3ff6"
        }
      ],
      "title": "net: mvpp2: refill RX buffers before XDP or skb use",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53215",
    "datePublished": "2026-06-25T08:39:18.875Z",
    "dateReserved": "2026-06-09T07:44:35.392Z",
    "dateUpdated": "2026-08-05T12:34:11.464Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:49:02.973Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_helper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5cf28d5c8dcbbe8af6d3b145babe491906d7bad1",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "504ba4168466c91210c45acdc332479cfd5f2da6",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "dc1739eff48e34cc71d4e2f03715493fbcebd8af",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "2cf2737c85a2ba2b52024dafe68ffad2676f97be",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "2c16e4d64dd91227742dfe196a3e7b0568bef65a",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "620f3d14c1ef51d425060a3056ad8dbae8f998a3",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "90bd7e8501349db3006d21fbc09df9ffcb172965",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            },
            {
              "lessThan": "a242a9ae58aa46ff7dae51ce64150a93957abe65",
              "status": "affected",
              "version": "ac7b848390036dadd4351899d2a23748075916bd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conntrack_helper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.134",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.81",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.134",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.81",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.22",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.12",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_helper: pass helper to expect cleanup\n\nnf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy()\nto remove expectations belonging to the helper being unregistered.\nHowever, it passes NULL instead of the helper pointer as the data\nargument, so expect_iter_me() never matches any expectation and all\nof them survive the cleanup.\n\nAfter unregister returns, nfnl_cthelper_del() frees the helper\nobject immediately.  Subsequent expectation dumps or packet-driven\ninit_conntrack() calls then dereference the freed exp-\u003ehelper,\ncausing a use-after-free.\n\nPass the actual helper pointer so expectations referencing it are\nproperly destroyed before the helper object is freed.\n\n  BUG: KASAN: slab-use-after-free in string+0x38f/0x430\n  Read of size 1 at addr ffff888003b14d20 by task poc/103\n  Call Trace:\n   string+0x38f/0x430\n   vsnprintf+0x3cc/0x1170\n   seq_printf+0x17a/0x240\n   exp_seq_show+0x2e5/0x560\n   seq_read_iter+0x419/0x1280\n   proc_reg_read+0x1ac/0x270\n   vfs_read+0x179/0x930\n   ksys_read+0xef/0x1c0\n  Freed by task 103:\n  The buggy address is located 32 bytes inside of\n   freed 192-byte region [ffff888003b14d00, ffff888003b14dc0)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:16:18.081Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5cf28d5c8dcbbe8af6d3b145babe491906d7bad1"
        },
        {
          "url": "https://git.kernel.org/stable/c/504ba4168466c91210c45acdc332479cfd5f2da6"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc1739eff48e34cc71d4e2f03715493fbcebd8af"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cf2737c85a2ba2b52024dafe68ffad2676f97be"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c16e4d64dd91227742dfe196a3e7b0568bef65a"
        },
        {
          "url": "https://git.kernel.org/stable/c/620f3d14c1ef51d425060a3056ad8dbae8f998a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/90bd7e8501349db3006d21fbc09df9ffcb172965"
        },
        {
          "url": "https://git.kernel.org/stable/c/a242a9ae58aa46ff7dae51ce64150a93957abe65"
        }
      ],
      "title": "netfilter: nf_conntrack_helper: pass helper to expect cleanup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43027",
    "datePublished": "2026-05-01T14:15:28.521Z",
    "dateReserved": "2026-05-01T14:12:55.976Z",
    "dateUpdated": "2026-07-14T12:49:02.973Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid5.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "66df9f30673db66ac35145820a8e24906069ae57",
              "status": "affected",
              "version": "773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6",
              "versionType": "git"
            },
            {
              "lessThan": "4166d5234fe8b6c3c7f796a6c198605356c5b355",
              "status": "affected",
              "version": "773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6",
              "versionType": "git"
            },
            {
              "lessThan": "a9055300e07d9d6800264d3c2560e1d0144689ca",
              "status": "affected",
              "version": "773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6",
              "versionType": "git"
            },
            {
              "lessThan": "09880592f5a9dc73377d6eb5ac123537b5f8df49",
              "status": "affected",
              "version": "773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6",
              "versionType": "git"
            },
            {
              "lessThan": "80fc6ca2cbde018d52e13f305edcd643911bd94b",
              "status": "affected",
              "version": "773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6",
              "versionType": "git"
            },
            {
              "lessThan": "1985cb3247e87ff6b8ca4bc5f9626f4f51024507",
              "status": "affected",
              "version": "773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6",
              "versionType": "git"
            },
            {
              "lessThan": "883cc33b7af1c448663287f069ef9dfea001e90f",
              "status": "affected",
              "version": "773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6",
              "versionType": "git"
            },
            {
              "lessThan": "7f9f7c697474268d9ef9479df3ddfe7cdcfbbffc",
              "status": "affected",
              "version": "773ca82fa1ee58dd1bf88b6a5ca385ec83a2cac6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/md/raid5.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5: fix soft lockup in retry_aligned_read()\n\nWhen retry_aligned_read() encounters an overlapped stripe, it releases\nthe stripe via raid5_release_stripe() which puts it on the lockless\nreleased_stripes llist. In the next raid5d loop iteration,\nrelease_stripe_list() drains the stripe onto handle_list (since\nSTRIPE_HANDLE is set by the original IO), but retry_aligned_read()\nruns before handle_active_stripes() and removes the stripe from\nhandle_list via find_get_stripe() -\u003e list_del_init(). This prevents\nhandle_stripe() from ever processing the stripe to resolve the\noverlap, causing an infinite loop and soft lockup.\n\nFix this by using __release_stripe() with temp_inactive_list instead\nof raid5_release_stripe() in the failure path, so the stripe does not\ngo through the released_stripes llist. This allows raid5d to break out\nof its loop, and the overlap will be resolved when the stripe is\neventually processed by handle_stripe()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:50:46.976Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/66df9f30673db66ac35145820a8e24906069ae57"
        },
        {
          "url": "https://git.kernel.org/stable/c/4166d5234fe8b6c3c7f796a6c198605356c5b355"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9055300e07d9d6800264d3c2560e1d0144689ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/09880592f5a9dc73377d6eb5ac123537b5f8df49"
        },
        {
          "url": "https://git.kernel.org/stable/c/80fc6ca2cbde018d52e13f305edcd643911bd94b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1985cb3247e87ff6b8ca4bc5f9626f4f51024507"
        },
        {
          "url": "https://git.kernel.org/stable/c/883cc33b7af1c448663287f069ef9dfea001e90f"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f9f7c697474268d9ef9479df3ddfe7cdcfbbffc"
        }
      ],
      "title": "md/raid5: fix soft lockup in retry_aligned_read()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46051",
    "datePublished": "2026-05-27T12:57:09.274Z",
    "dateReserved": "2026-05-13T15:03:33.094Z",
    "dateUpdated": "2026-06-14T17:50:46.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ioam6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6d1d9ed9b409e0662241e3d245d574a18f643494",
              "status": "affected",
              "version": "b63c5478e9cb1d1504eb02d9dac827ad24612b32",
              "versionType": "git"
            },
            {
              "lessThan": "95a1334748c95dd15546056280ade0c4b8dd7b78",
              "status": "affected",
              "version": "b63c5478e9cb1d1504eb02d9dac827ad24612b32",
              "versionType": "git"
            },
            {
              "lessThan": "b30b1675aa2bcf0491fd3830b051df4e08a7c8ca",
              "status": "affected",
              "version": "b63c5478e9cb1d1504eb02d9dac827ad24612b32",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ioam6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ioam6: fix OOB and missing lock\n\nWhen trace-\u003etype.bit6 is set:\n\n    if (trace-\u003etype.bit6) {\n        ...\n        queue = skb_get_tx_queue(dev, skb);\n        qdisc = rcu_dereference(queue-\u003eqdisc);\n\nThis code can lead to an out-of-bounds access of the dev-\u003e_tx[] array\nwhen is_input is true. In such a case, the packet is on the RX path and\nskb-\u003equeue_mapping contains the RX queue index of the ingress device. If\nthe ingress device has more RX queues than the egress device (dev) has\nTX queues, skb_get_queue_mapping(skb) will exceed dev-\u003enum_tx_queues.\nAdd a check to avoid this situation since skb_get_tx_queue() does not\nclamp the index. This issue has also revealed that per queue visibility\ncannot be accurate and will be replaced later as a new feature.\n\nWhile at it, add missing lock around qdisc_qstats_qlen_backlog(). The\nfunction __ioam6_fill_trace_data() is called from both softirq and\nprocess contexts, hence the use of spin_lock_bh() here."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable input path is reached by received IPv6 packets carrying a Hop-by-Hop IOAM Pre-allocated Trace option with queue-depth bit 6 set. In a reasonable IOAM-enabled routing deployment, an unauthenticated network peer can send such packets to the ingress interface.\nAC:L - The attacker controls the packet contents, including the IOAM trace type, and can repeatedly send packets; the RX-queue-to-TX-queue mismatch is a plausible target configuration rather than a race or condition the attacker must win. The OOB access occurs deterministically once the packet is processed with an out-of-range queue mapping.\nPR:N - Although enabling IOAM and creating namespaces are administrative configuration steps, the actual vulnerable code path processes unauthenticated network packets after IOAM is enabled. The packet sender needs no local account or kernel privileges.\nUI:N - No victim user action is required. Packet reception and IPv6 hop-by-hop IOAM processing trigger the vulnerable function automatically.\nS:U - The impact remains within the kernel/networking security authority of the affected system. This is not a VM escape, sandbox escape, or cross-authority boundary violation.\nC:H - The bug is an out-of-bounds read of the egress device\u0027s `dev-\u003e_tx[]` array followed by dereferencing data as a `Qdisc`, and the resulting value can be copied into IOAM trace data. Under the required overestimation rule, this is treated as high confidentiality impact because it is not a strictly bounded, harmless read.\nI:N - The vulnerable operation reads an out-of-bounds queue entry and qdisc statistics; it does not provide an out-of-bounds write or an apparent primitive to modify kernel memory. Any packet trace update is part of normal processing of the attacker\u0027s packet.\nA:H - An out-of-bounds queue pointer dereference can fault or otherwise oops/panic the kernel, especially when the computed `Qdisc` pointer is invalid. The same crafted packet pattern can be sent repeatedly, making denial of service high impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:50.022Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6d1d9ed9b409e0662241e3d245d574a18f643494"
        },
        {
          "url": "https://git.kernel.org/stable/c/95a1334748c95dd15546056280ade0c4b8dd7b78"
        },
        {
          "url": "https://git.kernel.org/stable/c/b30b1675aa2bcf0491fd3830b051df4e08a7c8ca"
        }
      ],
      "title": "net: ioam6: fix OOB and missing lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43083",
    "datePublished": "2026-05-06T07:40:18.504Z",
    "dateReserved": "2026-05-01T14:12:55.983Z",
    "dateUpdated": "2026-08-05T12:25:50.022Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/umem.c",
            "drivers/infiniband/hw/hns/hns_roce_mr.c",
            "drivers/infiniband/hw/irdma/verbs.c",
            "drivers/infiniband/hw/mlx4/mr.c",
            "drivers/infiniband/hw/mlx5/mr.c",
            "drivers/infiniband/sw/rxe/rxe_verbs.c",
            "include/rdma/ib_umem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "09dc18894148381d3bfc550083b1236043870dce",
              "status": "affected",
              "version": "b40656aa7d559adc1fe689396dc58b92a9a27286",
              "versionType": "git"
            },
            {
              "lessThan": "eba5df21eda0fe7418efbea2f799f8ea1b8ca94c",
              "status": "affected",
              "version": "b40656aa7d559adc1fe689396dc58b92a9a27286",
              "versionType": "git"
            },
            {
              "lessThan": "2904e985a2917b5dac65df82733065e78a65fc9d",
              "status": "affected",
              "version": "b40656aa7d559adc1fe689396dc58b92a9a27286",
              "versionType": "git"
            },
            {
              "lessThan": "50334a05a950840b39a1ce3d2a173b4183db9b3e",
              "status": "affected",
              "version": "b40656aa7d559adc1fe689396dc58b92a9a27286",
              "versionType": "git"
            },
            {
              "lessThan": "badad6fad60def1b9805559dd81dbab3d97b82aa",
              "status": "affected",
              "version": "b40656aa7d559adc1fe689396dc58b92a9a27286",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/umem.c",
            "drivers/infiniband/hw/hns/hns_roce_mr.c",
            "drivers/infiniband/hw/irdma/verbs.c",
            "drivers/infiniband/hw/mlx4/mr.c",
            "drivers/infiniband/hw/mlx5/mr.c",
            "drivers/infiniband/sw/rxe/rxe_verbs.c",
            "include/rdma/ib_umem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA: During rereg_mr ensure that REREG_ACCESS is compatible\n\nIf IB_MR_REREG_ACCESS changes from RO to RW then the umem has to be\nre-evaluated to ensure it is properly pinned as RW. Since the umem is\nhidden inside each driver\u0027s mr struct add a ib_umem_check_rereg() function\nthat each driver has to call before processing IB_MR_REREG_ACCESS.\n\nmlx4 has to retain its duplicate ib_access_writable check because it\nimplements IB_MR_REREG_ACCESS | IB_MR_REREG_TRANS by changing both items\nin place sequentially while the MR is live, so it will continue to not\nsupport this combination."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local RDMA uverbs write/ioctl operations on /dev/infiniband/uverbs*, not by unauthenticated network packets. Remote RDMA traffic may perform the final write only after a local process has created and reregistered the MR.\nAC:L - The trigger is a deterministic sequence: register an MR read-only, reregister it with writable access without changing translation, then use the writable MR. There is no race or attacker-uncontrolled timing requirement.\nPR:L - A basic local user can open the uverbs device when an RDMA device is exposed and create the required context, PD, and MR; the path has no CAP_SYS_ADMIN or CAP_NET_ADMIN gate. Resource limits may constrain size but do not make the attack require administrator privileges.\nUI:N - No victim action is required after the attacker has local execution and access to the RDMA uverbs device. The attacker drives the registration, reregistration, and write operations directly.\nS:U - The impact remains within the kernel/host security authority and is a local privilege escalation or host integrity violation. It does not inherently cross a VM, hypervisor, or IOMMU security boundary.\nC:H - The stale read-only pin can be converted into a writable RDMA mapping, enabling modification of read-only/COW or page-cache backed memory in a Dirty-COW-like way. A plausible privileged-code-execution path through corrupted executable page cache yields full confidentiality impact.\nI:H - The bug creates an unauthorized write primitive to pages that were not pinned with FOLL_WRITE and should not be writable. This can corrupt read-only user mappings or shared page-cache contents, making high integrity impact defensible.\nA:H - The same unauthorized write primitive can corrupt executable/library page cache or process memory and crash privileged services or destabilize the system. With plausible root code execution, high availability impact is also defensible."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:31.552Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/09dc18894148381d3bfc550083b1236043870dce"
        },
        {
          "url": "https://git.kernel.org/stable/c/eba5df21eda0fe7418efbea2f799f8ea1b8ca94c"
        },
        {
          "url": "https://git.kernel.org/stable/c/2904e985a2917b5dac65df82733065e78a65fc9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/50334a05a950840b39a1ce3d2a173b4183db9b3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/badad6fad60def1b9805559dd81dbab3d97b82aa"
        }
      ],
      "title": "RDMA: During rereg_mr ensure that REREG_ACCESS is compatible",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-52908",
    "datePublished": "2026-06-19T14:00:35.971Z",
    "dateReserved": "2026-06-09T07:44:35.366Z",
    "dateUpdated": "2026-08-05T12:31:31.552Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "io_uring/kbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a7b33671e418fca507feebd1d56e7f4952a4b25c",
              "status": "affected",
              "version": "c7fb19428d67dd0a2a78a4f237af01d39c78dc5a",
              "versionType": "git"
            },
            {
              "lessThan": "439a6728ec4641ffad1ca796622c19bc525e570f",
              "status": "affected",
              "version": "c7fb19428d67dd0a2a78a4f237af01d39c78dc5a",
              "versionType": "git"
            },
            {
              "lessThan": "f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa",
              "status": "affected",
              "version": "c7fb19428d67dd0a2a78a4f237af01d39c78dc5a",
              "versionType": "git"
            },
            {
              "lessThan": "50ad880db3013c6fee0ef13781762a39e2e7ef83",
              "status": "affected",
              "version": "c7fb19428d67dd0a2a78a4f237af01d39c78dc5a",
              "versionType": "git"
            },
            {
              "lessThan": "97b57f69fee1b61b41acbf37e7720cac9d389fa4",
              "status": "affected",
              "version": "c7fb19428d67dd0a2a78a4f237af01d39c78dc5a",
              "versionType": "git"
            },
            {
              "lessThan": "c2c185be5c85d37215397c8e8781abf0a69bec1f",
              "status": "affected",
              "version": "c7fb19428d67dd0a2a78a4f237af01d39c78dc5a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "io_uring/kbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/kbuf: check if target buffer list is still legacy on recycle\n\nThere\u0027s a gap between when the buffer was grabbed and when it\npotentially gets recycled, where if the list is empty, someone could\u0027ve\nupgraded it to a ring provided type. This can happen if the request\nis forced via io-wq. The legacy recycling is missing checking if the\nbuffer_list still exists, and if it\u0027s of the correct type. Add those\nchecks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reachable through local `io_uring_setup`, `io_uring_enter`, and `io_uring_register` operations using provided buffer selection and buffer-ring registration. It is not directly reachable from network packets or physical/adjacent interfaces.\nAC:L - The attacker controls the io_uring ring, the legacy provided buffer group, the in-flight async/io-wq request, and the conversion/removal of the same buffer group. The required timing can be driven by attacker-controlled concurrent local operations, so the race/lifecycle window is low complexity.\nPR:L - Exploitation requires a local unprivileged user able to create and use an io_uring instance; the relevant setup/register/submit paths do not require real root or init-namespace capabilities when io_uring is enabled. This is basic local user privilege, not administrator privilege.\nUI:N - No victim action is required after the attacker runs local code. The attacker performs all setup, submission, and buffer group conversion operations directly.\nS:U - The bug corrupts kernel memory from within the kernel/io_uring security authority and can lead to local kernel compromise or crash. It does not inherently cross a VM, IOMMU, or separate authorization boundary.\nC:H - The legacy recycle path can type-confuse a ring-provided buffer list and write kernel pointers into attacker-observable ring memory, and subsequent use can treat attacker-influenced objects as buffer-ring state. This is kernel memory corruption with a defensible path to high confidentiality impact.\nI:H - Recycling a legacy `struct io_buffer` into a ring buffer list corrupts list/ring state and can turn later ring-buffer operations into controlled kernel memory misuse. As a type confusion/memory corruption bug, high integrity impact is appropriate.\nA:H - If the target buffer list has been removed the old code can dereference a NULL buffer-list pointer, and if it has been upgraded it corrupts kernel state. Either case can produce an oops/panic or otherwise destabilize the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:27:30.302Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a7b33671e418fca507feebd1d56e7f4952a4b25c"
        },
        {
          "url": "https://git.kernel.org/stable/c/439a6728ec4641ffad1ca796622c19bc525e570f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3fb54e7a8b4aadcc2836ee463eec8c88709b8aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/50ad880db3013c6fee0ef13781762a39e2e7ef83"
        },
        {
          "url": "https://git.kernel.org/stable/c/97b57f69fee1b61b41acbf37e7720cac9d389fa4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2c185be5c85d37215397c8e8781abf0a69bec1f"
        }
      ],
      "title": "io_uring/kbuf: check if target buffer list is still legacy on recycle",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43366",
    "datePublished": "2026-05-08T14:21:19.191Z",
    "dateReserved": "2026-05-01T14:12:56.005Z",
    "dateUpdated": "2026-08-05T12:27:30.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nfnetlink_cthelper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0605e1985a95d4334a67869aee45a47e82301abf",
              "status": "affected",
              "version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
              "versionType": "git"
            },
            {
              "lessThan": "92441f6d9405a0c18d03f278b395e782f79a4a30",
              "status": "affected",
              "version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
              "versionType": "git"
            },
            {
              "lessThan": "3cc328ffc32ddb389cba7b78b6aa95d995c2876e",
              "status": "affected",
              "version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
              "versionType": "git"
            },
            {
              "lessThan": "4a1f6ee69267a5f524102c028981410eeacfa3da",
              "status": "affected",
              "version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
              "versionType": "git"
            },
            {
              "lessThan": "894c5780ddadd5fde0e16f66587918e6be1504c4",
              "status": "affected",
              "version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
              "versionType": "git"
            },
            {
              "lessThan": "05018cd9370f77bb18fbf6e15ff33c7a06f10b3c",
              "status": "affected",
              "version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
              "versionType": "git"
            },
            {
              "lessThan": "61b3a1f8621df1a5928118313f133996f6a786db",
              "status": "affected",
              "version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
              "versionType": "git"
            },
            {
              "lessThan": "6dcee8496d53165b2d8a5909b3050b62ae71fe89",
              "status": "affected",
              "version": "12f7a505331e6b2754684b509f2ac8f0011ce644",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nfnetlink_cthelper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.6"
            },
            {
              "lessThan": "3.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()\n\nnfnl_cthelper_dump_table() has a \u0027goto restart\u0027 that jumps to a label\ninside the for loop body.  When the \"last\" helper saved in cb-\u003eargs[1]\nis deleted between dump rounds, every entry fails the (cur != last)\ncheck, so cb-\u003eargs[1] is never cleared.  The for loop finishes with\ncb-\u003eargs[0] == nf_ct_helper_hsize, and the \u0027goto restart\u0027 jumps back\ninto the loop body bypassing the bounds check, causing an 8-byte\nout-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize].\n\nThe \u0027goto restart\u0027 block was meant to re-traverse the current bucket\nwhen \"last\" is no longer found, but it was placed after the for loop\ninstead of inside it.  Move the block into the for loop body so that\nthe restart only occurs while cb-\u003eargs[0] is still within bounds.\n\n BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0\n Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131\n Call Trace:\n  nfnl_cthelper_dump_table+0x9f/0x1b0\n  netlink_dump+0x333/0x880\n  netlink_recvmsg+0x3e2/0x4b0\n  sock_recvmsg+0xde/0xf0\n  __sys_recvfrom+0x150/0x200\n  __x64_sys_recvfrom+0x76/0x90\n  do_syscall_64+0xc3/0x6e0\n\n Allocated by task 1:\n  __kvmalloc_node_noprof+0x21b/0x700\n  nf_ct_alloc_hashtable+0x65/0xd0\n  nf_conntrack_helper_init+0x21/0x60\n  nf_conntrack_init_start+0x18d/0x300\n  nf_conntrack_standalone_init+0x12/0xc0"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:24:49.527Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0605e1985a95d4334a67869aee45a47e82301abf"
        },
        {
          "url": "https://git.kernel.org/stable/c/92441f6d9405a0c18d03f278b395e782f79a4a30"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cc328ffc32ddb389cba7b78b6aa95d995c2876e"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a1f6ee69267a5f524102c028981410eeacfa3da"
        },
        {
          "url": "https://git.kernel.org/stable/c/894c5780ddadd5fde0e16f66587918e6be1504c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/05018cd9370f77bb18fbf6e15ff33c7a06f10b3c"
        },
        {
          "url": "https://git.kernel.org/stable/c/61b3a1f8621df1a5928118313f133996f6a786db"
        },
        {
          "url": "https://git.kernel.org/stable/c/6dcee8496d53165b2d8a5909b3050b62ae71fe89"
        }
      ],
      "title": "netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43450",
    "datePublished": "2026-05-08T14:22:15.915Z",
    "dateReserved": "2026-05-01T14:12:56.010Z",
    "dateUpdated": "2026-05-11T22:24:49.527Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/qrtr/ns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b48fc702b20233b809f01053232c3cd5083c97b4",
              "status": "affected",
              "version": "0c2204a4ad710d95d348ea006f14ba926e842ffd",
              "versionType": "git"
            },
            {
              "lessThan": "991c431077b19176d3fe3bb54054c063776a8cdc",
              "status": "affected",
              "version": "0c2204a4ad710d95d348ea006f14ba926e842ffd",
              "versionType": "git"
            },
            {
              "lessThan": "94914731ca0b99899dceadd80d2df00584a688ca",
              "status": "affected",
              "version": "0c2204a4ad710d95d348ea006f14ba926e842ffd",
              "versionType": "git"
            },
            {
              "lessThan": "e6f6cd501fb54060940a6eb3f4103eeb5e426ae7",
              "status": "affected",
              "version": "0c2204a4ad710d95d348ea006f14ba926e842ffd",
              "versionType": "git"
            },
            {
              "lessThan": "3efaad55cad1ded429e3a873bfece389058a526b",
              "status": "affected",
              "version": "0c2204a4ad710d95d348ea006f14ba926e842ffd",
              "versionType": "git"
            },
            {
              "lessThan": "35fb4a0c077c5d1049c2628b769e0a1b1e65df0d",
              "status": "affected",
              "version": "0c2204a4ad710d95d348ea006f14ba926e842ffd",
              "versionType": "git"
            },
            {
              "lessThan": "868202aa2adae427060a42d5bd663b4d782ec02c",
              "status": "affected",
              "version": "0c2204a4ad710d95d348ea006f14ba926e842ffd",
              "versionType": "git"
            },
            {
              "lessThan": "d5ee2ff98322337951c56398e79d51815acbf955",
              "status": "affected",
              "version": "0c2204a4ad710d95d348ea006f14ba926e842ffd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/qrtr/ns.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: ns: Limit the maximum server registration per node\n\nCurrent code does no bound checking on the number of servers added per\nnode. A malicious client can flood NEW_SERVER messages and exhaust memory.\n\nFix this issue by limiting the maximum number of server registrations to\n256 per node. If the NEW_SERVER message is received for an old port, then\ndon\u0027t restrict it as it will get replaced. While at it, also rate limit\nthe error messages in the failure path of qrtr_ns_worker().\n\nNote that the limit of 256 is chosen based on the current platform\nrequirements. If requirement changes in the future, this limit can be\nincreased."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:27:59.057Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b48fc702b20233b809f01053232c3cd5083c97b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/991c431077b19176d3fe3bb54054c063776a8cdc"
        },
        {
          "url": "https://git.kernel.org/stable/c/94914731ca0b99899dceadd80d2df00584a688ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6f6cd501fb54060940a6eb3f4103eeb5e426ae7"
        },
        {
          "url": "https://git.kernel.org/stable/c/3efaad55cad1ded429e3a873bfece389058a526b"
        },
        {
          "url": "https://git.kernel.org/stable/c/35fb4a0c077c5d1049c2628b769e0a1b1e65df0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/868202aa2adae427060a42d5bd663b4d782ec02c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5ee2ff98322337951c56398e79d51815acbf955"
        }
      ],
      "title": "net: qrtr: ns: Limit the maximum server registration per node",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43491",
    "datePublished": "2026-05-19T10:44:23.832Z",
    "dateReserved": "2026-05-01T14:12:56.013Z",
    "dateUpdated": "2026-08-19T16:27:59.057Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/reflink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "73be4a08306bb84f4d5d16f62cb80e1543109ffa",
              "status": "affected",
              "version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
              "versionType": "git"
            },
            {
              "lessThan": "9a24f0000876b8755cf21972b41632f4d6f3dafb",
              "status": "affected",
              "version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
              "versionType": "git"
            },
            {
              "lessThan": "6f0f9c0a368aa1fe078109091322d3b0632d9380",
              "status": "affected",
              "version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
              "versionType": "git"
            },
            {
              "lessThan": "b48c980b6a7e409050bb3067165db31cc6205e3e",
              "status": "affected",
              "version": "05a5a7621ce66c142e081ffc24dd6ade6e912061",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/reflink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix deadlock between reflink and transaction commit when using flushoncommit\n\nWhen using the flushoncommit mount option, we can have a deadlock between\na transaction commit and a reflink operation that copied an inline extent\nto an offset beyond the current i_size of the destination node.\n\nThe deadlock happens like this:\n\n1) Task A clones an inline extent from inode X to an offset of inode Y\n   that is beyond Y\u0027s current i_size. This means we copied the inline\n   extent\u0027s data to a folio of inode Y that is beyond its EOF, using a\n   call to copy_inline_to_page();\n\n2) Task B starts a transaction commit and calls\n   btrfs_start_delalloc_flush() to flush delalloc;\n\n3) The delalloc flushing sees the new dirty folio of inode Y and when it\n   attempts to flush it, it ends up at extent_writepage() and sees that\n   the offset of the folio is beyond the i_size of inode Y, so it attempts\n   to invalidate the folio by calling folio_invalidate(), which ends up at\n   btrfs\u0027 folio invalidate callback - btrfs_invalidate_folio(). There it\n   tries to lock the folio\u0027s range in inode Y\u0027s extent io tree, but it\n   blocks since it\u0027s currently locked by task A - during a reflink we lock\n   the inodes and the source and destination ranges after flushing all\n   delalloc and waiting for ordered extent completion - after that we\n   don\u0027t expect to have dirty folios in the ranges, the exception is if\n   we have to copy an inline extent\u0027s data (because the destination offset\n   is not zero);\n\n4) Task A then attempts to start a transaction to update the inode item,\n   and then it\u0027s blocked since the current transaction is in the\n   TRANS_STATE_COMMIT_START state. Therefore task A has to wait for the\n   current transaction to become unblocked (its state \u003e=\n   TRANS_STATE_UNBLOCKED).\n\n   So task A is waiting for the transaction commit done by task B, and\n   the later waiting on the extent lock of inode Y that is currently\n   held by task A.\n\nSyzbot recently reported this with the following stack traces:\n\n  INFO: task kworker/u8:7:1053 blocked for more than 143 seconds.\n        Not tainted syzkaller #0\n  \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n  task:kworker/u8:7    state:D stack:23520 pid:1053  tgid:1053  ppid:2      task_flags:0x4208060 flags:0x00080000\n  Workqueue: writeback wb_workfn (flush-btrfs-46)\n  Call Trace:\n   \u003cTASK\u003e\n   context_switch kernel/sched/core.c:5298 [inline]\n   __schedule+0x1553/0x5240 kernel/sched/core.c:6911\n   __schedule_loop kernel/sched/core.c:6993 [inline]\n   schedule+0x164/0x360 kernel/sched/core.c:7008\n   wait_extent_bit fs/btrfs/extent-io-tree.c:811 [inline]\n   btrfs_lock_extent_bits+0x59c/0x700 fs/btrfs/extent-io-tree.c:1914\n   btrfs_lock_extent fs/btrfs/extent-io-tree.h:152 [inline]\n   btrfs_invalidate_folio+0x43d/0xc40 fs/btrfs/inode.c:7704\n   extent_writepage fs/btrfs/extent_io.c:1852 [inline]\n   extent_write_cache_pages fs/btrfs/extent_io.c:2580 [inline]\n   btrfs_writepages+0x12ff/0x2440 fs/btrfs/extent_io.c:2713\n   do_writepages+0x32e/0x550 mm/page-writeback.c:2554\n   __writeback_single_inode+0x133/0x11a0 fs/fs-writeback.c:1750\n   writeback_sb_inodes+0x995/0x19d0 fs/fs-writeback.c:2042\n   wb_writeback+0x456/0xb70 fs/fs-writeback.c:2227\n   wb_do_writeback fs/fs-writeback.c:2374 [inline]\n   wb_workfn+0x41a/0xf60 fs/fs-writeback.c:2414\n   process_one_work kernel/workqueue.c:3276 [inline]\n   process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359\n   worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440\n   kthread+0x388/0x470 kernel/kthread.c:436\n   ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158\n   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n   \u003c/TASK\u003e\n  INFO: task syz.4.64:6910 blocked for more than 143 seconds.\n        Not tainted syzkaller #0\n  \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n  task:syz.4.64        state:D stack:22752 pid:6910  tgid:\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-24T16:30:51.941Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/73be4a08306bb84f4d5d16f62cb80e1543109ffa"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a24f0000876b8755cf21972b41632f4d6f3dafb"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f0f9c0a368aa1fe078109091322d3b0632d9380"
        },
        {
          "url": "https://git.kernel.org/stable/c/b48c980b6a7e409050bb3067165db31cc6205e3e"
        }
      ],
      "title": "btrfs: fix deadlock between reflink and transaction commit when using flushoncommit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53122",
    "datePublished": "2026-06-24T16:30:51.941Z",
    "dateReserved": "2026-06-09T07:44:35.386Z",
    "dateUpdated": "2026-06-24T16:30:51.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/ip_options.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4cd6e9ed49347d3a2fdaaf07e32fb524756dddc2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2a87c3e8f03ce655ed0ef500d64d5fd924ec3691",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "89343ff12b3178fc236fe531a3603e7c97c68278",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "8ff85dbabbbfb05e86e6cde31d91ac5782179d4d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "00e8845fe3428c69e980dce5071cb3da1d8f7578",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "a4f3fd6516920988c47ba8d19714985c40c816a1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "28f5ad1b4055405eb1616e603fe511ba5e3725e7",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "d3915a1f5a4bc0ac911032903c3c6ab8df9fcc7c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/ip_options.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.94",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.36",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.13",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: restrict IPOPT_SSRR and IPOPT_LSRR options\n\nThis patch restricts setting Loose Source and Record Route (LSRR)\nand Strict Source and Record Route (SSRR) IP options to users\nwith CAP_NET_RAW capability.\n\nThis prevents unprivileged applications from forcing packets to route\nthrough attacker-controlled nodes to leak TCP ISN and possibly other\nprotocol information.\n\nWhile LSRR and SSRR are commonly filtered in many network environments,\nthey may still be supported and forwarded along some network paths.\n\nRFC 7126 (Recommendations on Filtering of IPv4 Packets Containing\nIPv4 Options) recommend to drop these options in 4.3 and 4.4."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T08:39:41.971Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4cd6e9ed49347d3a2fdaaf07e32fb524756dddc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a87c3e8f03ce655ed0ef500d64d5fd924ec3691"
        },
        {
          "url": "https://git.kernel.org/stable/c/89343ff12b3178fc236fe531a3603e7c97c68278"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ff85dbabbbfb05e86e6cde31d91ac5782179d4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/00e8845fe3428c69e980dce5071cb3da1d8f7578"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4f3fd6516920988c47ba8d19714985c40c816a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/28f5ad1b4055405eb1616e603fe511ba5e3725e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3915a1f5a4bc0ac911032903c3c6ab8df9fcc7c"
        }
      ],
      "title": "ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53249",
    "datePublished": "2026-06-25T08:39:41.971Z",
    "dateReserved": "2026-06-09T07:44:35.394Z",
    "dateUpdated": "2026-06-25T08:39:41.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2be11faf79e49fb8250a181ff0b4d2b2f084af83",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "ef6495d4df6e7af8f3de67e65150881c880f696c",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "15dc0a4de743a1aaa7b859b3aea79f08c695396c",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "b8c8a704f0bc133deb171f6aeb6f3a684203e212",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "b9561402489d41149f63e001a74384863b7b30a6",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "lessThan": "d62b8d236fab503c6fec1d3e9a38bea71feaca20",
              "status": "affected",
              "version": "76894f3e2f71177747b8b4763fb180e800279585",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2d046892a493d9760c35fdaefc3017f27f91b621",
              "versionType": "git"
            },
            {
              "lessThan": "6.1",
              "status": "affected",
              "version": "6.0.16",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.0.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: fix out-of-bounds read in symlink_data()\n\nSince smb2_check_message() returns success without length validation for\nthe symlink error response, in symlink_data() it is possible for\niov-\u003eiov_len to be smaller than sizeof(struct smb2_err_rsp). If the buffer\nonly contains the base SMB2 header (64 bytes), accessing\nerr-\u003eErrorContextCount (at offset 66) or err-\u003eByteCount later in\nsymlink_data() will cause an out-of-bounds read."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerability is in the SMB *client*, triggered by a crafted symlink error response from a remote (malicious, compromised, or MITM) SMB server over TCP/445; it processes attacker-controlled data from a remote network peer.\nAC:L - A malicious server can deterministically return a CREATE response with STATUS_STOPPED_ON_SYMLINK and len \u003c calc_len (e.g., only the 64-byte base header), reliably reaching symlink_data() with no race or attacker-uncontrolled condition.\nPR:N - The attacker is the remote SMB server; it requires no credentials or privileges on the victim client to send the malformed response, which is parsed during normal open/error handling.\nUI:N - Once a share is mounted (e.g., persistent fstab/autofs mount to a compromised or MITM\u0027d server), routine file access makes the server return the crafted symlink error with no additional victim action required per exploit.\nS:U - The out-of-bounds read stays within the client kernel\u0027s own memory and security authority; no privilege or sandbox boundary is crossed.\nC:H - An out-of-bounds read of adjacent kernel heap memory; in this same symlink-parse path (cf. CVE-2026-31613) OOB bytes are UTF-16-decoded into the symlink target and returned to userspace via readlink(2).\nI:N - The flaw is purely an out-of-bounds read of the error response buffer; it does not modify kernel memory.\nA:H - Reading past the message bounds can dereference invalid/unmapped memory and oops the client kernel, causing a denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:18.630Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2be11faf79e49fb8250a181ff0b4d2b2f084af83"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef6495d4df6e7af8f3de67e65150881c880f696c"
        },
        {
          "url": "https://git.kernel.org/stable/c/15dc0a4de743a1aaa7b859b3aea79f08c695396c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8c8a704f0bc133deb171f6aeb6f3a684203e212"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9561402489d41149f63e001a74384863b7b30a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d62b8d236fab503c6fec1d3e9a38bea71feaca20"
        }
      ],
      "title": "smb/client: fix out-of-bounds read in symlink_data()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46185",
    "datePublished": "2026-05-28T09:36:39.318Z",
    "dateReserved": "2026-05-13T15:03:33.103Z",
    "dateUpdated": "2026-08-05T12:30:18.630Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "kernel-rt",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-24T00:00:00.000Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the Linux kernel\u0027s Berkeley Packet Filter (BPF) verifier. When `ld_{abs,ind}` instructions are used in BPF subprograms, the verifier fails to correctly simulate the abnormal exit path if packet data loading fails. This oversight could lead to unexpected behavior or bypass of security checks within the BPF execution environment."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Moderate"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-253",
                "description": "Incorrect Check of Function Return Value",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T00:45:02.069Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-53090"
          },
          {
            "name": "RHBZ#2492305",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492305"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53090.json"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-24T00:00:00.000Z",
            "value": "Made public."
          }
        ],
        "title": "kernel: bpf: Fix ld_{abs,ind} failure path analysis in subprogs",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "928d354ae3557e8f755a227e67be88034eb3cd7f",
              "status": "affected",
              "version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
              "versionType": "git"
            },
            {
              "lessThan": "8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe",
              "status": "affected",
              "version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
              "versionType": "git"
            },
            {
              "lessThan": "de1055e7f9e67af32b1f3376066272b04e5223c0",
              "status": "affected",
              "version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
              "versionType": "git"
            },
            {
              "lessThan": "37ad2bb11e9de92cb7b94548705eeedd87f7d392",
              "status": "affected",
              "version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
              "versionType": "git"
            },
            {
              "lessThan": "8674e2db06cff6b50f2216eed9a761d15425bb34",
              "status": "affected",
              "version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
              "versionType": "git"
            },
            {
              "lessThan": "ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337",
              "status": "affected",
              "version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
              "versionType": "git"
            },
            {
              "lessThan": "d846d83bdacbd8f14fc45c63b8c1d22608452e1c",
              "status": "affected",
              "version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
              "versionType": "git"
            },
            {
              "lessThan": "ee861486e377edc55361c08dcbceab3f6b6577bd",
              "status": "affected",
              "version": "09b28d76eac48e922dc293da1aa2b2b85c32aeee",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix ld_{abs,ind} failure path analysis in subprogs\n\nUsage of ld_{abs,ind} instructions got extended into subprogs some time\nago via commit 09b28d76eac4 (\"bpf: Add abnormal return checks.\"). These\nare only allowed in subprograms when the latter are BTF annotated and\nhave scalar return types.\n\nThe code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 +\nexit) from legacy cBPF times. While the enforcement is on scalar return\ntypes, the verifier must also simulate the path of abnormal exit if the\npacket data load via ld_{abs,ind} failed.\n\nThis is currently not the case. Fix it by having the verifier simulate\nboth success and failure paths, and extend it in similar ways as we do\nfor tail calls. The success path (r0=unknown, continue to next insn) is\npushed onto stack for later validation and the r0=0 and return to the\ncaller is done on the fall-through side."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker must locally invoke the bpf() syscall to load a crafted BPF program; packets only trigger the already-loaded malicious program path.\nAC:L - The attacker controls the BPF bytecode, BTF annotations, and packet length needed to force the ld_abs/ld_ind failure path, with no race or external timing dependency.\nPR:L - The needed subprogram/BTF path requires CAP_BPF-equivalent BPF loading privileges, but BPF tokens can delegate these checks into a user namespace. Under the higher-severity rule, this is Low rather than High.\nUI:N - No victim action is required after the local attacker loads and triggers the crafted BPF program.\nS:U - The vulnerability compromises kernel execution within the same host security authority; it is standard local kernel privilege escalation, not a VM or hardware boundary escape.\nC:H - This is a verifier bypass where an unmodeled runtime path can execute code the verifier considered unreachable, enabling unsafe register and pointer use. Such BPF verifier bypasses can be developed into arbitrary kernel memory disclosure.\nI:H - The same unverified runtime path can be shaped into unsafe memory operations, making arbitrary kernel memory write or code execution defensible.\nA:H - Even without full exploitation, executing verifier-unchecked BPF operations can crash or panic the kernel, and the attacker can repeatedly trigger the path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:28:06.530Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/928d354ae3557e8f755a227e67be88034eb3cd7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a800497d9f6c2ec9c2c1ba7b71d0ac2ea7f7bbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/de1055e7f9e67af32b1f3376066272b04e5223c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/37ad2bb11e9de92cb7b94548705eeedd87f7d392"
        },
        {
          "url": "https://git.kernel.org/stable/c/8674e2db06cff6b50f2216eed9a761d15425bb34"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce01a4e5cfac7adbe0be565f90cd32ecbb2f8337"
        },
        {
          "url": "https://git.kernel.org/stable/c/d846d83bdacbd8f14fc45c63b8c1d22608452e1c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee861486e377edc55361c08dcbceab3f6b6577bd"
        }
      ],
      "title": "bpf: Fix ld_{abs,ind} failure path analysis in subprogs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53090",
    "datePublished": "2026-06-24T16:30:29.413Z",
    "dateReserved": "2026-06-09T07:44:35.384Z",
    "dateUpdated": "2026-08-19T16:28:06.530Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/virtio_transport_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2ea5d2c79edcc99c7dbe0bb7518f5e1ee2a2391f",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "fd51e810affa38d735d04261e673b2a5fe9c8665",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "f66c7904fb6f0e420a654bc90909e64a25d00896",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "65c484726e74013a2ec7ba67a34d87760ae8f390",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "29371f3cc83e2a92265b4768014a30b80234112f",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "e9edf9893cf26d060705c910a9b62d8cc96ed56a",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "6d3275fc4ed968938e1d556c344798046776668d",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            },
            {
              "lessThan": "52bcb57a4e8a0865a76c587c2451906342ae1b2d",
              "status": "affected",
              "version": "c0cfa2d8a788fcf45df5bf4070ab2474c88d543a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/virtio_transport_common.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.32",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.90",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.32",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.9",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: fix accept queue count leak on transport mismatch\n\nvirtio_transport_recv_listen() calls sk_acceptq_added() before\nvsock_assign_transport(). If vsock_assign_transport() fails or\nselects a different transport, the error path returns without\ncalling sk_acceptq_removed(), permanently incrementing\nsk_ack_backlog.\n\nAfter approximately backlog+1 such failures, sk_acceptq_is_full()\nreturns true, causing the listener to reject all new connections.\n\nFix by moving sk_acceptq_added() to after the transport validation,\nmatching the pattern used by vmci_transport and hyperv_transport."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T18:03:15.809Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2ea5d2c79edcc99c7dbe0bb7518f5e1ee2a2391f"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd51e810affa38d735d04261e673b2a5fe9c8665"
        },
        {
          "url": "https://git.kernel.org/stable/c/f66c7904fb6f0e420a654bc90909e64a25d00896"
        },
        {
          "url": "https://git.kernel.org/stable/c/65c484726e74013a2ec7ba67a34d87760ae8f390"
        },
        {
          "url": "https://git.kernel.org/stable/c/29371f3cc83e2a92265b4768014a30b80234112f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9edf9893cf26d060705c910a9b62d8cc96ed56a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d3275fc4ed968938e1d556c344798046776668d"
        },
        {
          "url": "https://git.kernel.org/stable/c/52bcb57a4e8a0865a76c587c2451906342ae1b2d"
        }
      ],
      "title": "vsock/virtio: fix accept queue count leak on transport mismatch",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46214",
    "datePublished": "2026-05-28T09:40:31.245Z",
    "dateReserved": "2026-05-13T15:03:33.105Z",
    "dateUpdated": "2026-06-14T18:03:15.809Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/array.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fefa0fcd78be465b7ad4c497fa6ec90d64194c04",
              "status": "affected",
              "version": "06fffb1267c9d986687b69d74a46ee332a50575e",
              "versionType": "git"
            },
            {
              "lessThan": "c93a33f28f915d446eea6fb3f0e1def0b3af1982",
              "status": "affected",
              "version": "06fffb1267c9d986687b69d74a46ee332a50575e",
              "versionType": "git"
            },
            {
              "lessThan": "1c8dc5b5517546c68ffae40b948336122bb61306",
              "status": "affected",
              "version": "06fffb1267c9d986687b69d74a46ee332a50575e",
              "versionType": "git"
            },
            {
              "lessThan": "0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e",
              "status": "affected",
              "version": "06fffb1267c9d986687b69d74a46ee332a50575e",
              "versionType": "git"
            },
            {
              "lessThan": "73ec7c96601d61d52310c659145bb06d933a0fa6",
              "status": "affected",
              "version": "06fffb1267c9d986687b69d74a46ee332a50575e",
              "versionType": "git"
            },
            {
              "lessThan": "4f9ae386861e280b7631ca252f798d25575627ee",
              "status": "affected",
              "version": "06fffb1267c9d986687b69d74a46ee332a50575e",
              "versionType": "git"
            },
            {
              "lessThan": "dd8b13cb4ff1a4545a214ed897fdf2bc341155b6",
              "status": "affected",
              "version": "06fffb1267c9d986687b69d74a46ee332a50575e",
              "versionType": "git"
            },
            {
              "lessThan": "76149d53502cf17ef3ae454ff384551236fba867",
              "status": "affected",
              "version": "06fffb1267c9d986687b69d74a46ee332a50575e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/proc/array.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.26"
            },
            {
              "lessThan": "2.6.26",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nprocfs: fix missing RCU protection when reading real_parent in do_task_stat()\n\nWhen reading /proc/[pid]/stat, do_task_stat() accesses task-\u003ereal_parent\nwithout proper RCU protection, which leads to:\n\n  cpu 0                               cpu 1\n  -----                               -----\n  do_task_stat\n    var = task-\u003ereal_parent\n                                      release_task\n                                        call_rcu(delayed_put_task_struct)\n    task_tgid_nr_ns(var)\n      rcu_read_lock   \u003c--- Too late to protect task-\u003ereal_parent!\n      task_pid_ptr    \u003c--- UAF!\n      rcu_read_unlock\n\nThis patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add\nproper RCU protection for accessing task-\u003ereal_parent."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local `open()`/`read()` on procfs (`/proc/[pid]/stat` or thread `stat`); there is no network, adjacent-radio, or physical-device path to `do_task_stat()`.\nAC:L - An attacker can reliably race by running concurrent `read()` loops on `/proc/child/stat` while another thread exits and reaps the parent via `wait4()`, controlling both sides of the `release_task()`/`call_rcu()` window.\nPR:L - Triggering the bug needs only an unprivileged local account that can read procfs (default `hidepid=off` allows reading other users\u2019 `stat`); no real root or init-namespace-only capability is required.\nUI:N - Exploitation is fully attacker-driven through syscalls and process lifecycle control; no victim user action (clicks, mounts, etc.) is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security domain, not a cross-boundary escape such as VM guest-to-host.\nC:H - The UAF dereferences freed `task_struct` memory via `task_pid_ptr()`/`__task_pid_nr_ns()`, enabling disclosure of stale slab contents and kernel pointers that can be groomed into an arbitrary-read primitive.\nI:H - Use-after-free on a `task_struct` slab object can be leveraged with heap grooming for control of freed memory and potential arbitrary write or code execution, not merely a bounded or cosmetic change.\nA:H - Concurrent UAF access to a freed parent `task_struct` can cause kernel oops/panic (KASAN reports slab-use-after-free class failures) even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:30:48.120Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fefa0fcd78be465b7ad4c497fa6ec90d64194c04"
        },
        {
          "url": "https://git.kernel.org/stable/c/c93a33f28f915d446eea6fb3f0e1def0b3af1982"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c8dc5b5517546c68ffae40b948336122bb61306"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/73ec7c96601d61d52310c659145bb06d933a0fa6"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f9ae386861e280b7631ca252f798d25575627ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd8b13cb4ff1a4545a214ed897fdf2bc341155b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/76149d53502cf17ef3ae454ff384551236fba867"
        }
      ],
      "title": "procfs: fix missing RCU protection when reading real_parent in do_task_stat()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46259",
    "datePublished": "2026-06-03T15:49:56.428Z",
    "dateReserved": "2026-05-13T15:03:33.108Z",
    "dateUpdated": "2026-08-05T12:30:48.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/auth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9ded62c302c0342efdb5eda3bf6e75720caad0df",
              "status": "affected",
              "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
              "versionType": "git"
            },
            {
              "lessThan": "f101271fcf55d7eacfefd610b51ec65f46ba8118",
              "status": "affected",
              "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
              "versionType": "git"
            },
            {
              "lessThan": "4b2738b93edad661178340239de657d876b73d3d",
              "status": "affected",
              "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
              "versionType": "git"
            },
            {
              "lessThan": "927e4bd5692f2a4901808822981fb2c8d4456548",
              "status": "affected",
              "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
              "versionType": "git"
            },
            {
              "lessThan": "016bc663657366d386993f63eb31072eb45a2b77",
              "status": "affected",
              "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
              "versionType": "git"
            },
            {
              "lessThan": "8f2be7285941a33a9f72579a23b96392f83c758e",
              "status": "affected",
              "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
              "versionType": "git"
            },
            {
              "lessThan": "5199c125d25aeae8615c4fc31652cc0fe624338e",
              "status": "affected",
              "version": "4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ceph/auth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.86",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()\n\nIf a message of type CEPH_MSG_AUTH_REPLY contains a zero value for both\nprotocol and result, this is currently not treated as an error. In case\nof ac-\u003enegotiating == true and ac-\u003eprotocol \u003e 0, this leads to setting\nac-\u003eprotocol = 0 and ac-\u003eops = NULL. Thereafter, the check for\nac-\u003eprotocol != protocol returns false, and init_protocol() is not\ncalled. Subsequently, ac-\u003eops-\u003ehandle_reply() is called, which leads to\na null pointer dereference, because ac-\u003eops is still NULL.\n\nThis patch changes the check for ac-\u003eprotocol != protocol to\n!ac-\u003eprotocol, as this also includes the case when the protocol was set\nto zero in the message. This causes the message to be treated as\ncontaining a bad auth protocol."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code processes a CEPH_MSG_AUTH_REPLY received from a remote Ceph monitor over TCP; the libceph client reaches monitors across routed networks, so the attacker (rogue monitor or MITM) operates remotely.\nAC:L - The attacker fully controls the reply message contents and sends protocol=0/result=0 during the negotiation it controls; the crash is deterministic with no race or unobservable memory-layout dependency.\nPR:N - The crafted reply is processed during the authentication handshake before the monitor\u0027s identity is verified, and a remote server/MITM needs no privileges on the victim client.\nUI:N - Once a CephFS/RBD client is connected, monitor connections and reconnections (and the negotiation state) occur automatically, so no user action is required at attack time.\nS:U - The crash occurs within the kernel itself with no crossing of a security boundary into another authority such as a hypervisor or other VM.\nC:N - A NULL pointer dereference yields no information disclosure; no attacker-controlled memory is read or leaked.\nI:N - The NULL dereference does not modify any kernel data and provides no write primitive.\nA:H - Dereferencing the NULL ac-\u003eops triggers a kernel oops/panic, crashing the system \u2014 a remote denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:11.187Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9ded62c302c0342efdb5eda3bf6e75720caad0df"
        },
        {
          "url": "https://git.kernel.org/stable/c/f101271fcf55d7eacfefd610b51ec65f46ba8118"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b2738b93edad661178340239de657d876b73d3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/927e4bd5692f2a4901808822981fb2c8d4456548"
        },
        {
          "url": "https://git.kernel.org/stable/c/016bc663657366d386993f63eb31072eb45a2b77"
        },
        {
          "url": "https://git.kernel.org/stable/c/8f2be7285941a33a9f72579a23b96392f83c758e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5199c125d25aeae8615c4fc31652cc0fe624338e"
        }
      ],
      "title": "libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46024",
    "datePublished": "2026-05-27T12:56:29.932Z",
    "dateReserved": "2026-05-13T15:03:33.093Z",
    "dateUpdated": "2026-08-05T12:29:11.187Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ppp/ppp_generic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c9edd90c57ae23692fff6b049fdfa4572a9fd532",
              "status": "affected",
              "version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
              "versionType": "git"
            },
            {
              "lessThan": "5080e188c914110034bbc569d5cfa2f06204681d",
              "status": "affected",
              "version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
              "versionType": "git"
            },
            {
              "lessThan": "67e901e28d177ac9a9bed76d69ce3471e704a89e",
              "status": "affected",
              "version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
              "versionType": "git"
            },
            {
              "lessThan": "954745d0223e7caec917c0b2d1a889ff56fa6e54",
              "status": "affected",
              "version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
              "versionType": "git"
            },
            {
              "lessThan": "3b2c2157dc2afc5c17cd7238afefca92f1ef330e",
              "status": "affected",
              "version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
              "versionType": "git"
            },
            {
              "lessThan": "5013be175c7ffd8b39efbc3c9c4db5b10b85fea8",
              "status": "affected",
              "version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
              "versionType": "git"
            },
            {
              "lessThan": "1a8a51ce85075a56a743b6f142606dd2696a391c",
              "status": "affected",
              "version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
              "versionType": "git"
            },
            {
              "lessThan": "2bb6379416fd19f44c3423a00bfd8626259f6067",
              "status": "affected",
              "version": "273ec51dd7ceaa76e038875d85061ec856d8905e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ppp/ppp_generic.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nppp: require CAP_NET_ADMIN in target netns for unattached ioctls\n\n/dev/ppp open is currently authorized against file-\u003ef_cred-\u003euser_ns,\nwhile unattached administrative ioctls operate on current-\u003ensproxy-\u003enet_ns.\n\nAs a result, a local unprivileged user can create a new user namespace\nwith CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,\nand still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against\nan inherited network namespace.\n\nRequire CAP_NET_ADMIN in the user namespace that owns the target network\nnamespace before handling unattached PPP administrative ioctls.\n\nThis preserves normal pppd operation in the network namespace it is\nactually privileged in, while rejecting the userns-only inherited-netns\ncase."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable PPP administrative ioctls are reached locally through `/dev/ppp` and the `ioctl` syscall, not by remote packets.\nAC:L - An attacker can deterministically create a user namespace, open `/dev/ppp`, and issue the unattached ioctls against the inherited target network namespace; no race or external condition is required.\nPR:L - A basic unprivileged local user can gain `CAP_NET_ADMIN` only inside a new user namespace and abuse the pre-fix check, so this does not require real root or host `CAP_NET_ADMIN`.\nUI:N - No victim action is required after the attacker has local code execution; the attacker directly invokes the namespace and ioctl operations.\nS:C - The bug crosses the user-namespace capability boundary by allowing capabilities in one user namespace to administer PPP resources in a network namespace owned by another user namespace.\nC:H - By attaching to existing PPP units or channels, an attacker can read PPP control/authentication traffic and can plausibly expose sensitive PPP-session data in affected deployments.\nI:H - The attacker can create PPP interfaces, attach to units/channels, alter PPP parameters, and inject or redirect PPP frames in a network namespace they should not administer.\nA:H - The attacker can disrupt PPP connectivity by changing interface/channel state, disconnecting or bridging channels, or exhausting PPP resources, causing loss of network availability in PPP-dependent systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:07.985Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c9edd90c57ae23692fff6b049fdfa4572a9fd532"
        },
        {
          "url": "https://git.kernel.org/stable/c/5080e188c914110034bbc569d5cfa2f06204681d"
        },
        {
          "url": "https://git.kernel.org/stable/c/67e901e28d177ac9a9bed76d69ce3471e704a89e"
        },
        {
          "url": "https://git.kernel.org/stable/c/954745d0223e7caec917c0b2d1a889ff56fa6e54"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b2c2157dc2afc5c17cd7238afefca92f1ef330e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5013be175c7ffd8b39efbc3c9c4db5b10b85fea8"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a8a51ce85075a56a743b6f142606dd2696a391c"
        },
        {
          "url": "https://git.kernel.org/stable/c/2bb6379416fd19f44c3423a00bfd8626259f6067"
        }
      ],
      "title": "ppp: require CAP_NET_ADMIN in target netns for unattached ioctls",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53075",
    "datePublished": "2026-06-24T16:30:16.214Z",
    "dateReserved": "2026-06-09T07:44:35.383Z",
    "dateUpdated": "2026-08-05T12:33:07.985Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7925/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "153bcba36c87a1ba555b57b6c49028d5812f895b",
              "status": "affected",
              "version": "45064d19fd3af6aeb0887b35b5564927980cf150",
              "versionType": "git"
            },
            {
              "lessThan": "2d8e0053bca29143ace51e08c980ff076844a4b0",
              "status": "affected",
              "version": "45064d19fd3af6aeb0887b35b5564927980cf150",
              "versionType": "git"
            },
            {
              "lessThan": "dd08ca3f092f4185ece69ce2a835c23198b1628a",
              "status": "affected",
              "version": "45064d19fd3af6aeb0887b35b5564927980cf150",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "978d1756b3ae1b857826eb7ed8181f3c5180dce9",
              "versionType": "git"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/mediatek/mt76/mt7925/main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync\n\nroc_abort_sync() can deadlock with roc_work(). roc_work() holds\ndev-\u003emt76.mutex, while cancel_work_sync() waits for roc_work()\nto finish. If the caller already owns the same mutex, both\nsides block and no progress is possible.\n\nThis deadlock can occur during station removal when\nmt76_sta_state() -\u003e mt76_sta_remove() -\u003e\nmt7925_mac_sta_remove_link() -\u003e mt7925_mac_link_sta_remove() -\u003e\nmt7925_roc_abort_sync() invokes cancel_work_sync() while\nroc_work() is still running and holding dev-\u003emt76.mutex.\n\nThis avoids the mutex deadlock and preserves exactly-once\nwork ownership."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-24T16:30:39.184Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/153bcba36c87a1ba555b57b6c49028d5812f895b"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d8e0053bca29143ace51e08c980ff076844a4b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd08ca3f092f4185ece69ce2a835c23198b1628a"
        }
      ],
      "title": "wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53103",
    "datePublished": "2026-06-24T16:30:39.184Z",
    "dateReserved": "2026-06-09T07:44:35.385Z",
    "dateUpdated": "2026-06-24T16:30:39.184Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5d0fb9806ab6cf2c3cfba0e1b8c701da65e25af8",
              "status": "affected",
              "version": "1284cd3a2b740d0118458d2ea470a1e5bc19b187",
              "versionType": "git"
            },
            {
              "lessThan": "9baf26a91565b7bb2b1d9f99aaf884a2b28c2f6d",
              "status": "affected",
              "version": "1284cd3a2b740d0118458d2ea470a1e5bc19b187",
              "versionType": "git"
            },
            {
              "lessThan": "6ac890f1d60ac3707ee8dae15a67d9a833e49956",
              "status": "affected",
              "version": "1284cd3a2b740d0118458d2ea470a1e5bc19b187",
              "versionType": "git"
            },
            {
              "lessThan": "95597d11dc8bddb2b9a051c9232000bfbb5e43ba",
              "status": "affected",
              "version": "1284cd3a2b740d0118458d2ea470a1e5bc19b187",
              "versionType": "git"
            },
            {
              "lessThan": "950803f7254721c1c15858fbbfae3deaaeeecb11",
              "status": "affected",
              "version": "1284cd3a2b740d0118458d2ea470a1e5bc19b187",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.19",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.9",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: fix type confusion in bond_setup_by_slave()\n\nkernel BUG at net/core/skbuff.c:2306!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbuff.c:2306\nRSP: 0018:ffffc90004aff760 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffff88807e3c8780 RCX: ffffffff89593e0e\nRDX: ffff88807b7c4900 RSI: ffffffff89594747 RDI: ffff88807b7c4900\nRBP: 0000000000000820 R08: 0000000000000005 R09: 0000000000000000\nR10: 00000000961a63e0 R11: 0000000000000000 R12: ffff88807e3c8780\nR13: 00000000961a6560 R14: dffffc0000000000 R15: 00000000961a63e0\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fe1a0ed8df0 CR3: 000000002d816000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n ipgre_header+0xdd/0x540 net/ipv4/ip_gre.c:900\n dev_hard_header include/linux/netdevice.h:3439 [inline]\n packet_snd net/packet/af_packet.c:3028 [inline]\n packet_sendmsg+0x3ae5/0x53c0 net/packet/af_packet.c:3108\n sock_sendmsg_nosec net/socket.c:727 [inline]\n __sock_sendmsg net/socket.c:742 [inline]\n ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592\n ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646\n __sys_sendmsg+0x170/0x220 net/socket.c:2678\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fe1a0e6c1a9\n\nWhen a non-Ethernet device (e.g. GRE tunnel) is enslaved to a bond,\nbond_setup_by_slave() directly copies the slave\u0027s header_ops to the\nbond device:\n\n    bond_dev-\u003eheader_ops = slave_dev-\u003eheader_ops;\n\nThis causes a type confusion when dev_hard_header() is later called\non the bond device. Functions like ipgre_header(), ip6gre_header(),all use\nnetdev_priv(dev) to access their device-specific private data. When\ncalled with the bond device, netdev_priv() returns the bond\u0027s private\ndata (struct bonding) instead of the expected type (e.g. struct\nip_tunnel), leading to garbage values being read and kernel crashes.\n\nFix this by introducing bond_header_ops with wrapper functions that\ndelegate to the active slave\u0027s header_ops using the slave\u0027s own\ndevice. This ensures netdev_priv() in the slave\u0027s header functions\nalways receives the correct device.\n\nThe fix is placed in the bonding driver rather than individual device\ndrivers, as the root cause is bond blindly inheriting header_ops from\nthe slave without considering that these callbacks expect a specific\nnetdev_priv() layout.\n\nThe type confusion can be observed by adding a printk in\nipgre_header() and running the following commands:\n\n    ip link add dummy0 type dummy\n    ip addr add 10.0.0.1/24 dev dummy0\n    ip link set dummy0 up\n    ip link add gre1 type gre local 10.0.0.1\n    ip link add bond1 type bond mode active-backup\n    ip link set gre1 master bond1\n    ip link set gre1 up\n    ip link set bond1 up\n    ip addr add fe80::1/64 dev bond1"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached through local rtnetlink/AF_PACKET operations: creating/enslaving a non-Ethernet slave to a bond and then causing `dev_hard_header()` on the bond device. Remote packets are not sufficient without the vulnerable local device configuration.\nAC:L - No race or special external timing is required; the attacker can deterministically create the bond/GRE setup and trigger the confused header callback. Required modules/configuration are common and autoloadable through rtnetlink in normal deployments.\nPR:L - The setup requires `CAP_NET_ADMIN` and the AF_PACKET trigger requires `CAP_NET_RAW`, but both are obtainable by an unprivileged local user inside a user/network namespace. Therefore this is low privilege rather than real init-namespace root only.\nUI:N - Exploitation does not require a victim user to perform an action. The attacker can perform the setup and trigger locally.\nS:U - The impact is within the kernel security authority on the same system. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug is kernel type confusion where bonding private data is interpreted as another device\u0027s private structure, and the confused callback can read kernel data using the wrong layout. Following the required higher-severity rule for type confusion, confidentiality impact is High.\nI:H - The confused header callback uses bogus private-data fields to construct and push protocol headers into an skb, making this a kernel memory/type confusion condition rather than a pure NULL dereference. Type confusion is scored as High integrity impact.\nA:H - The reported failure is a kernel BUG/oops in `pskb_expand_head()` reachable through the confused `ipgre_header()` call. This provides a reliable local kernel crash/DoS."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:03.247Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5d0fb9806ab6cf2c3cfba0e1b8c701da65e25af8"
        },
        {
          "url": "https://git.kernel.org/stable/c/9baf26a91565b7bb2b1d9f99aaf884a2b28c2f6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ac890f1d60ac3707ee8dae15a67d9a833e49956"
        },
        {
          "url": "https://git.kernel.org/stable/c/95597d11dc8bddb2b9a051c9232000bfbb5e43ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/950803f7254721c1c15858fbbfae3deaaeeecb11"
        }
      ],
      "title": "bonding: fix type confusion in bond_setup_by_slave()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43456",
    "datePublished": "2026-05-08T14:22:20.036Z",
    "dateReserved": "2026-05-01T14:12:56.010Z",
    "dateUpdated": "2026-08-05T12:28:03.247Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}