Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-0981
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à l'intégrité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian trixie versions ant\u00e9rieures \u00e0 6.12.100-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-64552",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64552"
},
{
"name": "CVE-2026-64287",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64287"
},
{
"name": "CVE-2026-64538",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64538"
},
{
"name": "CVE-2026-64192",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64192"
},
{
"name": "CVE-2026-64461",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64461"
},
{
"name": "CVE-2026-64542",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64542"
},
{
"name": "CVE-2026-64413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64413"
},
{
"name": "CVE-2026-64510",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64510"
},
{
"name": "CVE-2026-64405",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64405"
},
{
"name": "CVE-2026-64531",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64531"
},
{
"name": "CVE-2026-53260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53260"
},
{
"name": "CVE-2026-53365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53365"
},
{
"name": "CVE-2026-64550",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64550"
},
{
"name": "CVE-2026-64557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64557"
},
{
"name": "CVE-2026-64508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64508"
},
{
"name": "CVE-2026-64438",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64438"
},
{
"name": "CVE-2026-64462",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64462"
},
{
"name": "CVE-2026-64421",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64421"
},
{
"name": "CVE-2026-64341",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64341"
},
{
"name": "CVE-2026-64534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64534"
},
{
"name": "CVE-2026-64364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64364"
},
{
"name": "CVE-2026-64553",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64553"
},
{
"name": "CVE-2026-64363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64363"
},
{
"name": "CVE-2026-64375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64375"
},
{
"name": "CVE-2026-64546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64546"
},
{
"name": "CVE-2026-64488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64488"
},
{
"name": "CVE-2026-64371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64371"
},
{
"name": "CVE-2026-64539",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64539"
},
{
"name": "CVE-2026-64551",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64551"
},
{
"name": "CVE-2026-64554",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64554"
},
{
"name": "CVE-2026-64401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64401"
},
{
"name": "CVE-2026-64533",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64533"
},
{
"name": "CVE-2026-64541",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64541"
},
{
"name": "CVE-2026-64549",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64549"
},
{
"name": "CVE-2026-63970",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63970"
},
{
"name": "CVE-2026-64559",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64559"
},
{
"name": "CVE-2026-64544",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64544"
},
{
"name": "CVE-2026-64352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64352"
},
{
"name": "CVE-2026-64555",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64555"
},
{
"name": "CVE-2026-64472",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64472"
},
{
"name": "CVE-2026-64509",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64509"
},
{
"name": "CVE-2026-64307",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64307"
},
{
"name": "CVE-2026-64545",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64545"
},
{
"name": "CVE-2026-64227",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64227"
},
{
"name": "CVE-2026-64481",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64481"
},
{
"name": "CVE-2026-53005",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-53005"
},
{
"name": "CVE-2026-64540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64540"
},
{
"name": "CVE-2026-64434",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64434"
},
{
"name": "CVE-2026-64558",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64558"
},
{
"name": "CVE-2026-45944",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45944"
},
{
"name": "CVE-2026-64286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64286"
},
{
"name": "CVE-2026-64537",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64537"
},
{
"name": "CVE-2026-64361",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64361"
},
{
"name": "CVE-2026-64369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64369"
},
{
"name": "CVE-2026-64547",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64547"
},
{
"name": "CVE-2026-64543",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64543"
},
{
"name": "CVE-2026-64206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64206"
},
{
"name": "CVE-2026-64530",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64530"
},
{
"name": "CVE-2026-64560",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64560"
},
{
"name": "CVE-2026-64493",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64493"
},
{
"name": "CVE-2026-64535",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64535"
},
{
"name": "CVE-2026-64416",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64416"
},
{
"name": "CVE-2026-64548",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64548"
},
{
"name": "CVE-2026-64532",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64532"
},
{
"name": "CVE-2026-64428",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64428"
},
{
"name": "CVE-2026-64507",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64507"
},
{
"name": "CVE-2026-64390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64390"
},
{
"name": "CVE-2026-64441",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64441"
}
],
"initial_release_date": "2026-08-07T00:00:00",
"last_revision_date": "2026-08-07T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0981",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-07T00:00:00.000000"
}
],
"risks": [
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian",
"vendor_advisories": [
{
"published_at": "2026-07-31",
"title": "Bulletin de s\u00e9curit\u00e9 Debian msg00316",
"url": "https://lists.debian.org/debian-security-announce/2026/msg00316.html"
}
]
}
CVE-2026-64206 (GCVE-0-2026-64206)
Vulnerability from cvelistv5
Published
2026-07-20 16:27
Modified
2026-08-17 04:51
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
l2cap_conn_del() takes conn->lock and then calls cancel_work_sync() for
pending_rx_work. process_pending_rx() takes the same mutex, so teardown
can deadlock against the worker it is flushing.
This issue was found by our static analysis tool and then manually
reviewed against the current tree.
The grounded PoC kept the l2cap_conn_ready() -> queue_work(...,
&conn->pending_rx_work) submit path, the l2cap_conn_del() ->
cancel_work_sync(&conn->pending_rx_work) teardown path, and the
process_pending_rx() -> mutex_lock(&conn->lock) worker edge. Lockdep
WARNING: possible circular locking dependency detected
process_pending_rx+0x21/0x2a [vuln_msv]
l2cap_conn_del.constprop.0+0x3f/0x4e [vuln_msv]
*** DEADLOCK ***
Cancel pending_rx_work before taking conn->lock, matching the existing
lock-before-drain ordering used for the two delayed works in the same
teardown path. The pending_rx queue is still purged after the work has
been cancelled and conn->lock has been acquired.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7ab56c3a6eccb215034b0cb096e0313441cbf2a4 Version: 7ab56c3a6eccb215034b0cb096e0313441cbf2a4 Version: 7ab56c3a6eccb215034b0cb096e0313441cbf2a4 Version: 7ab56c3a6eccb215034b0cb096e0313441cbf2a4 Version: 7ab56c3a6eccb215034b0cb096e0313441cbf2a4 Version: 7ab56c3a6eccb215034b0cb096e0313441cbf2a4 Version: 7ab56c3a6eccb215034b0cb096e0313441cbf2a4 Version: 7ab56c3a6eccb215034b0cb096e0313441cbf2a4 Version: ee805f9499ebd0edf0877990968543c752043b59 Version: 3.15.5 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fc0c3b9cf27cfa2a06f66dae1d08c668fe0a2faa",
"status": "affected",
"version": "7ab56c3a6eccb215034b0cb096e0313441cbf2a4",
"versionType": "git"
},
{
"lessThan": "9901f847a762a5d953871dd95767ce2aed3d684d",
"status": "affected",
"version": "7ab56c3a6eccb215034b0cb096e0313441cbf2a4",
"versionType": "git"
},
{
"lessThan": "4a0bb0fd63fe2b0c62e1072cd1811d6f61e0081c",
"status": "affected",
"version": "7ab56c3a6eccb215034b0cb096e0313441cbf2a4",
"versionType": "git"
},
{
"lessThan": "8daaf7f73fe998631a160d1a5a7e1b0b0480eef8",
"status": "affected",
"version": "7ab56c3a6eccb215034b0cb096e0313441cbf2a4",
"versionType": "git"
},
{
"lessThan": "8de7b386ffad480ca59222b688c94a2da8f0d805",
"status": "affected",
"version": "7ab56c3a6eccb215034b0cb096e0313441cbf2a4",
"versionType": "git"
},
{
"lessThan": "d5616beb3355b5fca2280d796c1cf7ada4ee6551",
"status": "affected",
"version": "7ab56c3a6eccb215034b0cb096e0313441cbf2a4",
"versionType": "git"
},
{
"lessThan": "e96fbac8d3a73b0bc165383c092a30628561d320",
"status": "affected",
"version": "7ab56c3a6eccb215034b0cb096e0313441cbf2a4",
"versionType": "git"
},
{
"lessThan": "2641a9e0a1dd4af2e21995470a21d55dd35e5203",
"status": "affected",
"version": "7ab56c3a6eccb215034b0cb096e0313441cbf2a4",
"versionType": "git"
},
{
"status": "affected",
"version": "ee805f9499ebd0edf0877990968543c752043b59",
"versionType": "git"
},
{
"lessThan": "3.16",
"status": "affected",
"version": "3.15.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.15.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: cancel pending_rx_work before taking conn-\u003elock\n\nl2cap_conn_del() takes conn-\u003elock and then calls cancel_work_sync() for\npending_rx_work. process_pending_rx() takes the same mutex, so teardown\ncan deadlock against the worker it is flushing.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the l2cap_conn_ready() -\u003e queue_work(...,\n\u0026conn-\u003epending_rx_work) submit path, the l2cap_conn_del() -\u003e\ncancel_work_sync(\u0026conn-\u003epending_rx_work) teardown path, and the\nprocess_pending_rx() -\u003e mutex_lock(\u0026conn-\u003elock) worker edge. Lockdep\n\n WARNING: possible circular locking dependency detected\n process_pending_rx+0x21/0x2a [vuln_msv]\n l2cap_conn_del.constprop.0+0x3f/0x4e [vuln_msv]\n *** DEADLOCK ***\n\nCancel pending_rx_work before taking conn-\u003elock, matching the existing\nlock-before-drain ordering used for the two delayed works in the same\nteardown path. The pending_rx queue is still purged after the work has\nbeen cancelled and conn-\u003elock has been acquired."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - A nearby Bluetooth peer can reach the flaw by establishing an ACL or LE link and supplying L2CAP traffic while forcing connection teardown.\nAC:L - The attacker controls connection establishment, queued traffic, and link termination, and can repeat attempts to win the workqueue race.\nPR:N - The vulnerable link-bring-up and teardown paths are reachable before Bluetooth pairing or authentication and require no attacker privileges.\nUI:N - No victim action is required once the Bluetooth interface is enabled and accepting connections.\nS:U - The vulnerable L2CAP code and the affected kernel resources belong to the same security authority.\nC:H - If the worker has started, work_pending() can be false and teardown can skip synchronization, free the l2cap_conn, and leave process_pending_rx() accessing reclaimed memory, creating an exploitable heap use-after-free.\nI:H - The resumed worker performs mutex and queue operations on the freed, potentially reallocated l2cap_conn, permitting heap corruption and potentially attacker-controlled writes or control-flow hijacking.\nA:H - The documented lock inversion can permanently deadlock connection teardown and the Bluetooth workqueue; the associated use-after-free can also crash or panic the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:51:53.043Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fc0c3b9cf27cfa2a06f66dae1d08c668fe0a2faa"
},
{
"url": "https://git.kernel.org/stable/c/9901f847a762a5d953871dd95767ce2aed3d684d"
},
{
"url": "https://git.kernel.org/stable/c/4a0bb0fd63fe2b0c62e1072cd1811d6f61e0081c"
},
{
"url": "https://git.kernel.org/stable/c/8daaf7f73fe998631a160d1a5a7e1b0b0480eef8"
},
{
"url": "https://git.kernel.org/stable/c/8de7b386ffad480ca59222b688c94a2da8f0d805"
},
{
"url": "https://git.kernel.org/stable/c/d5616beb3355b5fca2280d796c1cf7ada4ee6551"
},
{
"url": "https://git.kernel.org/stable/c/e96fbac8d3a73b0bc165383c092a30628561d320"
},
{
"url": "https://git.kernel.org/stable/c/2641a9e0a1dd4af2e21995470a21d55dd35e5203"
}
],
"title": "Bluetooth: L2CAP: cancel pending_rx_work before taking conn-\u003elock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64206",
"datePublished": "2026-07-20T16:27:53.885Z",
"dateReserved": "2026-07-19T15:36:31.769Z",
"dateUpdated": "2026-08-17T04:51:53.043Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64413 (GCVE-0-2026-64413)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebtables: zero chainstack array
sashiko reports:
looking at ebtables table
translation, could a sparse cpu_possible_mask lead to an uninitialized pointer
free?
If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible,
but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at
CPU 2, the cleanup loop will blindly decrement and call vfree() on
newinfo->chainstack[1].
Not a real-world bug, such allocation isn't expected to fail
in the first place.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/netfilter/ebtables.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2ade612967e2cdfb9290ebcb773f302c82f311fa",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "42bef500d07b5769d916e9122a3e3fa3fd2245ef",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "fc7f105451044501a50cfd530cfa3b472c54acbc",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9e6c5169db423e51dcc66a73fd15409c0d38e088",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "29bf41a9b59aff9f6197df58641a00037d567ca8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "9f74d28e903fa4fdf82f870d0aeadddc8196e41c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5ee856e4208acafaaaf7b84824d39b78c21345d6",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "cbfe53599eebffd188938ab6774cc41794f6f9d5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/netfilter/ebtables.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebtables: zero chainstack array\n\nsashiko reports:\n looking at ebtables table\n translation, could a sparse cpu_possible_mask lead to an uninitialized pointer\n free?\n\n If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible,\n but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at\n CPU 2, the cleanup loop will blindly decrement and call vfree() on\n newinfo-\u003echainstack[1].\n\nNot a real-world bug, such allocation isn\u0027t expected to fail\nin the first place."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable translation path is reached through a local SOL_IP setsockopt(EBT_SO_SET_ENTRIES) call on an IPv4 socket, not through received network traffic.\nAC:H - Exploitation requires a boot-fixed sparse cpu_possible_mask and a per-CPU vmalloc failure after an earlier allocation succeeds. Although memory pressure is attacker-influenceable, these uncommon conditions are not fully attacker-controlled.\nPR:L - The path requires CAP_NET_ADMIN in the socket network namespace, which an unprivileged user can obtain through an owned user and network namespace where unprivileged user namespaces are enabled.\nUI:N - The attacker directly submits the crafted ebtables replacement; no victim action is required.\nS:U - This is ordinary user-namespace-to-kernel privilege escalation within the host security authority, without crossing a VM, hypervisor, or IOMMU boundary.\nC:H - The uninitialized slot can alias a live vmalloc allocation, causing it to be freed and leaving its owner with a groomable use-after-free capable of exposing arbitrary kernel memory.\nI:H - Freeing a live vmalloc-backed kernel object can enable controlled reallocation, arbitrary memory modification, and kernel control-flow hijacking.\nA:H - An invalid vfree can panic kernels configured with panic_on_warn, while freeing a live allocation creates a use-after-free that can crash or panic the kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:55:12.351Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2ade612967e2cdfb9290ebcb773f302c82f311fa"
},
{
"url": "https://git.kernel.org/stable/c/42bef500d07b5769d916e9122a3e3fa3fd2245ef"
},
{
"url": "https://git.kernel.org/stable/c/fc7f105451044501a50cfd530cfa3b472c54acbc"
},
{
"url": "https://git.kernel.org/stable/c/9e6c5169db423e51dcc66a73fd15409c0d38e088"
},
{
"url": "https://git.kernel.org/stable/c/29bf41a9b59aff9f6197df58641a00037d567ca8"
},
{
"url": "https://git.kernel.org/stable/c/9f74d28e903fa4fdf82f870d0aeadddc8196e41c"
},
{
"url": "https://git.kernel.org/stable/c/5ee856e4208acafaaaf7b84824d39b78c21345d6"
},
{
"url": "https://git.kernel.org/stable/c/cbfe53599eebffd188938ab6774cc41794f6f9d5"
}
],
"title": "netfilter: ebtables: zero chainstack array",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64413",
"datePublished": "2026-07-25T08:50:53.759Z",
"dateReserved": "2026-07-19T15:36:31.786Z",
"dateUpdated": "2026-08-17T04:55:12.351Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64546 (GCVE-0-2026-64546)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/edid: fix OOB read in drm_parse_tiled_block()
drm_parse_tiled_block() casts the DisplayID block to a
struct displayid_tiled_block and reads the full fixed layout up to
tile->topology_id[7] without checking block->num_bytes. The DisplayID
iterator only validates the declared payload length, so a crafted EDID
can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or
DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at
the end of a DisplayID extension. The read then runs past the end of the
exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read.
Reject blocks shorter than the spec's 22-byte tiled payload before
reading the fixed struct, as drm_parse_vesa_mso_data() already does.
BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update
Read of size 2 at addr ffff888010077700 by task exploit/147
dump_stack_lvl (lib/dump_stack.c:94 ...)
print_report (mm/kasan/report.c:378 ...)
kasan_report (mm/kasan/report.c:595)
drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581)
bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574)
drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426)
status_store (drivers/gpu/drm/drm_sysfs.c:219)
...
vfs_write (fs/read_write.c:595 fs/read_write.c:688)
ksys_write (fs/read_write.c:740)
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 40d9b043a89e2301e1f97ade055a73ecc28e9afe Version: 40d9b043a89e2301e1f97ade055a73ecc28e9afe Version: 40d9b043a89e2301e1f97ade055a73ecc28e9afe Version: 40d9b043a89e2301e1f97ade055a73ecc28e9afe Version: 40d9b043a89e2301e1f97ade055a73ecc28e9afe Version: 40d9b043a89e2301e1f97ade055a73ecc28e9afe Version: 40d9b043a89e2301e1f97ade055a73ecc28e9afe Version: 40d9b043a89e2301e1f97ade055a73ecc28e9afe |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_edid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0",
"status": "affected",
"version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
"versionType": "git"
},
{
"lessThan": "9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061",
"status": "affected",
"version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
"versionType": "git"
},
{
"lessThan": "157727131ce8a52d8d9bc676c372ef82db6436c4",
"status": "affected",
"version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
"versionType": "git"
},
{
"lessThan": "bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d",
"status": "affected",
"version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
"versionType": "git"
},
{
"lessThan": "4f5484d25f85ad6c989bad5f6a43450cecfcfd28",
"status": "affected",
"version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
"versionType": "git"
},
{
"lessThan": "9cc0f8e63e8c34cf43def35cbd305ba711181a1f",
"status": "affected",
"version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
"versionType": "git"
},
{
"lessThan": "4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb",
"status": "affected",
"version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
"versionType": "git"
},
{
"lessThan": "faaa1e1155833e7d4ce7e3cfaf64c0d636b190db",
"status": "affected",
"version": "40d9b043a89e2301e1f97ade055a73ecc28e9afe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_edid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/edid: fix OOB read in drm_parse_tiled_block()\n\ndrm_parse_tiled_block() casts the DisplayID block to a\nstruct displayid_tiled_block and reads the full fixed layout up to\ntile-\u003etopology_id[7] without checking block-\u003enum_bytes. The DisplayID\niterator only validates the declared payload length, so a crafted EDID\ncan advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or\nDATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at\nthe end of a DisplayID extension. The read then runs past the end of the\nexact-sized kmemdup()\u0027d EDID allocation, a heap out-of-bounds read.\n\nReject blocks shorter than the spec\u0027s 22-byte tiled payload before\nreading the fixed struct, as drm_parse_vesa_mso_data() already does.\n\n BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update\n Read of size 2 at addr ffff888010077700 by task exploit/147\n dump_stack_lvl (lib/dump_stack.c:94 ...)\n print_report (mm/kasan/report.c:378 ...)\n kasan_report (mm/kasan/report.c:595)\n drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581)\n bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574)\n drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426)\n status_store (drivers/gpu/drm/drm_sysfs.c:219)\n ...\n vfs_write (fs/read_write.c:595 fs/read_write.c:688)\n ksys_write (fs/read_write.c:740)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The crafted EDID reaches the parser through a local device node \u2014 an unprivileged DRM client supplying a raw EDID buffer via the exynos vidi `DRM_AUTH` ioctl, or root via the connector\u0027s debugfs `edid_override` plus a sysfs re-probe. No network path exists, and local ioctl delivery is the lowest-friction vector (a physically attached malicious monitor/dock is an additional, equally automatic route).\nAC:L - The attacker fully controls the EDID bytes and only needs to place a tiled-display DisplayID block with a small `num_bytes` at the tail of the last extension block; `drm_edid_valid()` checks nothing but the header and checksums, which the attacker computes. No race and no memory-layout precondition is needed to trigger the read.\nPR:L - Handing an arbitrary EDID to `drm_edid_connector_update()` via `DRM_IOCTL_EXYNOS_VIDI_CONNECTION` requires only an authenticated DRM client (`DRM_AUTH`), i.e. an ordinary logged-in user with access to /dev/dri \u2014 no CAP_SYS_ADMIN and no root.\nUI:N - The attacker drives the connector probe itself through the ioctl, and on the hotplug path the EDID is read and parsed automatically by the kernel. No victim action is involved.\nS:U - The out-of-bounds read stays within the kernel\u0027s own heap and the impact is confined to the kernel security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Up to ~21 bytes of adjacent slab memory are read past the exact-size EDID allocation, and eight of those bytes are persisted into the connector\u0027s tile fields and handed back to userspace in the TILE property blob via `DRM_IOCTL_MODE_GETPROPBLOB`, giving a repeatable heap-content leak usable to defeat KASLR or recover neighbouring object data.\nI:N - The defect is purely a read; `drm_mode_create_tile_group()` copies the OOB source into a properly sized destination, so no out-of-bounds write or control-flow corruption occurs.\nA:H - The read runs past the end of the slab object and, for exact-fit allocations at a slab boundary, can touch unmapped memory; on KASAN or panic_on_warn kernels it is an immediate fatal report, and the resulting garbage tile geometry is propagated to the modesetting path."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:23.260Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0"
},
{
"url": "https://git.kernel.org/stable/c/9acd5c1ddc17ca4c5ffa0c373e3fdf480506e061"
},
{
"url": "https://git.kernel.org/stable/c/157727131ce8a52d8d9bc676c372ef82db6436c4"
},
{
"url": "https://git.kernel.org/stable/c/bfa05d89dc3ca3fb1a9099ef5185549a5ec8490d"
},
{
"url": "https://git.kernel.org/stable/c/4f5484d25f85ad6c989bad5f6a43450cecfcfd28"
},
{
"url": "https://git.kernel.org/stable/c/9cc0f8e63e8c34cf43def35cbd305ba711181a1f"
},
{
"url": "https://git.kernel.org/stable/c/4137e1ecec9c8cb6c4fcee28ffabbbc7409eb7fb"
},
{
"url": "https://git.kernel.org/stable/c/faaa1e1155833e7d4ce7e3cfaf64c0d636b190db"
}
],
"title": "drm/edid: fix OOB read in drm_parse_tiled_block()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64546",
"datePublished": "2026-07-27T20:10:37.217Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-17T04:57:23.260Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53260 (GCVE-0-2026-53260)
Vulnerability from cvelistv5
Published
2026-06-25 08:39
Modified
2026-08-05 12:34
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
syzbot reported a weird reqsk->rsk_refcnt underflow in
__inet_csk_reqsk_queue_drop().
The captured reqsk_put() in __inet_csk_reqsk_queue_drop()
is called only when it successfully removes reqsk from ehash.
Moreover, reqsk_timer_handler() calls another reqsk_put()
after that.
This indicates that the reqsk was missing both refcnts for
ehash and the timer itself.
Since all the syzbot reports had PREEMPT_RT enabled, the only
possible scenario is that reqsk_queue_hash_req() is preempted
after mod_timer() and before refcount_set(), and then the timer
triggered after 1s aborts the reqsk due to its listener's close().
Let's wrap mod_timer() and refcount_set() with
preempt_disable_nested() and preempt_enable_nested().
Note that inet_ehash_insert() holds the normal spin_lock()
(mutex in PREEMPT_RT), so it must be called outside of
preempt_disable_nested(), but this is fine.
The lookup path just ignores 0 sk_refcnt entries in ehash
and tries to create another reqsk, but this will fail at
inet_ehash_insert().
[0]:
refcount_t: underflow; use-after-free.
WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16
Modules linked in:
CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28
Code: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a <67> 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f
RSP: 0000:ffffc90000157948 EFLAGS: 00010246
RAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00
RBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005
R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568
R13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0
Call Trace:
<TASK>
__refcount_sub_and_test include/linux/refcount.h:400 [inline]
__refcount_dec_and_test include/linux/refcount.h:432 [inline]
refcount_dec_and_test include/linux/refcount.h:450 [inline]
reqsk_put include/net/request_sock.h:136 [inline]
__inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007
reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137
call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2374 [inline]
__run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386
run_timer_base kernel/time/timer.c:2395 [inline]
run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403
handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
run_ktimerd+0x69/0x100 kernel/softirq.c:1151
smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/inet_connection_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "889fc99967007e2493833515a645cb2d800f6742",
"status": "affected",
"version": "d2d6422f8bd17c6bb205133e290625a564194496",
"versionType": "git"
},
{
"lessThan": "de5a46f3b2c8d3cd20afa158bd3a725e3e3d6fd3",
"status": "affected",
"version": "d2d6422f8bd17c6bb205133e290625a564194496",
"versionType": "git"
},
{
"lessThan": "b183215ff714efb747d9d5a429322ba6404b5401",
"status": "affected",
"version": "d2d6422f8bd17c6bb205133e290625a564194496",
"versionType": "git"
},
{
"lessThan": "e10902df24488ca722303133acfc82490f7d59ad",
"status": "affected",
"version": "d2d6422f8bd17c6bb205133e290625a564194496",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/inet_connection_sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.13",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().\n\nsyzbot reported a weird reqsk-\u003ersk_refcnt underflow in\n__inet_csk_reqsk_queue_drop().\n\nThe captured reqsk_put() in __inet_csk_reqsk_queue_drop()\nis called only when it successfully removes reqsk from ehash.\n\nMoreover, reqsk_timer_handler() calls another reqsk_put()\nafter that.\n\nThis indicates that the reqsk was missing both refcnts for\nehash and the timer itself.\n\nSince all the syzbot reports had PREEMPT_RT enabled, the only\npossible scenario is that reqsk_queue_hash_req() is preempted\nafter mod_timer() and before refcount_set(), and then the timer\ntriggered after 1s aborts the reqsk due to its listener\u0027s close().\n\nLet\u0027s wrap mod_timer() and refcount_set() with\npreempt_disable_nested() and preempt_enable_nested().\n\nNote that inet_ehash_insert() holds the normal spin_lock()\n(mutex in PREEMPT_RT), so it must be called outside of\npreempt_disable_nested(), but this is fine.\n\nThe lookup path just ignores 0 sk_refcnt entries in ehash\nand tries to create another reqsk, but this will fail at\ninet_ehash_insert().\n\n[0]:\nrefcount_t: underflow; use-after-free.\nWARNING: lib/refcount.c:28 at refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28, CPU#0: ktimers/0/16\nModules linked in:\nCPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}\nTainted: [L]=SOFTLOCKUP\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026\nRIP: 0010:refcount_warn_saturate+0xb2/0x110 lib/refcount.c:28\nCode: e4 7d d1 0a 67 48 0f b9 3a eb 4a e8 38 3d 23 fd 48 8d 3d e1 7d d1 0a 67 48 0f b9 3a eb 37 e8 25 3d 23 fd 48 8d 3d de 7d d1 0a \u003c67\u003e 48 0f b9 3a eb 24 e8 12 3d 23 fd 48 8d 3d db 7d d1 0a 67 48 0f\nRSP: 0000:ffffc90000157948 EFLAGS: 00010246\nRAX: ffffffff84a1301b RBX: 0000000000000003 RCX: ffff88801ca98000\nRDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8f72ae00\nRBP: ffffffff99ae3b01 R08: ffff88801ca98000 R09: 0000000000000005\nR10: 0000000000000100 R11: 0000000000000004 R12: ffff8880425ef568\nR13: ffff8880425ef4f8 R14: ffff8880425ef578 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffff888126386000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f7b46710e9c CR3: 000000000dbb6000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n __refcount_sub_and_test include/linux/refcount.h:400 [inline]\n __refcount_dec_and_test include/linux/refcount.h:432 [inline]\n refcount_dec_and_test include/linux/refcount.h:450 [inline]\n reqsk_put include/net/request_sock.h:136 [inline]\n __inet_csk_reqsk_queue_drop+0x3ce/0x440 net/ipv4/inet_connection_sock.c:1007\n reqsk_timer_handler+0x651/0xdf0 net/ipv4/inet_connection_sock.c:1137\n call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748\n expire_timers kernel/time/timer.c:1799 [inline]\n __run_timers kernel/time/timer.c:2374 [inline]\n __run_timer_base+0x6a3/0x9f0 kernel/time/timer.c:2386\n run_timer_base kernel/time/timer.c:2395 [inline]\n run_timer_softirq+0x67/0x170 kernel/time/timer.c:2403\n handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622\n __do_softirq kernel/softirq.c:656 [inline]\n run_ktimerd+0x69/0x100 kernel/softirq.c:1151\n smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160\n kthread+0x388/0x470 kernel/kthread.c:436\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable TCP request-socket path is reached by unauthenticated IPv4 or IPv6 SYN packets delivered to a listening socket over the network. This occurs before any application-level authentication.\nAC:L - Although the bug is a PREEMPT_RT timing race, an attacker can repeatedly create request sockets and timer/drop races by driving TCP connection attempts; under the required higher-severity rule this is treated as attacker-controllable rather than an uncontrollable environmental condition.\nPR:N - No credentials, capabilities, or prior authentication are required to send SYN packets to an exposed TCP listener and reach `tcp_conn_request()` and `reqsk_queue_hash_req()`. The path is in the generic TCP receive stack.\nUI:N - Exploitation does not require a victim user to open a file, mount anything, or perform an interactive action. Network traffic alone can exercise the vulnerable path on an affected listening service.\nS:U - The impact is within the kernel/network stack security authority on the same host. There is no VM escape, IOMMU bypass, or cross-authority boundary change.\nC:H - The failure is explicitly reported as a refcount underflow/use-after-free in a kernel heap object. Per the required guidance, UAF-class lifetime corruption is scored as high confidentiality impact because it can potentially be shaped into memory disclosure.\nI:H - The corrupted request-socket lifetime can leave stale kernel objects reachable through ehash/timer paths. Per the required guidance, UAF-class kernel memory corruption is scored as high integrity impact because it may be exploitable for write or control-flow manipulation.\nA:H - The observed failure triggers a kernel refcount warning with use-after-free semantics in timer context and can destabilize networking or the kernel. Kernel warnings/oopses, hangs, or UAF-triggered crashes are high availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:34:39.011Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/889fc99967007e2493833515a645cb2d800f6742"
},
{
"url": "https://git.kernel.org/stable/c/de5a46f3b2c8d3cd20afa158bd3a725e3e3d6fd3"
},
{
"url": "https://git.kernel.org/stable/c/b183215ff714efb747d9d5a429322ba6404b5401"
},
{
"url": "https://git.kernel.org/stable/c/e10902df24488ca722303133acfc82490f7d59ad"
}
],
"title": "tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53260",
"datePublished": "2026-06-25T08:39:49.229Z",
"dateReserved": "2026-06-09T07:44:35.394Z",
"dateUpdated": "2026-08-05T12:34:39.011Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64192 (GCVE-0-2026-64192)
Vulnerability from cvelistv5
Published
2026-07-20 16:27
Modified
2026-08-23 12:45
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
When CONFIG_BPF_LSM=y is set, BPF inode storage maps
(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However,
if the BPF LSM is not explicitly enabled at boot time (e.g. omitted
from the "lsm=" boot parameter), lsm_prepare() is never executed for
the BPF LSM.
Consequently, the BPF inode security blob offset
(bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at
its default compiled size of 8 bytes instead of being updated to a
valid offset past the reserved struct rcu_head (typically 16 bytes
or more).
When a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE
map, bpf_inode() evaluates inode->i_security + 8. This erroneously
aliases the struct rcu_head.func callback pointer at the beginning
of the inode->i_security blob. During subsequent map element cleanup
or inode destruction, writing NULL to owner_storage clears the queued
RCU callback pointer. When rcu_do_batch() later executes the queued
callback, it attempts an instruction fetch at address 0x0, triggering
an immediate kernel panic.
Fix this by introducing a global bpf_lsm_initialized boolean flag
marked with __ro_after_init. Set this flag to true inside bpf_lsm_init()
when the LSM framework successfully registers the BPF LSM. Gate map
allocation in inode_storage_map_alloc() on this flag, returning
-EOPNOTSUPP if the BPF LSM is in turn uninitialized.
This fail-fast approach prevents userspace from allocating inode
storage maps when the supporting BPF LSM infrastructure is absent,
avoiding zombie map states.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8ea636848aca35b9f97c5b5dee30225cf2dd0fe6 Version: 8ea636848aca35b9f97c5b5dee30225cf2dd0fe6 Version: 8ea636848aca35b9f97c5b5dee30225cf2dd0fe6 Version: 8ea636848aca35b9f97c5b5dee30225cf2dd0fe6 Version: 8ea636848aca35b9f97c5b5dee30225cf2dd0fe6 Version: 8ea636848aca35b9f97c5b5dee30225cf2dd0fe6 Version: 8ea636848aca35b9f97c5b5dee30225cf2dd0fe6 Version: 8ea636848aca35b9f97c5b5dee30225cf2dd0fe6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/bpf_lsm.h",
"kernel/bpf/bpf_inode_storage.c",
"security/bpf/hooks.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "413b14b9623a2e6ee131c2b2152b304aeb04e378",
"status": "affected",
"version": "8ea636848aca35b9f97c5b5dee30225cf2dd0fe6",
"versionType": "git"
},
{
"lessThan": "a6d634f794c808a261eac7d5af023a7e06b9ecd8",
"status": "affected",
"version": "8ea636848aca35b9f97c5b5dee30225cf2dd0fe6",
"versionType": "git"
},
{
"lessThan": "721f669853bdbf46b475a81bb5d05d610f8c19de",
"status": "affected",
"version": "8ea636848aca35b9f97c5b5dee30225cf2dd0fe6",
"versionType": "git"
},
{
"lessThan": "5337eebdf8c5d4810b1913047f078d2815d5645f",
"status": "affected",
"version": "8ea636848aca35b9f97c5b5dee30225cf2dd0fe6",
"versionType": "git"
},
{
"lessThan": "de984ea883405420fdc416ae8964b752df586970",
"status": "affected",
"version": "8ea636848aca35b9f97c5b5dee30225cf2dd0fe6",
"versionType": "git"
},
{
"lessThan": "267fdd9b6530c399dfd996e1a0a7628b45baf9f0",
"status": "affected",
"version": "8ea636848aca35b9f97c5b5dee30225cf2dd0fe6",
"versionType": "git"
},
{
"lessThan": "c76b8abce575e0c6e4096957220b4515ed847d89",
"status": "affected",
"version": "8ea636848aca35b9f97c5b5dee30225cf2dd0fe6",
"versionType": "git"
},
{
"lessThan": "a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4",
"status": "affected",
"version": "8ea636848aca35b9f97c5b5dee30225cf2dd0fe6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/bpf_lsm.h",
"kernel/bpf/bpf_inode_storage.c",
"security/bpf/hooks.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.266",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.217",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.184",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.266",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.217",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.184",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized\n\nWhen CONFIG_BPF_LSM=y is set, BPF inode storage maps\n(BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However,\nif the BPF LSM is not explicitly enabled at boot time (e.g. omitted\nfrom the \"lsm=\" boot parameter), lsm_prepare() is never executed for\nthe BPF LSM.\n\nConsequently, the BPF inode security blob offset\n(bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at\nits default compiled size of 8 bytes instead of being updated to a\nvalid offset past the reserved struct rcu_head (typically 16 bytes\nor more).\n\nWhen a privileged user creates and updates a BPF_MAP_TYPE_INODE_STORAGE\nmap, bpf_inode() evaluates inode-\u003ei_security + 8. This erroneously\naliases the struct rcu_head.func callback pointer at the beginning\nof the inode-\u003ei_security blob. During subsequent map element cleanup\nor inode destruction, writing NULL to owner_storage clears the queued\nRCU callback pointer. When rcu_do_batch() later executes the queued\ncallback, it attempts an instruction fetch at address 0x0, triggering\nan immediate kernel panic.\n\nFix this by introducing a global bpf_lsm_initialized boolean flag\nmarked with __ro_after_init. Set this flag to true inside bpf_lsm_init()\nwhen the LSM framework successfully registers the BPF LSM. Gate map\nallocation in inode_storage_map_alloc() on this flag, returning\n-EOPNOTSUPP if the BPF LSM is in turn uninitialized.\n\nThis fail-fast approach prevents userspace from allocating inode\nstorage maps when the supporting BPF LSM infrastructure is absent,\navoiding zombie map states."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T12:45:34.754Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/413b14b9623a2e6ee131c2b2152b304aeb04e378"
},
{
"url": "https://git.kernel.org/stable/c/a6d634f794c808a261eac7d5af023a7e06b9ecd8"
},
{
"url": "https://git.kernel.org/stable/c/721f669853bdbf46b475a81bb5d05d610f8c19de"
},
{
"url": "https://git.kernel.org/stable/c/5337eebdf8c5d4810b1913047f078d2815d5645f"
},
{
"url": "https://git.kernel.org/stable/c/de984ea883405420fdc416ae8964b752df586970"
},
{
"url": "https://git.kernel.org/stable/c/267fdd9b6530c399dfd996e1a0a7628b45baf9f0"
},
{
"url": "https://git.kernel.org/stable/c/c76b8abce575e0c6e4096957220b4515ed847d89"
},
{
"url": "https://git.kernel.org/stable/c/a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4"
}
],
"title": "bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64192",
"datePublished": "2026-07-20T16:27:51.720Z",
"dateReserved": "2026-07-19T07:54:57.040Z",
"dateUpdated": "2026-08-23T12:45:34.754Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64434 (GCVE-0-2026-64434)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-08-19 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
l2cap_chan_timeout() runs asynchronously and accesses chan->conn. If
the connection is torn down while the timer is running or pending,
chan->conn can be freed, leading to a use-after-free when the timer
worker attempts to lock conn->lock:
| BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
| BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]
| BUG: KASAN: slab-use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]
| BUG: KASAN: slab-use-after-free in mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318
| Write of size 8 at addr ffff8881298d9550 by task kworker/2:1/83
|
| CPU: 2 UID: 0 PID: 83 Comm: kworker/2:1 Not tainted 7.1.0-rc6-next-20260601-dirty #6 PREEMPT(full)
| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
| Workqueue: events l2cap_chan_timeout
| Call Trace:
| <TASK>
| instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
| atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]
| __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]
| mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318
| l2cap_chan_timeout+0x5d/0x1b0 net/bluetooth/l2cap_core.c:422
| process_one_work kernel/workqueue.c:3326 [inline]
| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409
| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490
| kthread+0x346/0x430 kernel/kthread.c:436
| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158
| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
| </TASK>
|
| Allocated by task 320:
| l2cap_conn_add+0xa7/0x820 net/bluetooth/l2cap_core.c:7075
| l2cap_connect_cfm+0xdb/0xd70 net/bluetooth/l2cap_core.c:7452
| hci_connect_cfm include/net/bluetooth/hci_core.h:2139 [inline]
| hci_remote_features_evt+0x52f/0x9f0 net/bluetooth/hci_event.c:3760
| hci_event_func net/bluetooth/hci_event.c:7796 [inline]
| hci_event_packet+0x561/0xa70 net/bluetooth/hci_event.c:7847
| hci_rx_work+0x370/0x890 net/bluetooth/hci_core.c:4040
| process_one_work kernel/workqueue.c:3326 [inline]
| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409
| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490
| kthread+0x346/0x430 kernel/kthread.c:436
| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158
| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
|
| Freed by task 322:
| hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline]
| hci_conn_hash_flush+0x101/0x1f0 net/bluetooth/hci_conn.c:2736
| hci_dev_close_sync+0x889/0xde0 net/bluetooth/hci_sync.c:5405
| hci_dev_do_close net/bluetooth/hci_core.c:502 [inline]
| hci_unregister_dev+0x1f7/0x370 net/bluetooth/hci_core.c:2679
| vhci_release+0x12a/0x180 drivers/bluetooth/hci_vhci.c:690
| __fput+0x369/0x890 fs/file_table.c:510
| task_work_run+0x160/0x1d0 kernel/task_work.c:233
| get_signal+0xf5b/0x1120 kernel/signal.c:2810
| arch_do_signal_or_restart+0x4d/0x600 arch/x86/kernel/signal.c:337
| __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
| exit_to_user_mode_loop+0x85/0x510 kernel/entry/common.c:98
| do_syscall_64+0x263/0x3d0 arch/x86/entry/syscall_64.c:100
| entry_SYSCALL_64_after_hwframe+0x77/0x7f
|
| The buggy address belongs to the object at ffff8881298d9400
| which belongs to the cache kmalloc-512 of size 512
| The buggy address is located 336 bytes inside of
| freed 512-byte region [ffff8881298d9400, ffff8881298d9600)
Fix it by having chan->conn hold a reference to l2cap_conn (via
l2cap_conn_get) when the channel is added to the connection, and
releasing it in the channel destructor. This ensures the l2cap_conn
remains alive as long as the channel exists.
A new FLAG_DEL channel flag is introduced to indicate that the ch
---truncated---
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 3634cbdc2eb414b69ffa752ddbe5e0458518e321 Version: e1c100e2d61bd8c718b7d91fe3e050780a9bf72d Version: deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9 Version: 89dec92041717b027216e110599e4f6d6c921b79 Version: 50dfec218808b148ab4247b1858031b7a32015c5 Version: 859d3ace791ed878ae9ba5522c7844d960da8f88 Version: 8c8e620467a7b51562dbcefbd1f09f288d7d710d Version: 8c8e620467a7b51562dbcefbd1f09f288d7d710d Version: 7555fd885a0603f50e49a655850a1f2bd8a25398 Version: 5.10.259 ≤ Version: 5.15.210 ≤ Version: 6.1.176 ≤ Version: 6.6.143 ≤ Version: 6.12.93 ≤ Version: 6.18.35 ≤ Version: 7.0.12 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/l2cap.h",
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8f90405a4a6f1f1880dc07996b47bf57c712bd8a",
"status": "affected",
"version": "3634cbdc2eb414b69ffa752ddbe5e0458518e321",
"versionType": "git"
},
{
"lessThan": "32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b",
"status": "affected",
"version": "e1c100e2d61bd8c718b7d91fe3e050780a9bf72d",
"versionType": "git"
},
{
"lessThan": "8922c7940bae9ce4b1736dddb6362370793835c2",
"status": "affected",
"version": "deb8493a8fa599f6c95e2465b12bfdfb7f94a1d9",
"versionType": "git"
},
{
"lessThan": "91047a4396a8b1857a6f712a90cf33ec0012b189",
"status": "affected",
"version": "89dec92041717b027216e110599e4f6d6c921b79",
"versionType": "git"
},
{
"lessThan": "0b0e2bf39cf99e458d991b9df253727e036a7d7d",
"status": "affected",
"version": "50dfec218808b148ab4247b1858031b7a32015c5",
"versionType": "git"
},
{
"lessThan": "d3b739db5dc6f688a60d56da872fabaf65246032",
"status": "affected",
"version": "859d3ace791ed878ae9ba5522c7844d960da8f88",
"versionType": "git"
},
{
"lessThan": "50c38d9f42a529691e4e67ea9cedf4f0bfc8d277",
"status": "affected",
"version": "8c8e620467a7b51562dbcefbd1f09f288d7d710d",
"versionType": "git"
},
{
"lessThan": "b66774b48dd98f07254951f74ea6f513efe7ff8b",
"status": "affected",
"version": "8c8e620467a7b51562dbcefbd1f09f288d7d710d",
"versionType": "git"
},
{
"status": "affected",
"version": "7555fd885a0603f50e49a655850a1f2bd8a25398",
"versionType": "git"
},
{
"lessThan": "5.10.265",
"status": "affected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThan": "5.15.216",
"status": "affected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThan": "6.1.183",
"status": "affected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThan": "6.12.97",
"status": "affected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThan": "6.18.39",
"status": "affected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThan": "7.1",
"status": "affected",
"version": "7.0.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/l2cap.h",
"net/bluetooth/l2cap_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"lessThan": "7.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10.259",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.15.210",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "6.1.176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.143",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12.93",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.18.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\n\nl2cap_chan_timeout() runs asynchronously and accesses chan-\u003econn. If\nthe connection is torn down while the timer is running or pending,\nchan-\u003econn can be freed, leading to a use-after-free when the timer\nworker attempts to lock conn-\u003elock:\n\n| BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]\n| BUG: KASAN: slab-use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]\n| BUG: KASAN: slab-use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]\n| BUG: KASAN: slab-use-after-free in mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318\n| Write of size 8 at addr ffff8881298d9550 by task kworker/2:1/83\n|\n| CPU: 2 UID: 0 PID: 83 Comm: kworker/2:1 Not tainted 7.1.0-rc6-next-20260601-dirty #6 PREEMPT(full)\n| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\n| Workqueue: events l2cap_chan_timeout\n| Call Trace:\n| \u003cTASK\u003e\n| instrument_atomic_read_write include/linux/instrumented.h:112 [inline]\n| atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:4456 [inline]\n| __mutex_trylock_fast kernel/locking/mutex.c:161 [inline]\n| mutex_lock+0x4f/0xa0 kernel/locking/mutex.c:318\n| l2cap_chan_timeout+0x5d/0x1b0 net/bluetooth/l2cap_core.c:422\n| process_one_work kernel/workqueue.c:3326 [inline]\n| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409\n| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490\n| kthread+0x346/0x430 kernel/kthread.c:436\n| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158\n| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n| \u003c/TASK\u003e\n|\n| Allocated by task 320:\n| l2cap_conn_add+0xa7/0x820 net/bluetooth/l2cap_core.c:7075\n| l2cap_connect_cfm+0xdb/0xd70 net/bluetooth/l2cap_core.c:7452\n| hci_connect_cfm include/net/bluetooth/hci_core.h:2139 [inline]\n| hci_remote_features_evt+0x52f/0x9f0 net/bluetooth/hci_event.c:3760\n| hci_event_func net/bluetooth/hci_event.c:7796 [inline]\n| hci_event_packet+0x561/0xa70 net/bluetooth/hci_event.c:7847\n| hci_rx_work+0x370/0x890 net/bluetooth/hci_core.c:4040\n| process_one_work kernel/workqueue.c:3326 [inline]\n| process_scheduled_works+0x7c8/0xfb0 kernel/workqueue.c:3409\n| worker_thread+0x8a9/0xcf0 kernel/workqueue.c:3490\n| kthread+0x346/0x430 kernel/kthread.c:436\n| ret_from_fork+0x1a3/0x470 arch/x86/kernel/process.c:158\n| ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n|\n| Freed by task 322:\n| hci_disconn_cfm include/net/bluetooth/hci_core.h:2154 [inline]\n| hci_conn_hash_flush+0x101/0x1f0 net/bluetooth/hci_conn.c:2736\n| hci_dev_close_sync+0x889/0xde0 net/bluetooth/hci_sync.c:5405\n| hci_dev_do_close net/bluetooth/hci_core.c:502 [inline]\n| hci_unregister_dev+0x1f7/0x370 net/bluetooth/hci_core.c:2679\n| vhci_release+0x12a/0x180 drivers/bluetooth/hci_vhci.c:690\n| __fput+0x369/0x890 fs/file_table.c:510\n| task_work_run+0x160/0x1d0 kernel/task_work.c:233\n| get_signal+0xf5b/0x1120 kernel/signal.c:2810\n| arch_do_signal_or_restart+0x4d/0x600 arch/x86/kernel/signal.c:337\n| __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]\n| exit_to_user_mode_loop+0x85/0x510 kernel/entry/common.c:98\n| do_syscall_64+0x263/0x3d0 arch/x86/entry/syscall_64.c:100\n| entry_SYSCALL_64_after_hwframe+0x77/0x7f\n|\n| The buggy address belongs to the object at ffff8881298d9400\n| which belongs to the cache kmalloc-512 of size 512\n| The buggy address is located 336 bytes inside of\n| freed 512-byte region [ffff8881298d9400, ffff8881298d9600)\n\nFix it by having chan-\u003econn hold a reference to l2cap_conn (via\nl2cap_conn_get) when the channel is added to the connection, and\nreleasing it in the channel destructor. This ensures the l2cap_conn\nremains alive as long as the channel exists.\n\nA new FLAG_DEL channel flag is introduced to indicate that the ch\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - An unauthenticated Bluetooth peer within radio range can reach the vulnerable worker by creating a half-configured L2CAP channel and subsequently terminating the ACL connection.\nAC:L - The attacker controls both channel creation and connection teardown, can leave the 40-second channel timer armed, and can repeat or parallelize attempts to win the race.\nPR:N - The BR/EDR signaling path processes incoming L2CAP requests before application acceptance, and an SDP listener permits this path without pairing or authentication.\nUI:N - Exploitation requires no victim action because an already-running Bluetooth service and the kernel independently process the connection, timer, and disconnection.\nS:U - The UAF compromises the host kernel within the same security authority and does not inherently cross a VM, IOMMU, or comparable boundary.\nC:H - The freed kmalloc object can be reclaimed with attacker-influenced contents, allowing the UAF to support kernel-memory disclosure primitives.\nI:H - The worker performs mutex writes into the freed allocation, enabling heap corruption and potentially arbitrary write or kernel control-flow hijacking after heap grooming.\nA:H - The stale mutex access can corrupt memory, trigger an oops or panic, and can be retriggered by a nearby Bluetooth peer."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:16.061Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8f90405a4a6f1f1880dc07996b47bf57c712bd8a"
},
{
"url": "https://git.kernel.org/stable/c/32d783cafb46ff3ca58e6f9fd62c9c5f35eaf26b"
},
{
"url": "https://git.kernel.org/stable/c/8922c7940bae9ce4b1736dddb6362370793835c2"
},
{
"url": "https://git.kernel.org/stable/c/91047a4396a8b1857a6f712a90cf33ec0012b189"
},
{
"url": "https://git.kernel.org/stable/c/0b0e2bf39cf99e458d991b9df253727e036a7d7d"
},
{
"url": "https://git.kernel.org/stable/c/d3b739db5dc6f688a60d56da872fabaf65246032"
},
{
"url": "https://git.kernel.org/stable/c/50c38d9f42a529691e4e67ea9cedf4f0bfc8d277"
},
{
"url": "https://git.kernel.org/stable/c/b66774b48dd98f07254951f74ea6f513efe7ff8b"
}
],
"title": "Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64434",
"datePublished": "2026-07-25T08:51:09.066Z",
"dateReserved": "2026-07-19T15:36:31.787Z",
"dateUpdated": "2026-08-19T16:28:16.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64534 (GCVE-0-2026-64534)
Vulnerability from cvelistv5
Published
2026-07-27 06:32
Modified
2026-08-05 12:42
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,
nvmet_req_uninit() is called unconditionally. However, if the command
arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init()
had returned false and percpu_ref_tryget_live() was never executed. The
unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a
refcount underflow, leading to a WARNING in
percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and
eventually a permanent workqueue deadlock.
Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling
nvmet_req_uninit(), matching the existing pattern in
nvmet_tcp_execute_request().
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 91edfca6f8b364d60cde3ddefaf7d03ddf35774b Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: 4b17476d809273617d3317fa0d4ae78aa488d760 Version: 5.10.20 ≤ Version: 5.11.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf",
"status": "affected",
"version": "91edfca6f8b364d60cde3ddefaf7d03ddf35774b",
"versionType": "git"
},
{
"lessThan": "ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"lessThan": "c7874dad84b20433c0fe3919f291a762d40de08b",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"lessThan": "e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"lessThan": "d306da8833e75f669d93424fd84940236f3850bc",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"lessThan": "2ed3c9d955e8cd6361f130623baa664a75fb345f",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"lessThan": "4606467a75cfc16721937272ed29462a750b60c8",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"status": "affected",
"version": "4b17476d809273617d3317fa0d4ae78aa488d760",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.20",
"versionType": "semver"
},
{
"lessThan": "5.12",
"status": "affected",
"version": "5.11.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path\n\nIn nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,\nnvmet_req_uninit() is called unconditionally. However, if the command\narrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init()\nhad returned false and percpu_ref_tryget_live() was never executed. The\nunconditional percpu_ref_put() inside nvmet_req_uninit() then causes a\nrefcount underflow, leading to a WARNING in\npercpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and\neventually a permanent workqueue deadlock.\n\nCheck cmd-\u003eflags \u0026 NVMET_TCP_F_INIT_FAILED before calling\nnvmet_req_uninit(), matching the existing pattern in\nnvmet_tcp_execute_request()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable NVMe/TCP target receive path processes attacker-supplied ICReq, CapsuleCmd, inline payload, and digest data over an Internet-routable TCP connection.\nAC:L - The attacker can negotiate data digests and reliably send a rejected write command with inline data followed by an incorrect digest; no race or condition outside the attacker\u0027s control is required.\nPR:N - A malformed CapsuleCmd can trigger this path before CONNECT, host-NQN ACL evaluation, or DH-HMAC-CHAP authentication, so the remote attacker needs no credentials or privileges.\nUI:N - The target processes the malicious protocol sequence automatically without any victim action.\nS:U - The vulnerable transport and the affected kernel memory, execution, and storage resources belong to the same target-host security authority.\nC:H - The unmatched reference decrement can offset a legitimate in-flight request reference, allowing command structures and SGL pages to be freed while backend I/O still uses them; this UAF can expose arbitrary reused kernel memory.\nI:H - The premature freeing of request structures and I/O pages can let backend operations write through reallocated memory or corrupt completion control state, making arbitrary kernel writes and control-flow hijacking defensible.\nA:H - The basic trigger causes a submission-queue refcount underflow and permanent workqueue deadlock, while UAF variants can crash the kernel; unauthenticated attackers can repeat the trigger across connections."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:42:44.214Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/22ec7a9fe9153d2737ee9b2fa6d2e43a1491decf"
},
{
"url": "https://git.kernel.org/stable/c/ba35b1c674ca3841c0dfadd698f2c1b3ec542d4e"
},
{
"url": "https://git.kernel.org/stable/c/c7874dad84b20433c0fe3919f291a762d40de08b"
},
{
"url": "https://git.kernel.org/stable/c/e602c93b25bda4a9d0ff1791a4bdbfdcbb074af1"
},
{
"url": "https://git.kernel.org/stable/c/d306da8833e75f669d93424fd84940236f3850bc"
},
{
"url": "https://git.kernel.org/stable/c/2ed3c9d955e8cd6361f130623baa664a75fb345f"
},
{
"url": "https://git.kernel.org/stable/c/4606467a75cfc16721937272ed29462a750b60c8"
}
],
"title": "nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64534",
"datePublished": "2026-07-27T06:32:34.301Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-05T12:42:44.214Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64352 (GCVE-0-2026-64352)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Allow LPM map access from sleepable BPF programs
trie_lookup_elem() annotates its rcu_dereference_check() walks with
only rcu_read_lock_bh_held(). Because rcu_dereference_check(p, c)
resolves to "c || rcu_read_lock_held()", this passes for XDP/NAPI and
classic RCU readers but fails for sleepable BPF programs, which enter
via __bpf_prog_enter_sleepable() and hold only rcu_read_lock_trace().
trie_update_elem() and trie_delete_elem() have the same problem in a
different form: they walk the trie with plain rcu_dereference(), which
asserts rcu_read_lock_held() unconditionally. Both are reachable from
sleepable BPF programs via the bpf_map_update_elem / bpf_map_delete_elem
helpers, and from the syscall path under classic rcu_read_lock(). In
the writer paths the trie is actually protected by trie->lock (an
rqspinlock taken across the walk); we never relied on the RCU read-side
lock to keep nodes alive there.
A sleepable LSM hook that ends up touching an LPM trie therefore
triggers lockdep on debug kernels:
=============================
WARNING: suspicious RCU usage
7.1.0-... Tainted: G E
-----------------------------
kernel/bpf/lpm_trie.c:249 suspicious rcu_dereference_check() usage!
1 lock held by net_tests/540:
#0: (rcu_tasks_trace_srcu_struct){....}-{0:0},
at: __bpf_prog_enter_sleepable+0x26/0x280
Call Trace:
dump_stack_lvl
lockdep_rcu_suspicious
trie_lookup_elem
bpf_prog_..._enforce_security_socket_connect
bpf_trampoline_...
security_socket_connect
__sys_connect
do_syscall_64
This is lockdep-only -- no UAF, since Tasks Trace RCU does serialize
against the trie's reclaim path -- but it spams the console once per
distinct callsite on every debug kernel running a sleepable BPF LSM
that touches an LPM trie, which is increasingly common.
For the lookup path, switch the rcu_dereference_check() annotation
from rcu_read_lock_bh_held() to bpf_rcu_lock_held(), which accepts all
three contexts (classic, BH, Tasks Trace). Other map types already
follow this convention.
For trie_update_elem() and trie_delete_elem(), annotate the walks as
rcu_dereference_protected(*p, 1) -- matching trie_free() in the same
file -- since trie->lock is held across the walk. rqspinlock has no
lockdep_map, so the predicate degenerates to '1' rather than
lockdep_is_held(&trie->lock); the protection is real but not
machine-verifiable. trie_get_next_key() also uses bare
rcu_dereference() but is reachable only from the BPF syscall, which
holds classic rcu_read_lock() before dispatching, so it is left
untouched.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 694cea395fded425008e93cd90cfdf7a451674af Version: 694cea395fded425008e93cd90cfdf7a451674af Version: 694cea395fded425008e93cd90cfdf7a451674af Version: 694cea395fded425008e93cd90cfdf7a451674af Version: 694cea395fded425008e93cd90cfdf7a451674af Version: 694cea395fded425008e93cd90cfdf7a451674af Version: 694cea395fded425008e93cd90cfdf7a451674af |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/lpm_trie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f0967d4f1ba4323a3cb7dc8fdba74dd3a8caaf04",
"status": "affected",
"version": "694cea395fded425008e93cd90cfdf7a451674af",
"versionType": "git"
},
{
"lessThan": "304ca50582f0c047370f85e13caec456f78c9fcc",
"status": "affected",
"version": "694cea395fded425008e93cd90cfdf7a451674af",
"versionType": "git"
},
{
"lessThan": "ec662a8b2cde01e76b37ccd4b992d0342299e69c",
"status": "affected",
"version": "694cea395fded425008e93cd90cfdf7a451674af",
"versionType": "git"
},
{
"lessThan": "9bfdf4b81b0e56d47bc6c46c34a46638be716695",
"status": "affected",
"version": "694cea395fded425008e93cd90cfdf7a451674af",
"versionType": "git"
},
{
"lessThan": "57454944737f3ad9a8703aecbbb79713b513a94b",
"status": "affected",
"version": "694cea395fded425008e93cd90cfdf7a451674af",
"versionType": "git"
},
{
"lessThan": "bd6ad9a6b30498d845413e863fb95c6fab3babe3",
"status": "affected",
"version": "694cea395fded425008e93cd90cfdf7a451674af",
"versionType": "git"
},
{
"lessThan": "2f884d371fafea137afea504d49ee4a7c8d7985b",
"status": "affected",
"version": "694cea395fded425008e93cd90cfdf7a451674af",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/lpm_trie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Allow LPM map access from sleepable BPF programs\n\ntrie_lookup_elem() annotates its rcu_dereference_check() walks with\nonly rcu_read_lock_bh_held(). Because rcu_dereference_check(p, c)\nresolves to \"c || rcu_read_lock_held()\", this passes for XDP/NAPI and\nclassic RCU readers but fails for sleepable BPF programs, which enter\nvia __bpf_prog_enter_sleepable() and hold only rcu_read_lock_trace().\n\ntrie_update_elem() and trie_delete_elem() have the same problem in a\ndifferent form: they walk the trie with plain rcu_dereference(), which\nasserts rcu_read_lock_held() unconditionally. Both are reachable from\nsleepable BPF programs via the bpf_map_update_elem / bpf_map_delete_elem\nhelpers, and from the syscall path under classic rcu_read_lock(). In\nthe writer paths the trie is actually protected by trie-\u003elock (an\nrqspinlock taken across the walk); we never relied on the RCU read-side\nlock to keep nodes alive there.\n\nA sleepable LSM hook that ends up touching an LPM trie therefore\ntriggers lockdep on debug kernels:\n\n =============================\n WARNING: suspicious RCU usage\n 7.1.0-... Tainted: G E\n -----------------------------\n kernel/bpf/lpm_trie.c:249 suspicious rcu_dereference_check() usage!\n 1 lock held by net_tests/540:\n #0: (rcu_tasks_trace_srcu_struct){....}-{0:0},\n at: __bpf_prog_enter_sleepable+0x26/0x280\n Call Trace:\n dump_stack_lvl\n lockdep_rcu_suspicious\n trie_lookup_elem\n bpf_prog_..._enforce_security_socket_connect\n bpf_trampoline_...\n security_socket_connect\n __sys_connect\n do_syscall_64\n\nThis is lockdep-only -- no UAF, since Tasks Trace RCU does serialize\nagainst the trie\u0027s reclaim path -- but it spams the console once per\ndistinct callsite on every debug kernel running a sleepable BPF LSM\nthat touches an LPM trie, which is increasingly common.\n\nFor the lookup path, switch the rcu_dereference_check() annotation\nfrom rcu_read_lock_bh_held() to bpf_rcu_lock_held(), which accepts all\nthree contexts (classic, BH, Tasks Trace). Other map types already\nfollow this convention.\n\nFor trie_update_elem() and trie_delete_elem(), annotate the walks as\nrcu_dereference_protected(*p, 1) -- matching trie_free() in the same\nfile -- since trie-\u003elock is held across the walk. rqspinlock has no\nlockdep_map, so the predicate degenerates to \u00271\u0027 rather than\nlockdep_is_held(\u0026trie-\u003elock); the protection is real but not\nmachine-verifiable. trie_get_next_key() also uses bare\nrcu_dereference() but is reachable only from the BPF syscall, which\nholds classic rcu_read_lock() before dispatching, so it is left\nuntouched."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:57.862Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f0967d4f1ba4323a3cb7dc8fdba74dd3a8caaf04"
},
{
"url": "https://git.kernel.org/stable/c/304ca50582f0c047370f85e13caec456f78c9fcc"
},
{
"url": "https://git.kernel.org/stable/c/ec662a8b2cde01e76b37ccd4b992d0342299e69c"
},
{
"url": "https://git.kernel.org/stable/c/9bfdf4b81b0e56d47bc6c46c34a46638be716695"
},
{
"url": "https://git.kernel.org/stable/c/57454944737f3ad9a8703aecbbb79713b513a94b"
},
{
"url": "https://git.kernel.org/stable/c/bd6ad9a6b30498d845413e863fb95c6fab3babe3"
},
{
"url": "https://git.kernel.org/stable/c/2f884d371fafea137afea504d49ee4a7c8d7985b"
}
],
"title": "bpf: Allow LPM map access from sleepable BPF programs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64352",
"datePublished": "2026-07-25T08:50:11.522Z",
"dateReserved": "2026-07-19T15:36:31.782Z",
"dateUpdated": "2026-08-17T04:53:57.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64538 (GCVE-0-2026-64538)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
fib6_nh_mtu_change() re-fetches idev via __in6_dev_get(arg->dev) and
dereferences idev->cnf.mtu6 without a NULL check. addrconf_ifdown()
clears dev->ip6_ptr with RCU_INIT_POINTER() after rt6_disable_ip() has
released tb6_lock, so the RA-driven MTU walk can observe a NULL idev and
oops. The caller rt6_mtu_change_route() guards its own __in6_dev_get(),
but this re-fetch is unguarded; nexthop-backed routes survive
addrconf_ifdown()'s flush, so the walk still reaches it after ip6_ptr is
nulled.
Return 0 when idev is NULL, matching rt6_mtu_change_route() and the
fib6_mtu() fix in commit 5ad509c1fdad ("ipv6: Fix null-ptr-deref in
fib6_mtu().").
Oops: general protection fault, ... KASAN: null-ptr-deref in range
[0x00000000000002a8-0x00000000000002af]
RIP: 0010:fib6_nh_mtu_change+0x203/0x990
rt6_mtu_change_route+0x141/0x1d0
__fib6_clean_all+0xd0/0x160
rt6_mtu_change+0xb4/0x100
ndisc_router_discovery+0x24b5/0x2cb0
icmpv6_rcv+0x12e9/0x1710
ipv6_rcv+0x39b/0x410
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c0b220cf7d80eb8a36ae9f12cae6df4577a6814e Version: c0b220cf7d80eb8a36ae9f12cae6df4577a6814e Version: c0b220cf7d80eb8a36ae9f12cae6df4577a6814e Version: c0b220cf7d80eb8a36ae9f12cae6df4577a6814e Version: c0b220cf7d80eb8a36ae9f12cae6df4577a6814e Version: c0b220cf7d80eb8a36ae9f12cae6df4577a6814e Version: c0b220cf7d80eb8a36ae9f12cae6df4577a6814e Version: c0b220cf7d80eb8a36ae9f12cae6df4577a6814e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d08d019f2f43a6f9a71e81868bbc326b3afaf37b",
"status": "affected",
"version": "c0b220cf7d80eb8a36ae9f12cae6df4577a6814e",
"versionType": "git"
},
{
"lessThan": "1451deca9896957159f0666520a792c1b861af4f",
"status": "affected",
"version": "c0b220cf7d80eb8a36ae9f12cae6df4577a6814e",
"versionType": "git"
},
{
"lessThan": "b2c70dd3326809429b709a9c7e9220d29923051a",
"status": "affected",
"version": "c0b220cf7d80eb8a36ae9f12cae6df4577a6814e",
"versionType": "git"
},
{
"lessThan": "302d57ed7872838b40e56a868fb4c7da7da606e9",
"status": "affected",
"version": "c0b220cf7d80eb8a36ae9f12cae6df4577a6814e",
"versionType": "git"
},
{
"lessThan": "80600b5d0f3ecb9324120dc95b5e915130f516c5",
"status": "affected",
"version": "c0b220cf7d80eb8a36ae9f12cae6df4577a6814e",
"versionType": "git"
},
{
"lessThan": "b0d0eb13a0441a8ebf4f227843deaf494f1e2c33",
"status": "affected",
"version": "c0b220cf7d80eb8a36ae9f12cae6df4577a6814e",
"versionType": "git"
},
{
"lessThan": "6428634f7a0b7878144b4925c37856bef3224967",
"status": "affected",
"version": "c0b220cf7d80eb8a36ae9f12cae6df4577a6814e",
"versionType": "git"
},
{
"lessThan": "46c3b8191aad3d032776bf3bebf03efdf5f4b905",
"status": "affected",
"version": "c0b220cf7d80eb8a36ae9f12cae6df4577a6814e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: Fix null-ptr-deref in fib6_nh_mtu_change().\n\nfib6_nh_mtu_change() re-fetches idev via __in6_dev_get(arg-\u003edev) and\ndereferences idev-\u003ecnf.mtu6 without a NULL check. addrconf_ifdown()\nclears dev-\u003eip6_ptr with RCU_INIT_POINTER() after rt6_disable_ip() has\nreleased tb6_lock, so the RA-driven MTU walk can observe a NULL idev and\noops. The caller rt6_mtu_change_route() guards its own __in6_dev_get(),\nbut this re-fetch is unguarded; nexthop-backed routes survive\naddrconf_ifdown()\u0027s flush, so the walk still reaches it after ip6_ptr is\nnulled.\n\nReturn 0 when idev is NULL, matching rt6_mtu_change_route() and the\nfib6_mtu() fix in commit 5ad509c1fdad (\"ipv6: Fix null-ptr-deref in\nfib6_mtu().\").\n\n Oops: general protection fault, ... KASAN: null-ptr-deref in range\n [0x00000000000002a8-0x00000000000002af]\n RIP: 0010:fib6_nh_mtu_change+0x203/0x990\n rt6_mtu_change_route+0x141/0x1d0\n __fib6_clean_all+0xd0/0x160\n rt6_mtu_change+0xb4/0x100\n ndisc_router_discovery+0x24b5/0x2cb0\n icmpv6_rcv+0x12e9/0x1710\n ipv6_rcv+0x39b/0x410"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:14.474Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d08d019f2f43a6f9a71e81868bbc326b3afaf37b"
},
{
"url": "https://git.kernel.org/stable/c/1451deca9896957159f0666520a792c1b861af4f"
},
{
"url": "https://git.kernel.org/stable/c/b2c70dd3326809429b709a9c7e9220d29923051a"
},
{
"url": "https://git.kernel.org/stable/c/302d57ed7872838b40e56a868fb4c7da7da606e9"
},
{
"url": "https://git.kernel.org/stable/c/80600b5d0f3ecb9324120dc95b5e915130f516c5"
},
{
"url": "https://git.kernel.org/stable/c/b0d0eb13a0441a8ebf4f227843deaf494f1e2c33"
},
{
"url": "https://git.kernel.org/stable/c/6428634f7a0b7878144b4925c37856bef3224967"
},
{
"url": "https://git.kernel.org/stable/c/46c3b8191aad3d032776bf3bebf03efdf5f4b905"
}
],
"title": "ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64538",
"datePublished": "2026-07-27T20:10:32.779Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-17T04:57:14.474Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64371 (GCVE-0-2026-64371)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
proc: protect ptrace_may_access() with exec_update_lock (part 1)
Fix the easy cases where procfs currently calls ptrace_may_access() without
exec_update_lock protection, where the fix is to simply add the extra lock
or use mm_access():
- do_task_stat(): grab exec_update_lock
- proc_pid_wchan(): grab exec_update_lock
- proc_map_files_lookup(): use mm_access() instead of get_task_mm()
- proc_map_files_readdir(): use mm_access() instead of get_task_mm()
- proc_ns_get_link(): grab exec_update_lock
- proc_ns_readlink(): grab exec_update_lock
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f83ce3e6b02d5e48b3a43b001390e2b58820389d Version: f83ce3e6b02d5e48b3a43b001390e2b58820389d Version: f83ce3e6b02d5e48b3a43b001390e2b58820389d Version: f83ce3e6b02d5e48b3a43b001390e2b58820389d Version: f83ce3e6b02d5e48b3a43b001390e2b58820389d Version: f83ce3e6b02d5e48b3a43b001390e2b58820389d Version: f83ce3e6b02d5e48b3a43b001390e2b58820389d Version: f83ce3e6b02d5e48b3a43b001390e2b58820389d Version: 6b06d6282100dd5aacf7d45443d651a1995bd9c4 Version: 334ed22054b2ec8477e4409e214fc139cf937ef6 Version: 2.6.27.23 ≤ Version: 2.6.29.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/proc/array.c",
"fs/proc/base.c",
"fs/proc/namespaces.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae1e630bcaac739f625822078edbaea98366930d",
"status": "affected",
"version": "f83ce3e6b02d5e48b3a43b001390e2b58820389d",
"versionType": "git"
},
{
"lessThan": "d54f14655fd7d7b293698a8b6918563c4c0465e7",
"status": "affected",
"version": "f83ce3e6b02d5e48b3a43b001390e2b58820389d",
"versionType": "git"
},
{
"lessThan": "bb43679356f1f2a4c6b1c88aec4f021e5b5c74e9",
"status": "affected",
"version": "f83ce3e6b02d5e48b3a43b001390e2b58820389d",
"versionType": "git"
},
{
"lessThan": "7456ae990a9738962b33146916fabca62ae3d4e0",
"status": "affected",
"version": "f83ce3e6b02d5e48b3a43b001390e2b58820389d",
"versionType": "git"
},
{
"lessThan": "4bfe8c481846cee52473a2f7d7b30ee8e6749fc4",
"status": "affected",
"version": "f83ce3e6b02d5e48b3a43b001390e2b58820389d",
"versionType": "git"
},
{
"lessThan": "f9b4b03ccc9c69bf7f7298d4559906ebea7143b3",
"status": "affected",
"version": "f83ce3e6b02d5e48b3a43b001390e2b58820389d",
"versionType": "git"
},
{
"lessThan": "c1cfd63326f5d09999134e9052c353faf738286e",
"status": "affected",
"version": "f83ce3e6b02d5e48b3a43b001390e2b58820389d",
"versionType": "git"
},
{
"lessThan": "6650527444dadc63d84aa939d14ecba4fadb2f69",
"status": "affected",
"version": "f83ce3e6b02d5e48b3a43b001390e2b58820389d",
"versionType": "git"
},
{
"status": "affected",
"version": "6b06d6282100dd5aacf7d45443d651a1995bd9c4",
"versionType": "git"
},
{
"status": "affected",
"version": "334ed22054b2ec8477e4409e214fc139cf937ef6",
"versionType": "git"
},
{
"lessThan": "2.6.28",
"status": "affected",
"version": "2.6.27.23",
"versionType": "semver"
},
{
"lessThan": "2.6.30",
"status": "affected",
"version": "2.6.29.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/proc/array.c",
"fs/proc/base.c",
"fs/proc/namespaces.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.27.23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.29.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nproc: protect ptrace_may_access() with exec_update_lock (part 1)\n\nFix the easy cases where procfs currently calls ptrace_may_access() without\nexec_update_lock protection, where the fix is to simply add the extra lock\nor use mm_access():\n\n - do_task_stat(): grab exec_update_lock\n - proc_pid_wchan(): grab exec_update_lock\n - proc_map_files_lookup(): use mm_access() instead of get_task_mm()\n - proc_map_files_readdir(): use mm_access() instead of get_task_mm()\n - proc_ns_get_link(): grab exec_update_lock\n - proc_ns_readlink(): grab exec_update_lock"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:21.091Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae1e630bcaac739f625822078edbaea98366930d"
},
{
"url": "https://git.kernel.org/stable/c/d54f14655fd7d7b293698a8b6918563c4c0465e7"
},
{
"url": "https://git.kernel.org/stable/c/bb43679356f1f2a4c6b1c88aec4f021e5b5c74e9"
},
{
"url": "https://git.kernel.org/stable/c/7456ae990a9738962b33146916fabca62ae3d4e0"
},
{
"url": "https://git.kernel.org/stable/c/4bfe8c481846cee52473a2f7d7b30ee8e6749fc4"
},
{
"url": "https://git.kernel.org/stable/c/f9b4b03ccc9c69bf7f7298d4559906ebea7143b3"
},
{
"url": "https://git.kernel.org/stable/c/c1cfd63326f5d09999134e9052c353faf738286e"
},
{
"url": "https://git.kernel.org/stable/c/6650527444dadc63d84aa939d14ecba4fadb2f69"
}
],
"title": "proc: protect ptrace_may_access() with exec_update_lock (part 1)",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64371",
"datePublished": "2026-07-25T08:50:23.981Z",
"dateReserved": "2026-07-19T15:36:31.783Z",
"dateUpdated": "2026-08-17T04:54:21.091Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64549 (GCVE-0-2026-64549)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
bpa10x_setup() sends the vendor command 0xfc0e and passes the response
to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at
skb->data + 1, without checking the length:
bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
hci_set_fw_info(hdev, "%s", skb->data + 1);
A device that returns a one-byte response (status only) leaves
skb->data + 1 past the end of the data, and the %s walk reads adjacent
slab memory until it meets a NUL. The same happens when the payload is
not NUL-terminated within skb->len. The out-of-bounds bytes end up in
the kernel log and the firmware-info debugfs file.
Print the revision string with a bounded "%.*s" limited to skb->len - 1
instead. This keeps the string readable for well-behaved devices while
never reading past the received data, and does not fail setup, so a
device returning a short or unterminated response keeps working.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ddd68ec8f4847b460c9f580076eafe13b031a6fd Version: ddd68ec8f4847b460c9f580076eafe13b031a6fd Version: ddd68ec8f4847b460c9f580076eafe13b031a6fd Version: ddd68ec8f4847b460c9f580076eafe13b031a6fd Version: ddd68ec8f4847b460c9f580076eafe13b031a6fd Version: ddd68ec8f4847b460c9f580076eafe13b031a6fd Version: ddd68ec8f4847b460c9f580076eafe13b031a6fd Version: ddd68ec8f4847b460c9f580076eafe13b031a6fd |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/bpa10x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1813add71e386f77b3040e6c8dc9b7b3ff965a6c",
"status": "affected",
"version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
"versionType": "git"
},
{
"lessThan": "bd56c23f1f8681a2857ee924a8bd3abf87c8913b",
"status": "affected",
"version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
"versionType": "git"
},
{
"lessThan": "7a64f39ebe1bacd9004a62eceadac0b122ec3cc2",
"status": "affected",
"version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
"versionType": "git"
},
{
"lessThan": "f80b4afe893dffa9fabdbf80fb4d6782b24a6793",
"status": "affected",
"version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
"versionType": "git"
},
{
"lessThan": "4b4008dda1d0c6e598d7865631ad4eda63a560f0",
"status": "affected",
"version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
"versionType": "git"
},
{
"lessThan": "bfc9e7be289df11e8e38c98cd78019d67fdd0bd5",
"status": "affected",
"version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
"versionType": "git"
},
{
"lessThan": "a8e169d308775039200bb9c905c7ce420db6e8c5",
"status": "affected",
"version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
"versionType": "git"
},
{
"lessThan": "dd068ef044128db655f48323a4acfd5907e04903",
"status": "affected",
"version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bluetooth/bpa10x.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()\n\nbpa10x_setup() sends the vendor command 0xfc0e and passes the response\nto bt_dev_info() and hci_set_fw_info() as a \"%s\" string starting at\nskb-\u003edata + 1, without checking the length:\n\n\tbt_dev_info(hdev, \"%s\", (char *)(skb-\u003edata + 1));\n\thci_set_fw_info(hdev, \"%s\", skb-\u003edata + 1);\n\nA device that returns a one-byte response (status only) leaves\nskb-\u003edata + 1 past the end of the data, and the %s walk reads adjacent\nslab memory until it meets a NUL. The same happens when the payload is\nnot NUL-terminated within skb-\u003elen. The out-of-bounds bytes end up in\nthe kernel log and the firmware-info debugfs file.\n\nPrint the revision string with a bounded \"%.*s\" limited to skb-\u003elen - 1\ninstead. This keeps the string readable for well-behaved devices while\nnever reading past the received data, and does not fail setup, so a\ndevice returning a short or unterminated response keeps working."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:26.570Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1813add71e386f77b3040e6c8dc9b7b3ff965a6c"
},
{
"url": "https://git.kernel.org/stable/c/bd56c23f1f8681a2857ee924a8bd3abf87c8913b"
},
{
"url": "https://git.kernel.org/stable/c/7a64f39ebe1bacd9004a62eceadac0b122ec3cc2"
},
{
"url": "https://git.kernel.org/stable/c/f80b4afe893dffa9fabdbf80fb4d6782b24a6793"
},
{
"url": "https://git.kernel.org/stable/c/4b4008dda1d0c6e598d7865631ad4eda63a560f0"
},
{
"url": "https://git.kernel.org/stable/c/bfc9e7be289df11e8e38c98cd78019d67fdd0bd5"
},
{
"url": "https://git.kernel.org/stable/c/a8e169d308775039200bb9c905c7ce420db6e8c5"
},
{
"url": "https://git.kernel.org/stable/c/dd068ef044128db655f48323a4acfd5907e04903"
}
],
"title": "Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64549",
"datePublished": "2026-07-27T20:10:38.894Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-17T04:57:26.570Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64441 (GCVE-0-2026-64441)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-08-17 04:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
Three IE/attribute parsing functions have missing bounds checks.
rtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer
without verifying that the header bytes (tag + length) are within the
remaining buffer before reading them. Additionally, rtw_get_sec_ie()
compares the 4-byte WPA OUI at cnt+2 without checking that at least
6 bytes remain, and rtw_get_wapi_ie() compares a 4-byte WAPI OUI at
cnt+6 without checking that at least 10 bytes remain.
rtw_get_wps_attr() reads wps_ie[0] and wps_ie+2 unconditionally at
entry, before verifying that wps_ielen is large enough to contain
the 6-byte WPS IE header (element_id + length + 4-byte OUI). Inside
the attribute loop, get_unaligned_be16() is called on attr_ptr and
attr_ptr+2 without checking that 4 bytes remain in the buffer.
Add a cnt+2 bounds check before each loop body in rtw_get_sec_ie()
and rtw_get_wapi_ie(), guard each multi-byte comparison with a minimum
IE length requirement, add a wps_ielen < 6 early return in
rtw_get_wps_attr(), and add a 4-byte bounds check in its inner loop.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b Version: 554c0a3abf216c991c5ebddcdb2c08689ecd290b |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_ieee80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "efa27d487abcdec79669a60a6d94d5d6eceb7c1d",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "2ea1ce30ead61589214240e8d33d96310fd613e5",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "b27ecba3196f6c14e3809595ebd69c0c2392512a",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "6ab1161e539fb7a1c8b35ff5a6ced4702e855b9c",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "4b51ee8a40fe47864197d73cc02b191de7a6b072",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "729c4e72563bda0f1725db1db9ea08df06f41d9b",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
},
{
"lessThan": "1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344",
"status": "affected",
"version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/rtl8723bs/core/rtw_ieee80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()\n\nThree IE/attribute parsing functions have missing bounds checks.\n\nrtw_get_sec_ie() and rtw_get_wapi_ie() iterate over a raw IE buffer\nwithout verifying that the header bytes (tag + length) are within the\nremaining buffer before reading them. Additionally, rtw_get_sec_ie()\ncompares the 4-byte WPA OUI at cnt+2 without checking that at least\n6 bytes remain, and rtw_get_wapi_ie() compares a 4-byte WAPI OUI at\ncnt+6 without checking that at least 10 bytes remain.\n\nrtw_get_wps_attr() reads wps_ie[0] and wps_ie+2 unconditionally at\nentry, before verifying that wps_ielen is large enough to contain\nthe 6-byte WPS IE header (element_id + length + 4-byte OUI). Inside\nthe attribute loop, get_unaligned_be16() is called on attr_ptr and\nattr_ptr+2 without checking that 4 bytes remain in the buffer.\n\nAdd a cnt+2 bounds check before each loop body in rtw_get_sec_ie()\nand rtw_get_wapi_ie(), guard each multi-byte comparison with a minimum\nIE length requirement, add a wps_ielen \u003c 6 early return in\nrtw_get_wps_attr(), and add a 4-byte bounds check in its inner loop."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - Malformed beacon or probe-response information elements reach the vulnerable parsers over the air, so the attacker only needs to be within Wi-Fi radio range.\nAC:L - A crafted truncated WPS Selected Registrar attribute followed by controlled IE data deterministically supplies the out-of-bounds length; no race or uncontrollable condition is required.\nPR:N - Beacon and probe-response management frames are processed before association or authentication, and no capability or credential check gates this path.\nUI:N - The driver processes beacons automatically, and routine system-initiated scans reach the WPS path without human action.\nS:U - Exploitation compromises the kernel of the affected host without crossing a separate virtualization or authorization boundary.\nC:H - The out-of-bounds attribute length reaches a copy into a one-byte stack object, permitting control-flow corruption and potential kernel code execution with access to arbitrary kernel-resident data.\nI:H - The attacker can make adjacent controlled frame bytes overflow the one-byte stack destination, potentially overwriting control data and executing arbitrary kernel code.\nA:H - The bounded OOB reads can fault, while the derived stack overflow can trigger an oops, stack-canary panic, or control-flow failure and can be repeated using injected management frames."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:55:43.148Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/efa27d487abcdec79669a60a6d94d5d6eceb7c1d"
},
{
"url": "https://git.kernel.org/stable/c/2ea1ce30ead61589214240e8d33d96310fd613e5"
},
{
"url": "https://git.kernel.org/stable/c/b27ecba3196f6c14e3809595ebd69c0c2392512a"
},
{
"url": "https://git.kernel.org/stable/c/6ab1161e539fb7a1c8b35ff5a6ced4702e855b9c"
},
{
"url": "https://git.kernel.org/stable/c/4b51ee8a40fe47864197d73cc02b191de7a6b072"
},
{
"url": "https://git.kernel.org/stable/c/729c4e72563bda0f1725db1db9ea08df06f41d9b"
},
{
"url": "https://git.kernel.org/stable/c/1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344"
}
],
"title": "staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64441",
"datePublished": "2026-07-25T08:51:13.834Z",
"dateReserved": "2026-07-19T15:36:31.788Z",
"dateUpdated": "2026-08-17T04:55:43.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64551 (GCVE-0-2026-64551)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: validate STALE_COOKIE cause length before reading staleness
When an ERROR chunk with a STALE_COOKIE cause is received in the
COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure
of Staleness that follows the cause header:
err = (struct sctp_errhdr *)(chunk->skb->data);
stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));
err is the first cause in the chunk, not the STALE_COOKIE cause that
caused the dispatch, and nothing guarantees the staleness field is
present. sctp_walk_errors() only requires a cause to be as long as the
4-byte header, so for a STALE_COOKIE cause of length 4 the read runs
past the cause, and for a minimal ERROR chunk past skb->tail. The value
is echoed to the peer in the Cookie Preservative of the reply INIT,
leaking uninitialized memory.
sctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so
check its length there and pass it to sctp_sf_do_5_2_6_stale(), which
reads that cause instead of the first one. A STALE_COOKIE cause too
short to hold the staleness field is discarded.
The read is reachable by any peer that can drive an association into
COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket
in a user and network namespace.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_statefuns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6022da37786701df1fc5dd946a6dcba59d5473b1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "861f884f5471632c731cbbd612a1c072e391a624",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "588706ebaf8cdb4a4161602949eba365514b1db1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a257b41ddfe9e327b26581ad2777f04b23ac73f5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "08a8f2d13f703924316e9aeac863a88ef50990c7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ebe0a55d954fa8da383b6192edb8f763dcb002d5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "bbd6b2ea966cf57b6ae095cf5a8dbc993cd197a0",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "1cd23ca80784223fa2204e16203f754da4e821f8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sctp/sm_statefuns.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: validate STALE_COOKIE cause length before reading staleness\n\nWhen an ERROR chunk with a STALE_COOKIE cause is received in the\nCOOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure\nof Staleness that follows the cause header:\n\n\terr = (struct sctp_errhdr *)(chunk-\u003eskb-\u003edata);\n\tstale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));\n\nerr is the first cause in the chunk, not the STALE_COOKIE cause that\ncaused the dispatch, and nothing guarantees the staleness field is\npresent. sctp_walk_errors() only requires a cause to be as long as the\n4-byte header, so for a STALE_COOKIE cause of length 4 the read runs\npast the cause, and for a minimal ERROR chunk past skb-\u003etail. The value\nis echoed to the peer in the Cookie Preservative of the reply INIT,\nleaking uninitialized memory.\n\nsctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so\ncheck its length there and pass it to sctp_sf_do_5_2_6_stale(), which\nreads that cause instead of the first one. A STALE_COOKIE cause too\nshort to hold the staleness field is discarded.\n\nThe read is reachable by any peer that can drive an association into\nCOOKIE_ECHOED, including an unprivileged process using a raw SCTP socket\nin a user and network namespace."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable code is in the SCTP receive-side state machine and is driven entirely by an attacker-crafted ERROR chunk arriving over the network; no local access is needed. Per kernel guidance, net/ stack bugs reachable via received packets (SCTP explicitly) are Network.\nAC:L - The attacker fully controls the trigger: acting as the SCTP peer it answers INIT with INIT-ACK to place the association in COOKIE_ECHOED, then sends a minimal ERROR chunk with a 4-byte STALE_COOKIE cause as the last chunk in the packet. There is no race, no memory-layout dependency, and the vtag needed is the one the victim itself advertised in its INIT.\nPR:N - SCTP association setup is unauthenticated; the only check is sctp_vtag_verify() against a tag the peer already received in the victim\u0027s INIT. The attacker needs no credentials or privileges on the target system.\nUI:N - No human user action is required \u2014 SCTP client daemons (SIGTRAN, Diameter, cluster transports) establish and retry associations automatically, and an on-path attacker can inject the ERROR into an in-progress handshake. In the local variant an unprivileged process creates both sides itself with no user involved.\nS:U - The out-of-bounds read and the resulting disclosure stay within the kernel\u0027s own security authority; no VM, sandbox, or IOMMU boundary is crossed.\nC:H - Uninitialized kernel memory past skb-\u003etail is read and then transmitted straight back to the attacker inside the reply INIT\u0027s Cookie Preservative parameter, and the attack can be repeated indefinitely to sample recycled network-buffer memory that may contain remnants of other connections\u0027 traffic. This is a remote, unauthenticated, repeatable kernel heap disclosure oracle, matching the C:H treatment given to the sibling SCTP uninit-read CVE-2026-53225.\nI:N - The bug is a pure read; nothing in kernel memory or in the victim\u0027s association state is modified. The only affected value is a protocol field in a packet sent to the attacker itself.\nA:H - The read runs past the end of the received packet data, a memory-safety violation whose target is not proven to remain inside the skb\u0027s allocation across all receive paths (GSO/frag_list segments, UDP-encapsulated and linearized skbs), so it can fault and oops; kernel guidance and the CNA\u0027s scoring of the equivalent SCTP out-of-bounds-read bug both treat this class as A:H."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:28.771Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6022da37786701df1fc5dd946a6dcba59d5473b1"
},
{
"url": "https://git.kernel.org/stable/c/861f884f5471632c731cbbd612a1c072e391a624"
},
{
"url": "https://git.kernel.org/stable/c/588706ebaf8cdb4a4161602949eba365514b1db1"
},
{
"url": "https://git.kernel.org/stable/c/a257b41ddfe9e327b26581ad2777f04b23ac73f5"
},
{
"url": "https://git.kernel.org/stable/c/08a8f2d13f703924316e9aeac863a88ef50990c7"
},
{
"url": "https://git.kernel.org/stable/c/ebe0a55d954fa8da383b6192edb8f763dcb002d5"
},
{
"url": "https://git.kernel.org/stable/c/bbd6b2ea966cf57b6ae095cf5a8dbc993cd197a0"
},
{
"url": "https://git.kernel.org/stable/c/1cd23ca80784223fa2204e16203f754da4e821f8"
}
],
"title": "sctp: validate STALE_COOKIE cause length before reading staleness",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64551",
"datePublished": "2026-07-27T20:10:40.012Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-17T04:57:28.771Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64557 (GCVE-0-2026-64557)
Vulnerability from cvelistv5
Published
2026-07-29 08:01
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after
release_sock(parent). Once the parent lock is dropped the newly
enqueued child socket sk is reachable via the accept queue, so another
task can accept and free it before the callback dereferences sk,
resulting in a use-after-free.
Rework the ->new_connection() op so the core, rather than the callback,
owns the child channel's lifetime. The op now receives a pre-allocated
new_chan and returns an errno instead of allocating and returning a
channel. l2cap_new_connection() allocates the child channel and links
it into the conn list via __l2cap_chan_add() before invoking the
callback, so the conn-list reference keeps the channel alive once
release_sock(parent) exposes the socket to other tasks.
Channel configuration that was duplicated in l2cap_sock_init() and the
various new_connection callbacks is consolidated into
l2cap_chan_set_defaults(), which now inherits from the parent channel
when one is supplied.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8ffb929098a56939ac71509302eeab5b207bf262 Version: 8ffb929098a56939ac71509302eeab5b207bf262 Version: 8ffb929098a56939ac71509302eeab5b207bf262 Version: 8ffb929098a56939ac71509302eeab5b207bf262 Version: 8ffb929098a56939ac71509302eeab5b207bf262 Version: 8ffb929098a56939ac71509302eeab5b207bf262 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/l2cap.h",
"net/bluetooth/6lowpan.c",
"net/bluetooth/l2cap_core.c",
"net/bluetooth/l2cap_sock.c",
"net/bluetooth/smp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b39298044e5534612511a2ff5de03ba5f6e7a820",
"status": "affected",
"version": "8ffb929098a56939ac71509302eeab5b207bf262",
"versionType": "git"
},
{
"lessThan": "8c37e4338c801ebb8cee52436c01c41e009f6e87",
"status": "affected",
"version": "8ffb929098a56939ac71509302eeab5b207bf262",
"versionType": "git"
},
{
"lessThan": "84e718b6a814edc84159361f9f454a4e92ae91ae",
"status": "affected",
"version": "8ffb929098a56939ac71509302eeab5b207bf262",
"versionType": "git"
},
{
"lessThan": "36da806f7fbaee56ad9e81859deec203f9728700",
"status": "affected",
"version": "8ffb929098a56939ac71509302eeab5b207bf262",
"versionType": "git"
},
{
"lessThan": "733e76e74e406c1d1ddc7369420dd8a47f48bb8a",
"status": "affected",
"version": "8ffb929098a56939ac71509302eeab5b207bf262",
"versionType": "git"
},
{
"lessThan": "6fef032af0092ed5ccb767239a9ac1bc38c08a40",
"status": "affected",
"version": "8ffb929098a56939ac71509302eeab5b207bf262",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/l2cap.h",
"net/bluetooth/6lowpan.c",
"net/bluetooth/l2cap_core.c",
"net/bluetooth/l2cap_sock.c",
"net/bluetooth/smp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.13"
},
{
"lessThan": "3.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n\nl2cap_sock_new_connection_cb() returned l2cap_pi(sk)-\u003echan after\nrelease_sock(parent). Once the parent lock is dropped the newly\nenqueued child socket sk is reachable via the accept queue, so another\ntask can accept and free it before the callback dereferences sk,\nresulting in a use-after-free.\n\nRework the -\u003enew_connection() op so the core, rather than the callback,\nowns the child channel\u0027s lifetime. The op now receives a pre-allocated\nnew_chan and returns an errno instead of allocating and returning a\nchannel. l2cap_new_connection() allocates the child channel and links\nit into the conn list via __l2cap_chan_add() before invoking the\ncallback, so the conn-list reference keeps the channel alive once\nrelease_sock(parent) exposes the socket to other tasks.\n\nChannel configuration that was duplicated in l2cap_sock_init() and the\nvarious new_connection callbacks is consolidated into\nl2cap_chan_set_defaults(), which now inherits from the parent channel\nwhen one is supplied."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable callback is reached only from L2CAP signalling handlers (`l2cap_connect`, `l2cap_le_connect_req`, `l2cap_ecred_conn_req`, `l2cap_connect_cfm`) processing connection requests received from a remote Bluetooth peer. Bluetooth radio range constitutes an adjacent network.\nAC:L - The attacker drives one side of the race by sending unlimited L2CAP connect requests and can induce the other side, since the local daemon accepts (immediately, for DEFER_SETUP listeners) and closes rejected/unauthorized children; on SMP the accepting task runs truly concurrently while the callback is still inside `release_sock()`, so the window is hit reliably with repeated attempts.\nPR:N - `l2cap_connect()` bypasses the link-mode and encryption-key-size checks entirely for PSM 0x0001 (SDP), where bluetoothd holds a listening L2CAP socket, so an unpaired and unauthenticated remote device can reach `l2cap_sock_new_connection_cb()`; LE CoC and low-security BR/EDR listeners are likewise reachable without credentials.\nUI:N - Incoming L2CAP connection requests are processed automatically by the kernel and accepted by the always-running Bluetooth daemon with no victim action, no pairing prompt, and no user confirmation.\nS:U - The corrupted `l2cap_chan`/`sock` objects and the resulting memory corruption are confined to the kernel\u0027s own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free: the freed `l2cap_chan` slab object can be reallocated with attacker-groomed data and its fields are subsequently read back and transmitted to the attacker via the connect response and `l2cap_build_conf_req()`, and `__l2cap_chan_add()` deposits kernel list pointers into the reallocated object, giving a kernel-memory disclosure primitive.\nI:H - After the free, `l2cap_connect()`/`l2cap_le_connect_req()` write attacker-supplied PSM, SCID, MTU/MPS and BD_ADDR values plus list pointers into the freed object, and `__set_chan_timer()` arms delayed work whose function pointers live in that freed memory \u2014 a controlled write primitive suitable for heap spraying and control-flow hijack.\nA:H - Even without successful exploitation, the use-after-free reads and writes into freed slab memory and links a dead object into the conn list, reliably producing kernel oops/panic and corrupted list traversal on subsequent L2CAP operations."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:35.594Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b39298044e5534612511a2ff5de03ba5f6e7a820"
},
{
"url": "https://git.kernel.org/stable/c/8c37e4338c801ebb8cee52436c01c41e009f6e87"
},
{
"url": "https://git.kernel.org/stable/c/84e718b6a814edc84159361f9f454a4e92ae91ae"
},
{
"url": "https://git.kernel.org/stable/c/36da806f7fbaee56ad9e81859deec203f9728700"
},
{
"url": "https://git.kernel.org/stable/c/733e76e74e406c1d1ddc7369420dd8a47f48bb8a"
},
{
"url": "https://git.kernel.org/stable/c/6fef032af0092ed5ccb767239a9ac1bc38c08a40"
}
],
"title": "Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64557",
"datePublished": "2026-07-29T08:01:47.462Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-17T04:57:35.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64510 (GCVE-0-2026-64510)
Vulnerability from cvelistv5
Published
2026-07-25 08:52
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
If acpi_nfit_init() fails after adding the acpi_desc object to the
acpi_descs list, that object is never removed from that list because
the acpi_nfit_shutdown() devm action is not added for the NFIT device
in that case. Next, the acpi_nfit_init() failure causes
acpi_nfit_probe() to fail, the acpi_desc object is freed, and a
dangling pointer is left behind in the acpi_descs. Any subsequent
ACPI Machine Check Exception will trigger nfit_handle_mce() which
iterates over acpi_descs and so a use-after-free will occur.
Moreover, if acpi_nfit_probe() returns 0 after installing a notify
handler for the NFIT device and without allocating the acpi_desc
object and setting the NFIT device's driver data pointer, the
acpi_desc object will be allocated by acpi_nfit_update_notify()
and acpi_nfit_init() will be called to initialize it. Regardless
of whether or not acpi_nfit_init() fails in that case, the
acpi_nfit_shutdown() devm action is not added for the NFIT device
and acpi_desc is never removed from the acpi_descs list. If the
acpi_desc object is freed subsequently on driver removal, any
subsequent ACPI MCE will lead to a use-after-free like in the
previous case.
To address the first issue mentioned above, make acpi_nfit_probe()
call acpi_nfit_shutdown() directly on acpi_nfit_init() failures and
to address the other one, add a remove callback to the driver and
make it call acpi_nfit_shutdown(). Also, since it is now possible to
pass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it
may not have been initialized, add checks against NULL for acpi_desc and
its nvdimm_bus field to that function and make acpi_nfit_unregister()
clear the latter after unregistering the NVDIMM bus.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a61fe6f7902ecaa89d5e6c709490fc4324927134 Version: a61fe6f7902ecaa89d5e6c709490fc4324927134 Version: a61fe6f7902ecaa89d5e6c709490fc4324927134 Version: a61fe6f7902ecaa89d5e6c709490fc4324927134 Version: a61fe6f7902ecaa89d5e6c709490fc4324927134 Version: a61fe6f7902ecaa89d5e6c709490fc4324927134 Version: a61fe6f7902ecaa89d5e6c709490fc4324927134 Version: a61fe6f7902ecaa89d5e6c709490fc4324927134 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/nfit/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ee82078e776ae31266cc70fdf62ac17c3c6f100a",
"status": "affected",
"version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
"versionType": "git"
},
{
"lessThan": "6ff054cc02a763914773b026cacb429e5fbf64fa",
"status": "affected",
"version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
"versionType": "git"
},
{
"lessThan": "b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4",
"status": "affected",
"version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
"versionType": "git"
},
{
"lessThan": "c127dbd832bd4b9aef8a749d9f491b74042f9b47",
"status": "affected",
"version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
"versionType": "git"
},
{
"lessThan": "df7c92216a1583a76cb0cbf2f21cd68870609b05",
"status": "affected",
"version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
"versionType": "git"
},
{
"lessThan": "3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa",
"status": "affected",
"version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
"versionType": "git"
},
{
"lessThan": "7d69235bdc581a4346e9bcd6a8bea37d3e1abd25",
"status": "affected",
"version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
"versionType": "git"
},
{
"lessThan": "38bf27511ef41bffebd157ec3eba41fc89ba59cd",
"status": "affected",
"version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/acpi/nfit/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: NFIT: core: Fix acpi_nfit_init() error cleanup\n\nIf acpi_nfit_init() fails after adding the acpi_desc object to the\nacpi_descs list, that object is never removed from that list because\nthe acpi_nfit_shutdown() devm action is not added for the NFIT device\nin that case. Next, the acpi_nfit_init() failure causes\nacpi_nfit_probe() to fail, the acpi_desc object is freed, and a\ndangling pointer is left behind in the acpi_descs. Any subsequent\nACPI Machine Check Exception will trigger nfit_handle_mce() which\niterates over acpi_descs and so a use-after-free will occur.\n\nMoreover, if acpi_nfit_probe() returns 0 after installing a notify\nhandler for the NFIT device and without allocating the acpi_desc\nobject and setting the NFIT device\u0027s driver data pointer, the\nacpi_desc object will be allocated by acpi_nfit_update_notify()\nand acpi_nfit_init() will be called to initialize it. Regardless\nof whether or not acpi_nfit_init() fails in that case, the\nacpi_nfit_shutdown() devm action is not added for the NFIT device\nand acpi_desc is never removed from the acpi_descs list. If the\nacpi_desc object is freed subsequently on driver removal, any\nsubsequent ACPI MCE will lead to a use-after-free like in the\nprevious case.\n\nTo address the first issue mentioned above, make acpi_nfit_probe()\ncall acpi_nfit_shutdown() directly on acpi_nfit_init() failures and\nto address the other one, add a remove callback to the driver and\nmake it call acpi_nfit_shutdown(). Also, since it is now possible to\npass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it\nmay not have been initialized, add checks against NULL for acpi_desc and\nits nvdimm_bus field to that function and make acpi_nfit_unregister()\nclear the latter after unregistering the NVDIMM bus."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - No network, wireless, or user-namespace interface reaches this path; the highest reasonable attack path is a local process triggering a qualifying MCE through an accessible poisoned memory mapping.\nAC:H - Exploitation requires a descriptor already made stale by NFIT initialization failure or late initialization followed by removal, plus a usable-address uncorrectable MCE. An unprivileged attacker cannot reliably create all these firmware and hardware conditions.\nPR:L - Once the stale state and poisoned mapping exist, a basic local account can trigger the MCE and spray reclaimed heap memory without capabilities. Deterministic driver removal or software MCE injection is root-only, but is unnecessary in this higher-severity plausible scenario.\nUI:N - No action by another user is required after the vulnerable system state exists; the attacker can access the relevant memory directly.\nS:U - The UAF compromises the same host kernel and does not inherently cross a VM, IOMMU, or other security-authority boundary.\nC:H - The freed descriptor and its subordinate SPA objects contain attacker-reclaimable pointers and linked lists, permitting controlled kernel-memory dereferences and potential arbitrary disclosure.\nI:H - Locking the freed embedded mutex already writes to reclaimed memory, while controlled bus, region, and list pointers can provide stronger write primitives and potential kernel code execution.\nA:H - The dangling descriptor is traversed during MCE processing and can cause an invalid mutex operation, invalid pointer dereference, deadlock, oops, or kernel panic, as established by the [published record](https://nvd.nist.gov/vuln/detail/CVE-2026-64510)."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:01.009Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ee82078e776ae31266cc70fdf62ac17c3c6f100a"
},
{
"url": "https://git.kernel.org/stable/c/6ff054cc02a763914773b026cacb429e5fbf64fa"
},
{
"url": "https://git.kernel.org/stable/c/b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4"
},
{
"url": "https://git.kernel.org/stable/c/c127dbd832bd4b9aef8a749d9f491b74042f9b47"
},
{
"url": "https://git.kernel.org/stable/c/df7c92216a1583a76cb0cbf2f21cd68870609b05"
},
{
"url": "https://git.kernel.org/stable/c/3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa"
},
{
"url": "https://git.kernel.org/stable/c/7d69235bdc581a4346e9bcd6a8bea37d3e1abd25"
},
{
"url": "https://git.kernel.org/stable/c/38bf27511ef41bffebd157ec3eba41fc89ba59cd"
}
],
"title": "ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64510",
"datePublished": "2026-07-25T08:52:03.208Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-08-17T04:57:01.009Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64550 (GCVE-0-2026-64550)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: qualcomm: rmnet: validate MAP frame length before ingress parsing
When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes
the skb straight to __rmnet_map_ingress_handler(), skipping the length
validation that rmnet_map_deaggregate() performs on the aggregated path.
The parser then dereferences the MAP header and csum header/trailer based on
the on-wire pkt_len without checking skb->len, so a short frame is read out
of bounds:
BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet
Read of size 1 at addr ffff88801118ed00 by task exploit/147
Call Trace:
...
rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413)
__rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96)
rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129)
__netif_receive_skb_core.constprop.0 (net/core/dev.c:6089)
netif_receive_skb (net/core/dev.c:6460)
tun_get_user (drivers/net/tun.c:1955)
tun_chr_write_iter (drivers/net/tun.c:2001)
vfs_write (fs/read_write.c:688)
ksys_write (fs/read_write.c:740)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...
Factor that validation out of rmnet_map_deaggregate() into
rmnet_map_validate_packet_len() and run it on the no-aggregation path too.
The MAP header is bounds-checked first, since this path can receive a frame
shorter than the header.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ceed73a2cf4aff2921802aa3d21d45280677547d Version: ceed73a2cf4aff2921802aa3d21d45280677547d Version: ceed73a2cf4aff2921802aa3d21d45280677547d Version: ceed73a2cf4aff2921802aa3d21d45280677547d Version: ceed73a2cf4aff2921802aa3d21d45280677547d Version: ceed73a2cf4aff2921802aa3d21d45280677547d Version: ceed73a2cf4aff2921802aa3d21d45280677547d Version: ceed73a2cf4aff2921802aa3d21d45280677547d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c",
"drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h",
"drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ed25befc8c36f896b5878f9078faddb67fd7e2d0",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "a54d76d176e50d2fdbd39b7231efe256170339e4",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "00f4c366dbca16a40772c3b7ec2d8cba839e9724",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "3868c3244369ab709a90c9aad7534d406009b824",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "14eb0c9491385d5361a292ea4974aec0e6887299",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "1b12612c367e4be9b0814c0468e7e687835315b4",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "231a8a4b76cb1b1827b3b19d7b3603642f5aaaef",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
},
{
"lessThan": "f0f1887a9e30712a1df03e152dce6fb91344b1f3",
"status": "affected",
"version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c",
"drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h",
"drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qualcomm: rmnet: validate MAP frame length before ingress parsing\n\nWhen ingress deaggregation is disabled, rmnet_map_ingress_handler() passes\nthe skb straight to __rmnet_map_ingress_handler(), skipping the length\nvalidation that rmnet_map_deaggregate() performs on the aggregated path.\nThe parser then dereferences the MAP header and csum header/trailer based on\nthe on-wire pkt_len without checking skb-\u003elen, so a short frame is read out\nof bounds:\n\n BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet\n Read of size 1 at addr ffff88801118ed00 by task exploit/147\n Call Trace:\n ...\n rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413)\n __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96)\n rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129)\n __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089)\n netif_receive_skb (net/core/dev.c:6460)\n tun_get_user (drivers/net/tun.c:1955)\n tun_chr_write_iter (drivers/net/tun.c:2001)\n vfs_write (fs/read_write.c:688)\n ksys_write (fs/read_write.c:740)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n ...\n\nFactor that validation out of rmnet_map_deaggregate() into\nrmnet_map_validate_packet_len() and run it on the no-aggregation path too.\nThe MAP header is bounds-checked first, since this path can receive a frame\nshorter than the header."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached by `write()` to a tun fd owned by the attacker, exactly as in the reporter\u0027s KASAN trace (`tun_chr_write_iter` \u2192 `netif_receive_skb` \u2192 `rmnet_rx_handler`), requiring a local account. Although rmnet can be stacked on an Ethernet device (commit 74692caf1b0b), the universally available and demonstrated vector is local.\nAC:L - Every precondition is attacker-chosen \u2014 the `data_format` flags (deaggregation off, CKSUMV4 on) via `IFLA_RMNET_FLAGS`, the frame length, and the `pkt_len`/`pad` fields that select the OOB offset \u2014 with no race, timing, or uncontrolled memory-layout dependency. The trigger is a single deterministic `write()` that can be repeated indefinitely to sweep offsets.\nPR:L - Only an unprivileged local account is needed: `/dev/net/tun` is world-accessible, and both `TUNSETIFF` and `rtnl_newlink` gate on namespace-scoped `ns_capable`/`netlink_net_capable(CAP_NET_ADMIN)`, which `unshare -Urn` grants without real root.\nUI:N - The attacker creates the tun device, the rmnet link, and writes the malformed frame entirely on its own. No victim action or pre-existing configuration is required.\nS:U - The out-of-bounds access and its consequences are confined to kernel memory within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is an attacker-positioned read up to 65535 bytes past a small slab object, and the result is disclosed back to userspace through the unprivileged rmnet ethtool counters \u2014 because the pseudo-header checksum is computed from the attacker\u0027s own IP header, the exact 16-bit heap word at a chosen offset is recoverable in a few probes, yielding a precise heap-read primitive for KASLR bypass and secret disclosure.\nI:L - There is no arbitrary write, but out-of-bounds data determines `skb-\u003eip_summed = CHECKSUM_UNNECESSARY`, causing packets whose checksums were never validated to be accepted by the IP stack as verified. On the MAP-command path `rmnet_map_send_ack()` also writes `cmd-\u003ecmd_type` past the end of a short frame after `skb_trim()` underflows into a no-op.\nA:H - A 64 KB overshoot from a small kmalloc object can land on an unmapped page (guard pages, DEBUG_PAGEALLOC/hardened allocators, memory-region edges), faulting in kernel context and producing an oops; on the real WWAN receive path (ipa/qmi_wwan/mhi_net NAPI) this executes in softirq, where the fault is a panic. KASAN builds abort immediately, as the reporter\u0027s trace shows."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:27.672Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ed25befc8c36f896b5878f9078faddb67fd7e2d0"
},
{
"url": "https://git.kernel.org/stable/c/a54d76d176e50d2fdbd39b7231efe256170339e4"
},
{
"url": "https://git.kernel.org/stable/c/00f4c366dbca16a40772c3b7ec2d8cba839e9724"
},
{
"url": "https://git.kernel.org/stable/c/3868c3244369ab709a90c9aad7534d406009b824"
},
{
"url": "https://git.kernel.org/stable/c/14eb0c9491385d5361a292ea4974aec0e6887299"
},
{
"url": "https://git.kernel.org/stable/c/1b12612c367e4be9b0814c0468e7e687835315b4"
},
{
"url": "https://git.kernel.org/stable/c/231a8a4b76cb1b1827b3b19d7b3603642f5aaaef"
},
{
"url": "https://git.kernel.org/stable/c/f0f1887a9e30712a1df03e152dce6fb91344b1f3"
}
],
"title": "net: qualcomm: rmnet: validate MAP frame length before ingress parsing",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64550",
"datePublished": "2026-07-27T20:10:39.459Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-17T04:57:27.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64539 (GCVE-0-2026-64539)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: eir: Fix stack OOB write when prepending the Flags AD
eir_create_adv_data() builds the advertising data into a fixed-size
buffer ("size", 31 for the legacy path). It may prepend a 3-byte "Flags"
AD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies
the per-instance data without checking that it still fits:
memcpy(ptr, adv->adv_data, adv->adv_data_len);
tlv_data_max_len() only reserves those 3 bytes when the user-supplied
flags carry a managed-flags bit, so an instance added with flags == 0 is
accepted with adv_data_len up to the full buffer. At advertise time the
flags are still prepended, and the memcpy() writes 3 + adv_data_len
bytes into the size-byte buffer:
BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301)
Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65
Workqueue: hci0 hci_cmd_sync_work
__asan_memcpy (mm/kasan/shadow.c:106)
eir_create_adv_data (net/bluetooth/eir.c:301)
hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310)
hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817)
hci_cmd_sync_work (net/bluetooth/hci_sync.c:332)
This frame has 1 object:
[32, 64) 'cp'
The "Flags" structure is added by the kernel, not requested by
userspace, so only prepend it when it fits together with the instance
advertising data; when there is no room for both, drop the flags rather
than the user-provided data.
Reachable by a local user with CAP_NET_ADMIN owning an LE-only
controller on the legacy advertising path.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/eir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f0b6232af56441d0a2dcb173cc4f8d8aab39014",
"status": "affected",
"version": "b44133ff03be30b55f23036e62f403a3f7784fce",
"versionType": "git"
},
{
"lessThan": "09301f1fdf2aef8cce34d0c4650c30e7edb1ced9",
"status": "affected",
"version": "b44133ff03be30b55f23036e62f403a3f7784fce",
"versionType": "git"
},
{
"lessThan": "f1b4df9c260c51726da2e86e19322825fddeefd0",
"status": "affected",
"version": "b44133ff03be30b55f23036e62f403a3f7784fce",
"versionType": "git"
},
{
"lessThan": "57077eeb586c42f124bc09e018449362223067b3",
"status": "affected",
"version": "b44133ff03be30b55f23036e62f403a3f7784fce",
"versionType": "git"
},
{
"lessThan": "6f5fb689fdf80bdd143f22a502f9eb1f3c85e286",
"status": "affected",
"version": "b44133ff03be30b55f23036e62f403a3f7784fce",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/eir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: eir: Fix stack OOB write when prepending the Flags AD\n\neir_create_adv_data() builds the advertising data into a fixed-size\nbuffer (\"size\", 31 for the legacy path). It may prepend a 3-byte \"Flags\"\nAD structure (LE_AD_NO_BREDR on an LE-only controller) and then copies\nthe per-instance data without checking that it still fits:\n\n\tmemcpy(ptr, adv-\u003eadv_data, adv-\u003eadv_data_len);\n\ntlv_data_max_len() only reserves those 3 bytes when the user-supplied\nflags carry a managed-flags bit, so an instance added with flags == 0 is\naccepted with adv_data_len up to the full buffer. At advertise time the\nflags are still prepended, and the memcpy() writes 3 + adv_data_len\nbytes into the size-byte buffer:\n\n BUG: KASAN: stack-out-of-bounds in eir_create_adv_data (net/bluetooth/eir.c:301)\n Write of size 31 at addr ffff88800a547bdc by task kworker/u9:0/65\n Workqueue: hci0 hci_cmd_sync_work\n __asan_memcpy (mm/kasan/shadow.c:106)\n eir_create_adv_data (net/bluetooth/eir.c:301)\n hci_update_adv_data_sync (net/bluetooth/hci_sync.c:1310)\n hci_schedule_adv_instance_sync (net/bluetooth/hci_sync.c:1817)\n hci_cmd_sync_work (net/bluetooth/hci_sync.c:332)\n This frame has 1 object:\n [32, 64) \u0027cp\u0027\n\nThe \"Flags\" structure is added by the kernel, not requested by\nuserspace, so only prepend it when it fits together with the instance\nadvertising data; when there is no room for both, drop the flags rather\nthan the user-provided data.\n\nReachable by a local user with CAP_NET_ADMIN owning an LE-only\ncontroller on the legacy advertising path."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The overflow is driven entirely by locally supplied advertising data written to an AF_BLUETOOTH HCI control socket (MGMT_OP_ADD_ADVERTISING / ADD_EXT_ADV_DATA / MESH_SEND); no remote or adjacent Bluetooth peer can influence the length or contents. Consistent with the same-class CVE-2026-53209 and CVE-2026-64126, this is a local-only trigger.\nAC:L - The attacker fully controls both preconditions \u2014 submit an instance with flags==0 and adv_data_len at the maximum, containing no EIR_FLAGS element \u2014 and the kernel then deterministically prepends the 3-byte Flags AD on any LE-only controller. No race, no memory-layout luck, no retry needed.\nPR:L - Reaching the mgmt handler requires HCI_SOCK_TRUSTED, granted by CAP_NET_ADMIN, which is a delegated capability routinely held by the Bluetooth stack daemon rather than full system root, and this CNA scores the identical CAP_NET_ADMIN-gated Bluetooth mgmt paths (CVE-2026-64126, CVE-2026-53209, CVE-2026-31511) as PR:L. Choosing the higher-severity option where the privilege boundary is arguable.\nUI:N - The attacker issues the mgmt commands itself and the overflow fires from hci_cmd_sync_work when the instance is scheduled for advertising. No victim action of any kind is involved.\nS:U - The corruption is confined to the kernel\u0027s own stack within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - On the extended-advertising path the inflated length (254 \u003e 251) makes struct_size() copy 3 bytes of adjacent kernel stack past the DEFINE_FLEX pdu into the HCI command skb, which is exposed via the HCI monitor channel and handed to the controller for broadcast, and the stack corruption is generally leverageable for further disclosure.\nI:H - This is an out-of-bounds write of fully attacker-controlled bytes (the tail of the user-supplied adv_data) past a local stack object, and it additionally leaves hdev-\u003eadv_data_len set to a value larger than the data actually stored. An attacker-controlled linear stack overflow is treated as high integrity impact.\nA:H - Overwriting bytes immediately past the stack object corrupts adjacent frame state and, with CONFIG_STACKPROTECTOR, will trip __stack_chk_fail leading to a kernel panic; the reported KASAN stack-out-of-bounds confirms real memory corruption in hci_cmd_sync_work."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:15.586Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f0b6232af56441d0a2dcb173cc4f8d8aab39014"
},
{
"url": "https://git.kernel.org/stable/c/09301f1fdf2aef8cce34d0c4650c30e7edb1ced9"
},
{
"url": "https://git.kernel.org/stable/c/f1b4df9c260c51726da2e86e19322825fddeefd0"
},
{
"url": "https://git.kernel.org/stable/c/57077eeb586c42f124bc09e018449362223067b3"
},
{
"url": "https://git.kernel.org/stable/c/6f5fb689fdf80bdd143f22a502f9eb1f3c85e286"
}
],
"title": "Bluetooth: eir: Fix stack OOB write when prepending the Flags AD",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64539",
"datePublished": "2026-07-27T20:10:33.363Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-17T04:57:15.586Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64554 (GCVE-0-2026-64554)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
br_ip6_fragment() gets prevhdr, a pointer into the skb head, from
ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb
skb_checksum_help() reallocates the head via pskb_expand_head(), leaving
prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a
use-after-free write.
Save prevhdr's offset before skb_checksum_help() and recompute it after,
like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6
fragment").
BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857)
Write of size 1 at addr ffff888013ff5016 by task exploit/141
Call Trace:
...
kasan_report (mm/kasan/report.c:595)
ip6_frag_next (net/ipv6/ip6_output.c:857)
br_ip6_fragment (net/ipv6/netfilter.c:212)
nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407)
nf_hook_slow (net/netfilter/core.c:619)
br_forward_finish (net/bridge/br_forward.c:66)
__br_forward (net/bridge/br_forward.c:115)
maybe_deliver (net/bridge/br_forward.c:191)
br_flood (net/bridge/br_forward.c:245)
br_handle_frame_finish (net/bridge/br_input.c:229)
br_handle_frame (net/bridge/br_input.c:442)
...
packet_sendmsg (net/packet/af_packet.c:3114)
...
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception in interrupt
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 764dd163ac922f8683b5bcd3007251ce7b26cd33 Version: 764dd163ac922f8683b5bcd3007251ce7b26cd33 Version: 764dd163ac922f8683b5bcd3007251ce7b26cd33 Version: 764dd163ac922f8683b5bcd3007251ce7b26cd33 Version: 764dd163ac922f8683b5bcd3007251ce7b26cd33 Version: 764dd163ac922f8683b5bcd3007251ce7b26cd33 Version: 764dd163ac922f8683b5bcd3007251ce7b26cd33 Version: 764dd163ac922f8683b5bcd3007251ce7b26cd33 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8c10778ec674b67a07ea042fcba64270f3f38a5a",
"status": "affected",
"version": "764dd163ac922f8683b5bcd3007251ce7b26cd33",
"versionType": "git"
},
{
"lessThan": "2731efa6364e47934c96eb69e01ea131e8af8030",
"status": "affected",
"version": "764dd163ac922f8683b5bcd3007251ce7b26cd33",
"versionType": "git"
},
{
"lessThan": "00c06ef8c018493943891a7d0ca82b71b24f3180",
"status": "affected",
"version": "764dd163ac922f8683b5bcd3007251ce7b26cd33",
"versionType": "git"
},
{
"lessThan": "c141f69d0a0fb16964dbc293650047e69bda8af7",
"status": "affected",
"version": "764dd163ac922f8683b5bcd3007251ce7b26cd33",
"versionType": "git"
},
{
"lessThan": "f2e6596d10783557aeb9668da2a3b4d19deb2001",
"status": "affected",
"version": "764dd163ac922f8683b5bcd3007251ce7b26cd33",
"versionType": "git"
},
{
"lessThan": "1c4f67c89fd27c4df4c70b135c2c59627698b3c0",
"status": "affected",
"version": "764dd163ac922f8683b5bcd3007251ce7b26cd33",
"versionType": "git"
},
{
"lessThan": "4ac981a8b7ce7aec99a52d08f8a8953e8e120067",
"status": "affected",
"version": "764dd163ac922f8683b5bcd3007251ce7b26cd33",
"versionType": "git"
},
{
"lessThan": "86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d",
"status": "affected",
"version": "764dd163ac922f8683b5bcd3007251ce7b26cd33",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/netfilter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()\n\nbr_ip6_fragment() gets prevhdr, a pointer into the skb head, from\nip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb\nskb_checksum_help() reallocates the head via pskb_expand_head(), leaving\nprevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a\nuse-after-free write.\n\nSave prevhdr\u0027s offset before skb_checksum_help() and recompute it after,\nlike commit ef0efcd3bd3f (\"ipv6: Fix dangling pointer when ipv6\nfragment\").\n\n BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857)\n Write of size 1 at addr ffff888013ff5016 by task exploit/141\n Call Trace:\n ...\n kasan_report (mm/kasan/report.c:595)\n ip6_frag_next (net/ipv6/ip6_output.c:857)\n br_ip6_fragment (net/ipv6/netfilter.c:212)\n nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407)\n nf_hook_slow (net/netfilter/core.c:619)\n br_forward_finish (net/bridge/br_forward.c:66)\n __br_forward (net/bridge/br_forward.c:115)\n maybe_deliver (net/bridge/br_forward.c:191)\n br_flood (net/bridge/br_forward.c:245)\n br_handle_frame_finish (net/bridge/br_input.c:229)\n br_handle_frame (net/bridge/br_input.c:442)\n ...\n packet_sendmsg (net/packet/af_packet.c:3114)\n ...\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n Kernel panic - not syncing: Fatal exception in interrupt"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The vulnerable code is the bridge forwarding/refragmentation path, driven entirely by frames received on a bridge port from an L2 peer \u2014 typically a guest VM over tap/virtio or a container over veth, which per skbuff.h are exactly the sources that deliver CHECKSUM_PARTIAL skbs on receive. This is logically adjacent topology (bridged segment/overlay), not a routed internet path, so AV:A rather than N.\nAC:L - The attacker controls every precondition: send IPv6 fragments (forces conntrack reassembly and sets frag_max_size), set VIRTIO_NET_HDR_F_NEEDS_CSUM for CHECKSUM_PARTIAL, and target a broadcast/multicast/unknown-unicast MAC so br_flood calls deliver_clone() and makes the skb cloned. No race and no attacker-independent condition is involved; the corruption is deterministic once the packet is crafted.\nPR:N - A guest VM or container attached to the host bridge holds no credentials on the vulnerable host and needs none \u2014 it merely emits frames onto the segment. In the equivalent local variant the entire setup (bridge, veth, nft bridge conntrack, AF_PACKET with CAP_NET_RAW) is reachable from an unprivileged user namespace, so no real privilege is required either way.\nUI:N - The corruption happens automatically in softirq context while the bridge forwards the attacker\u0027s packet. No action by any user or administrator on the target is needed.\nS:U - The vulnerable component and the impacted resource are both the host kernel\u0027s network stack; no hypervisor, IOMMU, or sandbox boundary is bypassed by the bug itself. Standard kernel memory corruption is scored Unchanged.\nC:H - This is a use-after-free/out-of-bounds write on the slab; the freed skb head and the write target can be groomed by the attacker, and such heap corruption is routinely leveraged into arbitrary kernel memory disclosure. Per kernel scoring guidance, UAF/OOB corruption is High confidentiality impact.\nI:H - ip6_frag_next() writes NEXTHDR_FRAGMENT (0x2c) at skb_network_header(frag) plus an uncontrolled inter-allocation delta, giving a repeatable 1-byte heap write at a heap-groomable offset \u2014 once per emitted fragment. A controlled byte write into adjacent slab objects is a classic primitive for corrupting kernel data structures and escalating to control-flow hijack.\nA:H - KASAN reports a slab-use-after-free write followed by \"Kernel panic - not syncing: Fatal exception in interrupt\" because the fault occurs in softirq forwarding context, taking down the whole host rather than one task. The attacker can repeat it at will with a stream of crafted fragments."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:32.112Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8c10778ec674b67a07ea042fcba64270f3f38a5a"
},
{
"url": "https://git.kernel.org/stable/c/2731efa6364e47934c96eb69e01ea131e8af8030"
},
{
"url": "https://git.kernel.org/stable/c/00c06ef8c018493943891a7d0ca82b71b24f3180"
},
{
"url": "https://git.kernel.org/stable/c/c141f69d0a0fb16964dbc293650047e69bda8af7"
},
{
"url": "https://git.kernel.org/stable/c/f2e6596d10783557aeb9668da2a3b4d19deb2001"
},
{
"url": "https://git.kernel.org/stable/c/1c4f67c89fd27c4df4c70b135c2c59627698b3c0"
},
{
"url": "https://git.kernel.org/stable/c/4ac981a8b7ce7aec99a52d08f8a8953e8e120067"
},
{
"url": "https://git.kernel.org/stable/c/86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d"
}
],
"title": "netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64554",
"datePublished": "2026-07-27T20:10:41.726Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-17T04:57:32.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64307 (GCVE-0-2026-64307)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-08-17 04:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)
Sashiko notes:
> if SEV initialization fails and KVM is actively running normal VMs, could a
> userspace process trigger this code path via /dev/sev ioctls (e.g.,
> SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN
> execution for an active VM trigger a general protection fault and crash the
> host?
Refuse to re-try initialization if SNP is not already initialized for
SNP_CONFIG.
This is technically an ABI break: before if SNP initialization failed it
could be transparently retriggered by this ioctl, and if no VMs were
running, everything worked fine. Hopefully this is enough of a corner case
that nobody will notice, but someone does, there are a few options:
* do something like symbol_get() for kvm and refuse to initialize if KVM is
loaded
* check each cpu's HSAVE_PA for non-zero data before re-initializing
* once initialization has failed, continue to refuse to initialize until
the ccp module is unloaded
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/ccp/sev-dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "345a6e869b33687e9268044bcaeeefd7c61da675",
"status": "affected",
"version": "1c3506ea8599a3ad1b9aae5cbd573134f8d18db7",
"versionType": "git"
},
{
"lessThan": "441ea32cf2755a0dc593557056b00b7caa0651f5",
"status": "affected",
"version": "ceac7fb89e8da465aec3ac3c20477f912f5c3a6c",
"versionType": "git"
},
{
"lessThan": "20f548cdac94860a164e5ebba4f7e4a01051cb06",
"status": "affected",
"version": "ceac7fb89e8da465aec3ac3c20477f912f5c3a6c",
"versionType": "git"
},
{
"lessThan": "08f0e65e784c4b20e6e620dd4f68d8636073a3d2",
"status": "affected",
"version": "ceac7fb89e8da465aec3ac3c20477f912f5c3a6c",
"versionType": "git"
},
{
"lessThan": "6.12.97",
"status": "affected",
"version": "6.12.75",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/ccp/sev-dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12.75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)\n\nSashiko notes:\n\n\u003e if SEV initialization fails and KVM is actively running normal VMs, could a\n\u003e userspace process trigger this code path via /dev/sev ioctls (e.g.,\n\u003e SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN\n\u003e execution for an active VM trigger a general protection fault and crash the\n\u003e host?\n\nRefuse to re-try initialization if SNP is not already initialized for\nSNP_CONFIG.\n\nThis is technically an ABI break: before if SNP initialization failed it\ncould be transparently retriggered by this ioctl, and if no VMs were\nrunning, everything worked fine. Hopefully this is enough of a corner case\nthat nobody will notice, but someone does, there are a few options:\n\n* do something like symbol_get() for kvm and refuse to initialize if KVM is\n loaded\n* check each cpu\u0027s HSAVE_PA for non-zero data before re-initializing\n* once initialization has failed, continue to refuse to initialize until\n the ccp module is unloaded"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:06.569Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/345a6e869b33687e9268044bcaeeefd7c61da675"
},
{
"url": "https://git.kernel.org/stable/c/441ea32cf2755a0dc593557056b00b7caa0651f5"
},
{
"url": "https://git.kernel.org/stable/c/20f548cdac94860a164e5ebba4f7e4a01051cb06"
},
{
"url": "https://git.kernel.org/stable/c/08f0e65e784c4b20e6e620dd4f68d8636073a3d2"
}
],
"title": "crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG)",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64307",
"datePublished": "2026-07-25T08:49:40.782Z",
"dateReserved": "2026-07-19T15:36:31.779Z",
"dateUpdated": "2026-08-17T04:53:06.569Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64421 (GCVE-0-2026-64421)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: nxp: imx8-isi: Fix use-after-free on remove
KASAN reports a slab-use-after-free in __media_entity_remove_link()
during rmmod of imx8_isi:
BUG: KASAN: slab-use-after-free in __media_entity_remove_link+0x608/0x650
Read of size 2 at addr ffff0000d47cb02a by task rmmod/724
Call trace:
__media_entity_remove_link+0x608/0x650
__media_entity_remove_links+0x78/0x144
__media_device_unregister_entity+0x150/0x280
media_device_unregister_entity+0x48/0x68
v4l2_device_unregister_subdev+0x158/0x300
v4l2_async_unbind_subdev_one+0x22c/0x358
v4l2_async_nf_unbind_all_subdevs+0xfc/0x1c0
v4l2_async_nf_unregister+0x5c/0x14c
mxc_isi_remove+0x124/0x2a0 [imx8_isi]
Allocated by task 249:
__kmalloc_noprof+0x27c/0x690
mxc_isi_crossbar_init+0x22c/0x560 [imx8_isi]
Freed by task 724:
kfree+0x1e4/0x5b0
mxc_isi_crossbar_cleanup+0x34/0x80 [imx8_isi]
mxc_isi_remove+0x11c/0x2a0 [imx8_isi]
The problem is that mxc_isi_remove() calls mxc_isi_crossbar_cleanup()
before mxc_isi_v4l2_cleanup(). The crossbar cleanup frees the media
entity pads, but the subsequent v4l2 cleanup still tries to remove
media links that reference those pads.
Fix this by calling mxc_isi_v4l2_cleanup() before
mxc_isi_crossbar_cleanup() to ensure all media entities are properly
unregistered while the pads are still valid.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d22fb719654bfde6f682c9f14629f5f9534175b7",
"status": "affected",
"version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
"versionType": "git"
},
{
"lessThan": "ba2aa5d325270cd965c44458c5ff5ab555e6af51",
"status": "affected",
"version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
"versionType": "git"
},
{
"lessThan": "ef382a6baf0a95cf199fdf6bba2fd08e58b0a249",
"status": "affected",
"version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
"versionType": "git"
},
{
"lessThan": "c12a5b2261351cd3b03921ce4720332ff5184b50",
"status": "affected",
"version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
"versionType": "git"
},
{
"lessThan": "b670bf89824ede5d07d20bb9bfbafb754846081d",
"status": "affected",
"version": "cf21f328fcafacf4f96e7a30ef9dceede1076378",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/nxp/imx8-isi/imx8-isi-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: nxp: imx8-isi: Fix use-after-free on remove\n\nKASAN reports a slab-use-after-free in __media_entity_remove_link()\nduring rmmod of imx8_isi:\n\n BUG: KASAN: slab-use-after-free in __media_entity_remove_link+0x608/0x650\n Read of size 2 at addr ffff0000d47cb02a by task rmmod/724\n\n Call trace:\n __media_entity_remove_link+0x608/0x650\n __media_entity_remove_links+0x78/0x144\n __media_device_unregister_entity+0x150/0x280\n media_device_unregister_entity+0x48/0x68\n v4l2_device_unregister_subdev+0x158/0x300\n v4l2_async_unbind_subdev_one+0x22c/0x358\n v4l2_async_nf_unbind_all_subdevs+0xfc/0x1c0\n v4l2_async_nf_unregister+0x5c/0x14c\n mxc_isi_remove+0x124/0x2a0 [imx8_isi]\n\n Allocated by task 249:\n __kmalloc_noprof+0x27c/0x690\n mxc_isi_crossbar_init+0x22c/0x560 [imx8_isi]\n\n Freed by task 724:\n kfree+0x1e4/0x5b0\n mxc_isi_crossbar_cleanup+0x34/0x80 [imx8_isi]\n mxc_isi_remove+0x11c/0x2a0 [imx8_isi]\n\nThe problem is that mxc_isi_remove() calls mxc_isi_crossbar_cleanup()\nbefore mxc_isi_v4l2_cleanup(). The crossbar cleanup frees the media\nentity pads, but the subsequent v4l2 cleanup still tries to remove\nmedia links that reference those pads.\n\nFix this by calling mxc_isi_v4l2_cleanup() before\nmxc_isi_crossbar_cleanup() to ensure all media entities are properly\nunregistered while the pads are still valid."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:55:21.058Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d22fb719654bfde6f682c9f14629f5f9534175b7"
},
{
"url": "https://git.kernel.org/stable/c/ba2aa5d325270cd965c44458c5ff5ab555e6af51"
},
{
"url": "https://git.kernel.org/stable/c/ef382a6baf0a95cf199fdf6bba2fd08e58b0a249"
},
{
"url": "https://git.kernel.org/stable/c/c12a5b2261351cd3b03921ce4720332ff5184b50"
},
{
"url": "https://git.kernel.org/stable/c/b670bf89824ede5d07d20bb9bfbafb754846081d"
}
],
"title": "media: nxp: imx8-isi: Fix use-after-free on remove",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64421",
"datePublished": "2026-07-25T08:50:59.926Z",
"dateReserved": "2026-07-19T15:36:31.786Z",
"dateUpdated": "2026-08-17T04:55:21.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64462 (GCVE-0-2026-64462)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-08-17 04:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: altera: Fix resource leaks on probe failure
The chained IRQ handler is set during probe, but is only removed during the
driver remove(). If pci_host_probe() fails, the handler and INTx IRQ
domain remain set even though the devm-managed host bridge storage
containing struct altera_pcie will be released, leaving the handler with
a stale data pointer.
Interrupts are also enabled before pci_host_probe() is called. If probe
fails after that point, the controller interrupt source should be disabled
before the chained handler and INTx domain are removed.
So set the chained handler only after the INTx domain has been created.
Disable controller interrupts during IRQ teardown, and tear the IRQ setup
down if pci_host_probe() fails.
[mani: commit log]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c63aed7334c21de8d626ff028ccad98cf5847a0e Version: c63aed7334c21de8d626ff028ccad98cf5847a0e Version: c63aed7334c21de8d626ff028ccad98cf5847a0e Version: c63aed7334c21de8d626ff028ccad98cf5847a0e Version: c63aed7334c21de8d626ff028ccad98cf5847a0e Version: c63aed7334c21de8d626ff028ccad98cf5847a0e Version: c63aed7334c21de8d626ff028ccad98cf5847a0e Version: c63aed7334c21de8d626ff028ccad98cf5847a0e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/controller/pcie-altera.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "af7cf5d56d7d57c4fbfdb7b5b693790f331b07b7",
"status": "affected",
"version": "c63aed7334c21de8d626ff028ccad98cf5847a0e",
"versionType": "git"
},
{
"lessThan": "9cf0cc481e1645ec65e61486ae41c486c59781cb",
"status": "affected",
"version": "c63aed7334c21de8d626ff028ccad98cf5847a0e",
"versionType": "git"
},
{
"lessThan": "99fc088d6cc6890ae35fa2f29c50ebe027844c20",
"status": "affected",
"version": "c63aed7334c21de8d626ff028ccad98cf5847a0e",
"versionType": "git"
},
{
"lessThan": "a25bfa2a6665a1d77324d4a609e7513b87680227",
"status": "affected",
"version": "c63aed7334c21de8d626ff028ccad98cf5847a0e",
"versionType": "git"
},
{
"lessThan": "0db9aa9ec51be0a0ffdcdfd9af2b7bf3aeb7911a",
"status": "affected",
"version": "c63aed7334c21de8d626ff028ccad98cf5847a0e",
"versionType": "git"
},
{
"lessThan": "09c43b7b7d29c6fadb27f32cdf7f3bb6598befa9",
"status": "affected",
"version": "c63aed7334c21de8d626ff028ccad98cf5847a0e",
"versionType": "git"
},
{
"lessThan": "6864c789b570e57f932847fa83f6b56917182d73",
"status": "affected",
"version": "c63aed7334c21de8d626ff028ccad98cf5847a0e",
"versionType": "git"
},
{
"lessThan": "7a94138caeb27f3c49c1dbd93bf422098925bb28",
"status": "affected",
"version": "c63aed7334c21de8d626ff028ccad98cf5847a0e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/controller/pcie-altera.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: altera: Fix resource leaks on probe failure\n\nThe chained IRQ handler is set during probe, but is only removed during the\ndriver remove(). If pci_host_probe() fails, the handler and INTx IRQ\ndomain remain set even though the devm-managed host bridge storage\ncontaining struct altera_pcie will be released, leaving the handler with\na stale data pointer.\n\nInterrupts are also enabled before pci_host_probe() is called. If probe\nfails after that point, the controller interrupt source should be disabled\nbefore the chained handler and INTx domain are removed.\n\nSo set the chained handler only after the INTx domain has been created.\nDisable controller interrupts during IRQ teardown, and tear the IRQ setup\ndown if pci_host_probe() fails.\n\n[mani: commit log]"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:56:07.206Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/af7cf5d56d7d57c4fbfdb7b5b693790f331b07b7"
},
{
"url": "https://git.kernel.org/stable/c/9cf0cc481e1645ec65e61486ae41c486c59781cb"
},
{
"url": "https://git.kernel.org/stable/c/99fc088d6cc6890ae35fa2f29c50ebe027844c20"
},
{
"url": "https://git.kernel.org/stable/c/a25bfa2a6665a1d77324d4a609e7513b87680227"
},
{
"url": "https://git.kernel.org/stable/c/0db9aa9ec51be0a0ffdcdfd9af2b7bf3aeb7911a"
},
{
"url": "https://git.kernel.org/stable/c/09c43b7b7d29c6fadb27f32cdf7f3bb6598befa9"
},
{
"url": "https://git.kernel.org/stable/c/6864c789b570e57f932847fa83f6b56917182d73"
},
{
"url": "https://git.kernel.org/stable/c/7a94138caeb27f3c49c1dbd93bf422098925bb28"
}
],
"title": "PCI: altera: Fix resource leaks on probe failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64462",
"datePublished": "2026-07-25T08:51:29.013Z",
"dateReserved": "2026-07-19T15:36:31.789Z",
"dateUpdated": "2026-08-17T04:56:07.206Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64364 (GCVE-0-2026-64364)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: multitouch: fix out-of-bounds bit access on mt_io_flags
mt_io_flags is a single unsigned long, but mt_process_slot(),
mt_release_pending_palms() and mt_release_contacts() use it as a
per-slot bitmap indexed by the slot number. That slot number is only
bounded by td->maxcontacts, which is taken from the device's
ContactCountMaximum feature report and can be up to 255, not by
BITS_PER_LONG.
As a result, a multitouch device that advertises a large contact count
makes set_bit()/clear_bit() operate past the mt_io_flags word and
corrupt the adjacent members of struct mt_device. The sticky-fingers
release timer is the easiest way to reach this. mt_release_contacts()
runs
for (i = 0; i < mt->num_slots; i++)
clear_bit(i, &td->mt_io_flags);
with num_slots == maxcontacts. For maxcontacts around 250 the loop
clears the bits that overlap td->applications.next, zeroing that list
head, and the list_for_each_entry() that immediately follows then
dereferences NULL. The kernel panics from timer (softirq) context. On a
KASAN build this shows up as a general protection fault in
mt_release_contacts() with a null-ptr-deref at offset 0x58, which is
offsetof(struct mt_application, num_received).
The state is reachable from an untrusted USB or Bluetooth HID
multitouch device; no local privileges are required.
Store the per-slot active state in a separately allocated bitmap sized
for maxcontacts, the same pattern already used for pending_palm_slots,
and keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two
"mt_io_flags & MT_IO_SLOTS_MASK" arming checks become
bitmap_empty(td->active_slots, td->maxcontacts).
Move MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the
same commit to leave the low byte for the slot bits; with the slot bits
gone it fits in bit 0 again, which also keeps it within the unsigned
long on 32-bit.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fc488f675344931ffab6a51c43691065ec006567 Version: 77711d850bed75ae7142c3d1f22c1a8b4d049c33 Version: 6acfe25968913788d30ec0eedd80178c4ea3f1d0 Version: d280c138e66be87d1fccfed42593f02fdb893905 Version: f32fea4c0234c971c12e46d76612cdc2dd4bb046 Version: 46f781e0d151844589dc2125c8cce3300546f92a Version: 46f781e0d151844589dc2125c8cce3300546f92a Version: 46f781e0d151844589dc2125c8cce3300546f92a Version: 59bd04163e6451b9c7275277882ed9f4abfa2051 Version: 5.10.246 ≤ Version: 5.15.196 ≤ Version: 6.1.158 ≤ Version: 6.6.114 ≤ Version: 6.12.55 ≤ Version: 6.17.5 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-multitouch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "12e90656e330ff8bbaf2f29c535fdb8a11cc6f55",
"status": "affected",
"version": "fc488f675344931ffab6a51c43691065ec006567",
"versionType": "git"
},
{
"lessThan": "152983d87387f6a8ae72b73474cfa55fbcf1ec75",
"status": "affected",
"version": "77711d850bed75ae7142c3d1f22c1a8b4d049c33",
"versionType": "git"
},
{
"lessThan": "b5c037d6b807017e74a115288f81bc9cd5a5aab8",
"status": "affected",
"version": "6acfe25968913788d30ec0eedd80178c4ea3f1d0",
"versionType": "git"
},
{
"lessThan": "a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d",
"status": "affected",
"version": "d280c138e66be87d1fccfed42593f02fdb893905",
"versionType": "git"
},
{
"lessThan": "e24918ee67c4dc3d20d4670750e46e9b160365f4",
"status": "affected",
"version": "f32fea4c0234c971c12e46d76612cdc2dd4bb046",
"versionType": "git"
},
{
"lessThan": "37daa8c96bd563d03150e23f094cb60703594a6d",
"status": "affected",
"version": "46f781e0d151844589dc2125c8cce3300546f92a",
"versionType": "git"
},
{
"lessThan": "6493ebf9489efef0105078377b973ab33d51af22",
"status": "affected",
"version": "46f781e0d151844589dc2125c8cce3300546f92a",
"versionType": "git"
},
{
"lessThan": "8813b0612275cc61fe9e6603d0ee019247ade6be",
"status": "affected",
"version": "46f781e0d151844589dc2125c8cce3300546f92a",
"versionType": "git"
},
{
"status": "affected",
"version": "59bd04163e6451b9c7275277882ed9f4abfa2051",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.246",
"versionType": "semver"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.196",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.158",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.114",
"versionType": "semver"
},
{
"lessThan": "6.12.97",
"status": "affected",
"version": "6.12.55",
"versionType": "semver"
},
{
"lessThan": "6.18",
"status": "affected",
"version": "6.17.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-multitouch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.246",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.196",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.158",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.114",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12.55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: fix out-of-bounds bit access on mt_io_flags\n\nmt_io_flags is a single unsigned long, but mt_process_slot(),\nmt_release_pending_palms() and mt_release_contacts() use it as a\nper-slot bitmap indexed by the slot number. That slot number is only\nbounded by td-\u003emaxcontacts, which is taken from the device\u0027s\nContactCountMaximum feature report and can be up to 255, not by\nBITS_PER_LONG.\n\nAs a result, a multitouch device that advertises a large contact count\nmakes set_bit()/clear_bit() operate past the mt_io_flags word and\ncorrupt the adjacent members of struct mt_device. The sticky-fingers\nrelease timer is the easiest way to reach this. mt_release_contacts()\nruns\n\n\tfor (i = 0; i \u003c mt-\u003enum_slots; i++)\n\t\tclear_bit(i, \u0026td-\u003emt_io_flags);\n\nwith num_slots == maxcontacts. For maxcontacts around 250 the loop\nclears the bits that overlap td-\u003eapplications.next, zeroing that list\nhead, and the list_for_each_entry() that immediately follows then\ndereferences NULL. The kernel panics from timer (softirq) context. On a\nKASAN build this shows up as a general protection fault in\nmt_release_contacts() with a null-ptr-deref at offset 0x58, which is\noffsetof(struct mt_application, num_received).\n\nThe state is reachable from an untrusted USB or Bluetooth HID\nmultitouch device; no local privileges are required.\n\nStore the per-slot active state in a separately allocated bitmap sized\nfor maxcontacts, the same pattern already used for pending_palm_slots,\nand keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two\n\"mt_io_flags \u0026 MT_IO_SLOTS_MASK\" arming checks become\nbitmap_empty(td-\u003eactive_slots, td-\u003emaxcontacts).\n\nMove MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the\nsame commit to leave the low byte for the slot bits; with the slot bits\ngone it fits in bit 0 again, which also keeps it within the unsigned\nlong on 32-bit."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - A malicious Bluetooth HID multitouch peripheral within radio range can supply the descriptor, feature value, and input reports; malicious USB devices provide an additional physical path.\nAC:L - Advertising 250 contacts, sending one active contact, and remaining silent for 100 ms deterministically triggers the timer path without a race, heap grooming, or uncontrollable condition.\nPR:N - The external HID device needs no target-system account or capability, and normal HID connection handling delivers its attacker-controlled data to the driver.\nUI:N - An already-connected or automatically reconnecting Bluetooth peripheral can trigger the flaw without victim action; report processing itself requires no file, prompt, or application interaction.\nS:U - The corruption occurs in the host kernel and compromises resources governed by that same kernel security authority.\nC:H - Attacker-controlled out-of-bounds bit operations cover adjacent list pointers and can redirect subsequent kernel memory accesses, supporting kernel compromise and arbitrary disclosure.\nI:H - The device obtains attacker-directed set/clear operations over adjacent pointer fields, enabling crafted pointer corruption, further kernel writes, and potentially code execution.\nA:H - The deterministic timeout path corrupts the applications list and causes a kernel panic from softirq context, and a malicious peripheral can trigger it repeatedly."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:11.199Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/12e90656e330ff8bbaf2f29c535fdb8a11cc6f55"
},
{
"url": "https://git.kernel.org/stable/c/152983d87387f6a8ae72b73474cfa55fbcf1ec75"
},
{
"url": "https://git.kernel.org/stable/c/b5c037d6b807017e74a115288f81bc9cd5a5aab8"
},
{
"url": "https://git.kernel.org/stable/c/a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d"
},
{
"url": "https://git.kernel.org/stable/c/e24918ee67c4dc3d20d4670750e46e9b160365f4"
},
{
"url": "https://git.kernel.org/stable/c/37daa8c96bd563d03150e23f094cb60703594a6d"
},
{
"url": "https://git.kernel.org/stable/c/6493ebf9489efef0105078377b973ab33d51af22"
},
{
"url": "https://git.kernel.org/stable/c/8813b0612275cc61fe9e6603d0ee019247ade6be"
}
],
"title": "HID: multitouch: fix out-of-bounds bit access on mt_io_flags",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64364",
"datePublished": "2026-07-25T08:50:19.441Z",
"dateReserved": "2026-07-19T15:36:31.783Z",
"dateUpdated": "2026-08-17T04:54:11.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64461 (GCVE-0-2026-64461)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-08-17 04:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
PCI: mediatek: Fix IRQ domain leak when port fails to enable
When mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port
from pcie->ports and frees the port structure. However, the IRQ domains set
up earlier by mtk_pcie_init_irq_domain() are never freed.
Fix this by refactoring mtk_pcie_irq_teardown() into a per-port helper,
mtk_pcie_irq_teardown_port(), and calling it from mtk_pcie_setup() when
mtk_pcie_enable_port() fails. Since the IRQ teardown must only happen in
the probe error path (during resume, child devices may have active MSI
mappings and the NOIRQ context prohibits sleeping locks),
mtk_pcie_enable_port() is changed to return an error code so callers can
distinguish the two paths and act accordingly.
This issue was reported by Sashiko while reviewing the EcoNet EN7528 SoC
support series.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b099631df160ec608cd6147f4d20a8042567a5b8 Version: b099631df160ec608cd6147f4d20a8042567a5b8 Version: b099631df160ec608cd6147f4d20a8042567a5b8 Version: b099631df160ec608cd6147f4d20a8042567a5b8 Version: b099631df160ec608cd6147f4d20a8042567a5b8 Version: b099631df160ec608cd6147f4d20a8042567a5b8 Version: b099631df160ec608cd6147f4d20a8042567a5b8 Version: b099631df160ec608cd6147f4d20a8042567a5b8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/pci/controller/pcie-mediatek.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e23da72ef202654a7d5269885c4fa39a8404db76",
"status": "affected",
"version": "b099631df160ec608cd6147f4d20a8042567a5b8",
"versionType": "git"
},
{
"lessThan": "ec7c05eed47d8b15c45380aee7ca168a82e15035",
"status": "affected",
"version": "b099631df160ec608cd6147f4d20a8042567a5b8",
"versionType": "git"
},
{
"lessThan": "1fbe8972a39548a633d06d7b03a01b7b119a2c12",
"status": "affected",
"version": "b099631df160ec608cd6147f4d20a8042567a5b8",
"versionType": "git"
},
{
"lessThan": "fe8c701a53c2816cd82301f66c671d952003c1b0",
"status": "affected",
"version": "b099631df160ec608cd6147f4d20a8042567a5b8",
"versionType": "git"
},
{
"lessThan": "ce52e494a7555bdae1d990a2654fd7547ef6d986",
"status": "affected",
"version": "b099631df160ec608cd6147f4d20a8042567a5b8",
"versionType": "git"
},
{
"lessThan": "6e6a529d6f779413379b4404c9ef6a36c0337225",
"status": "affected",
"version": "b099631df160ec608cd6147f4d20a8042567a5b8",
"versionType": "git"
},
{
"lessThan": "df77314b3bedbd9ad5d6f0682f98b99e3c5f7e2e",
"status": "affected",
"version": "b099631df160ec608cd6147f4d20a8042567a5b8",
"versionType": "git"
},
{
"lessThan": "f865a57896bd92d7662eb2818d8f48872e2cbbc7",
"status": "affected",
"version": "b099631df160ec608cd6147f4d20a8042567a5b8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/pci/controller/pcie-mediatek.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: mediatek: Fix IRQ domain leak when port fails to enable\n\nWhen mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port\nfrom pcie-\u003eports and frees the port structure. However, the IRQ domains set\nup earlier by mtk_pcie_init_irq_domain() are never freed.\n\nFix this by refactoring mtk_pcie_irq_teardown() into a per-port helper,\nmtk_pcie_irq_teardown_port(), and calling it from mtk_pcie_setup() when\nmtk_pcie_enable_port() fails. Since the IRQ teardown must only happen in\nthe probe error path (during resume, child devices may have active MSI\nmappings and the NOIRQ context prohibits sleeping locks),\nmtk_pcie_enable_port() is changed to return an error code so callers can\ndistinguish the two paths and act accordingly.\n\nThis issue was reported by Sashiko while reviewing the EcoNet EN7528 SoC\nsupport series."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:56:06.127Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e23da72ef202654a7d5269885c4fa39a8404db76"
},
{
"url": "https://git.kernel.org/stable/c/ec7c05eed47d8b15c45380aee7ca168a82e15035"
},
{
"url": "https://git.kernel.org/stable/c/1fbe8972a39548a633d06d7b03a01b7b119a2c12"
},
{
"url": "https://git.kernel.org/stable/c/fe8c701a53c2816cd82301f66c671d952003c1b0"
},
{
"url": "https://git.kernel.org/stable/c/ce52e494a7555bdae1d990a2654fd7547ef6d986"
},
{
"url": "https://git.kernel.org/stable/c/6e6a529d6f779413379b4404c9ef6a36c0337225"
},
{
"url": "https://git.kernel.org/stable/c/df77314b3bedbd9ad5d6f0682f98b99e3c5f7e2e"
},
{
"url": "https://git.kernel.org/stable/c/f865a57896bd92d7662eb2818d8f48872e2cbbc7"
}
],
"title": "PCI: mediatek: Fix IRQ domain leak when port fails to enable",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64461",
"datePublished": "2026-07-25T08:51:28.309Z",
"dateReserved": "2026-07-19T15:36:31.789Z",
"dateUpdated": "2026-08-17T04:56:06.127Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64472 (GCVE-0-2026-64472)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-08-17 04:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vfio/mlx5: Fix racy bitfields and tighten struct layout
Bitfield operations are not atomic, they use a read-modify-write
pattern, therefore we should be careful not to pack bitfields that
can be concurrently updated into the same storage unit.
This split takes a binary approach: flags that are only modified
pre/post open/close remain bitfields, flags modified from user
action, including actions that reach across to another device (ex.
reset) use dedicated storage units.
Note mlx5_vhca_page_tracker.status is relocated to fill the alignment
hole this split exposes.
Bitfield justifications:
migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe
chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe
mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe
Dedicated storage units:
mdev_detach: written in the VF attach/detach event notifier
mlx5fv_vf_event() at runtime
log_active: written in mlx5vf_start_page_tracker()/
mlx5vf_stop_page_tracker() during runtime dirty tracking
deferred_reset: written in mlx5vf_state_mutex_unlock()/
mlx5vf_pci_aer_reset_done() during runtime reset handling
is_err: set by tracker error handling and dirty-log polling at runtime
object_changed: set by tracker event handling and cleared by dirty-log
polling at runtime
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f Version: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f Version: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f Version: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f Version: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f Version: 61a2f1460fd03285ea34c1a235f2f50f71e13a1f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vfio/pci/mlx5/cmd.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1dd99b8f4e143592e12e5a77e7b538bc698116cb",
"status": "affected",
"version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
"versionType": "git"
},
{
"lessThan": "f1db80a67da928a92ba460ede1be52d8941f46be",
"status": "affected",
"version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
"versionType": "git"
},
{
"lessThan": "399d806f998f7a25405fc1b97227e579aead24af",
"status": "affected",
"version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
"versionType": "git"
},
{
"lessThan": "7ed120b1a007bace57c461805519d70e1af44e59",
"status": "affected",
"version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
"versionType": "git"
},
{
"lessThan": "39d163627b51886492bf31f66cb02c94613d2287",
"status": "affected",
"version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
"versionType": "git"
},
{
"lessThan": "f2365a63b02ddea32e7db78b742c2503ec7b81f1",
"status": "affected",
"version": "61a2f1460fd03285ea34c1a235f2f50f71e13a1f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vfio/pci/mlx5/cmd.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/mlx5: Fix racy bitfields and tighten struct layout\n\nBitfield operations are not atomic, they use a read-modify-write\npattern, therefore we should be careful not to pack bitfields that\ncan be concurrently updated into the same storage unit.\n\nThis split takes a binary approach: flags that are only modified\npre/post open/close remain bitfields, flags modified from user\naction, including actions that reach across to another device (ex.\nreset) use dedicated storage units.\n\nNote mlx5_vhca_page_tracker.status is relocated to fill the alignment\nhole this split exposes.\n\nBitfield justifications:\n\n migrate_cap: written only in mlx5vf_cmd_set_migratable() at probe\n chunk_mode: written only in mlx5vf_cmd_set_migratable() at probe\n mig_state_cap: written only in mlx5vf_cmd_set_migratable() at probe\n\nDedicated storage units:\n\n mdev_detach: written in the VF attach/detach event notifier\n mlx5fv_vf_event() at runtime\n log_active: written in mlx5vf_start_page_tracker()/\n mlx5vf_stop_page_tracker() during runtime dirty tracking\n deferred_reset: written in mlx5vf_state_mutex_unlock()/\n mlx5vf_pci_aer_reset_done() during runtime reset handling\n is_err: set by tracker error handling and dirty-log polling at runtime\n object_changed: set by tracker event handling and cleared by dirty-log\n polling at runtime"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:56:18.199Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1dd99b8f4e143592e12e5a77e7b538bc698116cb"
},
{
"url": "https://git.kernel.org/stable/c/f1db80a67da928a92ba460ede1be52d8941f46be"
},
{
"url": "https://git.kernel.org/stable/c/399d806f998f7a25405fc1b97227e579aead24af"
},
{
"url": "https://git.kernel.org/stable/c/7ed120b1a007bace57c461805519d70e1af44e59"
},
{
"url": "https://git.kernel.org/stable/c/39d163627b51886492bf31f66cb02c94613d2287"
},
{
"url": "https://git.kernel.org/stable/c/f2365a63b02ddea32e7db78b742c2503ec7b81f1"
}
],
"title": "vfio/mlx5: Fix racy bitfields and tighten struct layout",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64472",
"datePublished": "2026-07-25T08:51:35.978Z",
"dateReserved": "2026-07-19T15:36:31.790Z",
"dateUpdated": "2026-08-17T04:56:18.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64493 (GCVE-0-2026-64493)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-08-17 04:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iio: pressure: mpl115: fix runtime PM leak on read error
mpl115_read_raw() takes a runtime PM reference with pm_runtime_get_sync()
before reading the processed pressure or raw temperature, but on the read
error path it returns without calling pm_runtime_put_autosuspend(). Each
failed read therefore leaks a runtime PM reference and prevents the device
from autosuspending.
Drop the reference before checking the return value so both the success
and error paths are balanced.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iio/pressure/mpl115.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5022f4ed5aae974ec530e3cbf0bd223be13055f7",
"status": "affected",
"version": "0c3a333524a3e5ba4b6c7b2638faef8420cfdb2a",
"versionType": "git"
},
{
"lessThan": "aab0fed636b14a5fd52fcae58b484f1cb96b841d",
"status": "affected",
"version": "0c3a333524a3e5ba4b6c7b2638faef8420cfdb2a",
"versionType": "git"
},
{
"lessThan": "b3f1af4ba8e9cf33aa08c4cdcaa5a17b140521ec",
"status": "affected",
"version": "0c3a333524a3e5ba4b6c7b2638faef8420cfdb2a",
"versionType": "git"
},
{
"lessThan": "46e69d3dd429b33e50e2731913239f6af4ea2705",
"status": "affected",
"version": "0c3a333524a3e5ba4b6c7b2638faef8420cfdb2a",
"versionType": "git"
},
{
"lessThan": "fbe67ff37a6fd855a6c097f84f3738bd13d0a898",
"status": "affected",
"version": "0c3a333524a3e5ba4b6c7b2638faef8420cfdb2a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iio/pressure/mpl115.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: pressure: mpl115: fix runtime PM leak on read error\n\nmpl115_read_raw() takes a runtime PM reference with pm_runtime_get_sync()\nbefore reading the processed pressure or raw temperature, but on the read\nerror path it returns without calling pm_runtime_put_autosuspend(). Each\nfailed read therefore leaks a runtime PM reference and prevents the device\nfrom autosuspending.\n\nDrop the reference before checking the return value so both the success\nand error paths are balanced."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:56:41.512Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5022f4ed5aae974ec530e3cbf0bd223be13055f7"
},
{
"url": "https://git.kernel.org/stable/c/aab0fed636b14a5fd52fcae58b484f1cb96b841d"
},
{
"url": "https://git.kernel.org/stable/c/b3f1af4ba8e9cf33aa08c4cdcaa5a17b140521ec"
},
{
"url": "https://git.kernel.org/stable/c/46e69d3dd429b33e50e2731913239f6af4ea2705"
},
{
"url": "https://git.kernel.org/stable/c/fbe67ff37a6fd855a6c097f84f3738bd13d0a898"
}
],
"title": "iio: pressure: mpl115: fix runtime PM leak on read error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64493",
"datePublished": "2026-07-25T08:51:51.036Z",
"dateReserved": "2026-07-19T15:36:31.792Z",
"dateUpdated": "2026-08-17T04:56:41.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64509 (GCVE-0-2026-64509)
Vulnerability from cvelistv5
Published
2026-07-25 08:52
Modified
2026-08-17 04:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
rust: block: fix GenDisk cleanup paths
GenDiskBuilder::build() still has fallible work after
__blk_mq_alloc_disk(), but its error path only recovers the
foreign queue data. That leaks the temporary gendisk and
request_queue until later teardown. If the caller moved the last
Arc<TagSet<T>> into build(), the leaked queue can retain blk-mq
state after the tag set is dropped.
Fix the pre-registration failure path by dropping the temporary
gendisk reference with put_disk() before recovering queue_data,
so disk_release() can tear down the owned queue.
Also pair GenDisk::drop() with put_disk() after del_gendisk().
Once a Rust GenDisk has been added with device_add_disk(),
del_gendisk() only unregisters it; the final gendisk reference
still has to be dropped to complete the release path.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"rust/kernel/block/mq/gen_disk.rs"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d1dcaa5229a63a6b6df7e0f673fe576cf3d6e8cb",
"status": "affected",
"version": "3253aba3408aa4eb2e4e09365eede3e63ef7536b",
"versionType": "git"
},
{
"lessThan": "e7636f26f77070a529c26d65afd217514ce85ce4",
"status": "affected",
"version": "3253aba3408aa4eb2e4e09365eede3e63ef7536b",
"versionType": "git"
},
{
"lessThan": "6822a2685b4da9a87efd1fce4b042678a31ff734",
"status": "affected",
"version": "3253aba3408aa4eb2e4e09365eede3e63ef7536b",
"versionType": "git"
},
{
"lessThan": "2957771379fa335103a4b539db57bb2271e12142",
"status": "affected",
"version": "3253aba3408aa4eb2e4e09365eede3e63ef7536b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"rust/kernel/block/mq/gen_disk.rs"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.11"
},
{
"lessThan": "6.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrust: block: fix GenDisk cleanup paths\n\nGenDiskBuilder::build() still has fallible work after\n__blk_mq_alloc_disk(), but its error path only recovers the\nforeign queue data. That leaks the temporary gendisk and\nrequest_queue until later teardown. If the caller moved the last\nArc\u003cTagSet\u003cT\u003e\u003e into build(), the leaked queue can retain blk-mq\nstate after the tag set is dropped.\n\nFix the pre-registration failure path by dropping the temporary\ngendisk reference with put_disk() before recovering queue_data,\nso disk_release() can tear down the owned queue.\n\nAlso pair GenDisk::drop() with put_disk() after del_gendisk().\nOnce a Rust GenDisk has been added with device_add_disk(),\ndel_gendisk() only unregisters it; the final gendisk reference\nstill has to be dropped to complete the release path."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:56:59.904Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d1dcaa5229a63a6b6df7e0f673fe576cf3d6e8cb"
},
{
"url": "https://git.kernel.org/stable/c/e7636f26f77070a529c26d65afd217514ce85ce4"
},
{
"url": "https://git.kernel.org/stable/c/6822a2685b4da9a87efd1fce4b042678a31ff734"
},
{
"url": "https://git.kernel.org/stable/c/2957771379fa335103a4b539db57bb2271e12142"
}
],
"title": "rust: block: fix GenDisk cleanup paths",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64509",
"datePublished": "2026-07-25T08:52:02.486Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-08-17T04:56:59.904Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45944 (GCVE-0-2026-45944)
Vulnerability from cvelistv5
Published
2026-05-27 12:18
Modified
2026-08-05 12:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Clear Present bit before tearing down context entry
When tearing down a context entry, the current implementation zeros the
entire 128-bit entry using multiple 64-bit writes. This creates a window
where the hardware can fetch a "torn" entry — where some fields are
already zeroed while the 'Present' bit is still set — leading to
unpredictable behavior or spurious faults.
While x86 provides strong write ordering, the compiler may reorder writes
to the two 64-bit halves of the context entry. Even without compiler
reordering, the hardware fetch is not guaranteed to be atomic with
respect to multiple CPU writes.
Align with the "Guidance to Software for Invalidations" in the VT-d spec
(Section 6.5.3.3) by implementing the recommended ownership handshake:
1. Clear only the 'Present' (P) bit of the context entry first to
signal the transition of ownership from hardware to software.
2. Use dma_wmb() to ensure the cleared bit is visible to the IOMMU.
3. Perform the required cache and context-cache invalidation to ensure
hardware no longer has cached references to the entry.
4. Fully zero out the entry only after the invalidation is complete.
Also, add a dma_wmb() to context_set_present() to ensure the entry
is fully initialized before the 'Present' bit becomes visible.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/iommu.c",
"drivers/iommu/intel/iommu.h",
"drivers/iommu/intel/pasid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c716a59e9977d751e5eb54bcfa6a80124cb5067b",
"status": "affected",
"version": "ba39592764ed20cee09aae5352e603a27bf56b0d",
"versionType": "git"
},
{
"lessThan": "d2138abc8f0a7fce4101b7229b43b06811ed083d",
"status": "affected",
"version": "ba39592764ed20cee09aae5352e603a27bf56b0d",
"versionType": "git"
},
{
"lessThan": "a922dbafb4a674d958d702038232d09a30daf770",
"status": "affected",
"version": "ba39592764ed20cee09aae5352e603a27bf56b0d",
"versionType": "git"
},
{
"lessThan": "c1e4f1dccbe9d7656d1c6872ebeadb5992d0aaa2",
"status": "affected",
"version": "ba39592764ed20cee09aae5352e603a27bf56b0d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/iommu.c",
"drivers/iommu/intel/iommu.h",
"drivers/iommu/intel/pasid.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"lessThan": "2.6.24",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.14",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.4",
"versionStartIncluding": "2.6.24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "2.6.24",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Clear Present bit before tearing down context entry\n\nWhen tearing down a context entry, the current implementation zeros the\nentire 128-bit entry using multiple 64-bit writes. This creates a window\nwhere the hardware can fetch a \"torn\" entry \u2014 where some fields are\nalready zeroed while the \u0027Present\u0027 bit is still set \u2014 leading to\nunpredictable behavior or spurious faults.\n\nWhile x86 provides strong write ordering, the compiler may reorder writes\nto the two 64-bit halves of the context entry. Even without compiler\nreordering, the hardware fetch is not guaranteed to be atomic with\nrespect to multiple CPU writes.\n\nAlign with the \"Guidance to Software for Invalidations\" in the VT-d spec\n(Section 6.5.3.3) by implementing the recommended ownership handshake:\n\n1. Clear only the \u0027Present\u0027 (P) bit of the context entry first to\n signal the transition of ownership from hardware to software.\n2. Use dma_wmb() to ensure the cleared bit is visible to the IOMMU.\n3. Perform the required cache and context-cache invalidation to ensure\n hardware no longer has cached references to the entry.\n4. Fully zero out the entry only after the invalidation is complete.\n\nAlso, add a dma_wmb() to context_set_present() to ensure the entry\nis fully initialized before the \u0027Present\u0027 bit becomes visible."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable setup/teardown paths are reached via local IOMMU domain management (VFIO/iommufd device assignment or sysfs driver bind/unbind); there is no network or adjacent-network path to this code.\nAC:H - Manifesting the torn-entry requires the IOMMU hardware to fetch the context entry in a microscopic window between the CPU writes and the cache/context-cache invalidation, combined with compiler/CPU write reordering \u2014 timing conditions the attacker cannot reliably control.\nPR:H - Driving an IOMMU context setup/teardown requires CAP_SYS_ADMIN-level privilege (VFIO/iommufd assignment or sysfs driver unbind), which is not obtainable through user namespaces.\nUI:N - The teardown/setup window is reached purely through IOMMU control operations with no victim action required.\nS:C - The IOMMU is the DMA isolation boundary; a torn/stale context entry lets a device\u0027s in-flight DMA be mistranslated and escape its assigned domain, impacting memory belonging to a different security authority (the host or another domain).\nC:H - A device using a stale/torn translation during the window can read host memory outside its intended domain across the IOMMU boundary, yielding a potential arbitrary device-driven read.\nI:H - The same cross-boundary mistranslation lets the device write host memory outside its domain, providing an arbitrary device-driven write primitive.\nA:H - The commit documents \"unpredictable behavior or spurious faults\"; torn-entry fetches generate DMAR fault storms and device/driver malfunction that can hang or crash the system."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:28:51.029Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c716a59e9977d751e5eb54bcfa6a80124cb5067b"
},
{
"url": "https://git.kernel.org/stable/c/d2138abc8f0a7fce4101b7229b43b06811ed083d"
},
{
"url": "https://git.kernel.org/stable/c/a922dbafb4a674d958d702038232d09a30daf770"
},
{
"url": "https://git.kernel.org/stable/c/c1e4f1dccbe9d7656d1c6872ebeadb5992d0aaa2"
}
],
"title": "iommu/vt-d: Clear Present bit before tearing down context entry",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-45944",
"datePublished": "2026-05-27T12:18:00.481Z",
"dateReserved": "2026-05-13T15:03:33.087Z",
"dateUpdated": "2026-08-05T12:28:51.029Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64535 (GCVE-0-2026-64535)
Vulnerability from cvelistv5
Published
2026-07-27 06:32
Modified
2026-08-19 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp: Fix potential UAF when ddgst mismatch
Shivam Kumar found via vulnerability testing:
When data digest is enabled on an NVMe/TCP connection and a digest
mismatch occurs on a non-final H2C_DATA PDU during an R2T-based
data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst()
calls nvmet_req_uninit() — which performs percpu_ref_put() on the
submission queue — but does NOT mark the command as completed. It
does not set cqe->status, does not modify rbytes_done, and does not
clear any flag. When the subsequent fatal error triggers queue
teardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands,
checks nvmet_tcp_need_data_in() for each one, and finds that the
already-uninited command still appears to need data (because
rbytes_done < transfer_len and cqe->status == 0). It therefore calls
nvmet_req_uninit() a second time on the same command — a double
percpu_ref_put against a single percpu_ref_get.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 91edfca6f8b364d60cde3ddefaf7d03ddf35774b Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: fda871c0ba5d2eed2cd1c881573168129da70058 Version: 4b17476d809273617d3317fa0d4ae78aa488d760 Version: 5.10.20 ≤ Version: 5.11.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dfb902462bca478f050224ec7a7195aafa7643b1",
"status": "affected",
"version": "91edfca6f8b364d60cde3ddefaf7d03ddf35774b",
"versionType": "git"
},
{
"lessThan": "7e558308eba14c8136cb1e615f0c850f76d1fc0a",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"lessThan": "96fe2513df590e74b04253a45089cae75569570e",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"lessThan": "e091ff83d962f9ed00d9bd70443676de9fe98bdc",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"lessThan": "6f9442983a3e4227afd1c83a5251ddbca585ea21",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"lessThan": "088ee46c18d99baef453afd74181dd40ade044ad",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"lessThan": "dbbd07d0a7020b80f6a7028e561908f7b83b3d5a",
"status": "affected",
"version": "fda871c0ba5d2eed2cd1c881573168129da70058",
"versionType": "git"
},
{
"status": "affected",
"version": "4b17476d809273617d3317fa0d4ae78aa488d760",
"versionType": "git"
},
{
"lessThan": "5.10.265",
"status": "affected",
"version": "5.10.20",
"versionType": "semver"
},
{
"lessThan": "5.12",
"status": "affected",
"version": "5.11.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/nvme/target/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-tcp: Fix potential UAF when ddgst mismatch\n\nShivam Kumar found via vulnerability testing:\nWhen data digest is enabled on an NVMe/TCP connection and a digest\nmismatch occurs on a non-final H2C_DATA PDU during an R2T-based\ndata transfer, the digest error handler in nvmet_tcp_try_recv_ddgst()\ncalls nvmet_req_uninit() \u2014 which performs percpu_ref_put() on the\nsubmission queue \u2014 but does NOT mark the command as completed. It\ndoes not set cqe-\u003estatus, does not modify rbytes_done, and does not\nclear any flag. When the subsequent fatal error triggers queue\nteardown, nvmet_tcp_uninit_data_in_cmds() iterates all commands,\nchecks nvmet_tcp_need_data_in() for each one, and finds that the\nalready-uninited command still appears to need data (because\nrbytes_done \u003c transfer_len and cqe-\u003estatus == 0). It therefore calls\nnvmet_req_uninit() a second time on the same command \u2014 a double\npercpu_ref_put against a single percpu_ref_get."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable NVMe/TCP target receive worker processes attacker-controlled H2C_DATA PDUs received through a listening TCP socket, making it remotely network reachable.\nAC:L - The attacker controls digest negotiation, PDU chunking, transfer length, and digest contents, allowing a non-final digest mismatch to be triggered deterministically while keeping other I/O outstanding.\nPR:N - A reasonable non-TLS target deployment using allow_any_host requires no credentials or local capabilities; the remote peer can negotiate data digests and submit the malicious protocol sequence directly.\nUI:N - Exploitation requires only network protocol traffic and no action by a victim user.\nS:U - The vulnerable receive processing and resulting kernel compromise occur within the target host\u0027s existing kernel security authority.\nC:H - The premature reference release can free queue, request, response-buffer, and percpu-ref state while asynchronous completions still access it, creating a kernel UAF capable of arbitrary memory disclosure.\nI:H - The kernel UAF exposes writes through reclaimed request and queue structures and is plausibly exploitable for arbitrary kernel memory modification or code execution.\nA:H - The refcount corruption can cause a permanent workqueue teardown deadlock, while the resulting UAF can also produce an oops or kernel panic; the network trigger can be repeated."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:23.449Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dfb902462bca478f050224ec7a7195aafa7643b1"
},
{
"url": "https://git.kernel.org/stable/c/7e558308eba14c8136cb1e615f0c850f76d1fc0a"
},
{
"url": "https://git.kernel.org/stable/c/96fe2513df590e74b04253a45089cae75569570e"
},
{
"url": "https://git.kernel.org/stable/c/e091ff83d962f9ed00d9bd70443676de9fe98bdc"
},
{
"url": "https://git.kernel.org/stable/c/6f9442983a3e4227afd1c83a5251ddbca585ea21"
},
{
"url": "https://git.kernel.org/stable/c/088ee46c18d99baef453afd74181dd40ade044ad"
},
{
"url": "https://git.kernel.org/stable/c/dbbd07d0a7020b80f6a7028e561908f7b83b3d5a"
}
],
"title": "nvmet-tcp: Fix potential UAF when ddgst mismatch",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64535",
"datePublished": "2026-07-27T06:32:34.859Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-19T16:28:23.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64390 (GCVE-0-2026-64390)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: track the connection owning a byte-range lock
SMB2_LOCK adds each granted byte-range lock to both the file lock list
and the lock list of the connection which handled the request. The
final close and durable handle paths, however, remove the connection
list entry while holding fp->conn->llist_lock.
With SMB3 multichannel, the connection handling the LOCK request can be
different from the connection which opened the file. The entry can
therefore be removed under a different spinlock from the one protecting
the list it belongs to. A concurrent traversal can then access freed
struct ksmbd_lock and struct file_lock objects.
Record the connection owning each lock's clist entry and hold a
reference to it while the entry is linked. Use that connection and its
llist_lock for unlock, rollback, close, and durable preserve. Durable
reconnect assigns the new connection as the owner when publishing the
locks again.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f5a544e3bab78142207e0242d22442db85ba1eff Version: f5a544e3bab78142207e0242d22442db85ba1eff Version: f5a544e3bab78142207e0242d22442db85ba1eff Version: f5a544e3bab78142207e0242d22442db85ba1eff Version: f5a544e3bab78142207e0242d22442db85ba1eff Version: f5a544e3bab78142207e0242d22442db85ba1eff Version: f5a544e3bab78142207e0242d22442db85ba1eff |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c",
"fs/smb/server/vfs_cache.c",
"fs/smb/server/vfs_cache.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "22d38cf75b556c20b039743bdf3654d535b858be",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
},
{
"lessThan": "66eb3643164e5e1029907793926c132f8b5c6148",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
},
{
"lessThan": "ea5c9bf99f626a15cc59f645dc895f2b3f01992e",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
},
{
"lessThan": "fe20d492a69a6f79e637f438072b212e21ed3b78",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
},
{
"lessThan": "427faaa52b0b399940c1a88065a5c310d10dad15",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
},
{
"lessThan": "5fecc15a30cb9ebd310f7b52c1ab607edcea78f6",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
},
{
"lessThan": "c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb",
"status": "affected",
"version": "f5a544e3bab78142207e0242d22442db85ba1eff",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/smb2pdu.c",
"fs/smb/server/vfs_cache.c",
"fs/smb/server/vfs_cache.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: track the connection owning a byte-range lock\n\nSMB2_LOCK adds each granted byte-range lock to both the file lock list\nand the lock list of the connection which handled the request. The\nfinal close and durable handle paths, however, remove the connection\nlist entry while holding fp-\u003econn-\u003ellist_lock.\n\nWith SMB3 multichannel, the connection handling the LOCK request can be\ndifferent from the connection which opened the file. The entry can\ntherefore be removed under a different spinlock from the one protecting\nthe list it belongs to. A concurrent traversal can then access freed\nstruct ksmbd_lock and struct file_lock objects.\n\nRecord the connection owning each lock\u0027s clist entry and hold a\nreference to it while the entry is linked. Use that connection and its\nllist_lock for unlock, rollback, close, and durable preserve. Durable\nreconnect assigns the new connection as the owner when publishing the\nlocks again."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - An attacker reaches smb2_lock through remotely supplied SMB2 requests handled by ksmbd over TCP port 445.\nAC:L - In a multichannel deployment, the attacker controls the channels, lock creation, concurrent traversal, connection teardown, and close operations needed to trigger the lifetime violation.\nPR:L - The path requires a valid non-guest SMB3 session, signed multichannel binding, authorized tree connection, and an accessible file handle. An ordinary authenticated share user suffices; no administrative privilege is required.\nUI:N - The authenticated attacker can open, lock, traverse, and close the file or disconnect a channel without any victim action.\nS:U - The memory corruption compromises the ksmbd host kernel within the same security authority and does not inherently cross a VM, container, or IOMMU boundary.\nC:H - Freed ksmbd_lock and file_lock objects can be reclaimed and subsequently dereferenced during connection lock-list traversal, supporting disclosure of arbitrary kernel memory during exploitation.\nI:H - Stale list_del operations write through freed or attacker-influenced list pointers, providing exploitable heap corruption that can plausibly yield arbitrary writes and kernel code execution.\nA:H - The use-after-free and corrupted linked lists can cause kernel oopses, panics, or hangs, and the remote attacker can repeatedly retrigger the condition."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:42.740Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/22d38cf75b556c20b039743bdf3654d535b858be"
},
{
"url": "https://git.kernel.org/stable/c/66eb3643164e5e1029907793926c132f8b5c6148"
},
{
"url": "https://git.kernel.org/stable/c/ea5c9bf99f626a15cc59f645dc895f2b3f01992e"
},
{
"url": "https://git.kernel.org/stable/c/fe20d492a69a6f79e637f438072b212e21ed3b78"
},
{
"url": "https://git.kernel.org/stable/c/427faaa52b0b399940c1a88065a5c310d10dad15"
},
{
"url": "https://git.kernel.org/stable/c/5fecc15a30cb9ebd310f7b52c1ab607edcea78f6"
},
{
"url": "https://git.kernel.org/stable/c/c1016dd1d8b2bcd1158bbaabe94a31bb7e7431fb"
}
],
"title": "ksmbd: track the connection owning a byte-range lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64390",
"datePublished": "2026-07-25T08:50:37.406Z",
"dateReserved": "2026-07-19T15:36:31.785Z",
"dateUpdated": "2026-08-17T04:54:42.740Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64507 (GCVE-0-2026-64507)
Vulnerability from cvelistv5
Published
2026-07-25 08:52
Modified
2026-08-19 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
x86/bugs: Enable IBPB flush on BPF JIT allocation
Enable hardening against JIT spraying when Spectre-v2 mitigations are in
use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip
enabling the IBPB flush if the BPF dispatcher is already using a retpoline
sequence.
This hardening applies only when BPF-JIT is in use. Guard the enabling
under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/x86/include/asm/nospec-branch.h",
"arch/x86/kernel/cpu/bugs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "25dbcd31781e2bc3cd63d873af1fcd06f863a126",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "cb27f3bf915cc0f20fc0c48da9059304e39ebd35",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "9354248fc1c33a844ca1872761f6668b393e8c37",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "52440e15d9628f8f239373c0f2e5e8f92feea2df",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "a3af84b0fa00ead01fcd0e28b5d773ff25990a0d",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/x86/include/asm/nospec-branch.h",
"arch/x86/kernel/cpu/bugs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/bugs: Enable IBPB flush on BPF JIT allocation\n\nEnable hardening against JIT spraying when Spectre-v2 mitigations are in\nuse. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip\nenabling the IBPB flush if the BPF dispatcher is already using a retpoline\nsequence.\n\nThis hardening applies only when BPF-JIT is in use. Guard the enabling\nunder CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:18.513Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/25dbcd31781e2bc3cd63d873af1fcd06f863a126"
},
{
"url": "https://git.kernel.org/stable/c/cb27f3bf915cc0f20fc0c48da9059304e39ebd35"
},
{
"url": "https://git.kernel.org/stable/c/9354248fc1c33a844ca1872761f6668b393e8c37"
},
{
"url": "https://git.kernel.org/stable/c/8a4c8af9ae67eb072d90d1b339f14d27a82bd2a1"
},
{
"url": "https://git.kernel.org/stable/c/52440e15d9628f8f239373c0f2e5e8f92feea2df"
},
{
"url": "https://git.kernel.org/stable/c/a3af84b0fa00ead01fcd0e28b5d773ff25990a0d"
}
],
"title": "x86/bugs: Enable IBPB flush on BPF JIT allocation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64507",
"datePublished": "2026-07-25T08:52:01.008Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-08-19T16:28:18.513Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64537 (GCVE-0-2026-64537)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bridge: cfm: reject invalid CCM interval at configuration time
ccm_tx_work_expired() re-arms itself via queue_delayed_work() using
the configured exp_interval converted by interval_to_us(). When
exp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range,
interval_to_us() returns 0, causing the worker to fire immediately in
a tight loop that allocates skbs until OOM.
Fix this by validating exp_interval at configuration time:
- Constrain IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL to the valid range
[BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_INTERVAL_10_MIN] in the
netlink policy so userspace cannot set an invalid value.
- Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has
not yet been configured (defaults to 0 from kzalloc).
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2be665c3940d367e0a2a8128eb4985ce323f99a3 Version: 2be665c3940d367e0a2a8128eb4985ce323f99a3 Version: 2be665c3940d367e0a2a8128eb4985ce323f99a3 Version: 2be665c3940d367e0a2a8128eb4985ce323f99a3 Version: 2be665c3940d367e0a2a8128eb4985ce323f99a3 Version: 2be665c3940d367e0a2a8128eb4985ce323f99a3 Version: 2be665c3940d367e0a2a8128eb4985ce323f99a3 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bridge/br_cfm.c",
"net/bridge/br_cfm_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2870056a78961e0fecd652362ee9d3fcfd24a8a6",
"status": "affected",
"version": "2be665c3940d367e0a2a8128eb4985ce323f99a3",
"versionType": "git"
},
{
"lessThan": "f0f5eb59a97ece0d85de8cfa95dc18c609302a8b",
"status": "affected",
"version": "2be665c3940d367e0a2a8128eb4985ce323f99a3",
"versionType": "git"
},
{
"lessThan": "53788b134519e995699ea3721969c96a08d64575",
"status": "affected",
"version": "2be665c3940d367e0a2a8128eb4985ce323f99a3",
"versionType": "git"
},
{
"lessThan": "b42aeb58317f12024734759ff745856b53948873",
"status": "affected",
"version": "2be665c3940d367e0a2a8128eb4985ce323f99a3",
"versionType": "git"
},
{
"lessThan": "a090880c1f544589427e5b7050c40fb211ccecb4",
"status": "affected",
"version": "2be665c3940d367e0a2a8128eb4985ce323f99a3",
"versionType": "git"
},
{
"lessThan": "865643640b5b5c4579b32d7a55ac9ad648362eaa",
"status": "affected",
"version": "2be665c3940d367e0a2a8128eb4985ce323f99a3",
"versionType": "git"
},
{
"lessThan": "f3e02edd8322b31b8e6517faa6ba053bf29d1e26",
"status": "affected",
"version": "2be665c3940d367e0a2a8128eb4985ce323f99a3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bridge/br_cfm.c",
"net/bridge/br_cfm_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbridge: cfm: reject invalid CCM interval at configuration time\n\nccm_tx_work_expired() re-arms itself via queue_delayed_work() using\nthe configured exp_interval converted by interval_to_us(). When\nexp_interval is BR_CFM_CCM_INTERVAL_NONE or out of range,\ninterval_to_us() returns 0, causing the worker to fire immediately in\na tight loop that allocates skbs until OOM.\n\nFix this by validating exp_interval at configuration time:\n\n - Constrain IFLA_BRIDGE_CFM_CC_CONFIG_EXP_INTERVAL to the valid range\n [BR_CFM_CCM_INTERVAL_3_3_MS, BR_CFM_CCM_INTERVAL_10_MIN] in the\n netlink policy so userspace cannot set an invalid value.\n\n - Reject starting CCM TX in br_cfm_cc_ccm_tx() when exp_interval has\n not yet been configured (defaults to 0 from kzalloc)."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:13.368Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2870056a78961e0fecd652362ee9d3fcfd24a8a6"
},
{
"url": "https://git.kernel.org/stable/c/f0f5eb59a97ece0d85de8cfa95dc18c609302a8b"
},
{
"url": "https://git.kernel.org/stable/c/53788b134519e995699ea3721969c96a08d64575"
},
{
"url": "https://git.kernel.org/stable/c/b42aeb58317f12024734759ff745856b53948873"
},
{
"url": "https://git.kernel.org/stable/c/a090880c1f544589427e5b7050c40fb211ccecb4"
},
{
"url": "https://git.kernel.org/stable/c/865643640b5b5c4579b32d7a55ac9ad648362eaa"
},
{
"url": "https://git.kernel.org/stable/c/f3e02edd8322b31b8e6517faa6ba053bf29d1e26"
}
],
"title": "bridge: cfm: reject invalid CCM interval at configuration time",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64537",
"datePublished": "2026-07-27T20:10:32.210Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-17T04:57:13.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64531 (GCVE-0-2026-64531)
Vulnerability from cvelistv5
Published
2026-07-27 06:32
Modified
2026-08-22 04:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: reject oversized nested action attrs
Open vSwitch stores generated flow actions as nlattrs, whose nla_len
field is u16. Commit a1e64addf3ff ("net: openvswitch: remove
misbehaving actions length check") allowed the total sw_flow_actions
stream to grow beyond 64 KiB, which is valid, but also removed the last
guard preventing a generated nested action attribute from exceeding
U16_MAX.
An oversized generated container can thus be closed with a truncated
nla_len. A later dump or teardown then walks a structurally different
stream than the one that was validated. In particular, an oversized
nested CLONE/CT action may cause subsequent bytes in the generated
stream to be interpreted as independent actions.
Keep the larger total-action-stream behavior, but make nested action
close reject generated containers that do not fit in nla_len, and return
the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and
CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse
construction order before discarding failed wrappers, so resources copied
into the rejected tails are released before the wrappers are removed.
Most failed outer wrappers are discarded by truncating actions_len after
child resources have been released. CHECK_PKT_LEN also trims its parent
after branch resources are gone. SET/TUNNEL close failures unwind their
known tun_dst ownership directly, and SET_TO_MASKED has no external
ownership and truncates on close failure.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 057dbc5b72e9fcac439cd561c3a539b8a0edeb92 Version: 2532adbfe917c0e71dba2650ffc6efe396314c87 Version: 4b1a0ee6164c7204c68ab5a9c48c07bfe8852485 Version: e6610f9c08b4c04cf7949c10fc246c071d00e935 Version: a1e64addf3ff9257b45b78bc7d743781c3f41340 Version: a1e64addf3ff9257b45b78bc7d743781c3f41340 Version: a1e64addf3ff9257b45b78bc7d743781c3f41340 Version: 6b099d285d7ed324494b6d684f377aa103856118 Version: 5.15.180 ≤ Version: 6.1.132 ≤ Version: 6.6.84 ≤ Version: 6.12.20 ≤ Version: 6.13.8 ≤ |
||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-08-22T04:12:18.141Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/8"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/31/17"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/01/1"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/01/3"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/22/1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/openvswitch/flow_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ab855641241387db062a5e41d9ad6b8561542572",
"status": "affected",
"version": "057dbc5b72e9fcac439cd561c3a539b8a0edeb92",
"versionType": "git"
},
{
"lessThan": "c66bd2626c2764f23764ff0f8277f44a9cfe8349",
"status": "affected",
"version": "2532adbfe917c0e71dba2650ffc6efe396314c87",
"versionType": "git"
},
{
"lessThan": "d573250d228401f707f4dbc09d11227a6215ee5f",
"status": "affected",
"version": "4b1a0ee6164c7204c68ab5a9c48c07bfe8852485",
"versionType": "git"
},
{
"lessThan": "f1efff8858403191361a01269c6fe8dd7f55a385",
"status": "affected",
"version": "e6610f9c08b4c04cf7949c10fc246c071d00e935",
"versionType": "git"
},
{
"lessThan": "dbd14f736be02cfe73049bd801af89becd1a0749",
"status": "affected",
"version": "a1e64addf3ff9257b45b78bc7d743781c3f41340",
"versionType": "git"
},
{
"lessThan": "1b41cbe05b184f8861712f0806cc0c4f5d8c6dfe",
"status": "affected",
"version": "a1e64addf3ff9257b45b78bc7d743781c3f41340",
"versionType": "git"
},
{
"lessThan": "3f1f755366687d051174739fb99f7d560202f60b",
"status": "affected",
"version": "a1e64addf3ff9257b45b78bc7d743781c3f41340",
"versionType": "git"
},
{
"status": "affected",
"version": "6b099d285d7ed324494b6d684f377aa103856118",
"versionType": "git"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.180",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.132",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.84",
"versionType": "semver"
},
{
"lessThan": "6.12.97",
"status": "affected",
"version": "6.12.20",
"versionType": "semver"
},
{
"lessThan": "6.14",
"status": "affected",
"version": "6.13.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/openvswitch/flow_netlink.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.180",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.132",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: reject oversized nested action attrs\n\nOpen vSwitch stores generated flow actions as nlattrs, whose nla_len\nfield is u16. Commit a1e64addf3ff (\"net: openvswitch: remove\nmisbehaving actions length check\") allowed the total sw_flow_actions\nstream to grow beyond 64 KiB, which is valid, but also removed the last\nguard preventing a generated nested action attribute from exceeding\nU16_MAX.\n\nAn oversized generated container can thus be closed with a truncated\nnla_len. A later dump or teardown then walks a structurally different\nstream than the one that was validated. In particular, an oversized\nnested CLONE/CT action may cause subsequent bytes in the generated\nstream to be interpreted as independent actions.\n\nKeep the larger total-action-stream behavior, but make nested action\nclose reject generated containers that do not fit in nla_len, and return\nthe error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and\nCHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse\nconstruction order before discarding failed wrappers, so resources copied\ninto the rejected tails are released before the wrappers are removed.\n\nMost failed outer wrappers are discarded by truncating actions_len after\nchild resources have been released. CHECK_PKT_LEN also trims its parent\nafter branch resources are gone. SET/TUNNEL close failures unwind their\nknown tun_dst ownership directly, and SET_TO_MASKED has no external\nownership and truncates on close failure."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable action builder is reached through local Generic Netlink requests such as OVS_FLOW_CMD_NEW or OVS_PACKET_CMD_EXECUTE. Remote packets cannot construct the malformed action stream.\nAC:L - The attacker deterministically controls the nested-action expansion, wrapped length, and resulting parser alignment; no race or uncontrollable condition is required.\nPR:L - The operations require CAP_NET_ADMIN but use GENL_UNS_ADMIN_PERM in namespace-aware families. An unprivileged user can obtain the required capability through an allowed user and network namespace.\nUI:N - Once the attacker sends the crafted netlink request, vulnerable dumping, teardown, or execution occurs without another user\u0027s participation.\nS:U - The vulnerability and its effects remain within the host kernel\u0027s security authority. Kernel privilege escalation from a user namespace does not constitute a CVSS scope change.\nC:H - Length truncation can reinterpret attacker-controlled userdata as an internal SET or CT action. The dump path can consequently dereference an attacker-selected kernel pointer and serialize referenced memory.\nI:H - Fake SET or CT actions can make execution or teardown perform reference-count operations, releases, and frees through attacker-controlled pointers. This provides exploitable memory-corruption primitives capable of kernel code execution.\nA:H - Attacker-controlled invalid pointers can cause a kernel oops or panic, while zero-length misparsed actions can cause a non-advancing execution loop and soft lockup."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:08.992Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ab855641241387db062a5e41d9ad6b8561542572"
},
{
"url": "https://git.kernel.org/stable/c/c66bd2626c2764f23764ff0f8277f44a9cfe8349"
},
{
"url": "https://git.kernel.org/stable/c/d573250d228401f707f4dbc09d11227a6215ee5f"
},
{
"url": "https://git.kernel.org/stable/c/f1efff8858403191361a01269c6fe8dd7f55a385"
},
{
"url": "https://git.kernel.org/stable/c/dbd14f736be02cfe73049bd801af89becd1a0749"
},
{
"url": "https://git.kernel.org/stable/c/1b41cbe05b184f8861712f0806cc0c4f5d8c6dfe"
},
{
"url": "https://git.kernel.org/stable/c/3f1f755366687d051174739fb99f7d560202f60b"
}
],
"title": "net: openvswitch: reject oversized nested action attrs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64531",
"datePublished": "2026-07-27T06:32:32.596Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-08-22T04:12:18.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64555 (GCVE-0-2026-64555)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()
kvm_hyp_handle_mops() resets the single-step state machine as part of
rewinding state for a MOPS exception by modifying vcpu_cpsr() and
writing the result directly into hardware.
In the case of nested virtualization, vcpu_cpsr() is a synthetic value
such that the rest of KVM can deal with vEL2 cleanly. That means the
value requires translation before being written into hardware, which is
unfortunately missing from the MOPS handler.
Fix it by directly modifying SPSR_EL2 and avoiding the synthetic state
altogether, which will be resynchronized on the next 'full' exit back
to KVM.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/hyp/include/hyp/switch.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "10a568010e827108d149779908850afaec898846",
"status": "affected",
"version": "2de451a329cf662beeba71f63c7f83ee24ca6642",
"versionType": "git"
},
{
"lessThan": "884b44256041ec6b2dcbe8e6a67384d26145cba1",
"status": "affected",
"version": "2de451a329cf662beeba71f63c7f83ee24ca6642",
"versionType": "git"
},
{
"lessThan": "dd3b237eb7780d65eae296d3d3a70012b6e7a02f",
"status": "affected",
"version": "2de451a329cf662beeba71f63c7f83ee24ca6642",
"versionType": "git"
},
{
"lessThan": "ff1022c3de46753eb7eba2f6efd990569e66ff95",
"status": "affected",
"version": "2de451a329cf662beeba71f63c7f83ee24ca6642",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/hyp/include/hyp/switch.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()\n\nkvm_hyp_handle_mops() resets the single-step state machine as part of\nrewinding state for a MOPS exception by modifying vcpu_cpsr() and\nwriting the result directly into hardware.\n\nIn the case of nested virtualization, vcpu_cpsr() is a synthetic value\nsuch that the rest of KVM can deal with vEL2 cleanly. That means the\nvalue requires translation before being written into hardware, which is\nunfortunately missing from the MOPS handler.\n\nFix it by directly modifying SPSR_EL2 and avoiding the synthetic state\naltogether, which will be resynchronized on the next \u0027full\u0027 exit back\nto KVM."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The attacker must be executing code inside a KVM/arm64 guest on the affected host \u2014 reached via /dev/kvm and guest instruction execution, not over any network protocol. This is local access to the host machine.\nAC:L - A guest hypervisor at vEL2 triggers the MOPS exception at will by executing a main/epilogue MOPS instruction with ill-formed alignment/size parameters; there is no race and no dependence on CPU migration or single-step state, so corruption of hardware SPSR_EL2 is fully deterministic.\nPR:L - Exploitation only needs the ability to create and run a nested-capable VM (/dev/kvm access, typically granted to unprivileged tenants/kvm-group users) and to run code inside that guest\u0027s own EL2 \u2014 no privilege on the host itself.\nUI:N - The guest triggers the faulty exception path entirely on its own during normal vCPU execution; no host user or administrator action is involved.\nS:C - The bogus ERET lands the guest\u0027s PC at real EL2 under the host\u0027s own EL2 translation regime and stack, with stage-2 no longer applied \u2014 the impact crosses the guest/host virtualization boundary into a different security authority.\nC:H - Execution at EL2 with the host\u0027s TTBR0_EL2/TTBR1_EL2 active and guest-controlled registers gives read access to the entire host kernel address space and to other guests\u0027 memory.\nI:H - The guest obtains a controlled control-flow transfer into host kernel text at EL2 with all GPRs under its control, which is an arbitrary code execution / arbitrary write primitive against the host hypervisor.\nA:H - Even without successful exploitation, ERETing to an unmapped or non-executable address at EL2 takes an unexpected EL2 exception that ends in a hyp panic, bringing down the host and every VM on it."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:33.289Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/10a568010e827108d149779908850afaec898846"
},
{
"url": "https://git.kernel.org/stable/c/884b44256041ec6b2dcbe8e6a67384d26145cba1"
},
{
"url": "https://git.kernel.org/stable/c/dd3b237eb7780d65eae296d3d3a70012b6e7a02f"
},
{
"url": "https://git.kernel.org/stable/c/ff1022c3de46753eb7eba2f6efd990569e66ff95"
}
],
"title": "KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64555",
"datePublished": "2026-07-27T20:10:42.259Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-17T04:57:33.289Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64438 (GCVE-0-2026-64438)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-08-17 04:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
The VF2PF interrupt handler queues PF-side response work that stores a
raw pointer to per-VF state (struct adf_accel_vf_info). Currently,
adf_disable_sriov() destroys per-VF mutexes and frees vf_info without
stopping new VF2PF work or waiting for in-flight workers to complete. A
concurrently scheduled or already queued worker can then dereference
freed memory.
This manifests as a use-after-free when KASAN is enabled:
BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0
Write of size 8 at addr 0000000000000260 by task kworker/24:2/...
Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]
Call Trace:
kasan_report+0x119/0x140
mutex_lock+0x76/0xe0
adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]
adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]
adf_iov_send_resp+0x8c/0xe0 [intel_qat]
process_one_work+0x6ac/0xfd0
worker_thread+0x4dd/0xd30
kthread+0x326/0x410
ret_from_fork+0x33b/0x670
Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker
processing, and interrupt re-enabling during teardown. Set this flag
atomically with the hardware interrupt mask inside
adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE
cluster MSI-X interrupt and flush the PF response workqueue before
tearing down per-VF locks and state so all in-flight work completes
before vf_info is destroyed.
Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and
unmask all VF2PF interrupts under the same lock when SR-IOV is
re-enabled. This ensures the software flag and hardware state transition
atomically on both the enable and disable paths.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ed8ccaef52fa03fb03cff45b380f72c9f869f273 Version: ed8ccaef52fa03fb03cff45b380f72c9f869f273 Version: ed8ccaef52fa03fb03cff45b380f72c9f869f273 Version: ed8ccaef52fa03fb03cff45b380f72c9f869f273 Version: ed8ccaef52fa03fb03cff45b380f72c9f869f273 Version: ed8ccaef52fa03fb03cff45b380f72c9f869f273 Version: ed8ccaef52fa03fb03cff45b380f72c9f869f273 Version: ed8ccaef52fa03fb03cff45b380f72c9f869f273 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/intel/qat/qat_common/adf_accel_devices.h",
"drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
"drivers/crypto/intel/qat/qat_common/adf_isr.c",
"drivers/crypto/intel/qat/qat_common/adf_sriov.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "218c2836b3987f3fa1d9eac505462cded0821e4c",
"status": "affected",
"version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
"versionType": "git"
},
{
"lessThan": "446b4d77599cf1a168573f7fb32a4a6aa4f09219",
"status": "affected",
"version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
"versionType": "git"
},
{
"lessThan": "5d916c1eae1933511a69bffe243b4ee5d7da399c",
"status": "affected",
"version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
"versionType": "git"
},
{
"lessThan": "f344a369d0380d54c8d6c8d24734a78dd5a89817",
"status": "affected",
"version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
"versionType": "git"
},
{
"lessThan": "51144032248cc4ea22917370565650670b8b4e9b",
"status": "affected",
"version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
"versionType": "git"
},
{
"lessThan": "49cd5ac6de8de39a14ead609bb552d372d5602cd",
"status": "affected",
"version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
"versionType": "git"
},
{
"lessThan": "6e92b28cd74fa433658efeadf21b9d4b01023d7d",
"status": "affected",
"version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
"versionType": "git"
},
{
"lessThan": "277281c10c63791067d24d421f7c43a15faa9096",
"status": "affected",
"version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/intel/qat/qat_common/adf_accel_devices.h",
"drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
"drivers/crypto/intel/qat/qat_common/adf_isr.c",
"drivers/crypto/intel/qat/qat_common/adf_sriov.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"lessThan": "4.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "4.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix VF2PF work teardown race in adf_disable_sriov()\n\nThe VF2PF interrupt handler queues PF-side response work that stores a\nraw pointer to per-VF state (struct adf_accel_vf_info). Currently,\nadf_disable_sriov() destroys per-VF mutexes and frees vf_info without\nstopping new VF2PF work or waiting for in-flight workers to complete. A\nconcurrently scheduled or already queued worker can then dereference\nfreed memory.\n\nThis manifests as a use-after-free when KASAN is enabled:\n\n BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0\n Write of size 8 at addr 0000000000000260 by task kworker/24:2/...\n Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]\n Call Trace:\n kasan_report+0x119/0x140\n mutex_lock+0x76/0xe0\n adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]\n adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]\n adf_iov_send_resp+0x8c/0xe0 [intel_qat]\n process_one_work+0x6ac/0xfd0\n worker_thread+0x4dd/0xd30\n kthread+0x326/0x410\n ret_from_fork+0x33b/0x670\n\nAdd a PF-local flag, vf2pf_disabled, that gates work queueing, worker\nprocessing, and interrupt re-enabling during teardown. Set this flag\natomically with the hardware interrupt mask inside\nadf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE\ncluster MSI-X interrupt and flush the PF response workqueue before\ntearing down per-VF locks and state so all in-flight work completes\nbefore vf_info is destroyed.\n\nIntroduce adf_enable_all_vf2pf_interrupts() to clear the flag and\nunmask all VF2PF interrupts under the same lock when SR-IOV is\nre-enabled. This ensures the software flag and hardware state transition\natomically on both the enable and disable paths."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation originates from a local process or guest with direct access to an assigned QAT VF, using VF MMIO or the VF driver to generate VF2PF messages; it is not network-reachable.\nAC:L - The VF controls mailbox generation, restart-complete signaling, and acknowledgement behavior, and can keep response work active for up to one second while teardown proceeds. VF removal itself also emits shutdown traffic, making the race repeatedly attacker-alignable.\nPR:L - The attacker needs authorized access to an assigned QAT VF, which can be delegated through VFIO to an unprivileged process or tenant VM. No host administrative capability is required during management-initiated teardown or reset.\nUI:N - Exploitation requires no victim-user action; device teardown, hot-unplug, shutdown, or automatic error recovery supplies the concurrent lifecycle event.\nS:C - In a virtualized deployment, a tenant controlling an assigned VF corrupts memory in the host PF kernel, crossing the guest-to-host isolation boundary.\nC:H - The freed VF-state allocation contains kernel pointers and synchronization state, and reclamation of the stale object can support disclosure of arbitrary host-kernel memory.\nI:H - The worker performs writes through destroyed mutexes and stale pointers into freed or reallocated memory, providing memory-corruption primitives potentially usable for host-kernel code execution.\nA:H - The observed use-after-free produces invalid kernel writes and NULL-pointer dereferences, allowing a kernel oops or panic and complete host availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:55:39.854Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c"
},
{
"url": "https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219"
},
{
"url": "https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c"
},
{
"url": "https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817"
},
{
"url": "https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b"
},
{
"url": "https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd"
},
{
"url": "https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d"
},
{
"url": "https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096"
}
],
"title": "crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64438",
"datePublished": "2026-07-25T08:51:11.740Z",
"dateReserved": "2026-07-19T15:36:31.788Z",
"dateUpdated": "2026-08-17T04:55:39.854Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64558 (GCVE-0-2026-64558)
Vulnerability from cvelistv5
Published
2026-07-29 16:31
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/pkey: Check length in pkey_pckmo handler implementation
Explicitly check the length of the target buffer in the pkey_pckmo
implementation of the key_to_protkey() handler function. The handler
function fails, if the generated output data exceeds the length of the
provided target buffer.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_pckmo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "02028a24e26d85262ab9c8fc4344e1f3503007fc",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "433e5e70cdc1edf382d28d08a885b22e2b98b7da",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "614aa0491c7a190556c2345dddee0b6f5ed90989",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "1ac287e2af9a9112fe271427ef45eceb26bce8b4",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_pckmo.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Check length in pkey_pckmo handler implementation\n\nExplicitly check the length of the target buffer in the pkey_pckmo\nimplementation of the key_to_protkey() handler function. The handler\nfunction fails, if the generated output data exceeds the length of the\nprovided target buffer."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable path is entered through the PKEY_KBLOB2PROTK/PKEY_KBLOB2PROTK2 ioctls on the /dev/pkey character device, or via an AF_ALG setkey on the paes skciphers. Both require local system access; no network input reaches this code.\nAC:L - A single ioctl with a hand-crafted 176-byte protected-key token (type 0x00, version TOKVER_PROTECTED_KEY, keytype PKEY_KEYTYPE_HMAC_1024, len 160) deterministically triggers the 96-byte overflow; there is no race, no memory-layout dependency, and no hardware or wrapping-key prerequisite since the non-AES branch skips pckmo_verify_protkey().\nPR:L - /dev/pkey is registered as a miscdevice with .mode = 0666 and pkey_unlocked_ioctl() contains no capability or permission check, so any unprivileged local user can reach the bug; the paes/AF_ALG setkey path likewise requires no privileges.\nUI:N - The attacker triggers the overflow entirely on their own via a single ioctl or socket option call; no victim action, mount, or file open is involved.\nS:U - The corruption is confined to the kernel\u0027s own stack within the same security authority; exploitation yields kernel privilege escalation rather than crossing a VM, IOMMU, or sandbox boundary.\nC:H - The attacker gains a fully controlled 96-byte out-of-bounds stack write that can clobber adjacent locals, saved pointers and return addresses, which is readily leveraged into arbitrary kernel memory disclosure; the copy also leaves *protkeylen inflated to 160 while the buffer is 64 bytes, feeding an oversized length back to callers.\nI:H - This is an out-of-bounds write of 96 attacker-chosen bytes past the end of a kernel stack object (the last member of struct pkey_kblob2pkey), overwriting saved registers and the return address \u2014 a classic control-flow hijack / local privilege escalation primitive.\nA:H - Smashing the kernel stack past the canary reliably produces a stack-protector panic or an oops on return, and any unprivileged user can repeat it at will to crash the machine."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:36.699Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/02028a24e26d85262ab9c8fc4344e1f3503007fc"
},
{
"url": "https://git.kernel.org/stable/c/433e5e70cdc1edf382d28d08a885b22e2b98b7da"
},
{
"url": "https://git.kernel.org/stable/c/614aa0491c7a190556c2345dddee0b6f5ed90989"
},
{
"url": "https://git.kernel.org/stable/c/1ac287e2af9a9112fe271427ef45eceb26bce8b4"
}
],
"title": "s390/pkey: Check length in pkey_pckmo handler implementation",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64558",
"datePublished": "2026-07-29T16:31:21.591Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-17T04:57:36.699Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64428 (GCVE-0-2026-64428)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-08-17 04:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpio: sch: use raw_spinlock_t in the irq startup path
sch_irq_unmask() enables the GPIO IRQ and then updates the controller
state through sch_irq_mask_unmask(), which takes sch->lock with
spin_lock_irqsave(). The callback can be reached from irq_startup()
while setting up a requested IRQ. That path is not sleepable, but on
PREEMPT_RT a regular spinlock_t becomes a sleeping lock.
This issue was found by our static analysis tool and then manually
reviewed against the current tree.
The grounded PoC kept the request_threaded_irq() -> __setup_irq() ->
irq_startup() -> sch_irq_unmask() -> sch_irq_mask_unmask() carrier and
used the original spin_lock_irqsave(&sch->lock) edge. Lockdep reported:
BUG: sleeping function called from invalid context
hardirqs last disabled at ... __setup_irq.constprop.0 ... [vuln_msv]
sch_rt_spin_lock_irqsave+0x1c/0x30 [vuln_msv]
sch_irq_mask_unmask.constprop.0+0x31/0x70 [vuln_msv]
__setup_irq.constprop.0+0xd/0x30 [vuln_msv]
Convert the SCH controller lock to raw_spinlock_t. The same lock is
also used by the GPIO direction and value callbacks, but those critical
sections only update MMIO-backed GPIO registers and do not contain
sleepable operations. Keeping this register lock non-sleeping is
therefore appropriate for the irqchip callbacks and does not change the
GPIO-side locking contract.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 7a81638485c1a62a87b4c391ecc9c651a4a9dc19 Version: 7a81638485c1a62a87b4c391ecc9c651a4a9dc19 Version: 7a81638485c1a62a87b4c391ecc9c651a4a9dc19 Version: 7a81638485c1a62a87b4c391ecc9c651a4a9dc19 Version: 7a81638485c1a62a87b4c391ecc9c651a4a9dc19 Version: 7a81638485c1a62a87b4c391ecc9c651a4a9dc19 Version: 7a81638485c1a62a87b4c391ecc9c651a4a9dc19 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-sch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3b1aa05ec27eeccc889ecaa3f2d9baa9f453e50d",
"status": "affected",
"version": "7a81638485c1a62a87b4c391ecc9c651a4a9dc19",
"versionType": "git"
},
{
"lessThan": "4f03a15cc73c83740fc355ee22b336492d17b4da",
"status": "affected",
"version": "7a81638485c1a62a87b4c391ecc9c651a4a9dc19",
"versionType": "git"
},
{
"lessThan": "7a550256d68bbdfa0903ab1c4595c04a6815493a",
"status": "affected",
"version": "7a81638485c1a62a87b4c391ecc9c651a4a9dc19",
"versionType": "git"
},
{
"lessThan": "a235cec779bb39ec8f961a935b28a2ce278c6c64",
"status": "affected",
"version": "7a81638485c1a62a87b4c391ecc9c651a4a9dc19",
"versionType": "git"
},
{
"lessThan": "4508366ab7dd0c2917a51a9c2e23cc1b9d35157a",
"status": "affected",
"version": "7a81638485c1a62a87b4c391ecc9c651a4a9dc19",
"versionType": "git"
},
{
"lessThan": "41cad91a09d69e8fff4e936db29b1054b4e9f9f7",
"status": "affected",
"version": "7a81638485c1a62a87b4c391ecc9c651a4a9dc19",
"versionType": "git"
},
{
"lessThan": "286533cb14a3c8a8bd39ff64ea2fc8e1aa0f638b",
"status": "affected",
"version": "7a81638485c1a62a87b4c391ecc9c651a4a9dc19",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-sch.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: sch: use raw_spinlock_t in the irq startup path\n\nsch_irq_unmask() enables the GPIO IRQ and then updates the controller\nstate through sch_irq_mask_unmask(), which takes sch-\u003elock with\nspin_lock_irqsave(). The callback can be reached from irq_startup()\nwhile setting up a requested IRQ. That path is not sleepable, but on\nPREEMPT_RT a regular spinlock_t becomes a sleeping lock.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the request_threaded_irq() -\u003e __setup_irq() -\u003e\nirq_startup() -\u003e sch_irq_unmask() -\u003e sch_irq_mask_unmask() carrier and\nused the original spin_lock_irqsave(\u0026sch-\u003elock) edge. Lockdep reported:\n\n BUG: sleeping function called from invalid context\n hardirqs last disabled at ... __setup_irq.constprop.0 ... [vuln_msv]\n sch_rt_spin_lock_irqsave+0x1c/0x30 [vuln_msv]\n sch_irq_mask_unmask.constprop.0+0x31/0x70 [vuln_msv]\n __setup_irq.constprop.0+0xd/0x30 [vuln_msv]\n\nConvert the SCH controller lock to raw_spinlock_t. The same lock is\nalso used by the GPIO direction and value callbacks, but those critical\nsections only update MMIO-backed GPIO registers and do not contain\nsleepable operations. Keeping this register lock non-sleeping is\ntherefore appropriate for the irqchip callbacks and does not change the\nGPIO-side locking contract."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:55:28.748Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3b1aa05ec27eeccc889ecaa3f2d9baa9f453e50d"
},
{
"url": "https://git.kernel.org/stable/c/4f03a15cc73c83740fc355ee22b336492d17b4da"
},
{
"url": "https://git.kernel.org/stable/c/7a550256d68bbdfa0903ab1c4595c04a6815493a"
},
{
"url": "https://git.kernel.org/stable/c/a235cec779bb39ec8f961a935b28a2ce278c6c64"
},
{
"url": "https://git.kernel.org/stable/c/4508366ab7dd0c2917a51a9c2e23cc1b9d35157a"
},
{
"url": "https://git.kernel.org/stable/c/41cad91a09d69e8fff4e936db29b1054b4e9f9f7"
},
{
"url": "https://git.kernel.org/stable/c/286533cb14a3c8a8bd39ff64ea2fc8e1aa0f638b"
}
],
"title": "gpio: sch: use raw_spinlock_t in the irq startup path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64428",
"datePublished": "2026-07-25T08:51:05.460Z",
"dateReserved": "2026-07-19T15:36:31.787Z",
"dateUpdated": "2026-08-17T04:55:28.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64530 (GCVE-0-2026-64530)
Vulnerability from cvelistv5
Published
2026-07-26 06:28
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle
tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the
defragmentation engine (e.g. act_ct on out-of-order fragments). When
that happens the skb is no longer owned by the caller and must not be
touched again.
tcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the
switch and returned the skb to the caller as if classification had
passed. The only qdisc that wires up qevents today is RED, via three call sites
(qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop)
red_enqueue() was continuing to operate on an skb it no longer owns in this
case -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.
tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10
tc filter add block 10 ... action ct
(with ct defrag enabled and traffic that produces out-of-order
fragments, e.g. a fragmented UDP stream)
Handle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress
and egress fast paths do: treat it as stolen and return NULL without
touching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be
dropped/freed here, as it is no longer owned by us.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 172ba7d46c202e679f3ccb10264c67416aaeb1c4 Version: 0b5b831122fc3789fff75be433ba3e4dd7b779d4 Version: 73f7da5fd124f2cda9161e2e46114915e6e82e97 Version: 3f14b377d01d8357eba032b4cabc8c1149b458b6 Version: 3f14b377d01d8357eba032b4cabc8c1149b458b6 Version: 3f14b377d01d8357eba032b4cabc8c1149b458b6 Version: 3f14b377d01d8357eba032b4cabc8c1149b458b6 Version: f5346df0591d10bc948761ca854b1fae6d2ef441 Version: 5.15.148 ≤ Version: 6.1.75 ≤ Version: 6.6.14 ≤ Version: 6.7.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/cls_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5ed3d6f85991656667059d3fa5a1d683ac58c447",
"status": "affected",
"version": "172ba7d46c202e679f3ccb10264c67416aaeb1c4",
"versionType": "git"
},
{
"lessThan": "f42e8134a3a1074b834a574d404352f867ba994a",
"status": "affected",
"version": "0b5b831122fc3789fff75be433ba3e4dd7b779d4",
"versionType": "git"
},
{
"lessThan": "447d493034a9cf7bf13a2abac86d0573d907ec2f",
"status": "affected",
"version": "73f7da5fd124f2cda9161e2e46114915e6e82e97",
"versionType": "git"
},
{
"lessThan": "e1270e69dcf2c3512c453484178f2e9dc0db3f05",
"status": "affected",
"version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
"versionType": "git"
},
{
"lessThan": "2140c2f3f2e7b066e1ae616ede8856cafd8015e9",
"status": "affected",
"version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
"versionType": "git"
},
{
"lessThan": "e28aedab9488343924d227b5a896faed67ce84d5",
"status": "affected",
"version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
"versionType": "git"
},
{
"lessThan": "a8a02897f2b479127db261de05cbf0c28b98d159",
"status": "affected",
"version": "3f14b377d01d8357eba032b4cabc8c1149b458b6",
"versionType": "git"
},
{
"status": "affected",
"version": "f5346df0591d10bc948761ca854b1fae6d2ef441",
"versionType": "git"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.148",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.75",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.14",
"versionType": "semver"
},
{
"lessThan": "6.8",
"status": "affected",
"version": "6.7.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/cls_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.8"
},
{
"lessThan": "6.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.148",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle\n\ntcf_classify() can return TC_ACT_CONSUMED while the skb is held by the\ndefragmentation engine (e.g. act_ct on out-of-order fragments). When\nthat happens the skb is no longer owned by the caller and must not be\ntouched again.\n\ntcf_qevent_handle() did not handle TC_ACT_CONSUMED: it fell through the\nswitch and returned the skb to the caller as if classification had\npassed. The only qdisc that wires up qevents today is RED, via three call sites\n(qe_mark on RED_PROB_MARK/HARD_MARK, qe_early_drop on congestion_drop)\nred_enqueue() was continuing to operate on an skb it no longer owns in this\ncase -- enqueueing it, dropping it, or updating statistics. Resulting in a UAF.\n\n tc qdisc add dev eth0 root handle 1: red ... qevent early_drop block 10\n tc filter add block 10 ... action ct\n\n (with ct defrag enabled and traffic that produces out-of-order\n fragments, e.g. a fragmented UDP stream)\n\nHandle TC_ACT_CONSUMED in tcf_qevent_handle() the same way the ingress\nand egress fast paths do: treat it as stolen and return NULL without\ntouching the skb. Unlike the TC_ACT_STOLEN case, the skb must not be\ndropped/freed here, as it is no longer owned by us."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - On a transparent bridge or traffic-shaping gateway configured with the RED qevent and act_ct, unauthenticated remote IP fragments reach red_enqueue() through normal receive, bridge-forwarding, and egress-qdisc processing. No local netlink access is required to trigger the deployed configuration.\nAC:L - The attacker controls fragment contents and ordering and can drive RED into deterministic hard-mark or drop conditions with sustained traffic. No race or condition outside the attacker\u0027s control must be won.\nPR:N - CAP_NET_ADMIN is required to create the vulnerable configuration, but a remote attacker sending fragments through an already configured appliance needs no privileges or authentication. Local triggering is also possible with namespaced CAP_NET_ADMIN.\nUI:N - Triggering requires only attacker-generated fragmented traffic and does not depend on a victim performing any action.\nS:U - The corruption occurs within the host kernel and compromises resources governed by that same security authority. This remains unchanged scope even when used for namespace escape or kernel privilege escalation.\nC:H - The reclaimable sk_buff use-after-free and corrupted defragmentation-tree links can be leveraged through attacker-controlled network heap spraying to disclose arbitrary kernel memory.\nI:H - RED overwrites linkage fields that overlap the defragmentation RB node and may free the object while it remains referenced, enabling subsequent writes through freed or attacker-reclaimed kernel objects and potential code execution.\nA:H - The dangling fragment-tree entry can cause immediate or deferred use-after-free, double-free, invalid tree operations, and kernel panic when another fragment arrives or the queue expires. The attacker can trigger this repeatedly with fragmented traffic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:07.900Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5ed3d6f85991656667059d3fa5a1d683ac58c447"
},
{
"url": "https://git.kernel.org/stable/c/f42e8134a3a1074b834a574d404352f867ba994a"
},
{
"url": "https://git.kernel.org/stable/c/447d493034a9cf7bf13a2abac86d0573d907ec2f"
},
{
"url": "https://git.kernel.org/stable/c/e1270e69dcf2c3512c453484178f2e9dc0db3f05"
},
{
"url": "https://git.kernel.org/stable/c/2140c2f3f2e7b066e1ae616ede8856cafd8015e9"
},
{
"url": "https://git.kernel.org/stable/c/e28aedab9488343924d227b5a896faed67ce84d5"
},
{
"url": "https://git.kernel.org/stable/c/a8a02897f2b479127db261de05cbf0c28b98d159"
}
],
"title": "net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64530",
"datePublished": "2026-07-26T06:28:42.970Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-08-17T04:57:07.900Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64548 (GCVE-0-2026-64548)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
When the scatterlist ring is full or nearly full, bpf_msg_push_data()
enters a copy fallback path and computes copy + len for the page
allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING
and both are u32, a crafted len can wrap the sum to a small value,
causing an undersized allocation followed by an out-of-bounds memcpy.
BUG: unable to handle page fault for address: ffffed104089a402
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
Call Trace:
__asan_memcpy (mm/kasan/shadow.c:105)
bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788)
bpf_prog_9ed8b5711920a7d7+0x2e/0x36
sk_psock_msg_verdict (net/core/skmsg.c:934)
tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584)
__sys_sendto (net/socket.c:2206)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Add an overflow check before the allocation.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 Version: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 Version: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 Version: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 Version: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 Version: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 Version: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 Version: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5",
"status": "affected",
"version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
"versionType": "git"
},
{
"lessThan": "a12b1575f9feabd91695a9e9d004862f7195fa25",
"status": "affected",
"version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
"versionType": "git"
},
{
"lessThan": "ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d",
"status": "affected",
"version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
"versionType": "git"
},
{
"lessThan": "888706a76286c547bd035432602571e8024b5305",
"status": "affected",
"version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
"versionType": "git"
},
{
"lessThan": "db77b6bb6e6edb79b10b4efcce346eec5582d588",
"status": "affected",
"version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
"versionType": "git"
},
{
"lessThan": "4e40056bb5c829f0423f0a6694a0477726d2147e",
"status": "affected",
"version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
"versionType": "git"
},
{
"lessThan": "bd004716ba75fed6d185795c85cdc92540ebeaab",
"status": "affected",
"version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
"versionType": "git"
},
{
"lessThan": "0c0a8ed85349dae298712d79cb276acfeb794d82",
"status": "affected",
"version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()\n\nWhen the scatterlist ring is full or nearly full, bpf_msg_push_data()\nenters a copy fallback path and computes copy + len for the page\nallocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING\nand both are u32, a crafted len can wrap the sum to a small value,\ncausing an undersized allocation followed by an out-of-bounds memcpy.\n\n BUG: unable to handle page fault for address: ffffed104089a402\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n Call Trace:\n __asan_memcpy (mm/kasan/shadow.c:105)\n bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788)\n bpf_prog_9ed8b5711920a7d7+0x2e/0x36\n sk_psock_msg_verdict (net/core/skmsg.c:934)\n tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584)\n __sys_sendto (net/socket.c:2206)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nAdd an overflow check before the allocation."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable helper only runs from the sk_msg egress verdict path, reached via a local `sendmsg()`/`sendto()` syscall on a sockmap- or kTLS-attached socket (`tcp_bpf_sendmsg` \u2192 `sk_psock_msg_verdict`, `tls_sw_sendmsg`), as shown in the reported call trace. There is no remote-peer input path into `bpf_msg_push_data()`.\nAC:L - Both trigger conditions are fully attacker-controlled and deterministic: the copy-fallback path is forced by sending \u2265 MAX_SKB_FRAGS*PAGE_SIZE bytes in one sendmsg to fill the SG ring, and the wrapping `len` is a constant chosen by the sk_msg program. No race, timing window, or uncontrolled memory state is involved.\nPR:N - The act that triggers the corruption \u2014 `sendmsg()` on a socket already in the sockmap \u2014 requires no privileges whatsoever, and the same helper\u0027s prior flaw (CVE-2026-63926) was scored PR:N on this basis. `ARG_ANYTHING` means the verifier enforces no bound, so a deployed L7-proxy sk_msg program that derives `len` from message content (e.g. a signed `want - have` underflowing to a huge u32) hands the wrapping value to the kernel without any attacker privilege; where program authorship is needed, CAP_BPF+CAP_NET_ADMIN is delegable to unprivileged container users via a bpffs BPF token.\nUI:N - Exploitation is entirely driven by the attacker\u0027s own socket writes and BPF program; no victim action, mount, or file access is required.\nS:U - The undersized allocation and out-of-bounds write corrupt kernel memory within the same security authority as the vulnerable code. No VM, IOMMU, or hypervisor boundary is crossed.\nC:H - The wild-offset write plus the corrupted `sg.size`/element-length/`data_end` state (huge `len` added to `sg.size` while `sg_set_page()` records the wrapped length) lets adjacent kernel memory be exposed to the BPF program and pushed out on the socket, and the write primitive is readily convertible into an arbitrary kernel read.\nI:H - `memcpy(raw + front + len, from, back)` writes up to a full SG element of attacker-supplied payload roughly 4 GiB past a single-page allocation, with the offset tunable over a ~4 MiB window and the source page groomable \u2014 an attacker-controlled write into the direct map, sufficient for control-flow hijack and privilege escalation.\nA:H - The reported reproducer is an unrecoverable oops (\"unable to handle page fault for address: ffffed104089a402\") when the wild pointer hits unmapped direct-map space, and the ~4 GiB `sk_mem_charge()`/`sg.size` accounting corruption further destabilises the socket and allocator."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:25.465Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5"
},
{
"url": "https://git.kernel.org/stable/c/a12b1575f9feabd91695a9e9d004862f7195fa25"
},
{
"url": "https://git.kernel.org/stable/c/ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d"
},
{
"url": "https://git.kernel.org/stable/c/888706a76286c547bd035432602571e8024b5305"
},
{
"url": "https://git.kernel.org/stable/c/db77b6bb6e6edb79b10b4efcce346eec5582d588"
},
{
"url": "https://git.kernel.org/stable/c/4e40056bb5c829f0423f0a6694a0477726d2147e"
},
{
"url": "https://git.kernel.org/stable/c/bd004716ba75fed6d185795c85cdc92540ebeaab"
},
{
"url": "https://git.kernel.org/stable/c/0c0a8ed85349dae298712d79cb276acfeb794d82"
}
],
"title": "bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64548",
"datePublished": "2026-07-27T20:10:38.355Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-17T04:57:25.465Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64363 (GCVE-0-2026-64363)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: appleir: fix UAF on pending key_up_timer in remove()
appleir_remove() runs hid_hw_stop() before timer_delete_sync().
hid_hw_stop() synchronously unregisters the HID input device via
hid_disconnect() -> hidinput_disconnect() -> input_unregister_device(),
which drops the last reference and frees the underlying input_dev when
no userspace handle holds it open.
key_up_tick() reads appleir->input_dev and calls input_report_key() /
input_sync() on it. The timer is armed from appleir_raw_event() with
a HZ/8 (~125 ms) timeout on every keydown and key-repeat report. If a
key was pressed shortly before the device is disconnected, the timer
can fire after hid_hw_stop() has freed input_dev but before the
teardown drains it.
A simple reorder is not sufficient. Putting the timer drain first
still leaves a window where a USB URB completion (raw_event) running
during hid_hw_stop() can call mod_timer() and re-arm the timer, which
then fires after hidinput_disconnect() has freed input_dev. The same
URB-completion window also lets raw_event() reach key_up(), key_down()
and battery_flat() directly, all of which dereference
appleir->input_dev.
Introduce a 'removing' flag on struct appleir, gated by the existing
spinlock. appleir_remove() sets the flag under the lock and then
shuts down the timer with timer_shutdown_sync(), which both drains any
in-flight callback and permanently disables further mod_timer() calls.
appleir_raw_event() and key_up_tick() bail out early if the flag is
set, so no path can arm or run the timer, or dereference
appleir->input_dev, after remove() has started tearing down.
The keyrepeat and flatbattery branches of appleir_raw_event()
previously called into the input layer without holding the spinlock;
take it now so the flag check is well-defined. This incidentally
closes a pre-existing read-side race on appleir->current_key in the
keyrepeat branch.
This bug is structurally a sibling of commit 4db2af929279 ("HID:
appletb-kbd: fix UAF in inactivity-timer cleanup path") and has been
present since the driver was introduced.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e Version: 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e Version: 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e Version: 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e Version: 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e Version: 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e Version: 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e Version: 9a4a5574ce427c364d81746fc7fb82d86b5f1a7e |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-appleir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "89ef67359672bf4cd6921524e39f61648fe38c0f",
"status": "affected",
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"versionType": "git"
},
{
"lessThan": "3d30a0bb0e79621ae921b487835c56198adfafa3",
"status": "affected",
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"versionType": "git"
},
{
"lessThan": "37a52c61d4f78153c38ae1f7491dfcc8ac828dcf",
"status": "affected",
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"versionType": "git"
},
{
"lessThan": "05e3decc55d1deca9410e0eb36466651fcbe57a5",
"status": "affected",
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"versionType": "git"
},
{
"lessThan": "3755f6e25776b8b12ddf062f9b573f05090e4034",
"status": "affected",
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"versionType": "git"
},
{
"lessThan": "b363d964ca829c1761c9f04188dfa28f90b0f2d4",
"status": "affected",
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"versionType": "git"
},
{
"lessThan": "6b0838e86da88b1d3bff86f19761ff25af73eaca",
"status": "affected",
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"versionType": "git"
},
{
"lessThan": "75fe87e19d8aff81eb2c64d15d244ab8da4de945",
"status": "affected",
"version": "9a4a5574ce427c364d81746fc7fb82d86b5f1a7e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-appleir.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: appleir: fix UAF on pending key_up_timer in remove()\n\nappleir_remove() runs hid_hw_stop() before timer_delete_sync().\nhid_hw_stop() synchronously unregisters the HID input device via\nhid_disconnect() -\u003e hidinput_disconnect() -\u003e input_unregister_device(),\nwhich drops the last reference and frees the underlying input_dev when\nno userspace handle holds it open.\n\nkey_up_tick() reads appleir-\u003einput_dev and calls input_report_key() /\ninput_sync() on it. The timer is armed from appleir_raw_event() with\na HZ/8 (~125 ms) timeout on every keydown and key-repeat report. If a\nkey was pressed shortly before the device is disconnected, the timer\ncan fire after hid_hw_stop() has freed input_dev but before the\nteardown drains it.\n\nA simple reorder is not sufficient. Putting the timer drain first\nstill leaves a window where a USB URB completion (raw_event) running\nduring hid_hw_stop() can call mod_timer() and re-arm the timer, which\nthen fires after hidinput_disconnect() has freed input_dev. The same\nURB-completion window also lets raw_event() reach key_up(), key_down()\nand battery_flat() directly, all of which dereference\nappleir-\u003einput_dev.\n\nIntroduce a \u0027removing\u0027 flag on struct appleir, gated by the existing\nspinlock. appleir_remove() sets the flag under the lock and then\nshuts down the timer with timer_shutdown_sync(), which both drains any\nin-flight callback and permanently disables further mod_timer() calls.\nappleir_raw_event() and key_up_tick() bail out early if the flag is\nset, so no path can arm or run the timer, or dereference\nappleir-\u003einput_dev, after remove() has started tearing down.\n\nThe keyrepeat and flatbattery branches of appleir_raw_event()\npreviously called into the input layer without holding the spinlock;\ntake it now so the flag check is well-defined. This incidentally\ncloses a pre-existing read-side race on appleir-\u003ecurrent_key in the\nkeyrepeat branch.\n\nThis bug is structurally a sibling of commit 4db2af929279 (\"HID:\nappletb-kbd: fix UAF in inactivity-timer cleanup path\") and has been\npresent since the driver was introduced."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:10.084Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/89ef67359672bf4cd6921524e39f61648fe38c0f"
},
{
"url": "https://git.kernel.org/stable/c/3d30a0bb0e79621ae921b487835c56198adfafa3"
},
{
"url": "https://git.kernel.org/stable/c/37a52c61d4f78153c38ae1f7491dfcc8ac828dcf"
},
{
"url": "https://git.kernel.org/stable/c/05e3decc55d1deca9410e0eb36466651fcbe57a5"
},
{
"url": "https://git.kernel.org/stable/c/3755f6e25776b8b12ddf062f9b573f05090e4034"
},
{
"url": "https://git.kernel.org/stable/c/b363d964ca829c1761c9f04188dfa28f90b0f2d4"
},
{
"url": "https://git.kernel.org/stable/c/6b0838e86da88b1d3bff86f19761ff25af73eaca"
},
{
"url": "https://git.kernel.org/stable/c/75fe87e19d8aff81eb2c64d15d244ab8da4de945"
}
],
"title": "HID: appleir: fix UAF on pending key_up_timer in remove()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64363",
"datePublished": "2026-07-25T08:50:18.824Z",
"dateReserved": "2026-07-19T15:36:31.783Z",
"dateUpdated": "2026-08-17T04:54:10.084Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64361 (GCVE-0-2026-64361)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
check_and_correct_requested_length() compares (off + len) against
node_size using u32 arithmetic. When the caller passes a large len
value (e.g. from an underflowed subtraction in hfs_brec_remove()),
off + len can wrap past 2^32 and produce a small result, causing the
bounds check to pass when it should fail.
For example, with off=14 and len=0xFFFFFFF2 (underflowed from
data_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6,
which is less than a typical node_size of 512, so the check passes and
the subsequent memmove reads ~4GB past the node buffer.
Fix this by widening the addition to u64 before comparing against
node_size. This prevents the u32 wrap while keeping the logic
straightforward.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 67ecc81f6492275c9c54280532f558483c99c90e Version: a1a60e79502279f996e55052f50cc14919020475 Version: fe2891a9c43ab87d1a210d61e6438ca6936e2f62 Version: 384a66b89f9540a9a8cb0f48807697dfabaece4c Version: efc095b35b23297e419c2ab4fc1ed1a8f0781a29 Version: a431930c9bac518bf99d6b1da526a7f37ddee8d8 Version: a431930c9bac518bf99d6b1da526a7f37ddee8d8 Version: a431930c9bac518bf99d6b1da526a7f37ddee8d8 Version: e7d2dc2421e821e4045775e6dc226378328de6f6 Version: fc7f732984ec91f30be3e574e0644066d07f2b78 Version: eec522fd0d28106b14a59ab2d658605febe4a3bb Version: 5.10.241 ≤ Version: 5.15.190 ≤ Version: 6.1.149 ≤ Version: 6.6.103 ≤ Version: 6.12.43 ≤ Version: 5.4.297 ≤ Version: 6.15.11 ≤ Version: 6.16.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/hfs/bnode.c",
"fs/hfsplus/hfsplus_fs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c8dd112173c02adf539fe2ad34a45f5e0068780d",
"status": "affected",
"version": "67ecc81f6492275c9c54280532f558483c99c90e",
"versionType": "git"
},
{
"lessThan": "fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1",
"status": "affected",
"version": "a1a60e79502279f996e55052f50cc14919020475",
"versionType": "git"
},
{
"lessThan": "671c3fcc2ad31c1311ea6414382a2d95104ae1b9",
"status": "affected",
"version": "fe2891a9c43ab87d1a210d61e6438ca6936e2f62",
"versionType": "git"
},
{
"lessThan": "b6a481642ea1977be2f84dc08c5affd742c177e7",
"status": "affected",
"version": "384a66b89f9540a9a8cb0f48807697dfabaece4c",
"versionType": "git"
},
{
"lessThan": "7399c3baee7bb622a92f0b895cd4d3009a693f2b",
"status": "affected",
"version": "efc095b35b23297e419c2ab4fc1ed1a8f0781a29",
"versionType": "git"
},
{
"lessThan": "607217f7ad419b53926f71e3f75001813bbc08ad",
"status": "affected",
"version": "a431930c9bac518bf99d6b1da526a7f37ddee8d8",
"versionType": "git"
},
{
"lessThan": "c25d3c931a63e762fcaa9cb125b901c53b62403f",
"status": "affected",
"version": "a431930c9bac518bf99d6b1da526a7f37ddee8d8",
"versionType": "git"
},
{
"lessThan": "966cb76fb2857a4242cab6ea2ea17acf818a3da7",
"status": "affected",
"version": "a431930c9bac518bf99d6b1da526a7f37ddee8d8",
"versionType": "git"
},
{
"status": "affected",
"version": "e7d2dc2421e821e4045775e6dc226378328de6f6",
"versionType": "git"
},
{
"status": "affected",
"version": "fc7f732984ec91f30be3e574e0644066d07f2b78",
"versionType": "git"
},
{
"status": "affected",
"version": "eec522fd0d28106b14a59ab2d658605febe4a3bb",
"versionType": "git"
},
{
"lessThan": "5.10.261",
"status": "affected",
"version": "5.10.241",
"versionType": "semver"
},
{
"lessThan": "5.15.212",
"status": "affected",
"version": "5.15.190",
"versionType": "semver"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.149",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.103",
"versionType": "semver"
},
{
"lessThan": "6.12.97",
"status": "affected",
"version": "6.12.43",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.297",
"versionType": "semver"
},
{
"lessThan": "6.16",
"status": "affected",
"version": "6.15.11",
"versionType": "semver"
},
{
"lessThan": "6.17",
"status": "affected",
"version": "6.16.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/hfs/bnode.c",
"fs/hfsplus/hfsplus_fs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.17"
},
{
"lessThan": "6.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "5.10.241",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15.190",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.149",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.103",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.297",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.15.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.16.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs/hfsplus: fix u32 overflow in check_and_correct_requested_length\n\ncheck_and_correct_requested_length() compares (off + len) against\nnode_size using u32 arithmetic. When the caller passes a large len\nvalue (e.g. from an underflowed subtraction in hfs_brec_remove()),\noff + len can wrap past 2^32 and produce a small result, causing the\nbounds check to pass when it should fail.\n\nFor example, with off=14 and len=0xFFFFFFF2 (underflowed from\ndata_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6,\nwhich is less than a typical node_size of 512, so the check passes and\nthe subsequent memmove reads ~4GB past the node buffer.\n\nFix this by widening the addition to u64 before comparing against\nnode_size. This prevents the u32 wrap while keeping the logic\nstraightforward."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable HFS/HFS+ B-tree operations are reachable through local filesystem syscalls such as removexattr() and rename() after a crafted volume is mounted. No network protocol directly supplies the malformed B-tree metadata.\nAC:L - A crafted B-tree deterministically produces the length underflow and u32 addition wrap; no race or condition outside the attacker\u0027s control is required.\nPR:L - Although mounting HFS/HFS+ requires init-namespace CAP_SYS_ADMIN, an unprivileged user with ordinary write access to a file on an already mounted crafted volume can trigger the flaw through user.* xattr removal or permitted rename operations.\nUI:N - The attacker can invoke the triggering filesystem syscall directly once the crafted volume is mounted; no action by another user is required.\nS:U - The corruption occurs in the kernel while processing filesystem metadata and does not cross a separate virtualization, IOMMU, or other security authority boundary.\nC:H - The wrapped near-4-GiB copy performs out-of-bounds reads and, in HFS+, can walk beyond the node\u0027s page-pointer array, providing a defensible path to broad kernel-memory disclosure.\nI:H - The affected move, copy, clear, and write paths can write beyond the B-tree node buffer; the huge memmove is therefore exploitable memory corruption rather than a read-only crash.\nA:H - The enormous out-of-bounds memory operation can reliably cause a kernel oops or panic and can corrupt large regions of kernel memory, producing complete system unavailability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:07.849Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c8dd112173c02adf539fe2ad34a45f5e0068780d"
},
{
"url": "https://git.kernel.org/stable/c/fc9d1447ca3cdc78d2e4ace1ce1f3a7c77ca08b1"
},
{
"url": "https://git.kernel.org/stable/c/671c3fcc2ad31c1311ea6414382a2d95104ae1b9"
},
{
"url": "https://git.kernel.org/stable/c/b6a481642ea1977be2f84dc08c5affd742c177e7"
},
{
"url": "https://git.kernel.org/stable/c/7399c3baee7bb622a92f0b895cd4d3009a693f2b"
},
{
"url": "https://git.kernel.org/stable/c/607217f7ad419b53926f71e3f75001813bbc08ad"
},
{
"url": "https://git.kernel.org/stable/c/c25d3c931a63e762fcaa9cb125b901c53b62403f"
},
{
"url": "https://git.kernel.org/stable/c/966cb76fb2857a4242cab6ea2ea17acf818a3da7"
}
],
"title": "hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64361",
"datePublished": "2026-07-25T08:50:17.345Z",
"dateReserved": "2026-07-19T15:36:31.783Z",
"dateUpdated": "2026-08-17T04:54:07.849Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64401 (GCVE-0-2026-64401)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: resolve SWN tcon from live registrations
cifs_swn_notify() looks up a witness registration by id under
cifs_swnreg_idr_mutex, drops the mutex, and then uses the registration's
cached tcon pointer. That pointer is not a lifetime reference, and it is
not a stable representative once cifs_get_swn_reg() lets multiple tcons
for the same net/share name share one registration id.
A same-share second mount can keep the cifs_swn_reg alive after the first
tcon unregisters and is freed. The registration then still points at the
freed first tcon, so taking tc_lock or incrementing tc_count through
swnreg->tcon only moves the use-after-free earlier. Taking tc_lock while
holding cifs_swnreg_idr_mutex also violates the documented CIFS lock
order.
Fix this by making the registration store only the stable witness
identity: id, net name, share name, and notify flags. When a notify
arrives, copy that identity under cifs_swnreg_idr_mutex, drop the mutex,
then find and pin a live witness tcon that currently matches the net/share
pair under the normal cifs_tcp_ses_lock -> tc_lock order. The notification
path uses that pinned tcon directly and drops the reference when done.
Registration and unregister messages now use the live tcon passed by the
caller instead of a cached tcon in the registration. The final unregister
send is folded into cifs_swn_unregister() while the registration is still
protected by cifs_swnreg_idr_mutex. This removes the previous
find/drop/reacquire raw-pointer window. The release path only removes the
idr entry and frees the stable identity strings.
This preserves the intended one-registration/many-tcon behavior: a
registration id represents a net/share pair, and notify handling acts on a
live representative selected at use time. It also preserves CLIENT_MOVE
ordering for the representative tcon because the old-IP unregister is sent
before cifs_swn_register() sends the new-IP register.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 Version: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 Version: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 Version: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 Version: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 Version: fed979a7e082bd9f25f9002c3c4f8740dacd0bc8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifs_swn.c",
"fs/smb/client/trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "51d18db392e5386a7bb9e816d611f14e600cca3c",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
},
{
"lessThan": "aa3c0cab4b28c5007ec570c63e1d6ad6943ed0fd",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
},
{
"lessThan": "945b4a4a54497db1dcb2f20ef801a84e884dac21",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
},
{
"lessThan": "91b8a58c6ac15c7db6518f696389933282f88da7",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
},
{
"lessThan": "0700f946659d0ab2352ec8a9b1c6fc74b13a27d7",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
},
{
"lessThan": "ec457f9afe5ae9538bdcd58fd4cb442b9787e183",
"status": "affected",
"version": "fed979a7e082bd9f25f9002c3c4f8740dacd0bc8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/cifs_swn.c",
"fs/smb/client/trace.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: resolve SWN tcon from live registrations\n\ncifs_swn_notify() looks up a witness registration by id under\ncifs_swnreg_idr_mutex, drops the mutex, and then uses the registration\u0027s\ncached tcon pointer. That pointer is not a lifetime reference, and it is\nnot a stable representative once cifs_get_swn_reg() lets multiple tcons\nfor the same net/share name share one registration id.\n\nA same-share second mount can keep the cifs_swn_reg alive after the first\ntcon unregisters and is freed. The registration then still points at the\nfreed first tcon, so taking tc_lock or incrementing tc_count through\nswnreg-\u003etcon only moves the use-after-free earlier. Taking tc_lock while\nholding cifs_swnreg_idr_mutex also violates the documented CIFS lock\norder.\n\nFix this by making the registration store only the stable witness\nidentity: id, net name, share name, and notify flags. When a notify\narrives, copy that identity under cifs_swnreg_idr_mutex, drop the mutex,\nthen find and pin a live witness tcon that currently matches the net/share\npair under the normal cifs_tcp_ses_lock -\u003e tc_lock order. The notification\npath uses that pinned tcon directly and drops the reference when done.\n\nRegistration and unregister messages now use the live tcon passed by the\ncaller instead of a cached tcon in the registration. The final unregister\nsend is folded into cifs_swn_unregister() while the registration is still\nprotected by cifs_swnreg_idr_mutex. This removes the previous\nfind/drop/reacquire raw-pointer window. The release path only removes the\nidr entry and frees the stable identity strings.\n\nThis preserves the intended one-registration/many-tcon behavior: a\nregistration id represents a net/share pair, and notify handling acts on a\nlive representative selected at use time. It also preserves CLIENT_MOVE\nordering for the representative tcon because the old-IP unregister is sent\nbefore cifs_swn_register() sends the new-IP register."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is locally reachable through the world-readable /proc/fs/cifs/DebugData path and, on earlier affected kernels, unrestricted SWN generic-netlink notifications.\nAC:L - A same-share second mount deterministically preserves the registration after the first tcon is freed; repeated proc reads or notifications then dereference the stale pointer without requiring an uncontrollable race.\nPR:L - An unprivileged local user can read /proc/fs/cifs/DebugData, and affected kernels predating the companion netlink authorization fix also allowed unprivileged SWN_NOTIFY messages. User namespaces do not grant CIFS mount authority, but no mount privilege is needed once normal mount turnover creates the stale registration.\nUI:N - Once a witness-enabled registration exists, exploitation requires no further victim action; the attacker can invoke the local trigger directly.\nS:U - Successful exploitation compromises the host kernel within the same security authority and does not inherently cross a VM, IOMMU, or other scope boundary.\nC:H - The heap UAF involves attacker-reclaimable cifs_tcon and cifs_swn_reg objects whose pointer chains reach session credentials and arbitrary kernel memory, enabling high-impact disclosure primitives.\nI:H - Reclaiming the freed objects can redirect client-move and reconnect operations through attacker-influenced pointers, providing arbitrary-write and control-flow-hijacking potential.\nA:H - Dereferencing the freed tcon or registration can cause an immediate kernel oops or panic, and the periodic echo worker can repeatedly exercise the stale pointer."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:59.017Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/51d18db392e5386a7bb9e816d611f14e600cca3c"
},
{
"url": "https://git.kernel.org/stable/c/aa3c0cab4b28c5007ec570c63e1d6ad6943ed0fd"
},
{
"url": "https://git.kernel.org/stable/c/945b4a4a54497db1dcb2f20ef801a84e884dac21"
},
{
"url": "https://git.kernel.org/stable/c/91b8a58c6ac15c7db6518f696389933282f88da7"
},
{
"url": "https://git.kernel.org/stable/c/0700f946659d0ab2352ec8a9b1c6fc74b13a27d7"
},
{
"url": "https://git.kernel.org/stable/c/ec457f9afe5ae9538bdcd58fd4cb442b9787e183"
}
],
"title": "smb: client: resolve SWN tcon from live registrations",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64401",
"datePublished": "2026-07-25T08:50:44.361Z",
"dateReserved": "2026-07-19T15:36:31.785Z",
"dateUpdated": "2026-08-17T04:54:59.017Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64341 (GCVE-0-2026-64341)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:53
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: iowarrior: fix use-after-free on disconnect race
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/iowarrior.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3c0a7b29ebb391d5f50b115e86f842b709195b08",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
},
{
"lessThan": "71590982700fdeb39a37a500c877228b0140978e",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
},
{
"lessThan": "c602254ba4c10f60a73cd99d147874f86a3f485c",
"status": "affected",
"version": "946b960d13c15f050a3b848987aaca79f6a459b7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/misc/iowarrior.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.21"
},
{
"lessThan": "2.6.21",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.21",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: iowarrior: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n other sleeping locks, can still use the lock object\n after it\u0027s unlocked\")"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:53:44.970Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3c0a7b29ebb391d5f50b115e86f842b709195b08"
},
{
"url": "https://git.kernel.org/stable/c/71590982700fdeb39a37a500c877228b0140978e"
},
{
"url": "https://git.kernel.org/stable/c/c602254ba4c10f60a73cd99d147874f86a3f485c"
}
],
"title": "USB: iowarrior: fix use-after-free on disconnect race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64341",
"datePublished": "2026-07-25T08:50:04.512Z",
"dateReserved": "2026-07-19T15:36:31.781Z",
"dateUpdated": "2026-08-17T04:53:44.970Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64533 (GCVE-0-2026-64533)
Vulnerability from cvelistv5
Published
2026-07-27 06:32
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: validate lcns_follow in log_replay conversion
log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY
records when replaying version 0 restart tables.
During this conversion, the memmove() length is derived directly from
the on-disk lcns_follow field:
memmove(&dp->vcn, &dp0->vcn_low,
2 * sizeof(u64) +
le32_to_cpu(dp->lcns_follow) * sizeof(u64));
check_rstbl() validates restart table structure, but does not constrain
per-entry lcns_follow values relative to the entry size. A malformed
filesystem image can provide an oversized lcns_follow value, causing
the conversion memmove() to access memory beyond the bounds of the
allocated restart table buffer.
The same field is later used to bound iteration over page_lcns[],
so validating lcns_follow during conversion also prevents downstream
out-of-bounds access from the same malformed metadata.
Compute the maximum valid lcns_follow from the already-validated
restart table entry size and reject entries that exceed this bound.
Reuse the existing t16/t32 scratch variables already declared in
log_replay() to avoid introducing new declarations.
[almaz.alexandrovich@paragon-software.com: fixed the conflicts]
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b46acd6a6a627d876898e1c84d3f84902264b445 Version: b46acd6a6a627d876898e1c84d3f84902264b445 Version: b46acd6a6a627d876898e1c84d3f84902264b445 Version: b46acd6a6a627d876898e1c84d3f84902264b445 Version: b46acd6a6a627d876898e1c84d3f84902264b445 Version: b46acd6a6a627d876898e1c84d3f84902264b445 Version: b46acd6a6a627d876898e1c84d3f84902264b445 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/fslog.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ca343a99806b4fc8e27c48f08be3445c5fcd1445",
"status": "affected",
"version": "b46acd6a6a627d876898e1c84d3f84902264b445",
"versionType": "git"
},
{
"lessThan": "ddfc8683e1a627dbf1b83bacf8961443dd654258",
"status": "affected",
"version": "b46acd6a6a627d876898e1c84d3f84902264b445",
"versionType": "git"
},
{
"lessThan": "57c071e2c4f30b9c6f5aacb6679aab1269fbae99",
"status": "affected",
"version": "b46acd6a6a627d876898e1c84d3f84902264b445",
"versionType": "git"
},
{
"lessThan": "159f694d682e4215b3822ae31ed3a4631628fe55",
"status": "affected",
"version": "b46acd6a6a627d876898e1c84d3f84902264b445",
"versionType": "git"
},
{
"lessThan": "7adb38279812c9c06b0e3fa7382f4d7887f3fa2d",
"status": "affected",
"version": "b46acd6a6a627d876898e1c84d3f84902264b445",
"versionType": "git"
},
{
"lessThan": "32b9f8733feb241627fa5f564b1a99b5cae974c5",
"status": "affected",
"version": "b46acd6a6a627d876898e1c84d3f84902264b445",
"versionType": "git"
},
{
"lessThan": "6a4c53a2e26a865565bd6a460961e8d6fcb32329",
"status": "affected",
"version": "b46acd6a6a627d876898e1c84d3f84902264b445",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/fslog.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate lcns_follow in log_replay conversion\n\nlog_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY\nrecords when replaying version 0 restart tables.\n\nDuring this conversion, the memmove() length is derived directly from\nthe on-disk lcns_follow field:\n\n\tmemmove(\u0026dp-\u003evcn, \u0026dp0-\u003evcn_low,\n\t\t2 * sizeof(u64) +\n\t\t\t\tle32_to_cpu(dp-\u003elcns_follow) * sizeof(u64));\n\ncheck_rstbl() validates restart table structure, but does not constrain\nper-entry lcns_follow values relative to the entry size. A malformed\nfilesystem image can provide an oversized lcns_follow value, causing\nthe conversion memmove() to access memory beyond the bounds of the\nallocated restart table buffer.\n\nThe same field is later used to bound iteration over page_lcns[],\nso validating lcns_follow during conversion also prevents downstream\nout-of-bounds access from the same malformed metadata.\n\nCompute the maximum valid lcns_follow from the already-validated\nrestart table entry size and reject entries that exceed this bound.\nReuse the existing t16/t32 scratch variables already declared in\nlog_replay() to avoid introducing new declarations.\n\n[almaz.alexandrovich@paragon-software.com: fixed the conflicts]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The NTFS3 parser consumes malicious metadata from a locally mounted block device or filesystem image, not directly through a network protocol.\nAC:L - A structurally valid 44-byte entry with attacker-controlled lcns_follow=2 already crosses the heap-buffer boundary. No race or uncontrollable condition is required.\nPR:N - The attacker needs no account or capability to prepare and supply the crafted image; the init-namespace CAP_SYS_ADMIN mount requirement applies to the interacting victim or privileged mounting helper.\nUI:R - A victim or trusted mounting helper must cause the crafted NTFS filesystem to be mounted before journal replay processes the malicious metadata.\nS:U - The corruption compromises the kernel processing its own filesystem metadata and does not cross a distinct security authority such as a guest-to-host boundary.\nC:H - The attacker-controlled memmove performs a heap out-of-bounds read of attacker-selected extent, and the resulting memory corruption can be leveraged to disclose kernel memory.\nI:H - The same memmove writes beyond the allocated restart-table buffer, allowing corruption of adjacent slab objects and potentially arbitrary writes or control-flow hijacking.\nA:H - A sufficiently large lcns_follow reliably drives the kernel into an extensive invalid memory access, causing an oops or panic during mount and permitting repeated denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:11.184Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ca343a99806b4fc8e27c48f08be3445c5fcd1445"
},
{
"url": "https://git.kernel.org/stable/c/ddfc8683e1a627dbf1b83bacf8961443dd654258"
},
{
"url": "https://git.kernel.org/stable/c/57c071e2c4f30b9c6f5aacb6679aab1269fbae99"
},
{
"url": "https://git.kernel.org/stable/c/159f694d682e4215b3822ae31ed3a4631628fe55"
},
{
"url": "https://git.kernel.org/stable/c/7adb38279812c9c06b0e3fa7382f4d7887f3fa2d"
},
{
"url": "https://git.kernel.org/stable/c/32b9f8733feb241627fa5f564b1a99b5cae974c5"
},
{
"url": "https://git.kernel.org/stable/c/6a4c53a2e26a865565bd6a460961e8d6fcb32329"
}
],
"title": "fs/ntfs3: validate lcns_follow in log_replay conversion",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64533",
"datePublished": "2026-07-27T06:32:33.740Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-17T04:57:11.184Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64560 (GCVE-0-2026-64560)
Vulnerability from cvelistv5
Published
2026-07-29 16:47
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
Wongi and Jungwoo decoded and reported a non-leader exec() related race
which can result in an UAF:
sys_timer_delete() exec()
posix_cpu_timer_del()
// Observes old leader
p = pid_task(pid, pid_type); de_thread()
switch_leader();
release_task(old_leader)
__exit_signal(old_leader)
sighand = lock(old_leader, sighand);
posix_cpu_timers*_exit();
sighand = lock_task_sighand(p) unhash_task(old_leader);
sh = lock(p, sighand) old_leader->sighand = NULL;
unlock(sighand);
(p->sighand == NULL)
unlock(sh)
return NULL;
// Returns without action
if(!sighand)
return 0;
free_posix_timer();
This is "harmless" unless the deleted timer was armed and enqueued in
p->signal because on exec() a TGID targeted timer is inherited.
As sys_timer_delete() freed the underlying posix timer object
run_posix_cpu_timers() or any timerqueue related add/delete operations on
other timers will access the freed object's timerqueue node, which results
in an UAF.
There is a similar problem vs. posix_cpu_timer_set(). For regular posix
timers it just transiently returns -ESRCH to user space, but for the use
case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is
allocated on the stack.
Also posix_cpu_timer_rearm() fails to rearm the timer, which means it stops
to expire.
While debating solutions Frederic pointed out another problem:
posix_cpu_timer_del(tmr)
__exit_signal(p)
posix_cpu_timers*_exit(p);
unhash_task(p);
p->sighand = NULL;
sh = lock_task_sighand(p)
sighand = p->sighand;
if (!sighand)
return NULL;
lock(sighand);
if (!sh)
WARN_ON_ONCE(timer_queued(tmr));
On weakly ordered architectures it is not guaranteed that
posix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit()
when p->sighand is observed as NULL, which means the WARN() can be a false
positive.
Solve these issues by:
1) Changing the store in __exit_signal() to smp_store_release().
2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path
of lock_task_sighand().
3) Creating a helper function for looking up the task and locking sighand
which does not return when sighand == NULL. Instead it retries the
task lookup and only if that fails it gives up.
4) Using that helper in the three affected functions.
#1/#2 ensures that the reader side which observes sighand == NULL also
observes all preceeding stores, i.e. the stores in posix_cpu_timers*_exit()
and the ones in unhash_task().
#3 ensures that the above described non-leader exec() situation is handled
gracefully. When the task lookup returns the old leader, but sighand ==
NULL then it retries. In the non-leader exec() case the subsequent task
lookup will observe the new leader due to #1/#2. In normal exit() scenarios
the subsequent lookup fails.
When the task lookup fails, the function also checks whether the timer is
still enqueued and issues a warning if that's the case. Unfortunately there
is nothing which can be done about it, but as the task is already not
longer visible the timer should not be accessed anymore. This check also
requires memory ordering, which is not provided when the first lookup
fails. To achieve that the check is preceeded by a smp_rmb() which pairs
with the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that
the stores in posix_cpu_timers*_exit() are visible.
The history of the non-leader exec() issue goes back to the early days of
posix CPU timers, which stored a pointer to the group leader task in the
timer. That obviously fails when a non-leader exec() switches the leader.
commit e0a70217107e ("posix-cpu-timers: workaround to suppress the problems
with mt exec") added a temporary workaround for that in 2010 which surv
---truncated---
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 Version: 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 Version: 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 Version: 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 Version: 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 Version: 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 Version: 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 Version: 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/exit.c",
"kernel/signal.c",
"kernel/time/posix-cpu-timers.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "67aa823e3e8c229c6d374df79c804f6721cb83b6",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "d8bcb28abad857f1415da7656f19b2ada90af04f",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "12a891c773aeb5823d63dbd0cb2ab931d6c21c9b",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "e74443f5db0037c556ef436fa64b88bf4ea08f83",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "6a7ecc25abe6f0fecc6e62a05096987200edbd02",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "ad1cafa1bdaa71da85d71cac053838bbe97852b6",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
},
{
"lessThan": "920f893f735e92ba3a1cd9256899a186b161928d",
"status": "affected",
"version": "55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/exit.c",
"kernel/signal.c",
"kernel/time/posix-cpu-timers.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.262",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.213",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.180",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.147",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.100",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.41",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.262",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.213",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.180",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.147",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.100",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.41",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nposix-cpu-timers: Prevent UAF caused by non-leader exec() race\n\nWongi and Jungwoo decoded and reported a non-leader exec() related race\nwhich can result in an UAF:\n\n sys_timer_delete()\t\t\texec()\n posix_cpu_timer_del()\n // Observes old leader\n p = pid_task(pid, pid_type);\t\tde_thread()\n \t\t\t\t\t switch_leader();\n\t\t\t\t\t release_task(old_leader)\n\t\t\t\t\t __exit_signal(old_leader)\n\t\t\t\t\t sighand = lock(old_leader, sighand);\n\t\t\t\t\t posix_cpu_timers*_exit();\n sighand = lock_task_sighand(p)\t unhash_task(old_leader);\n sh = lock(p, sighand)\t \t old_leader-\u003esighand = NULL;\n\t\t\t\t\t unlock(sighand);\n (p-\u003esighand == NULL)\n\tunlock(sh)\n\treturn NULL;\n\n // Returns without action\n if(!sighand)\n return 0;\n free_posix_timer();\n\nThis is \"harmless\" unless the deleted timer was armed and enqueued in\np-\u003esignal because on exec() a TGID targeted timer is inherited.\n\nAs sys_timer_delete() freed the underlying posix timer object\nrun_posix_cpu_timers() or any timerqueue related add/delete operations on\nother timers will access the freed object\u0027s timerqueue node, which results\nin an UAF.\n\nThere is a similar problem vs. posix_cpu_timer_set(). For regular posix\ntimers it just transiently returns -ESRCH to user space, but for the use\ncase in do_cpu_nanosleep() it\u0027s the same UAF just that the k_itimer is\nallocated on the stack.\n\nAlso posix_cpu_timer_rearm() fails to rearm the timer, which means it stops\nto expire.\n\nWhile debating solutions Frederic pointed out another problem:\n\n posix_cpu_timer_del(tmr)\n\t\t\t\t\t__exit_signal(p)\n\t\t\t\t\t posix_cpu_timers*_exit(p);\n\t\t\t\t\t unhash_task(p);\n\t\t\t\t\t p-\u003esighand = NULL;\n sh = lock_task_sighand(p)\n sighand = p-\u003esighand;\n\tif (!sighand)\n\t return NULL;\n\tlock(sighand);\n\n if (!sh)\n\tWARN_ON_ONCE(timer_queued(tmr));\n\nOn weakly ordered architectures it is not guaranteed that\nposix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit()\nwhen p-\u003esighand is observed as NULL, which means the WARN() can be a false\npositive.\n\nSolve these issues by:\n\n 1) Changing the store in __exit_signal() to smp_store_release().\n\n 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path\n of lock_task_sighand().\n\n 3) Creating a helper function for looking up the task and locking sighand\n which does not return when sighand == NULL. Instead it retries the\n task lookup and only if that fails it gives up.\n\n 4) Using that helper in the three affected functions.\n\n#1/#2 ensures that the reader side which observes sighand == NULL also\nobserves all preceeding stores, i.e. the stores in posix_cpu_timers*_exit()\nand the ones in unhash_task().\n\n#3 ensures that the above described non-leader exec() situation is handled\ngracefully. When the task lookup returns the old leader, but sighand ==\nNULL then it retries. In the non-leader exec() case the subsequent task\nlookup will observe the new leader due to #1/#2. In normal exit() scenarios\nthe subsequent lookup fails.\n\nWhen the task lookup fails, the function also checks whether the timer is\nstill enqueued and issues a warning if that\u0027s the case. Unfortunately there\nis nothing which can be done about it, but as the task is already not\nlonger visible the timer should not be accessed anymore. This check also\nrequires memory ordering, which is not provided when the first lookup\nfails. To achieve that the check is preceeded by a smp_rmb() which pairs\nwith the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that\nthe stores in posix_cpu_timers*_exit() are visible.\n\nThe history of the non-leader exec() issue goes back to the early days of\nposix CPU timers, which stored a pointer to the group leader task in the\ntimer. That obviously fails when a non-leader exec() switches the leader.\ncommit e0a70217107e (\"posix-cpu-timers: workaround to suppress the problems\nwith mt exec\") added a temporary workaround for that in 2010 which surv\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached purely through local syscalls (`timer_create`/`timer_settime`/`timer_delete`/`clock_nanosleep`) raced against `execve()` from a non-leader thread in the attacker\u0027s own process. No network or remote data path reaches posix-cpu-timers.\nAC:L - The attacker controls both sides of the race \u2014 one thread arms and deletes a process-wide CPU timer while a non-leader thread in the same process calls `execve()` \u2014 and can loop indefinitely with CPU pinning/thread spraying to widen the window between `pid_task()` and `lock_task_sighand()`. No condition depends on anything outside attacker control.\nPR:L - Any ordinary unprivileged local user can create and delete `CLOCK_PROCESS_CPUTIME_ID` timers; `pid_for_clock()` performs no capability check when the encoded PID is 0, and `CONFIG_POSIX_TIMERS` is `default y` on essentially all deployments.\nUI:N - The attacker performs every step \u2014 timer creation, arming, deletion, and the concurrent non-leader exec \u2014 entirely within its own multithreaded process. No victim action is involved.\nS:U - The corruption stays within the kernel\u0027s own security authority; it is a standard local kernel memory-corruption/privilege-escalation primitive with no VM, IOMMU, or hypervisor boundary crossed.\nC:H - The stale timerqueue node yields UAF reads of the freed `k_itimer` and causes `current` (a live `task_struct` pointer) plus rbtree pointers to be written into the freed/reallocated slot, and the freed object can be reclaimed by another attacker-created `k_itimer`, enabling kernel pointer disclosure and broad memory read.\nI:H - `collect_timerqueue()` writes into freed memory (`ctmr-\u003efiring`, `ctmr-\u003ehandling`, rbtree rebalancing, list insertion) and the `do_cpu_nanosleep()` variant does so into a live, attacker-groomed kernel stack frame, followed by `cpu_timer_fire()` dereferencing attacker-controlled `it_process`/`it_signal` \u2014 a control-flow-hijack-capable write primitive.\nA:H - Even without exploitation the dangling timerqueue node produces rbtree/list corruption and a kernel oops, and the pre-fix `WARN_ON_ONCE(timerqueue_node_queued(...))` is an immediate panic under `panic_on_warn`; the race can be triggered repeatedly by any local user."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:38.909Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/67aa823e3e8c229c6d374df79c804f6721cb83b6"
},
{
"url": "https://git.kernel.org/stable/c/d8bcb28abad857f1415da7656f19b2ada90af04f"
},
{
"url": "https://git.kernel.org/stable/c/cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa"
},
{
"url": "https://git.kernel.org/stable/c/12a891c773aeb5823d63dbd0cb2ab931d6c21c9b"
},
{
"url": "https://git.kernel.org/stable/c/e74443f5db0037c556ef436fa64b88bf4ea08f83"
},
{
"url": "https://git.kernel.org/stable/c/6a7ecc25abe6f0fecc6e62a05096987200edbd02"
},
{
"url": "https://git.kernel.org/stable/c/ad1cafa1bdaa71da85d71cac053838bbe97852b6"
},
{
"url": "https://git.kernel.org/stable/c/920f893f735e92ba3a1cd9256899a186b161928d"
}
],
"title": "posix-cpu-timers: Prevent UAF caused by non-leader exec() race",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64560",
"datePublished": "2026-07-29T16:47:17.602Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-17T04:57:38.909Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63970 (GCVE-0-2026-63970)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-08-05 12:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: bind uarg before filling zerocopy skb
virtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg
before entering the send loop, but virtio_transport_alloc_skb() still
fills the skb before it inherits that uarg. When fixed-buffer vectored
zerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach
managed frags and return -EMSGSIZE. The rollback path call kfree_skb()
to free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so
skb_release_data() falls through to ordinary frag unref.
Pass the uarg into virtio_transport_alloc_skb() and bind it immediately
before virtio_transport_fill_skb(). This keeps control or no-payload skbs
untouched while ensuring success and rollback share one lifetime rule.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/virtio_transport_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "72194f65050958e4c8e069adb6c5d89ef81ca197",
"status": "affected",
"version": "581512a6dc939ef122e49336626ae159f3b8a345",
"versionType": "git"
},
{
"lessThan": "b62e2b2b4a50953ca952f3cd3f77dd62dc50fd5d",
"status": "affected",
"version": "581512a6dc939ef122e49336626ae159f3b8a345",
"versionType": "git"
},
{
"lessThan": "5d317573f1d48e76cce5fb6250452b6e4102e0fb",
"status": "affected",
"version": "581512a6dc939ef122e49336626ae159f3b8a345",
"versionType": "git"
},
{
"lessThan": "1e584c304cfb94a759417130b1fc6d30b30c4cce",
"status": "affected",
"version": "581512a6dc939ef122e49336626ae159f3b8a345",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/virtio_transport_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: bind uarg before filling zerocopy skb\n\nvirtio_transport_send_pkt_info() allocates or reuses the zerocopy uarg\nbefore entering the send loop, but virtio_transport_alloc_skb() still\nfills the skb before it inherits that uarg. When fixed-buffer vectored\nzerocopy hits MAX_SKB_FRAGS, io_sg_from_iter() may partially attach\nmanaged frags and return -EMSGSIZE. The rollback path call kfree_skb()\nto free an skb that carries SKBFL_MANAGED_FRAG_REFS but no uarg, so\nskb_release_data() falls through to ordinary frag unref.\n\nPass the uarg into virtio_transport_alloc_skb() and bind it immediately\nbefore virtio_transport_fill_skb(). This keeps control or no-payload skbs\nuntouched while ensuring success and rollback share one lifetime rule."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached only via local AF_VSOCK transmission (syscall/io_uring send on a connected virtio vsock socket), not by processing remote network packets. Per kernel CVSS guidance, vsock is Local.\nAC:L - An attacker fully controls the trigger: SO_ZEROCOPY, io_uring IORING_OP_SEND_ZC with IORING_RECVSEND_FIXED_BUF and a vectored iov exceeding MAX_SKB_FRAGS (17), causing io_sg_from_iter() to return -EMSGSIZE on a deterministic error rollback path.\nPR:L - Exploitation requires only an unprivileged local process that can open a vsock connection and use io_uring zerocopy send; no CAP_NET_ADMIN or real root is needed beyond ordinary local user access in a virtio-vsock environment (KVM/Firecracker/cloud microVMs).\nUI:N - No victim interaction is required; the attacker triggers the bug directly through their own socket send/io_uring operation.\nS:U - Impact is kernel memory corruption and privilege escalation within the same security domain where the send occurs (guest kernel or host kernel). It is not a cross-boundary VM escape on the receive path; the flaw is in the sender\u0027s local skb teardown.\nC:H - Incorrect __skb_frag_unref() on SKBFL_MANAGED_FRAG_REFS pages without a bound uarg corrupts refcount/lifetime of io_uring registered buffer pages, yielding use-after-free and arbitrary kernel memory read primitives.\nI:H - The refcount corruption is a memory-safety bug in kernel heap/page management that can be leveraged for arbitrary write and control-flow hijacking, not merely a bounded data change.\nA:H - The erroneous frag unref on managed zerocopy pages can cause immediate kernel oops/panic from refcount underflow or use-after-free during skb teardown, independent of full exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:37:41.706Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/72194f65050958e4c8e069adb6c5d89ef81ca197"
},
{
"url": "https://git.kernel.org/stable/c/b62e2b2b4a50953ca952f3cd3f77dd62dc50fd5d"
},
{
"url": "https://git.kernel.org/stable/c/5d317573f1d48e76cce5fb6250452b6e4102e0fb"
},
{
"url": "https://git.kernel.org/stable/c/1e584c304cfb94a759417130b1fc6d30b30c4cce"
}
],
"title": "vsock/virtio: bind uarg before filling zerocopy skb",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-63970",
"datePublished": "2026-07-19T14:55:57.067Z",
"dateReserved": "2026-07-19T07:54:57.024Z",
"dateUpdated": "2026-08-05T12:37:41.706Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53005 (GCVE-0-2026-53005)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Drop all SCM attributes for SOCKMAP.
SOCKMAP can hide inflight fd from AF_UNIX GC.
When a socket in SOCKMAP receives skb with inflight fd,
sk_psock_verdict_data_ready() looks up the mapped socket and
enqueue skb to its psock->ingress_skb.
Since neither the old nor the new GC can inspect the psock
queue, the hidden skb leaks the inflight sockets. Note that
this cannot be detected via kmemleak because inflight sockets
are linked to a global list.
In addition, SOCKMAP redirect breaks the Tarjan-based GC's
assumption that unix_edge.successor is always alive, which
is no longer true once skb is redirected, resulting in
use-after-free below. [0]
Moreover, SOCKMAP does not call scm_stat_del() properly,
so unix_show_fdinfo() could report an incorrect fd count.
sk_msg_recvmsg() does not support any SCM attributes in the
first place.
Let's drop all SCM attributes before passing skb to the
SOCKMAP layer.
[0]:
BUG: KASAN: slab-use-after-free in unix_del_edges (net/unix/garbage.c:118 net/unix/garbage.c:181 net/unix/garbage.c:251)
Read of size 8 at addr ffff888125362670 by task kworker/56:1/496
CPU: 56 UID: 0 PID: 496 Comm: kworker/56:1 Not tainted 7.0.0-rc7-00263-gb9d8b856689d #3 PREEMPT(lazy)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
Workqueue: events sk_psock_backlog
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:122)
print_report (mm/kasan/report.c:379)
kasan_report (mm/kasan/report.c:597)
unix_del_edges (net/unix/garbage.c:118 net/unix/garbage.c:181 net/unix/garbage.c:251)
unix_destroy_fpl (net/unix/garbage.c:317)
unix_destruct_scm (./include/net/scm.h:80 ./include/net/scm.h:86 net/unix/af_unix.c:1976)
sk_psock_backlog (./include/linux/skbuff.h:?)
process_scheduled_works (kernel/workqueue.c:?)
worker_thread (kernel/workqueue.c:?)
kthread (kernel/kthread.c:438)
ret_from_fork (arch/x86/kernel/process.c:164)
ret_from_fork_asm (arch/x86/entry/entry_64.S:258)
</TASK>
Allocated by task 955:
kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78)
__kasan_slab_alloc (mm/kasan/common.c:369)
kmem_cache_alloc_noprof (mm/slub.c:4539)
sk_prot_alloc (net/core/sock.c:2240)
sk_alloc (net/core/sock.c:2301)
unix_create1 (net/unix/af_unix.c:1099)
unix_create (net/unix/af_unix.c:1169)
__sock_create (net/socket.c:1606)
__sys_socketpair (net/socket.c:1811)
__x64_sys_socketpair (net/socket.c:1863 net/socket.c:1860 net/socket.c:1860)
do_syscall_64 (arch/x86/entry/syscall_64.c:?)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Freed by task 496:
kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78)
kasan_save_free_info (mm/kasan/generic.c:587)
__kasan_slab_free (mm/kasan/common.c:287)
kmem_cache_free (mm/slub.c:6165)
__sk_destruct (net/core/sock.c:2282 net/core/sock.c:2384)
sk_psock_destroy (./include/net/sock.h:?)
process_scheduled_works (kernel/workqueue.c:?)
worker_thread (kernel/workqueue.c:?)
kthread (kernel/kthread.c:438)
ret_from_fork (arch/x86/kernel/process.c:164)
ret_from_fork_asm (arch/x86/entry/entry_64.S:258)
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/unix/af_unix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "48c41cd2e04af4b2cdef19e2d00994ae82952f14",
"status": "affected",
"version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
"versionType": "git"
},
{
"lessThan": "e0a71cbf0c1906a2eccbe69dd7d7f36fd1511d66",
"status": "affected",
"version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
"versionType": "git"
},
{
"lessThan": "b34a1d83c74a124c968b5adb25c809db3e2eb86a",
"status": "affected",
"version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
"versionType": "git"
},
{
"lessThan": "965dc93481d1b80d341bdd16c27b16fe197175ee",
"status": "affected",
"version": "c63829182c37c2d6d0608976d15fa61ebebe9e6b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/unix/af_unix.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.10",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Drop all SCM attributes for SOCKMAP.\n\nSOCKMAP can hide inflight fd from AF_UNIX GC.\n\nWhen a socket in SOCKMAP receives skb with inflight fd,\nsk_psock_verdict_data_ready() looks up the mapped socket and\nenqueue skb to its psock-\u003eingress_skb.\n\nSince neither the old nor the new GC can inspect the psock\nqueue, the hidden skb leaks the inflight sockets. Note that\nthis cannot be detected via kmemleak because inflight sockets\nare linked to a global list.\n\nIn addition, SOCKMAP redirect breaks the Tarjan-based GC\u0027s\nassumption that unix_edge.successor is always alive, which\nis no longer true once skb is redirected, resulting in\nuse-after-free below. [0]\n\nMoreover, SOCKMAP does not call scm_stat_del() properly,\nso unix_show_fdinfo() could report an incorrect fd count.\n\nsk_msg_recvmsg() does not support any SCM attributes in the\nfirst place.\n\nLet\u0027s drop all SCM attributes before passing skb to the\nSOCKMAP layer.\n\n[0]:\nBUG: KASAN: slab-use-after-free in unix_del_edges (net/unix/garbage.c:118 net/unix/garbage.c:181 net/unix/garbage.c:251)\nRead of size 8 at addr ffff888125362670 by task kworker/56:1/496\n\nCPU: 56 UID: 0 PID: 496 Comm: kworker/56:1 Not tainted 7.0.0-rc7-00263-gb9d8b856689d #3 PREEMPT(lazy)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\nWorkqueue: events sk_psock_backlog\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl (lib/dump_stack.c:122)\n print_report (mm/kasan/report.c:379)\n kasan_report (mm/kasan/report.c:597)\n unix_del_edges (net/unix/garbage.c:118 net/unix/garbage.c:181 net/unix/garbage.c:251)\n unix_destroy_fpl (net/unix/garbage.c:317)\n unix_destruct_scm (./include/net/scm.h:80 ./include/net/scm.h:86 net/unix/af_unix.c:1976)\n sk_psock_backlog (./include/linux/skbuff.h:?)\n process_scheduled_works (kernel/workqueue.c:?)\n worker_thread (kernel/workqueue.c:?)\n kthread (kernel/kthread.c:438)\n ret_from_fork (arch/x86/kernel/process.c:164)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:258)\n \u003c/TASK\u003e\n\nAllocated by task 955:\n kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78)\n __kasan_slab_alloc (mm/kasan/common.c:369)\n kmem_cache_alloc_noprof (mm/slub.c:4539)\n sk_prot_alloc (net/core/sock.c:2240)\n sk_alloc (net/core/sock.c:2301)\n unix_create1 (net/unix/af_unix.c:1099)\n unix_create (net/unix/af_unix.c:1169)\n __sock_create (net/socket.c:1606)\n __sys_socketpair (net/socket.c:1811)\n __x64_sys_socketpair (net/socket.c:1863 net/socket.c:1860 net/socket.c:1860)\n do_syscall_64 (arch/x86/entry/syscall_64.c:?)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nFreed by task 496:\n kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78)\n kasan_save_free_info (mm/kasan/generic.c:587)\n __kasan_slab_free (mm/kasan/common.c:287)\n kmem_cache_free (mm/slub.c:6165)\n __sk_destruct (net/core/sock.c:2282 net/core/sock.c:2384)\n sk_psock_destroy (./include/net/sock.h:?)\n process_scheduled_works (kernel/workqueue.c:?)\n worker_thread (kernel/workqueue.c:?)\n kthread (kernel/kthread.c:438)\n ret_from_fork (arch/x86/kernel/process.c:164)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:258)"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable AF_UNIX SOCKMAP path is reached through local syscalls such as bpf(), socketpair(), map update/attach, and sendmsg() with SCM_RIGHTS; remote network peers cannot pass AF_UNIX file descriptors into this path.\nAC:L - The attacker can create the sockets, install the SOCKMAP verdict redirect, send SCM_RIGHTS, and close/tear down the involved sockets; any timing involved is under attacker control.\nPR:L - Triggering requires creating/attaching SK_SKB SOCKMAP BPF objects, gated by CAP_BPF/CAP_NET_ADMIN or delegated BPF token access. In a reasonable namespaced/delegated BPF deployment this is low privilege rather than host-root-only.\nUI:N - No victim action is required after the attacker has local access and the needed BPF privileges; the trigger is entirely attacker-driven.\nS:U - The vulnerability is in the host kernel AF_UNIX/SOCKMAP implementation and impacts the same kernel security authority. This is standard kernel memory corruption/DoS rather than a hypervisor or device isolation boundary escape.\nC:H - The bug produces a use-after-free on AF_UNIX socket/SCM graph state after SOCKMAP hides redirected skb SCM attributes. Per kernel scoring guidance, UAF memory corruption is treated as capable of high confidentiality impact.\nI:H - The freed socket/graph state can be reused while kernel GC follows stale pointers, making this memory corruption potentially exploitable beyond a simple crash. Per guidance, UAF is scored as high integrity impact.\nA:H - The reported failure is a KASAN slab-use-after-free in AF_UNIX GC/workqueue processing, and the hidden inflight-fd skb state can also leak socket references. This can cause kernel oops/panic or sustained resource exhaustion."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:34.349Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/48c41cd2e04af4b2cdef19e2d00994ae82952f14"
},
{
"url": "https://git.kernel.org/stable/c/e0a71cbf0c1906a2eccbe69dd7d7f36fd1511d66"
},
{
"url": "https://git.kernel.org/stable/c/b34a1d83c74a124c968b5adb25c809db3e2eb86a"
},
{
"url": "https://git.kernel.org/stable/c/965dc93481d1b80d341bdd16c27b16fe197175ee"
}
],
"title": "af_unix: Drop all SCM attributes for SOCKMAP.",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53005",
"datePublished": "2026-06-24T16:29:16.901Z",
"dateReserved": "2026-06-09T07:44:35.377Z",
"dateUpdated": "2026-08-05T12:32:34.349Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64227 (GCVE-0-2026-64227)
Vulnerability from cvelistv5
Published
2026-07-24 15:23
Modified
2026-07-27 04:37
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ACPI: driver: Check ACPI_COMPANION() against NULL during probe
Since every platform driver can be forced to match a device that doesn't
match its list of device IDs because of device_match_driver_override(),
platform drivers that rely on the existence of a device's ACPI companion
object should verify its presence.
Accordingly, add requisite ACPI_COMPANION() or ACPI_HANDLE() checks
against NULL to 13 platform drivers handling core ACPI devices.
Also change the value returned by the ACPI thermal zone driver when
the device's ACPI companion is not present to -ENODEV for consistency
with the other drivers.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/acpi/ac.c",
"drivers/acpi/acpi_pad.c",
"drivers/acpi/acpi_tad.c",
"drivers/acpi/battery.c",
"drivers/acpi/button.c",
"drivers/acpi/ec.c",
"drivers/acpi/hed.c",
"drivers/acpi/nfit/core.c",
"drivers/acpi/pfr_telemetry.c",
"drivers/acpi/pfr_update.c",
"drivers/acpi/sbs.c",
"drivers/acpi/sbshc.c",
"drivers/acpi/thermal.c",
"drivers/acpi/tiny-power-button.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a9451bf561232314755baf69a5916e0ac77f33fc",
"status": "affected",
"version": "5829046825ac89fffc60f2670bc564fda2c0155a",
"versionType": "git"
},
{
"lessThan": "34f4d0e4e5065237d15651df759a99e81b7f9f51",
"status": "affected",
"version": "5829046825ac89fffc60f2670bc564fda2c0155a",
"versionType": "git"
},
{
"lessThan": "612ddab8fce04394bd7aebe8e0f2599642e30859",
"status": "affected",
"version": "5829046825ac89fffc60f2670bc564fda2c0155a",
"versionType": "git"
},
{
"lessThan": "e4865a56d013e86e46ea6acea15bb6eae01898ff",
"status": "affected",
"version": "5829046825ac89fffc60f2670bc564fda2c0155a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/acpi/ac.c",
"drivers/acpi/acpi_pad.c",
"drivers/acpi/acpi_tad.c",
"drivers/acpi/battery.c",
"drivers/acpi/button.c",
"drivers/acpi/ec.c",
"drivers/acpi/hed.c",
"drivers/acpi/nfit/core.c",
"drivers/acpi/pfr_telemetry.c",
"drivers/acpi/pfr_update.c",
"drivers/acpi/sbs.c",
"drivers/acpi/sbshc.c",
"drivers/acpi/thermal.c",
"drivers/acpi/tiny-power-button.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: driver: Check ACPI_COMPANION() against NULL during probe\n\nSince every platform driver can be forced to match a device that doesn\u0027t\nmatch its list of device IDs because of device_match_driver_override(),\nplatform drivers that rely on the existence of a device\u0027s ACPI companion\nobject should verify its presence.\n\nAccordingly, add requisite ACPI_COMPANION() or ACPI_HANDLE() checks\nagainst NULL to 13 platform drivers handling core ACPI devices.\n\nAlso change the value returned by the ACPI thermal zone driver when\nthe device\u0027s ACPI companion is not present to -ENODEV for consistency\nwith the other drivers."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-27T04:37:25.776Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a9451bf561232314755baf69a5916e0ac77f33fc"
},
{
"url": "https://git.kernel.org/stable/c/34f4d0e4e5065237d15651df759a99e81b7f9f51"
},
{
"url": "https://git.kernel.org/stable/c/612ddab8fce04394bd7aebe8e0f2599642e30859"
},
{
"url": "https://git.kernel.org/stable/c/e4865a56d013e86e46ea6acea15bb6eae01898ff"
}
],
"title": "ACPI: driver: Check ACPI_COMPANION() against NULL during probe",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64227",
"datePublished": "2026-07-24T15:23:10.936Z",
"dateReserved": "2026-07-19T15:36:31.771Z",
"dateUpdated": "2026-07-27T04:37:25.776Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64488 (GCVE-0-2026-64488)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-08-17 04:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: aoa: check snd_ctl_new1() return value
snd_ctl_new1() can return NULL when memory allocation fails. In
layout.c, the function does not check the return value before
dereferencing ctl->id.name or passing to aoa_snd_ctl_add(), which can
lead to a NULL pointer dereference.
Add NULL checks after snd_ctl_new1() calls and return early if any
fails.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f3d9478b2ce468c3115b02ecae7e975990697f15 Version: f3d9478b2ce468c3115b02ecae7e975990697f15 Version: f3d9478b2ce468c3115b02ecae7e975990697f15 Version: f3d9478b2ce468c3115b02ecae7e975990697f15 Version: f3d9478b2ce468c3115b02ecae7e975990697f15 Version: f3d9478b2ce468c3115b02ecae7e975990697f15 Version: f3d9478b2ce468c3115b02ecae7e975990697f15 Version: f3d9478b2ce468c3115b02ecae7e975990697f15 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/aoa/fabrics/layout.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b0154ebc6dc552c389a574b1e221d728e10346e7",
"status": "affected",
"version": "f3d9478b2ce468c3115b02ecae7e975990697f15",
"versionType": "git"
},
{
"lessThan": "d62624fe256b2d0d13454c78cbfc70ff5d954dc7",
"status": "affected",
"version": "f3d9478b2ce468c3115b02ecae7e975990697f15",
"versionType": "git"
},
{
"lessThan": "e5e8c4508d95af82f9b4d065f658e5476a8e9bc8",
"status": "affected",
"version": "f3d9478b2ce468c3115b02ecae7e975990697f15",
"versionType": "git"
},
{
"lessThan": "2ee9c46fd2dcd529cef18e37636ee12f5c3dbedd",
"status": "affected",
"version": "f3d9478b2ce468c3115b02ecae7e975990697f15",
"versionType": "git"
},
{
"lessThan": "d73067e2bbf3775a495d9f38e38d0a3cf53ee790",
"status": "affected",
"version": "f3d9478b2ce468c3115b02ecae7e975990697f15",
"versionType": "git"
},
{
"lessThan": "fd786466889e4a6e6de0f4462bd0068edea63960",
"status": "affected",
"version": "f3d9478b2ce468c3115b02ecae7e975990697f15",
"versionType": "git"
},
{
"lessThan": "e47f2a341adbac001b6f5d0211b0cd1c1668637b",
"status": "affected",
"version": "f3d9478b2ce468c3115b02ecae7e975990697f15",
"versionType": "git"
},
{
"lessThan": "8df560fefe6fed6a20b7e06720eeaeccec349ac0",
"status": "affected",
"version": "f3d9478b2ce468c3115b02ecae7e975990697f15",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/aoa/fabrics/layout.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"lessThan": "2.6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: aoa: check snd_ctl_new1() return value\n\nsnd_ctl_new1() can return NULL when memory allocation fails. In\nlayout.c, the function does not check the return value before\ndereferencing ctl-\u003eid.name or passing to aoa_snd_ctl_add(), which can\nlead to a NULL pointer dereference.\n\nAdd NULL checks after snd_ctl_new1() calls and return early if any\nfails."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:56:35.958Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b0154ebc6dc552c389a574b1e221d728e10346e7"
},
{
"url": "https://git.kernel.org/stable/c/d62624fe256b2d0d13454c78cbfc70ff5d954dc7"
},
{
"url": "https://git.kernel.org/stable/c/e5e8c4508d95af82f9b4d065f658e5476a8e9bc8"
},
{
"url": "https://git.kernel.org/stable/c/2ee9c46fd2dcd529cef18e37636ee12f5c3dbedd"
},
{
"url": "https://git.kernel.org/stable/c/d73067e2bbf3775a495d9f38e38d0a3cf53ee790"
},
{
"url": "https://git.kernel.org/stable/c/fd786466889e4a6e6de0f4462bd0068edea63960"
},
{
"url": "https://git.kernel.org/stable/c/e47f2a341adbac001b6f5d0211b0cd1c1668637b"
},
{
"url": "https://git.kernel.org/stable/c/8df560fefe6fed6a20b7e06720eeaeccec349ac0"
}
],
"title": "ALSA: aoa: check snd_ctl_new1() return value",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64488",
"datePublished": "2026-07-25T08:51:47.436Z",
"dateReserved": "2026-07-19T15:36:31.792Z",
"dateUpdated": "2026-08-17T04:56:35.958Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64369 (GCVE-0-2026-64369)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390: Revert support for DCACHE_WORD_ACCESS
load_unaligned_zeropad() reads eight bytes from unaligned addresses and may
cross page boundaries. It handles exceptions which may happen if reading
from the second page results in an exception.
For pages which are donated to the Ultravisor for secure execution purposes
the do_secure_storage_access() exception handler however does not handle
such exceptions correctly. Such an exception may result in an endless
exception loop which will never be resolved.
An attempt to fix this [1] turned out to be not sufficient. For now revert
load_unaligned_zeropad() until this problem has been resolved in a proper
way.
Note that the implementation of load_unaligned_zeropad() itself is
correct. The revert is just a temporary workaround until there is complete
fix for secure storage access exceptions.
[1] commit b00be77302d7 ("s390/mm: Add missing secure storage access fixups for donated memory")
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/s390/Kconfig",
"arch/s390/include/asm/asm-extable.h",
"arch/s390/include/asm/word-at-a-time.h",
"arch/s390/mm/extable.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c9e0f1517631ac08987f8385817119bccf2f1f12",
"status": "affected",
"version": "802ba53eefc592a6a82231f74e19bafe3256f172",
"versionType": "git"
},
{
"lessThan": "be79d285bea70d0edd5015bd487311bfa8cbebc9",
"status": "affected",
"version": "802ba53eefc592a6a82231f74e19bafe3256f172",
"versionType": "git"
},
{
"lessThan": "c94806905e02cc8e17a69c822d93c41743b7ffc5",
"status": "affected",
"version": "802ba53eefc592a6a82231f74e19bafe3256f172",
"versionType": "git"
},
{
"lessThan": "37540b8c287fc817bdbd0c62bb75ad6eab0e5d03",
"status": "affected",
"version": "802ba53eefc592a6a82231f74e19bafe3256f172",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/s390/Kconfig",
"arch/s390/include/asm/asm-extable.h",
"arch/s390/include/asm/word-at-a-time.h",
"arch/s390/mm/extable.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390: Revert support for DCACHE_WORD_ACCESS\n\nload_unaligned_zeropad() reads eight bytes from unaligned addresses and may\ncross page boundaries. It handles exceptions which may happen if reading\nfrom the second page results in an exception.\n\nFor pages which are donated to the Ultravisor for secure execution purposes\nthe do_secure_storage_access() exception handler however does not handle\nsuch exceptions correctly. Such an exception may result in an endless\nexception loop which will never be resolved.\n\nAn attempt to fix this [1] turned out to be not sufficient. For now revert\nload_unaligned_zeropad() until this problem has been resolved in a proper\nway.\n\nNote that the implementation of load_unaligned_zeropad() itself is\ncorrect. The revert is just a temporary workaround until there is complete\nfix for secure storage access exceptions.\n\n[1] commit b00be77302d7 (\"s390/mm: Add missing secure storage access fixups for donated memory\")"
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:18.866Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c9e0f1517631ac08987f8385817119bccf2f1f12"
},
{
"url": "https://git.kernel.org/stable/c/be79d285bea70d0edd5015bd487311bfa8cbebc9"
},
{
"url": "https://git.kernel.org/stable/c/c94806905e02cc8e17a69c822d93c41743b7ffc5"
},
{
"url": "https://git.kernel.org/stable/c/37540b8c287fc817bdbd0c62bb75ad6eab0e5d03"
}
],
"title": "s390: Revert support for DCACHE_WORD_ACCESS",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64369",
"datePublished": "2026-07-25T08:50:22.543Z",
"dateReserved": "2026-07-19T15:36:31.783Z",
"dateUpdated": "2026-08-17T04:54:18.866Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64552 (GCVE-0-2026-64552)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
virtio-net: fix len check in receive_big()
receive_big() bounds the device-announced length by
(big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose:
add_recvbuf_big() sets sg[1] to start at offset
sizeof(struct padded_vnet_hdr) into the first page, so the chain
actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +
big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the
check allows for the common hdr_len == 12 case.
A malicious virtio backend can announce a len in that gap. page_to_skb()
then walks one frag past the page chain, storing a NULL page->private
into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds
write past the static frag array and a NULL frag handed up the rx path.
Bound len by the size add_recvbuf_big() actually advertised.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 82f9028e83944a9eee5229cbc6fee9be1de8a62d Version: 946dec89c41726b94d31147ec528b96af0be1b5a Version: 82fe78065450d2d07f36a22e2b6b44955cf5ca5b Version: 0c716703965ffc5ef4311b65cb5d84a703784717 Version: 0c716703965ffc5ef4311b65cb5d84a703784717 Version: 0c716703965ffc5ef4311b65cb5d84a703784717 Version: 3e9d89f2ecd3636bd4cbdfd0b2dfdaf58f9882e2 Version: 6.1.159 ≤ Version: 6.6.117 ≤ Version: 6.12.58 ≤ Version: 6.17.8 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/virtio_net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f9451d0fd5ba635dcabb49bfe456a6db734a8986",
"status": "affected",
"version": "82f9028e83944a9eee5229cbc6fee9be1de8a62d",
"versionType": "git"
},
{
"lessThan": "38e94d63e29f4a5c6eae87ee2c02101aaa321502",
"status": "affected",
"version": "946dec89c41726b94d31147ec528b96af0be1b5a",
"versionType": "git"
},
{
"lessThan": "fbeb65154583879d556ea94cb2f15888e9470f3d",
"status": "affected",
"version": "82fe78065450d2d07f36a22e2b6b44955cf5ca5b",
"versionType": "git"
},
{
"lessThan": "c7fc9adf4e006155f7f2aeda052fbcde25cdcc49",
"status": "affected",
"version": "0c716703965ffc5ef4311b65cb5d84a703784717",
"versionType": "git"
},
{
"lessThan": "e6b8463b7d791f3886d7584259d6e9f06a69f12e",
"status": "affected",
"version": "0c716703965ffc5ef4311b65cb5d84a703784717",
"versionType": "git"
},
{
"lessThan": "9e5ad06ea826322ce8c58b4a68442a96f600c3c4",
"status": "affected",
"version": "0c716703965ffc5ef4311b65cb5d84a703784717",
"versionType": "git"
},
{
"status": "affected",
"version": "3e9d89f2ecd3636bd4cbdfd0b2dfdaf58f9882e2",
"versionType": "git"
},
{
"lessThan": "6.1.178",
"status": "affected",
"version": "6.1.159",
"versionType": "semver"
},
{
"lessThan": "6.6.145",
"status": "affected",
"version": "6.6.117",
"versionType": "semver"
},
{
"lessThan": "6.12.97",
"status": "affected",
"version": "6.12.58",
"versionType": "semver"
},
{
"lessThan": "6.18",
"status": "affected",
"version": "6.17.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/virtio_net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.18"
},
{
"lessThan": "6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "6.1.159",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6.117",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12.58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.17.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix len check in receive_big()\n\nreceive_big() bounds the device-announced length by\n(big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose:\nadd_recvbuf_big() sets sg[1] to start at offset\nsizeof(struct padded_vnet_hdr) into the first page, so the chain\nactually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +\nbig_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the\ncheck allows for the common hdr_len == 12 case.\n\nA malicious virtio backend can announce a len in that gap. page_to_skb()\nthen walks one frag past the page chain, storing a NULL page-\u003eprivate\ninto skb_shinfo()-\u003efrags[MAX_SKB_FRAGS], which is both an out-of-bounds\nwrite past the static frag array and a NULL frag handed up the rx path.\n\nBound len by the size add_recvbuf_big() actually advertised."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The malicious input is the buffer length announced by the virtio backend (hypervisor, vhost-user/VDUSE daemon, or virtio-net hardware device), not data from a network peer; a conforming backend can never announce a length in the vulnerable gap. This is the local device-to-driver attack surface, matching how other malicious-virtio-device bugs are scored.\nAC:L - The backend deterministically controls feature negotiation, MTU (hence big_packets_num_skbfrags), and the announced len, so it can force big-packets mode and hit the 20-byte gap on the first packet with no race or memory-layout luck.\nPR:N - The attacking backend requires no credentials or privileges inside the victim kernel \u2014 it is outside the guest\u0027s security authority and simply completes an RX descriptor. No guest-side account is needed.\nUI:N - Triggered automatically in the NAPI receive path as soon as the backend completes a receive buffer; no victim action is required.\nS:U - The corruption and crash are confined to the kernel that owns the virtio-net driver, with no crossing into a different security-managing authority such as an IOMMU or hypervisor boundary.\nC:H - A controlled 16-byte out-of-bounds write past skb_shared_info into an adjacent skb head in the NAPI page-frag cache lets the attacker corrupt neighbouring network buffer metadata, which is leverageable to disclose adjacent kernel memory; nr_frags is also left one past MAX_SKB_FRAGS so downstream code reads out-of-bounds frag state.\nI:H - This is an out-of-bounds write past the end of the static skb_shinfo()-\u003efrags[] array with attacker-influenced index and size, corrupting adjacent slab/page-frag memory \u2014 per guidance an OOB write is High and is potentially leverageable for control-flow hijack.\nA:H - After the OOB write, a NULL page is stored as a frag and immediately dereferenced via compound_head() in softirq context, producing a guaranteed kernel oops; the backend can repeat this at will."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:29.862Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f9451d0fd5ba635dcabb49bfe456a6db734a8986"
},
{
"url": "https://git.kernel.org/stable/c/38e94d63e29f4a5c6eae87ee2c02101aaa321502"
},
{
"url": "https://git.kernel.org/stable/c/fbeb65154583879d556ea94cb2f15888e9470f3d"
},
{
"url": "https://git.kernel.org/stable/c/c7fc9adf4e006155f7f2aeda052fbcde25cdcc49"
},
{
"url": "https://git.kernel.org/stable/c/e6b8463b7d791f3886d7584259d6e9f06a69f12e"
},
{
"url": "https://git.kernel.org/stable/c/9e5ad06ea826322ce8c58b4a68442a96f600c3c4"
}
],
"title": "virtio-net: fix len check in receive_big()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64552",
"datePublished": "2026-07-27T20:10:40.570Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-17T04:57:29.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64481 (GCVE-0-2026-64481)
Vulnerability from cvelistv5
Published
2026-07-25 08:51
Modified
2026-08-17 04:56
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/cs35l41: Fix firmware load work teardown
cs35l41_hda creates ALSA controls whose private data points at the
cs35l41_hda object. The firmware load control can also queue
fw_load_work.
Those controls are not removed on component unbind, and device remove
only cancels fw_load_work through cs35l41_remove_dsp(). That helper is
skipped when halo_initialized is false. With firmware_autostart
disabled, a firmware load can be requested before the DSP has been
initialized. If the component or device is removed before the queued
work runs, the worker can run after teardown and dereference driver
state that is no longer valid.
Track the created controls and remove them on unbind so no new control
callback can reach the driver data or queue more work. Then cancel
fw_load_work to drain any request that was already queued. Also cancel
the work unconditionally during device remove before runtime PM teardown.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/hda/codecs/side-codecs/cs35l41_hda.c",
"sound/hda/codecs/side-codecs/cs35l41_hda.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8947215c0136c9d905e4a46d824824f8b48a2e5b",
"status": "affected",
"version": "47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8",
"versionType": "git"
},
{
"lessThan": "ce0a903d0591e3e2c790c5b628802b08d1b287cc",
"status": "affected",
"version": "47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8",
"versionType": "git"
},
{
"lessThan": "d6a40a4d083ef74d00c8f9516cb5ff07ac70720b",
"status": "affected",
"version": "47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8",
"versionType": "git"
},
{
"lessThan": "b65020d5398f499c09498c9786dba6d67ae57664",
"status": "affected",
"version": "47ceabd99a28399f8971f4ca0a37ebc0a21dd2a8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/hda/codecs/side-codecs/cs35l41_hda.c",
"sound/hda/codecs/side-codecs/cs35l41_hda.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda/cs35l41: Fix firmware load work teardown\n\ncs35l41_hda creates ALSA controls whose private data points at the\ncs35l41_hda object. The firmware load control can also queue\nfw_load_work.\n\nThose controls are not removed on component unbind, and device remove\nonly cancels fw_load_work through cs35l41_remove_dsp(). That helper is\nskipped when halo_initialized is false. With firmware_autostart\ndisabled, a firmware load can be requested before the DSP has been\ninitialized. If the component or device is removed before the queued\nwork runs, the worker can run after teardown and dereference driver\nstate that is no longer valid.\n\nTrack the created controls and remove them on unbind so no new control\ncallback can reach the driver data or queue more work. Then cancel\nfw_load_work to drain any request that was already queued. Also cancel\nthe work unconditionally during device remove before runtime PM teardown."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - An attacker reaches the vulnerable callbacks through ALSA control ioctls on /dev/snd/controlC*. No network or physical protocol directly exposes this path.\nAC:L - After teardown, stale controls can repeatedly dereference the freed object or queue its embedded work item, so exploitation does not require winning a narrow race. A queued work_struct also remains directly usable after its containing allocation is freed.\nPR:L - An unprivileged user with ordinary audio-device access can invoke the control callbacks. The ioctl path contains no capability, namespace, or administrative privilege check.\nUI:N - Exploitation requires no victim to open content or perform an interactive action.\nS:U - The vulnerable driver and the affected kernel resources are governed by the same kernel security authority.\nC:H - The heap use-after-free permits attacker-influenced reuse and disclosure of freed kernel object contents, potentially supporting arbitrary kernel memory reads.\nI:H - The freed object embeds mutable workqueue list state and a function pointer that is subsequently invoked, making kernel memory corruption and control-flow hijacking defensible.\nA:H - Stale control accesses or corrupted queued work can cause a kernel oops, panic, or workqueue corruption, resulting in complete system unavailability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:56:28.073Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8947215c0136c9d905e4a46d824824f8b48a2e5b"
},
{
"url": "https://git.kernel.org/stable/c/ce0a903d0591e3e2c790c5b628802b08d1b287cc"
},
{
"url": "https://git.kernel.org/stable/c/d6a40a4d083ef74d00c8f9516cb5ff07ac70720b"
},
{
"url": "https://git.kernel.org/stable/c/b65020d5398f499c09498c9786dba6d67ae57664"
}
],
"title": "ALSA: hda/cs35l41: Fix firmware load work teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64481",
"datePublished": "2026-07-25T08:51:42.430Z",
"dateReserved": "2026-07-19T15:36:31.791Z",
"dateUpdated": "2026-08-17T04:56:28.073Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64532 (GCVE-0-2026-64532)
Vulnerability from cvelistv5
Published
2026-07-27 06:32
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}
In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and
UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove
destination is `Add2Ptr(e, le16_to_cpu(e->view.data_off))`,
where e->view.data_off comes from an on-disk NTFS_DE inside
an INDEX_ROOT or INDEX_BUFFER. Neither case validates
view.data_off + dlen against e->size; the existing
check_if_index_root / check_if_alloc_index helpers walk the
entry chain and validate the entry's offset, but not its
internal view fields.
The neighbouring read sites (e.g., fs/ntfs3/index.c when
iterating view entries) check view.data_off + view.data_size
<= e->size. Apply the same bound at the two memmove sites.
Reproduced under UML+KASAN on mainline 8d90b09e6741 via
pr_warn-only probe instrumentation: with view.data_off forced
to 0xFFFC, the memmove writes 32 bytes past the end of the
NTFS_DE.
This is similar in shape to Pavitra Jha's 2026-05-02 patch
"fs/ntfs3: prevent oob in case UpdateRecordDataRoot"
(<20260502105008.21827-1-jhapavitra98@gmail.com>) which
proposes calling ntfs3_bad_de_range(); that helper does not
exist in mainline. This patch uses inline checks.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: b46acd6a6a627d876898e1c84d3f84902264b445 Version: b46acd6a6a627d876898e1c84d3f84902264b445 Version: b46acd6a6a627d876898e1c84d3f84902264b445 Version: b46acd6a6a627d876898e1c84d3f84902264b445 Version: b46acd6a6a627d876898e1c84d3f84902264b445 Version: b46acd6a6a627d876898e1c84d3f84902264b445 Version: b46acd6a6a627d876898e1c84d3f84902264b445 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/fslog.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b20e5a709d8bd190d6e4645606763c7423e694c1",
"status": "affected",
"version": "b46acd6a6a627d876898e1c84d3f84902264b445",
"versionType": "git"
},
{
"lessThan": "d41b382068ca4e64e421f736cdd700095464b6ac",
"status": "affected",
"version": "b46acd6a6a627d876898e1c84d3f84902264b445",
"versionType": "git"
},
{
"lessThan": "429d653ca641d38a78609b8f62e81a0a5c780a2d",
"status": "affected",
"version": "b46acd6a6a627d876898e1c84d3f84902264b445",
"versionType": "git"
},
{
"lessThan": "315d3a9a48b49f889da3d858a9307e677cb9e1bd",
"status": "affected",
"version": "b46acd6a6a627d876898e1c84d3f84902264b445",
"versionType": "git"
},
{
"lessThan": "be306b8d9143a9c076c804a7ca025d69caf9c448",
"status": "affected",
"version": "b46acd6a6a627d876898e1c84d3f84902264b445",
"versionType": "git"
},
{
"lessThan": "36feda687afebae24c472202694448738809c411",
"status": "affected",
"version": "b46acd6a6a627d876898e1c84d3f84902264b445",
"versionType": "git"
},
{
"lessThan": "3e127829e57f5190f612412ece4541cb96d5ec7a",
"status": "affected",
"version": "b46acd6a6a627d876898e1c84d3f84902264b445",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/fslog.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}\n\nIn do_action()\u0027s UpdateRecordDataRoot (fslog.c:3489) and\nUpdateRecordDataAllocation (fslog.c:3697) cases, the memmove\ndestination is `Add2Ptr(e, le16_to_cpu(e-\u003eview.data_off))`,\nwhere e-\u003eview.data_off comes from an on-disk NTFS_DE inside\nan INDEX_ROOT or INDEX_BUFFER. Neither case validates\nview.data_off + dlen against e-\u003esize; the existing\ncheck_if_index_root / check_if_alloc_index helpers walk the\nentry chain and validate the entry\u0027s offset, but not its\ninternal view fields.\n\nThe neighbouring read sites (e.g., fs/ntfs3/index.c when\niterating view entries) check view.data_off + view.data_size\n\u003c= e-\u003esize. Apply the same bound at the two memmove sites.\n\nReproduced under UML+KASAN on mainline 8d90b09e6741 via\npr_warn-only probe instrumentation: with view.data_off forced\nto 0xFFFC, the memmove writes 32 bytes past the end of the\nNTFS_DE.\n\nThis is similar in shape to Pavitra Jha\u0027s 2026-05-02 patch\n\"fs/ntfs3: prevent oob in case UpdateRecordDataRoot\"\n(\u003c20260502105008.21827-1-jhapavitra98@gmail.com\u003e) which\nproposes calling ntfs3_bad_de_range(); that helper does not\nexist in mainline. This patch uses inline checks."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable journal-replay handlers are reached by mounting a crafted NTFS image or block device, not through a network receive path.\nAC:L - The attacker controls the index entry offset, copy length, and copied redo or undo data, making the out-of-bounds write deterministic without a race or external condition.\nPR:N - Although directly mounting NTFS3 requires initial-namespace CAP_SYS_ADMIN, an attacker needs no target-system privileges to supply a malicious image or volume that a privileged victim mounts.\nUI:R - In the no-privilege attack scenario, a victim must mount the crafted filesystem read-write so journal replay executes the vulnerable operation.\nS:U - The corruption occurs within the host kernel and impacts resources governed by that same security authority; it is not inherently a VM, IOMMU, or hypervisor escape.\nC:H - The attacker-controlled heap out-of-bounds write can corrupt adjacent kernel objects and plausibly enable code execution or arbitrary kernel-memory disclosure.\nI:H - The attacker chooses the copied bytes and a forward offset of up to 65535 bytes, permitting corruption of adjacent kernel objects or persistent filesystem metadata and potential control-flow hijacking.\nA:H - The out-of-bounds memmove can produce a kernel oops or panic during mount, as supported by the KASAN reproduction, causing complete system unavailability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:10.088Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b20e5a709d8bd190d6e4645606763c7423e694c1"
},
{
"url": "https://git.kernel.org/stable/c/d41b382068ca4e64e421f736cdd700095464b6ac"
},
{
"url": "https://git.kernel.org/stable/c/429d653ca641d38a78609b8f62e81a0a5c780a2d"
},
{
"url": "https://git.kernel.org/stable/c/315d3a9a48b49f889da3d858a9307e677cb9e1bd"
},
{
"url": "https://git.kernel.org/stable/c/be306b8d9143a9c076c804a7ca025d69caf9c448"
},
{
"url": "https://git.kernel.org/stable/c/36feda687afebae24c472202694448738809c411"
},
{
"url": "https://git.kernel.org/stable/c/3e127829e57f5190f612412ece4541cb96d5ec7a"
}
],
"title": "fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation}",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64532",
"datePublished": "2026-07-27T06:32:33.159Z",
"dateReserved": "2026-07-19T15:36:31.794Z",
"dateUpdated": "2026-08-17T04:57:10.088Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64405 (GCVE-0-2026-64405)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()
hci_abort_conn() read hci_skb_event(hdev->sent_cmd) when a connection
was pending, but hdev->sent_cmd can be NULL while req_status is still
HCI_REQ_PEND, leading to a NULL pointer dereference and a general
protection fault from the hci_rx_work() receive path.
Instead of inspecting hdev->sent_cmd, track the in-flight create
connection command with a new per-connection HCI_CONN_CREATE flag and
route all cancellation through hci_cancel_connect_sync(), which
dispatches to a dedicated per-type cancel function. The create command
is in exactly one of two states: still queued, or in flight. The cancel
function holds cmd_sync_work_lock across the whole decision: the worker
takes this lock to dequeue every entry, so while it is held a queued
command cannot start running and an in-flight command cannot complete
and let the next command become pending. This keeps the flag test and
hci_cmd_sync_cancel() atomic with respect to the worker, so a queued
command is simply dequeued, and an in-flight command owned by this
connection is cancelled without the risk of cancelling an unrelated
command that became pending in the meantime. CIS uses the same flag
mechanism via HCI_CONN_CREATE_CIS but cannot be dequeued per-connection.
hci_acl_create_conn_sync() and hci_le_create_conn_sync() clear
HCI_CONN_CREATE after the create command completes, but the command
status handler can free conn via hci_conn_del() (for example when the
controller rejects the connection) while the worker is still blocked on
the connection complete event. Hold a reference on conn across the
create command so the flag can be cleared without a use-after-free.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6083089ab00631617f9eac678df3ab050a9d837a Version: a13f316e90fdb1fb6df6582e845aa9b3270f3581 Version: a13f316e90fdb1fb6df6582e845aa9b3270f3581 Version: a13f316e90fdb1fb6df6582e845aa9b3270f3581 Version: a13f316e90fdb1fb6df6582e845aa9b3270f3581 Version: a13f316e90fdb1fb6df6582e845aa9b3270f3581 Version: e4511a67fcdba9729d1c7cfc6d2e645c765ce801 Version: 4ab81f16c68a602b2b69e333ae08d8748a9398de Version: 6.1.83 ≤ Version: 6.4.16 ≤ Version: 6.5.3 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/hci_core.h",
"net/bluetooth/hci_conn.c",
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "903227b6168bb99fd57d4e3c9c1b5014986198e0",
"status": "affected",
"version": "6083089ab00631617f9eac678df3ab050a9d837a",
"versionType": "git"
},
{
"lessThan": "83b22d7f7c384564fa42c3cf19bec715c693d7a2",
"status": "affected",
"version": "a13f316e90fdb1fb6df6582e845aa9b3270f3581",
"versionType": "git"
},
{
"lessThan": "70c397b62ee015e19b3924d9da741c8dda017819",
"status": "affected",
"version": "a13f316e90fdb1fb6df6582e845aa9b3270f3581",
"versionType": "git"
},
{
"lessThan": "61701912c58a05f6a043f097cc177a964abef348",
"status": "affected",
"version": "a13f316e90fdb1fb6df6582e845aa9b3270f3581",
"versionType": "git"
},
{
"lessThan": "b42cb640a0493d16b61ddd267420274be15efdc1",
"status": "affected",
"version": "a13f316e90fdb1fb6df6582e845aa9b3270f3581",
"versionType": "git"
},
{
"lessThan": "12917f591cea1af36087dba5b9ec888652f0b42a",
"status": "affected",
"version": "a13f316e90fdb1fb6df6582e845aa9b3270f3581",
"versionType": "git"
},
{
"status": "affected",
"version": "e4511a67fcdba9729d1c7cfc6d2e645c765ce801",
"versionType": "git"
},
{
"status": "affected",
"version": "4ab81f16c68a602b2b69e333ae08d8748a9398de",
"versionType": "git"
},
{
"lessThan": "6.1.118",
"status": "affected",
"version": "6.1.83",
"versionType": "semver"
},
{
"lessThan": "6.5",
"status": "affected",
"version": "6.4.16",
"versionType": "semver"
},
{
"lessThan": "6.6",
"status": "affected",
"version": "6.5.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/bluetooth/hci_core.h",
"net/bluetooth/hci_conn.c",
"net/bluetooth/hci_sync.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"lessThan": "6.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.118",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.118",
"versionStartIncluding": "6.1.83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()\n\nhci_abort_conn() read hci_skb_event(hdev-\u003esent_cmd) when a connection\nwas pending, but hdev-\u003esent_cmd can be NULL while req_status is still\nHCI_REQ_PEND, leading to a NULL pointer dereference and a general\nprotection fault from the hci_rx_work() receive path.\n\nInstead of inspecting hdev-\u003esent_cmd, track the in-flight create\nconnection command with a new per-connection HCI_CONN_CREATE flag and\nroute all cancellation through hci_cancel_connect_sync(), which\ndispatches to a dedicated per-type cancel function. The create command\nis in exactly one of two states: still queued, or in flight. The cancel\nfunction holds cmd_sync_work_lock across the whole decision: the worker\ntakes this lock to dequeue every entry, so while it is held a queued\ncommand cannot start running and an in-flight command cannot complete\nand let the next command become pending. This keeps the flag test and\nhci_cmd_sync_cancel() atomic with respect to the worker, so a queued\ncommand is simply dequeued, and an in-flight command owned by this\nconnection is cancelled without the risk of cancelling an unrelated\ncommand that became pending in the meantime. CIS uses the same flag\nmechanism via HCI_CONN_CREATE_CIS but cannot be dequeued per-connection.\n\nhci_acl_create_conn_sync() and hci_le_create_conn_sync() clear\nHCI_CONN_CREATE after the create command completes, but the command\nstatus handler can free conn via hci_conn_del() (for example when the\ncontroller rejects the connection) while the worker is still blocked on\nthe connection complete event. Hold a reference on conn across the\ncreate command so the flag can be cleared without a use-after-free."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:55:03.466Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/903227b6168bb99fd57d4e3c9c1b5014986198e0"
},
{
"url": "https://git.kernel.org/stable/c/83b22d7f7c384564fa42c3cf19bec715c693d7a2"
},
{
"url": "https://git.kernel.org/stable/c/70c397b62ee015e19b3924d9da741c8dda017819"
},
{
"url": "https://git.kernel.org/stable/c/61701912c58a05f6a043f097cc177a964abef348"
},
{
"url": "https://git.kernel.org/stable/c/b42cb640a0493d16b61ddd267420274be15efdc1"
},
{
"url": "https://git.kernel.org/stable/c/12917f591cea1af36087dba5b9ec888652f0b42a"
}
],
"title": "Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64405",
"datePublished": "2026-07-25T08:50:47.262Z",
"dateReserved": "2026-07-19T15:36:31.786Z",
"dateUpdated": "2026-08-17T04:55:03.466Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64547 (GCVE-0-2026-64547)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
For an even packet_len, net1080_rx_fixup() reads the pad byte at
skb->data[packet_len] before the skb->len != packet_len check further
down, and packet_len is only bounded against NC_MAX_PACKET. A malicious
NetChip 1080 device can send a short frame advertising a large even
packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the
skb:
BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup
Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14
...
net1080_rx_fixup (drivers/net/usb/net1080.c:384)
usbnet_bh (drivers/net/usb/usbnet.c:1589)
process_one_work (kernel/workqueue.c:3322)
bh_worker (kernel/workqueue.c:3708)
tasklet_action (kernel/softirq.c:965)
handle_softirqs (kernel/softirq.c:622)
...
Reject the frame when packet_len >= skb->len before reading.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 904813cd8a0b334189da285bb05af0b18b062502 Version: 904813cd8a0b334189da285bb05af0b18b062502 Version: 904813cd8a0b334189da285bb05af0b18b062502 Version: 904813cd8a0b334189da285bb05af0b18b062502 Version: 904813cd8a0b334189da285bb05af0b18b062502 Version: 904813cd8a0b334189da285bb05af0b18b062502 Version: 904813cd8a0b334189da285bb05af0b18b062502 Version: 904813cd8a0b334189da285bb05af0b18b062502 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/net1080.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f42217fa7d535e9ec4151f7971f06f6ea65e850a",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "c087749815379e9af2fdbeb08bfc33870b103958",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "e4a87126c085b097d29e17e3b7647295bba8be7c",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "685e92934f11d5e215dad58813e2f9955ac2f436",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "4dc8484be3302d187274364820d3bef6c62bde32",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "b153cfe84b1340c69a13d0957665a2bfcf21239c",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "ea866cab12db1a2100b400a8b03569e5bc0ee29a",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
},
{
"lessThan": "03f384bc0cb8d4a1301d4f5b0baef2d980258383",
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/net1080.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.14"
},
{
"lessThan": "2.6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: net1080: validate packet_len before pad-byte access in rx_fixup\n\nFor an even packet_len, net1080_rx_fixup() reads the pad byte at\nskb-\u003edata[packet_len] before the skb-\u003elen != packet_len check further\ndown, and packet_len is only bounded against NC_MAX_PACKET. A malicious\nNetChip 1080 device can send a short frame advertising a large even\npacket_len (e.g. 0x4000), so the pad-byte read lands past the end of the\nskb:\n\n BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup\n Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14\n ...\n net1080_rx_fixup (drivers/net/usb/net1080.c:384)\n usbnet_bh (drivers/net/usb/usbnet.c:1589)\n process_one_work (kernel/workqueue.c:3322)\n bh_worker (kernel/workqueue.c:3708)\n tasklet_action (kernel/softirq.c:965)\n handle_softirqs (kernel/softirq.c:622)\n ...\n\nReject the frame when packet_len \u003e= skb-\u003elen before reading."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - net1080 implements a point-to-point Ethernet link over a USB host-to-host cable, so the malformed NC frame originates from the logically adjacent peer host/device on that link rather than from a local user; a compromised peer (or a gadget-mode board presenting 0525:1080, which autoloads the default-y driver) sends the frame over an already-established link with no physical interaction at attack time.\nAC:L - The attacker fully and deterministically controls packet_len and the frame length in every received frame, so the out-of-bounds read is triggered on demand with no race, no timing dependency, and no reliance on memory layout the attacker cannot influence.\nPR:N - The rx path runs in softirq/workqueue context on every received URB with no authentication, no capability check, and no local account on the target; USB/link-level peers are entirely untrusted and ungated.\nUI:N - The driver binds automatically via MODULE_DEVICE_TABLE and processes frames in usbnet_bh without any user action; on an already-connected host-to-host cable the victim does nothing at all.\nS:U - The out-of-bounds read stays within the kernel\u0027s own memory and security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The attacker controls the read offset across a ~32 KB range past a 1523-byte slab/page-frag object, and the comparison outcome is leaked back over the wire because only the matching path reaches nc_ensure_sync()\u0027s vendor control transfer, yielding a repeatable oracle for probing kernel heap contents rather than a bounded few-byte read.\nI:N - The path performs only a one-byte read; the subsequent skb-\u003elen != packet_len check still rejects the frame, and the skb_trim calls on the underflow paths are no-ops, so no kernel memory or network data is modified.\nA:H - The read reaches roughly 31 KB beyond the allocation, which can cross into a KFENCE guard page, an unmapped hole, or a page-frag boundary and oops in softirq context, and on KASAN/panic_on_warn hardened kernels it panics the machine outright \u2014 repeatable per frame."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:24.361Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f42217fa7d535e9ec4151f7971f06f6ea65e850a"
},
{
"url": "https://git.kernel.org/stable/c/c087749815379e9af2fdbeb08bfc33870b103958"
},
{
"url": "https://git.kernel.org/stable/c/e4a87126c085b097d29e17e3b7647295bba8be7c"
},
{
"url": "https://git.kernel.org/stable/c/685e92934f11d5e215dad58813e2f9955ac2f436"
},
{
"url": "https://git.kernel.org/stable/c/4dc8484be3302d187274364820d3bef6c62bde32"
},
{
"url": "https://git.kernel.org/stable/c/b153cfe84b1340c69a13d0957665a2bfcf21239c"
},
{
"url": "https://git.kernel.org/stable/c/ea866cab12db1a2100b400a8b03569e5bc0ee29a"
},
{
"url": "https://git.kernel.org/stable/c/03f384bc0cb8d4a1301d4f5b0baef2d980258383"
}
],
"title": "net: usb: net1080: validate packet_len before pad-byte access in rx_fixup",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64547",
"datePublished": "2026-07-27T20:10:37.786Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-17T04:57:24.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64542 (GCVE-0-2026-64542)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-19 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv6: ndisc: fix NULL deref in accept_untracked_na()
accept_untracked_na() re-fetches the inet6_dev with __in6_dev_get(dev)
and dereferences idev->cnf.accept_untracked_na without a NULL check,
even though its only caller ndisc_recv_na() already fetched and
NULL-checked idev for the same device.
Both reads of dev->ip6_ptr run in the same RCU read-side critical
section, but a concurrent addrconf_ifdown() can clear dev->ip6_ptr
between them: lowering the MTU below IPV6_MIN_MTU calls addrconf_ifdown()
without the synchronize_net() that orders the unregister path, so the
re-fetch returns NULL and oopses:
BUG: KASAN: null-ptr-deref in ndisc_recv_na (net/ipv6/ndisc.c:974)
Read of size 4 at addr 0000000000000364
Call Trace:
<IRQ>
ndisc_recv_na (net/ipv6/ndisc.c:974)
icmpv6_rcv (net/ipv6/icmp.c:1193)
ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479)
ip6_input_finish (net/ipv6/ip6_input.c:534)
ip6_input (net/ipv6/ip6_input.c:545)
ip6_mc_input (net/ipv6/ip6_input.c:635)
ipv6_rcv (net/ipv6/ip6_input.c:351)
</IRQ>
It is reachable by an unprivileged user via a network namespace.
Pass the caller's already validated idev instead of re-fetching it; the
idev stays alive for the whole RCU critical section, so it is safe even
after dev->ip6_ptr has been cleared.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 Version: aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 Version: aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 Version: aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 Version: aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 Version: aaa5f515b16b6b3e137779ffb4c9558bb58c1e75 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv6/ndisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e5ba3017e46f275ad347e762e8eecacec5efa41d",
"status": "affected",
"version": "aaa5f515b16b6b3e137779ffb4c9558bb58c1e75",
"versionType": "git"
},
{
"lessThan": "160d3f0d7a556ceae505dcab521a37057b4ce28f",
"status": "affected",
"version": "aaa5f515b16b6b3e137779ffb4c9558bb58c1e75",
"versionType": "git"
},
{
"lessThan": "62c719203cb521b64fab74da94a81bdde5c18808",
"status": "affected",
"version": "aaa5f515b16b6b3e137779ffb4c9558bb58c1e75",
"versionType": "git"
},
{
"lessThan": "a6450f7cfae57b382cbaf66a577765c9a88b3c58",
"status": "affected",
"version": "aaa5f515b16b6b3e137779ffb4c9558bb58c1e75",
"versionType": "git"
},
{
"lessThan": "63d1c23764de2309cedbb779c75188d257a09d9b",
"status": "affected",
"version": "aaa5f515b16b6b3e137779ffb4c9558bb58c1e75",
"versionType": "git"
},
{
"lessThan": "d186e942365acece7c56d39da05dd63bf95b280a",
"status": "affected",
"version": "aaa5f515b16b6b3e137779ffb4c9558bb58c1e75",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv6/ndisc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ndisc: fix NULL deref in accept_untracked_na()\n\naccept_untracked_na() re-fetches the inet6_dev with __in6_dev_get(dev)\nand dereferences idev-\u003ecnf.accept_untracked_na without a NULL check,\neven though its only caller ndisc_recv_na() already fetched and\nNULL-checked idev for the same device.\n\nBoth reads of dev-\u003eip6_ptr run in the same RCU read-side critical\nsection, but a concurrent addrconf_ifdown() can clear dev-\u003eip6_ptr\nbetween them: lowering the MTU below IPV6_MIN_MTU calls addrconf_ifdown()\nwithout the synchronize_net() that orders the unregister path, so the\nre-fetch returns NULL and oopses:\n\n BUG: KASAN: null-ptr-deref in ndisc_recv_na (net/ipv6/ndisc.c:974)\n Read of size 4 at addr 0000000000000364\n Call Trace:\n \u003cIRQ\u003e\n ndisc_recv_na (net/ipv6/ndisc.c:974)\n icmpv6_rcv (net/ipv6/icmp.c:1193)\n ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479)\n ip6_input_finish (net/ipv6/ip6_input.c:534)\n ip6_input (net/ipv6/ip6_input.c:545)\n ip6_mc_input (net/ipv6/ip6_input.c:635)\n ipv6_rcv (net/ipv6/ip6_input.c:351)\n \u003c/IRQ\u003e\n\nIt is reachable by an unprivileged user via a network namespace.\n\nPass the caller\u0027s already validated idev instead of re-fetching it; the\nidev stays alive for the whole RCU critical section, so it is safe even\nafter dev-\u003eip6_ptr has been cleared."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:25.885Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e5ba3017e46f275ad347e762e8eecacec5efa41d"
},
{
"url": "https://git.kernel.org/stable/c/160d3f0d7a556ceae505dcab521a37057b4ce28f"
},
{
"url": "https://git.kernel.org/stable/c/62c719203cb521b64fab74da94a81bdde5c18808"
},
{
"url": "https://git.kernel.org/stable/c/a6450f7cfae57b382cbaf66a577765c9a88b3c58"
},
{
"url": "https://git.kernel.org/stable/c/63d1c23764de2309cedbb779c75188d257a09d9b"
},
{
"url": "https://git.kernel.org/stable/c/d186e942365acece7c56d39da05dd63bf95b280a"
}
],
"title": "ipv6: ndisc: fix NULL deref in accept_untracked_na()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64542",
"datePublished": "2026-07-27T20:10:34.994Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-19T16:28:25.885Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64543 (GCVE-0-2026-64543)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-19 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix use-after-free of the discoverer in tipc_disc_rcv()
bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(),
but tipc_disc_rcv() still dereferences b->disc in RX softirq under
rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv).
L2 bearers are safe thanks to the synchronize_net() in
tipc_disable_l2_media(), but the UDP bearer defers that call to the
cleanup_bearer() workqueue, so the discoverer is freed with no grace
period:
BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)
Read of size 8 at addr ffff88802348b728 by task poc_tipc/184
<IRQ>
tipc_disc_rcv (net/tipc/discover.c:149)
tipc_rcv (net/tipc/node.c:2126)
tipc_udp_recv (net/tipc/udp_media.c:391)
udp_rcv (net/ipv4/udp.c:2643)
ip_local_deliver_finish (net/ipv4/ip_input.c:241)
</IRQ>
Freed by task 181:
kfree (mm/slub.c:6565)
bearer_disable (net/tipc/bearer.c:418)
tipc_nl_bearer_disable (net/tipc/bearer.c:1001)
The bearer is freed with kfree_rcu(); free the discoverer the same way.
Add an rcu_head to struct tipc_discoverer and free it and its skb from an
RCU callback.
Because the RCU callback (tipc_disc_free_rcu) lives in module text, a
call_rcu() that is still pending when the tipc module is unloaded would
invoke a freed function. Add an rcu_barrier() to tipc_exit() after the
bearer subsystem has been torn down, so all pending discoverer callbacks
have run before the module text goes away.
Reachable from an unprivileged user namespace: the TIPCv2 genl family is
netnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC
and CONFIG_TIPC_MEDIA_UDP.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 Version: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 Version: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 Version: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 Version: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 Version: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 Version: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 Version: 25b0b9c4e835ffaa65b61c3efe2e28acf84d0259 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tipc/core.c",
"net/tipc/discover.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "380413cdfd29fb9fa486c82889132b680c4983c5",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "f05b3f4c78370469286879c765f5a1dd39dbcd32",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "4da2ac7749411971e1b222b992da5a172ce45f98",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "5e215bf1c47fdddf8203a0fe80a0ed594065f101",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "ec7d54d8cc1723921d671e3272b427c96366506f",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "b65289e1c3f352a9f92c6e19713ddd647e033253",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
},
{
"lessThan": "1579342d71133da7f00daa02c75cebec7372097b",
"status": "affected",
"version": "25b0b9c4e835ffaa65b61c3efe2e28acf84d0259",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tipc/core.c",
"net/tipc/discover.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix use-after-free of the discoverer in tipc_disc_rcv()\n\nbearer_disable() frees b-\u003edisc with tipc_disc_delete()\u0027s plain kfree(),\nbut tipc_disc_rcv() still dereferences b-\u003edisc in RX softirq under\nrcu_read_lock() (tipc_udp_recv -\u003e tipc_rcv -\u003e tipc_disc_rcv).\n\nL2 bearers are safe thanks to the synchronize_net() in\ntipc_disable_l2_media(), but the UDP bearer defers that call to the\ncleanup_bearer() workqueue, so the discoverer is freed with no grace\nperiod:\n\n BUG: KASAN: slab-use-after-free in tipc_disc_rcv (net/tipc/discover.c:149)\n Read of size 8 at addr ffff88802348b728 by task poc_tipc/184\n \u003cIRQ\u003e\n tipc_disc_rcv (net/tipc/discover.c:149)\n tipc_rcv (net/tipc/node.c:2126)\n tipc_udp_recv (net/tipc/udp_media.c:391)\n udp_rcv (net/ipv4/udp.c:2643)\n ip_local_deliver_finish (net/ipv4/ip_input.c:241)\n \u003c/IRQ\u003e\n Freed by task 181:\n kfree (mm/slub.c:6565)\n bearer_disable (net/tipc/bearer.c:418)\n tipc_nl_bearer_disable (net/tipc/bearer.c:1001)\n\nThe bearer is freed with kfree_rcu(); free the discoverer the same way.\nAdd an rcu_head to struct tipc_discoverer and free it and its skb from an\nRCU callback.\n\nBecause the RCU callback (tipc_disc_free_rcu) lives in module text, a\ncall_rcu() that is still pending when the tipc module is unloaded would\ninvoke a freed function. Add an rcu_barrier() to tipc_exit() after the\nbearer subsystem has been torn down, so all pending discoverer callbacks\nhave run before the module text goes away.\n\nReachable from an unprivileged user namespace: the TIPCv2 genl family is\nnetnsok and its bearer commands have no GENL_ADMIN_PERM. Needs CONFIG_TIPC\nand CONFIG_TIPC_MEDIA_UDP."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The free side is only reachable through the local TIPCv2 generic-netlink `BEARER_DISABLE` command (or netns teardown); a remote peer can supply the discovery packet that performs the use-after-free access but cannot itself cause `bearer_disable()` to run, so the complete attack requires local access.\nAC:L - The attacker controls both sides of the race \u2014 one thread floods TIPC discovery packets at the bearer\u0027s UDP port while another disables the bearer \u2014 and `bearer_disable()` clears `b-\u003eup` and then `kfree()`s the discoverer with no synchronization whatsoever, leaving a wide window that a multi-CPU packet flood hits reliably (a working PoC exists).\nPR:L - `tipc_genl_family` is `.netnsok = true` and the bearer enable/disable ops carry no `GENL_ADMIN_PERM` or other capability check, so an unprivileged user can do everything inside `unshare -Urn` after autoloading tipc via `socket(AF_TIPC, ...)`.\nUI:N - The attacking process performs both the bearer disable and the packet injection itself; no victim action or cooperating user is involved.\nS:U - The corruption stays within the kernel\u0027s own security authority \u2014 no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - `d-\u003enet` is read from the freed slab object and dereferenced as a `struct net *`; after reclaiming the kmalloc-192 allocation with sprayed data the attacker gains a controlled-pointer dereference chain usable for arbitrary kernel memory disclosure.\nI:H - `msg_set_prevnode(buf_msg(d-\u003eskb), sugg_addr)` writes a wire-controlled 32-bit value through the dangling `d-\u003eskb` pointer, and `tipc_disc_add_dest()` takes a spinlock and increments a counter in freed memory \u2014 together a controlled-address/controlled-value write suitable for control-flow hijacking.\nA:H - The use-after-free reliably produces a KASAN slab-use-after-free in softirq context and, on production kernels, a corrupted-pointer dereference or spinlock manipulation on reclaimed memory leading to kernel panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:28.342Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/380413cdfd29fb9fa486c82889132b680c4983c5"
},
{
"url": "https://git.kernel.org/stable/c/f05b3f4c78370469286879c765f5a1dd39dbcd32"
},
{
"url": "https://git.kernel.org/stable/c/4da2ac7749411971e1b222b992da5a172ce45f98"
},
{
"url": "https://git.kernel.org/stable/c/5e215bf1c47fdddf8203a0fe80a0ed594065f101"
},
{
"url": "https://git.kernel.org/stable/c/ec7d54d8cc1723921d671e3272b427c96366506f"
},
{
"url": "https://git.kernel.org/stable/c/a0c5fdeb5fa257f8c6d469af266bc087cb5de6a2"
},
{
"url": "https://git.kernel.org/stable/c/b65289e1c3f352a9f92c6e19713ddd647e033253"
},
{
"url": "https://git.kernel.org/stable/c/1579342d71133da7f00daa02c75cebec7372097b"
}
],
"title": "tipc: fix use-after-free of the discoverer in tipc_disc_rcv()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64543",
"datePublished": "2026-07-27T20:10:35.565Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-19T16:28:28.342Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64508 (GCVE-0-2026-64508)
Vulnerability from cvelistv5
Published
2026-07-25 08:52
Modified
2026-08-19 16:28
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Support for hardening against JIT spraying
The BPF JIT allocator packs many small programs into larger executable
allocations and reuses space within those allocations as programs are
loaded and freed. When fresh code is written into space that a previous
program occupied, an indirect jump into the new program can reuse a branch
prediction left behind by the old one.
Flush the indirect branch predictors before reusing JIT memory so that
indirect jumps into a newly written program don't reuse predictions from an
old program that occupied the same space.
Introduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush
static call for flushing the branch predictors on JIT memory reuse.
Architectures that need a flush, can update it to a predictor flush
function. By default, its a NOP and does not emit any CALL.
Allocations larger than a pack are not covered by this flush. That is safe
because cBPF programs (the unprivileged attack surface) are bounded well
below a pack size. Issue a warning if this assumption is ever violated
while the flush is active.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 Version: 57631054fae6dcc9c892ae6310b58bbb6f6e5048 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/filter.h",
"kernel/bpf/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1fbafd5235ca897b322161659ebe8ba651b00b3b",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "6e52c240c43a601b681e3a4e58fc5685114d4726",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "eed774da601268dae674e14d54a15e3624691f52",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "8ff183ee4d8c452960df58175a094828c0513b2e",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "7a6c171c6a1ac6d1509752dac131d941a3de0b37",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
},
{
"lessThan": "96cce16e26dd02a8678f1e87f88a4b5cdb63b995",
"status": "affected",
"version": "57631054fae6dcc9c892ae6310b58bbb6f6e5048",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/filter.h",
"kernel/bpf/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Support for hardening against JIT spraying\n\nThe BPF JIT allocator packs many small programs into larger executable\nallocations and reuses space within those allocations as programs are\nloaded and freed. When fresh code is written into space that a previous\nprogram occupied, an indirect jump into the new program can reuse a branch\nprediction left behind by the old one.\n\nFlush the indirect branch predictors before reusing JIT memory so that\nindirect jumps into a newly written program don\u0027t reuse predictions from an\nold program that occupied the same space.\n\nIntroduce bpf_arch_pred_flush_enabled static key and bpf_arch_pred_flush\nstatic call for flushing the branch predictors on JIT memory reuse.\nArchitectures that need a flush, can update it to a predictor flush\nfunction. By default, its a NOP and does not emit any CALL.\n\nAllocations larger than a pack are not covered by this flush. That is safe\nbecause cBPF programs (the unprivileged attack surface) are bounded well\nbelow a pack size. Issue a warning if this assumption is ever violated\nwhile the flush is active."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:28:20.972Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1fbafd5235ca897b322161659ebe8ba651b00b3b"
},
{
"url": "https://git.kernel.org/stable/c/6e52c240c43a601b681e3a4e58fc5685114d4726"
},
{
"url": "https://git.kernel.org/stable/c/eed774da601268dae674e14d54a15e3624691f52"
},
{
"url": "https://git.kernel.org/stable/c/8ff183ee4d8c452960df58175a094828c0513b2e"
},
{
"url": "https://git.kernel.org/stable/c/7a6c171c6a1ac6d1509752dac131d941a3de0b37"
},
{
"url": "https://git.kernel.org/stable/c/96cce16e26dd02a8678f1e87f88a4b5cdb63b995"
}
],
"title": "bpf: Support for hardening against JIT spraying",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64508",
"datePublished": "2026-07-25T08:52:01.732Z",
"dateReserved": "2026-07-19T15:36:31.793Z",
"dateUpdated": "2026-08-19T16:28:20.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64559 (GCVE-0-2026-64559)
Vulnerability from cvelistv5
Published
2026-07-29 16:31
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/pkey: Check length in PKEY_VERIFYPROTK ioctl
Explicitly check the buffer length request structure provided by
user-space and fail, if it exceeds the buffer size.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0a9e34ccbe772b8f321388cdbdf4f22b94e513e7",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "693bf91d4db134f9b1c2840c8e287eee3d993bac",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "7e7e03848c918aa0acad5ffd75d929e3afec1554",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
},
{
"lessThan": "b3d4ab2d7df9426f7f1d3671d7e2108f2ca6e970",
"status": "affected",
"version": "8fcc231ce3bea12b78bb94b280cdc03cff342435",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/pkey_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pkey: Check length in PKEY_VERIFYPROTK ioctl\n\nExplicitly check the buffer length request structure provided by\nuser-space and fail, if it exceeds the buffer size."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is reached only through the PKEY_VERIFYPROTK ioctl on the /dev/pkey character device, which requires local access to the system. There is no network-facing path to this code.\nAC:L - Triggering is fully deterministic \u2014 a single ioctl with protkey.len set to 0x20000010 wraps the u32 multiplication to a legal 128-bit keytype and drives the unchecked memcpy; no race, timing, or uncontrollable memory-layout condition is involved.\nPR:L - The pkey miscdevice is registered with .mode = 0666 and neither the open handler nor pkey_unlocked_ioctl performs any capability check, so any unprivileged local user (including a normal shell user on a shared IBM Z LPAR or z/VM guest) can issue the ioctl.\nUI:N - The attacker performs the entire attack via its own ioctl call; no action by any other user or administrator is needed.\nS:U - The out-of-bounds read and write are confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unchecked memcpy performs a huge out-of-bounds read that walks off the 64-byte on-stack protkey buffer through the entire kernel stack, relocating arbitrary kernel stack contents \u2014 including protected key material handled by this crypto driver \u2014 into heap objects, an unbounded kernel memory disclosure primitive.\nI:H - This is a massive slab out-of-bounds write into an 80-byte kmalloc-96 allocation whose first 64 bytes are entirely attacker-supplied and whose subsequent bytes come from groomable kernel-stack data, corrupting adjacent slab objects and providing a heap-overflow primitive suitable for control-flow hijacking.\nA:H - The smallest length that bypasses the keytype check requests a 512 MB copy, so the source pointer inevitably hits the VMAP_STACK guard page, producing an unhandled kernel fault/oops and panic after wide-scale heap corruption \u2014 a guaranteed, repeatable denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:37.809Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0a9e34ccbe772b8f321388cdbdf4f22b94e513e7"
},
{
"url": "https://git.kernel.org/stable/c/693bf91d4db134f9b1c2840c8e287eee3d993bac"
},
{
"url": "https://git.kernel.org/stable/c/7e7e03848c918aa0acad5ffd75d929e3afec1554"
},
{
"url": "https://git.kernel.org/stable/c/b3d4ab2d7df9426f7f1d3671d7e2108f2ca6e970"
}
],
"title": "s390/pkey: Check length in PKEY_VERIFYPROTK ioctl",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64559",
"datePublished": "2026-07-29T16:31:22.195Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-17T04:57:37.809Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64545 (GCVE-0-2026-64545)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net, bpf: check master for NULL in xdp_master_redirect()
xdp_master_redirect() dereferences the result of
netdev_master_upper_dev_get_rcu() without a NULL check, but that helper
returns NULL when the receiving device has no upper-master adjacency.
The reach guard only checks netif_is_bond_slave(). On bond slave release
bond_upper_dev_unlink() drops the upper-master adjacency before clearing
IFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window
still passes netif_is_bond_slave() while master is already NULL, and
faults on master->flags at offset 0xb0:
BUG: kernel NULL pointer dereference, address: 00000000000000b0
RIP: 0010:xdp_master_redirect (net/core/filter.c:4432)
Call Trace:
xdp_master_redirect (net/core/filter.c:4432)
bpf_prog_run_generic_xdp (include/net/xdp.h:700)
do_xdp_generic (net/core/dev.c:5608)
__netif_receive_skb_one_core (net/core/dev.c:6204)
process_backlog (net/core/dev.c:6319)
__napi_poll (net/core/dev.c:7729)
net_rx_action (net/core/dev.c:7792)
handle_softirqs (kernel/softirq.c:622)
__dev_queue_xmit (include/linux/bottom_half.h:33)
packet_sendmsg (net/packet/af_packet.c:3082)
__sys_sendto (net/socket.c:2252)
Kernel panic - not syncing: Fatal exception in interrupt
The missing check dates back to the original code; commit 1921f91298d1
("net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master")
later added the master->flags read where the fault now lands but kept the
unconditional deref. Check master for NULL before use; a NULL master is
treated the same as one that is not up.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 Version: 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 Version: 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 Version: 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 Version: 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 Version: 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 Version: 879af96ffd72706c6e3278ea6b45b0b0e37ec5d7 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c99ca049e910d61ddbd28cc2c47242f2bfbb4970",
"status": "affected",
"version": "879af96ffd72706c6e3278ea6b45b0b0e37ec5d7",
"versionType": "git"
},
{
"lessThan": "e2a56441233131fe18a76001de347ecda217e40c",
"status": "affected",
"version": "879af96ffd72706c6e3278ea6b45b0b0e37ec5d7",
"versionType": "git"
},
{
"lessThan": "3876318ea54e83eb70982b8280a3c5e4e32269bf",
"status": "affected",
"version": "879af96ffd72706c6e3278ea6b45b0b0e37ec5d7",
"versionType": "git"
},
{
"lessThan": "4edbcacca09f92b85d3951b6add11894b20a84bc",
"status": "affected",
"version": "879af96ffd72706c6e3278ea6b45b0b0e37ec5d7",
"versionType": "git"
},
{
"lessThan": "03b743586a2469744e96e9c1015096d07240935d",
"status": "affected",
"version": "879af96ffd72706c6e3278ea6b45b0b0e37ec5d7",
"versionType": "git"
},
{
"lessThan": "89c103d702b25ceb2d097faf854deb47b53b17ff",
"status": "affected",
"version": "879af96ffd72706c6e3278ea6b45b0b0e37ec5d7",
"versionType": "git"
},
{
"lessThan": "e82d8cc4321c373dc46e741cd2dfdaa7921fddb7",
"status": "affected",
"version": "879af96ffd72706c6e3278ea6b45b0b0e37ec5d7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet, bpf: check master for NULL in xdp_master_redirect()\n\nxdp_master_redirect() dereferences the result of\nnetdev_master_upper_dev_get_rcu() without a NULL check, but that helper\nreturns NULL when the receiving device has no upper-master adjacency.\n\nThe reach guard only checks netif_is_bond_slave(). On bond slave release\nbond_upper_dev_unlink() drops the upper-master adjacency before clearing\nIFF_SLAVE, so an XDP_TX reaching xdp_master_redirect() in that window\nstill passes netif_is_bond_slave() while master is already NULL, and\nfaults on master-\u003eflags at offset 0xb0:\n\n BUG: kernel NULL pointer dereference, address: 00000000000000b0\n RIP: 0010:xdp_master_redirect (net/core/filter.c:4432)\n Call Trace:\n xdp_master_redirect (net/core/filter.c:4432)\n bpf_prog_run_generic_xdp (include/net/xdp.h:700)\n do_xdp_generic (net/core/dev.c:5608)\n __netif_receive_skb_one_core (net/core/dev.c:6204)\n process_backlog (net/core/dev.c:6319)\n __napi_poll (net/core/dev.c:7729)\n net_rx_action (net/core/dev.c:7792)\n handle_softirqs (kernel/softirq.c:622)\n __dev_queue_xmit (include/linux/bottom_half.h:33)\n packet_sendmsg (net/packet/af_packet.c:3082)\n __sys_sendto (net/socket.c:2252)\n Kernel panic - not syncing: Fatal exception in interrupt\n\nThe missing check dates back to the original code; commit 1921f91298d1\n(\"net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master\")\nlater added the master-\u003eflags read where the fault now lands but kept the\nunconditional deref. Check master for NULL before use; a NULL master is\ntreated the same as one that is not up."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The faulting path is the XDP receive hook \u2014 packets arriving on a bond slave drive `bpf_prog_run_xdp`/`do_xdp_generic` \u2192 `xdp_master_redirect()`, so a remote attacker sending traffic to a bonded interface running an XDP_TX program (XDP load balancers/DDoS scrubbers on bonded uplinks are a mainstream deployment) supplies the triggering packets with no local access.\nAC:L - The attacker controls the packet side of the race and can sustain line-rate traffic so the multi-microsecond window between adjacency teardown and `IFF_SLAVE` clearing is hit essentially deterministically; where the attacker also holds the network configuration side (container/netns with bond and XDP control) both sides of the race are attacker-driven, which the kernel guidance classes as Low.\nPR:N - No credentials or authentication are needed to send frames to a bonded interface, and the fault occurs in softirq during receive processing before any socket, filesystem, or user-level authorization is consulted \u2014 matching the PR:N treatment of the sibling fix CVE-2026-53069 in this same function.\nUI:N - No victim action is required; the slave-release window is reached by routine and externally-induced events (bond reconfiguration, `bond_enslave` rollback, NIC hotplug/`NETDEV_UNREGISTER`), and the attacker need only keep traffic flowing.\nS:U - The NULL dereference and its consequences are confined to the kernel\u0027s own security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:N - The bug is a read of `master-\u003eflags` at fixed offset 0xb0 from a NULL pointer, which faults immediately; no memory contents are returned to the attacker and no kernel addresses are disclosed.\nI:N - There is no write primitive \u2014 the defect is a read-side dereference that faults before `master-\u003enetdev_ops-\u003endo_xdp_get_xmit_slave()` is reached, so no kernel data or control flow is modified.\nA:H - The dereference happens in softirq/interrupt context, producing \"Kernel panic - not syncing: Fatal exception in interrupt\" \u2014 a complete system crash rather than a recoverable oops, and it can be re-triggered on every reboot as long as traffic and bond reconfiguration continue."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:22.161Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c99ca049e910d61ddbd28cc2c47242f2bfbb4970"
},
{
"url": "https://git.kernel.org/stable/c/e2a56441233131fe18a76001de347ecda217e40c"
},
{
"url": "https://git.kernel.org/stable/c/3876318ea54e83eb70982b8280a3c5e4e32269bf"
},
{
"url": "https://git.kernel.org/stable/c/4edbcacca09f92b85d3951b6add11894b20a84bc"
},
{
"url": "https://git.kernel.org/stable/c/03b743586a2469744e96e9c1015096d07240935d"
},
{
"url": "https://git.kernel.org/stable/c/89c103d702b25ceb2d097faf854deb47b53b17ff"
},
{
"url": "https://git.kernel.org/stable/c/e82d8cc4321c373dc46e741cd2dfdaa7921fddb7"
}
],
"title": "net, bpf: check master for NULL in xdp_master_redirect()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64545",
"datePublished": "2026-07-27T20:10:36.659Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-17T04:57:22.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64553 (GCVE-0-2026-64553)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: psample: fix info leak in PSAMPLE_ATTR_DATA
psample open codes nla_put() presumably to avoid wiping
the data with 0s just to override it with packet data.
This open coding is missing clearing the pad, however,
each netlink attr is padded to 4B and data_len may
not be divisible by 4B.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 6ae0a6286171154661b74f7f550f9441c6008424 Version: 6ae0a6286171154661b74f7f550f9441c6008424 Version: 6ae0a6286171154661b74f7f550f9441c6008424 Version: 6ae0a6286171154661b74f7f550f9441c6008424 Version: 6ae0a6286171154661b74f7f550f9441c6008424 Version: 6ae0a6286171154661b74f7f550f9441c6008424 Version: 6ae0a6286171154661b74f7f550f9441c6008424 Version: 6ae0a6286171154661b74f7f550f9441c6008424 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/psample/psample.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0d3ea2ccddda442077fc44f11d873209c97ec50b",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "7fe7e6949964aa8ee6305f09db2dc9eede977bb3",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "e2fa322782a2d7d8078f7bb20817e0aa9f7c32e9",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "befe1ebe7fc2c65c80074bc34ceeb0a721ed3cd2",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "48930f6c59fd0056c2de46ce52bfe27d9c9e5eb6",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "a6cfb924ad74efce254e99c197d2e3863de70868",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "794a0d8bdbb39e083ed42caccb86d687a9b53570",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
},
{
"lessThan": "aedd02af1f8b0bceb7f42f5a21c41634ca9ed390",
"status": "affected",
"version": "6ae0a6286171154661b74f7f550f9441c6008424",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/psample/psample.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: psample: fix info leak in PSAMPLE_ATTR_DATA\n\npsample open codes nla_put() presumably to avoid wiping\nthe data with 0s just to override it with packet data.\nThis open coding is missing clearing the pad, however,\neach netlink attr is padded to 4B and data_len may\nnot be divisible by 4B."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:30.953Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0d3ea2ccddda442077fc44f11d873209c97ec50b"
},
{
"url": "https://git.kernel.org/stable/c/7fe7e6949964aa8ee6305f09db2dc9eede977bb3"
},
{
"url": "https://git.kernel.org/stable/c/e2fa322782a2d7d8078f7bb20817e0aa9f7c32e9"
},
{
"url": "https://git.kernel.org/stable/c/befe1ebe7fc2c65c80074bc34ceeb0a721ed3cd2"
},
{
"url": "https://git.kernel.org/stable/c/48930f6c59fd0056c2de46ce52bfe27d9c9e5eb6"
},
{
"url": "https://git.kernel.org/stable/c/a6cfb924ad74efce254e99c197d2e3863de70868"
},
{
"url": "https://git.kernel.org/stable/c/794a0d8bdbb39e083ed42caccb86d687a9b53570"
},
{
"url": "https://git.kernel.org/stable/c/aedd02af1f8b0bceb7f42f5a21c41634ca9ed390"
}
],
"title": "net: psample: fix info leak in PSAMPLE_ATTR_DATA",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64553",
"datePublished": "2026-07-27T20:10:41.159Z",
"dateReserved": "2026-07-19T15:36:31.796Z",
"dateUpdated": "2026-08-17T04:57:30.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64544 (GCVE-0-2026-64544)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
pefile_digest_pe_contents() computes the trailing-data hash length as
pelen - (hashed_bytes + certs_size). A crafted PE can make the addition
exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB.
This is passed to crypto_shash_update() which reads out of bounds and
panics on unmapped vmalloc guard pages.
BUG: unable to handle page fault for address: ffffc900038d8000
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152)
Call Trace:
<TASK>
__sha256_update (lib/crypto/sha256.c:208)
crypto_sha256_update (crypto/sha256.c:142)
verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436)
kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151)
__do_sys_kexec_file_load (kernel/kexec_file.c:406)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
</TASK>
Kernel panic - not syncing: Fatal exception
Validate that the addition does not overflow and the result does not
exceed pelen before the subtraction. Return -ELIBBAD on failure.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: af316fc442ef23901bbfcec5af55e69ca6ce9563 Version: af316fc442ef23901bbfcec5af55e69ca6ce9563 Version: af316fc442ef23901bbfcec5af55e69ca6ce9563 Version: af316fc442ef23901bbfcec5af55e69ca6ce9563 Version: af316fc442ef23901bbfcec5af55e69ca6ce9563 Version: af316fc442ef23901bbfcec5af55e69ca6ce9563 Version: af316fc442ef23901bbfcec5af55e69ca6ce9563 Version: af316fc442ef23901bbfcec5af55e69ca6ce9563 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/asymmetric_keys/verify_pefile.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "89efd998470a93284b7ad5a20d4e0e3c6858ae8e",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "7016377699b5b25b7ec3c0bf2ec3f983c7e95f7c",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "b798ada5a5d1cb4cc4cfa72074b1b463eca6c506",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "627938383761fb4334b41ebe7ef438d6b8b19d60",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "e162bc386e71b5412425a38ee048e8d2185491b9",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "6acd2fbd00f9c72aebefce63fc2e73e8f3d79061",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "803591785d33cf13b6f73ce2796e8b9e6d5e6526",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
},
{
"lessThan": "f7dd32c5179d7755de18e21d5674b08f9e5cb180",
"status": "affected",
"version": "af316fc442ef23901bbfcec5af55e69ca6ce9563",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/asymmetric_keys/verify_pefile.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents\n\npefile_digest_pe_contents() computes the trailing-data hash length as\npelen - (hashed_bytes + certs_size). A crafted PE can make the addition\nexceed pelen, causing the unsigned subtraction to underflow to ~4 GiB.\nThis is passed to crypto_shash_update() which reads out of bounds and\npanics on unmapped vmalloc guard pages.\n\n BUG: unable to handle page fault for address: ffffc900038d8000\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152)\n Call Trace:\n \u003cTASK\u003e\n __sha256_update (lib/crypto/sha256.c:208)\n crypto_sha256_update (crypto/sha256.c:142)\n verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436)\n kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151)\n __do_sys_kexec_file_load (kernel/kexec_file.c:406)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n \u003c/TASK\u003e\n Kernel panic - not syncing: Fatal exception\n\nValidate that the addition does not overflow and the result does not\nexceed pelen before the subtraction. Return -ELIBBAD on failure."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:21.054Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/89efd998470a93284b7ad5a20d4e0e3c6858ae8e"
},
{
"url": "https://git.kernel.org/stable/c/7016377699b5b25b7ec3c0bf2ec3f983c7e95f7c"
},
{
"url": "https://git.kernel.org/stable/c/b798ada5a5d1cb4cc4cfa72074b1b463eca6c506"
},
{
"url": "https://git.kernel.org/stable/c/627938383761fb4334b41ebe7ef438d6b8b19d60"
},
{
"url": "https://git.kernel.org/stable/c/e162bc386e71b5412425a38ee048e8d2185491b9"
},
{
"url": "https://git.kernel.org/stable/c/6acd2fbd00f9c72aebefce63fc2e73e8f3d79061"
},
{
"url": "https://git.kernel.org/stable/c/803591785d33cf13b6f73ce2796e8b9e6d5e6526"
},
{
"url": "https://git.kernel.org/stable/c/f7dd32c5179d7755de18e21d5674b08f9e5cb180"
}
],
"title": "crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64544",
"datePublished": "2026-07-27T20:10:36.101Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-17T04:57:21.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64540 (GCVE-0-2026-64540)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
genelink_rx_fixup() splits an aggregated RX frame into its individual
packets, using a per-packet length taken from device-supplied data. That
length is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared
against how many bytes were actually received.
A malicious GeneLink (GL620A) device can therefore send a short URB whose
header claims packet_count > 1 and a first packet of up to 1514 bytes.
skb_put_data(gl_skb, packet->packet_data, size);
then copies past the end of the receive buffer and hands the adjacent slab
contents up the network stack, an out-of-bounds read that leaks kernel heap.
No privilege is required: the path runs in the usbnet RX softirq as soon as
the interface is up.
BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (drivers/net/usb/gl620a.c:112)
Read of size 1514 at addr ffff888011309708 by task ksoftirqd/0/14
Call Trace:
...
__asan_memcpy (mm/kasan/shadow.c:105)
genelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620a.c:112)
usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1589)
process_one_work (kernel/workqueue.c:3322)
bh_worker (kernel/workqueue.c:3405)
tasklet_action (kernel/softirq.c:965)
handle_softirqs (kernel/softirq.c:622)
run_ksoftirqd (kernel/softirq.c:1076)
...
skb_pull() already verifies that the requested length fits the buffer and
returns NULL otherwise. Move it ahead of the copy and check its result, so
a packet that overruns the received data is rejected before it is read.
Well-formed frames, whose packets are fully present, are unaffected.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 47ee3051c856cc2aa95d35d577a8cb37279d540f Version: 47ee3051c856cc2aa95d35d577a8cb37279d540f Version: 47ee3051c856cc2aa95d35d577a8cb37279d540f Version: 47ee3051c856cc2aa95d35d577a8cb37279d540f Version: 47ee3051c856cc2aa95d35d577a8cb37279d540f Version: 47ee3051c856cc2aa95d35d577a8cb37279d540f Version: 47ee3051c856cc2aa95d35d577a8cb37279d540f Version: 47ee3051c856cc2aa95d35d577a8cb37279d540f |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/gl620a.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "255d03551f94c7bdd86c7d9181a70b21917d829f",
"status": "affected",
"version": "47ee3051c856cc2aa95d35d577a8cb37279d540f",
"versionType": "git"
},
{
"lessThan": "4359376e6238d89977a35086e47ca3b07f43e850",
"status": "affected",
"version": "47ee3051c856cc2aa95d35d577a8cb37279d540f",
"versionType": "git"
},
{
"lessThan": "8624e179fa3ce23c2fbd1a198ce30764b73f054a",
"status": "affected",
"version": "47ee3051c856cc2aa95d35d577a8cb37279d540f",
"versionType": "git"
},
{
"lessThan": "573418f7ea8f859a841417eb4b915594094fd967",
"status": "affected",
"version": "47ee3051c856cc2aa95d35d577a8cb37279d540f",
"versionType": "git"
},
{
"lessThan": "0575599e451aff3c5329922562374a2cab25fc51",
"status": "affected",
"version": "47ee3051c856cc2aa95d35d577a8cb37279d540f",
"versionType": "git"
},
{
"lessThan": "0a7d9c7c5f1f208c523abbb4db6aea7bc1fad3db",
"status": "affected",
"version": "47ee3051c856cc2aa95d35d577a8cb37279d540f",
"versionType": "git"
},
{
"lessThan": "3ef79fa3860e644c8de7834fa7300e1c58f38862",
"status": "affected",
"version": "47ee3051c856cc2aa95d35d577a8cb37279d540f",
"versionType": "git"
},
{
"lessThan": "8ff7f2a6da4fccaa5cc9be7251a24e71e29fbd1a",
"status": "affected",
"version": "47ee3051c856cc2aa95d35d577a8cb37279d540f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/gl620a.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.14"
},
{
"lessThan": "2.6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()\n\ngenelink_rx_fixup() splits an aggregated RX frame into its individual\npackets, using a per-packet length taken from device-supplied data. That\nlength is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared\nagainst how many bytes were actually received.\n\nA malicious GeneLink (GL620A) device can therefore send a short URB whose\nheader claims packet_count \u003e 1 and a first packet of up to 1514 bytes.\n\n\tskb_put_data(gl_skb, packet-\u003epacket_data, size);\n\nthen copies past the end of the receive buffer and hands the adjacent slab\ncontents up the network stack, an out-of-bounds read that leaks kernel heap.\nNo privilege is required: the path runs in the usbnet RX softirq as soon as\nthe interface is up.\n\n BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (drivers/net/usb/gl620a.c:112)\n Read of size 1514 at addr ffff888011309708 by task ksoftirqd/0/14\n Call Trace:\n ...\n __asan_memcpy (mm/kasan/shadow.c:105)\n genelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620a.c:112)\n usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1589)\n process_one_work (kernel/workqueue.c:3322)\n bh_worker (kernel/workqueue.c:3405)\n tasklet_action (kernel/softirq.c:965)\n handle_softirqs (kernel/softirq.c:622)\n run_ksoftirqd (kernel/softirq.c:1076)\n ...\n\nskb_pull() already verifies that the requested length fits the buffer and\nreturns NULL otherwise. Move it ahead of the copy and check its result, so\na packet that overruns the received data is rejected before it is read.\nWell-formed frames, whose packets are fully present, are unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:A - The gl620a driver is a FLAG_POINTTOPOINT network interface, and the malformed aggregation header is received network data generated by the peer host on the other end of the GeneLink host-to-host cable, processed in the usbnet RX softirq. The attack is confined to that directly attached link segment, making it logically adjacent rather than routable or purely physical.\nAC:L - The attacker fully controls the frame contents and only needs to send an 18-byte URB declaring packet_count \u003e 1 with a first packet_length of up to 1514; the missing bounds check is deterministic with no race, memory-layout, or timing dependency.\nPR:N - No credentials or privileges on the target are required \u2014 the parse runs unconditionally in the RX softirq for any frame received once the interface is up, with no capability or authentication check anywhere on the usbnet_bh -\u003e rx_process -\u003e rx_fixup path.\nUI:N - No victim action is needed beyond the interface being in its normal operational state, which is inherent to a host-to-host link cable in use and is done automatically by NetworkManager/systemd-networkd.\nS:U - The over-read and the leaked memory stay within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Up to ~47 KB of adjacent kernel heap is read past the valid received data and delivered up the network stack as an Ethernet frame, exfiltrating arbitrary slab contents (prior packet data, keys, pointers) to the attacker and to any local packet capture \u2014 an unbounded, repeatable kernel memory disclosure.\nI:N - The defect is strictly a read; gl_skb is allocated with alloc_skb(size) before skb_put_data() copies exactly size bytes, so no kernel memory is written out of bounds or otherwise modified.\nA:H - With rx_urb_size reduced the read runs tens of kilobytes past a small slab object and can touch unmapped memory from softirq context, and on hardened kernels the KASAN slab-out-of-bounds report (as captured in the fix commit) panics the machine; the attacker can repeat it with every frame."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:16.687Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/255d03551f94c7bdd86c7d9181a70b21917d829f"
},
{
"url": "https://git.kernel.org/stable/c/4359376e6238d89977a35086e47ca3b07f43e850"
},
{
"url": "https://git.kernel.org/stable/c/8624e179fa3ce23c2fbd1a198ce30764b73f054a"
},
{
"url": "https://git.kernel.org/stable/c/573418f7ea8f859a841417eb4b915594094fd967"
},
{
"url": "https://git.kernel.org/stable/c/0575599e451aff3c5329922562374a2cab25fc51"
},
{
"url": "https://git.kernel.org/stable/c/0a7d9c7c5f1f208c523abbb4db6aea7bc1fad3db"
},
{
"url": "https://git.kernel.org/stable/c/3ef79fa3860e644c8de7834fa7300e1c58f38862"
},
{
"url": "https://git.kernel.org/stable/c/8ff7f2a6da4fccaa5cc9be7251a24e71e29fbd1a"
}
],
"title": "usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64540",
"datePublished": "2026-07-27T20:10:33.905Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-17T04:57:16.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64375 (GCVE-0-2026-64375)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:54
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
proc: protect ptrace_may_access() with exec_update_lock (FD links)
proc_pid_get_link() and proc_pid_readlink() currently look up the task from
the pid once, then do the ptrace access check on that task, then look up
the task from the pid a second time to do the actual access.
That's racy in several ways.
To fix it, pass the task to the ->proc_get_link() handler, and instead of
proc_fd_access_allowed(), introduce a new helper call_proc_get_link() that
looks up and locks the task, does the access check, and calls
->proc_get_link().
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 778c1144771f0064b6f51bee865cceb0d996f2f9 Version: 778c1144771f0064b6f51bee865cceb0d996f2f9 Version: 778c1144771f0064b6f51bee865cceb0d996f2f9 Version: 778c1144771f0064b6f51bee865cceb0d996f2f9 Version: 778c1144771f0064b6f51bee865cceb0d996f2f9 Version: 778c1144771f0064b6f51bee865cceb0d996f2f9 Version: 778c1144771f0064b6f51bee865cceb0d996f2f9 Version: 778c1144771f0064b6f51bee865cceb0d996f2f9 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/proc/base.c",
"fs/proc/fd.c",
"fs/proc/internal.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6253dfee5afba536bb54fc6fe6c091c3758fafe1",
"status": "affected",
"version": "778c1144771f0064b6f51bee865cceb0d996f2f9",
"versionType": "git"
},
{
"lessThan": "65bf0d2b6e914f1448d6a2fde193dcf60936a651",
"status": "affected",
"version": "778c1144771f0064b6f51bee865cceb0d996f2f9",
"versionType": "git"
},
{
"lessThan": "de497d7aa2fae453a7e7c8f7d3e8682e565e3aaf",
"status": "affected",
"version": "778c1144771f0064b6f51bee865cceb0d996f2f9",
"versionType": "git"
},
{
"lessThan": "138c692d2b2d63d26f2eb957d0e4fcc5d61f9ff2",
"status": "affected",
"version": "778c1144771f0064b6f51bee865cceb0d996f2f9",
"versionType": "git"
},
{
"lessThan": "83b17872e3166c295c599279fc9562ac3840c638",
"status": "affected",
"version": "778c1144771f0064b6f51bee865cceb0d996f2f9",
"versionType": "git"
},
{
"lessThan": "497c6bae5167428596575f20af6613ff5671f383",
"status": "affected",
"version": "778c1144771f0064b6f51bee865cceb0d996f2f9",
"versionType": "git"
},
{
"lessThan": "dfd1894cb64cbd8758b461ed713800fe73db4f82",
"status": "affected",
"version": "778c1144771f0064b6f51bee865cceb0d996f2f9",
"versionType": "git"
},
{
"lessThan": "6255da28d4bb5349fe18e84cb043ccd394eba75d",
"status": "affected",
"version": "778c1144771f0064b6f51bee865cceb0d996f2f9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/proc/base.c",
"fs/proc/fd.c",
"fs/proc/internal.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"lessThan": "2.6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nproc: protect ptrace_may_access() with exec_update_lock (FD links)\n\nproc_pid_get_link() and proc_pid_readlink() currently look up the task from\nthe pid once, then do the ptrace access check on that task, then look up\nthe task from the pid a second time to do the actual access.\nThat\u0027s racy in several ways.\n\nTo fix it, pass the task to the -\u003eproc_get_link() handler, and instead of\nproc_fd_access_allowed(), introduce a new helper call_proc_get_link() that\nlooks up and locks the task, does the access check, and calls\n-\u003eproc_get_link()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation uses local open/openat or readlink syscalls against /proc/$pid symlinks; no network or physical access path reaches the flaw.\nAC:L - The attacker can launch the setuid target process and race concurrent procfs accesses repeatedly, thereby controlling both sides of the race.\nPR:L - A basic unprivileged user can pass the initial ptrace check against a same-UID dumpable child before it performs privileged exec; no capability is required.\nUI:N - The attacker can create and race the target by launching the setuid program directly, without action from another user.\nS:U - The procfs authorization bypass compromises privileged resources on the same host and constitutes ordinary local privilege escalation rather than crossing a VM or hardware isolation boundary.\nC:H - The race can redirect an authorized pre-exec lookup to a private post-setuid memfd whose permissive shmem inode allows the attacker to read all privileged contents, including secrets.\nI:H - The attacker can obtain write and truncation access to the privileged memfd; corruption of trusted data or executable content consumed by the setuid process can yield root-level code execution.\nA:H - Tampering with a privileged process\u0027s trusted memfd can crash or disable critical privileged services, and resulting root-level execution permits complete system availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:54:26.202Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6253dfee5afba536bb54fc6fe6c091c3758fafe1"
},
{
"url": "https://git.kernel.org/stable/c/65bf0d2b6e914f1448d6a2fde193dcf60936a651"
},
{
"url": "https://git.kernel.org/stable/c/de497d7aa2fae453a7e7c8f7d3e8682e565e3aaf"
},
{
"url": "https://git.kernel.org/stable/c/138c692d2b2d63d26f2eb957d0e4fcc5d61f9ff2"
},
{
"url": "https://git.kernel.org/stable/c/83b17872e3166c295c599279fc9562ac3840c638"
},
{
"url": "https://git.kernel.org/stable/c/497c6bae5167428596575f20af6613ff5671f383"
},
{
"url": "https://git.kernel.org/stable/c/dfd1894cb64cbd8758b461ed713800fe73db4f82"
},
{
"url": "https://git.kernel.org/stable/c/6255da28d4bb5349fe18e84cb043ccd394eba75d"
}
],
"title": "proc: protect ptrace_may_access() with exec_update_lock (FD links)",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64375",
"datePublished": "2026-07-25T08:50:26.869Z",
"dateReserved": "2026-07-19T15:36:31.784Z",
"dateUpdated": "2026-08-17T04:54:26.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64541 (GCVE-0-2026-64541)
Vulnerability from cvelistv5
Published
2026-07-27 20:10
Modified
2026-08-17 04:57
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
smc_cdc_rx_handler() looks up the connection by token under the link
group's conns_lock, drops the lock, and then dereferences conn and the
smc_sock derived from it, ending in sock_hold(&smc->sk) inside
smc_cdc_msg_recv(). No reference is held across the lock release.
The only reference pinning the socket while the connection is
discoverable in the link group is taken in smc_lgr_register_conn()
(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both
under conns_lock. Once the handler drops conns_lock, a concurrent
close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn()
can drop that reference and free the smc_sock, so the handler's later
sock_hold() runs on freed memory:
WARNING: lib/refcount.c:25 at refcount_warn_saturate
Workqueue: rxe_wq do_work
refcount_warn_saturate (lib/refcount.c:25)
smc_cdc_msg_recv (net/smc/smc_cdc.c:430)
smc_cdc_rx_handler (net/smc/smc_cdc.c:502)
smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445)
tasklet_action_common (kernel/softirq.c:938)
handle_softirqs (kernel/softirq.c:622)
Kernel panic - not syncing: panic_on_warn set
Only SMC-R is affected. The SMC-D receive tasklet is stopped by
tasklet_kill(&conn->rx_tsklet) in smc_conn_free() before the connection
is unregistered, so it cannot run concurrently with the free.
Take the socket reference while still holding conns_lock, so the
registration reference can no longer be the last one, and drop it once
the handler is done.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 Version: d7b0e37c1ac152905b18a5b9506179091a35b0b6 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/smc/smc_cdc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8de4f665d0febfb92803dece377791a563fc7041",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "8145b432136285e01091815b48ceb2dae261f262",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "1951bffbc6493ec34cff3956b29d4bc6606904a6",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "647b19e5cc145a2f1f685ae8ff3805a17356888c",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "472e9d7c0d5b03be3ff91ff941f57da822b031bc",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "ce5aa8084329351086894aa34d77e40301d5bd3d",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
},
{
"lessThan": "9d160b35cc34a2ba8229d07651468a7848325135",
"status": "affected",
"version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/smc/smc_cdc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.261",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.212",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.178",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.5",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket\n\nsmc_cdc_rx_handler() looks up the connection by token under the link\ngroup\u0027s conns_lock, drops the lock, and then dereferences conn and the\nsmc_sock derived from it, ending in sock_hold(\u0026smc-\u003esk) inside\nsmc_cdc_msg_recv(). No reference is held across the lock release.\n\nThe only reference pinning the socket while the connection is\ndiscoverable in the link group is taken in smc_lgr_register_conn()\n(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both\nunder conns_lock. Once the handler drops conns_lock, a concurrent\nclose() -\u003e smc_release() -\u003e smc_conn_free() -\u003e smc_lgr_unregister_conn()\ncan drop that reference and free the smc_sock, so the handler\u0027s later\nsock_hold() runs on freed memory:\n\n WARNING: lib/refcount.c:25 at refcount_warn_saturate\n Workqueue: rxe_wq do_work\n refcount_warn_saturate (lib/refcount.c:25)\n smc_cdc_msg_recv (net/smc/smc_cdc.c:430)\n smc_cdc_rx_handler (net/smc/smc_cdc.c:502)\n smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445)\n tasklet_action_common (kernel/softirq.c:938)\n handle_softirqs (kernel/softirq.c:622)\n Kernel panic - not syncing: panic_on_warn set\n\nOnly SMC-R is affected. The SMC-D receive tasklet is stopped by\ntasklet_kill(\u0026conn-\u003erx_tsklet) in smc_conn_free() before the connection\nis unregistered, so it cannot run concurrently with the free.\n\nTake the socket reference while still holding conns_lock, so the\nregistration reference can no longer be the last one, and drop it once\nthe handler is done."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable handler is driven entirely by a CDC control message sent by the remote SMC-R peer over the RDMA link, with an attacker-chosen `token` field and no local syscall involvement. SMC-R runs over RoCEv2 (IP/UDP-routable, port 4791) with the CLC handshake over plain TCP, and SMC-Rv2 explicitly supports non-local/routed peers, so the attacker need not share an L2 segment.\nAC:L - The attacker controls both sides of the race: it chooses when to emit CDC messages and which connection to target (the alert token is disclosed to it in the CLC accept/confirm), and it can drive the teardown side itself via CDC close/abort flags into `smc_close_passive_work()` or a stale seqno with `failover_validation` into `abort_work` -\u003e `smc_conn_kill()`. The race can be retried indefinitely across many connections in the same link group, and was reproduced in practice with soft-RoCE.\nPR:N - Establishing an SMC-R connection to a listening SMC socket requires no credentials \u2014 SMC has no authentication layer of its own, exactly like plain TCP. Everything after connection establishment (sending CDC messages with a chosen token, signalling close/abort) is available to an unauthenticated peer.\nUI:N - The CDC message is processed in a softirq tasklet from the RDMA completion queue with no involvement from any local user or application action. No victim interaction of any kind is needed.\nS:U - The corruption is confined to kernel memory within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed. This is a standard in-kernel use-after-free.\nC:H - The freed `smc_sock` is reused type-safely as another live socket, so attacker-supplied cursors applied by `smc_cdc_msg_recv_action()` break the `0 \u003c= bytes_to_rcv \u003c= rmb_desc-\u003elen` invariant and make `smc_rx_recvmsg()` hand stale RMB contents to userspace, while the urgent-data path reads `*(base + conn-\u003eurg_curs.count - 1)` at an attacker-chosen offset. Once the slab page is reclaimed after the RCU grace period, reuse is unconstrained, giving a general kernel-memory read primitive.\nI:H - `sock_hold()` on an already-zero refcount followed by `sock_put()` re-enters `sk_free()`, yielding a double free, and the handler additionally writes `sk_err`/`sk_shutdown`, makes indirect calls through `sk_data_ready()`/`sk_write_space()`, and `queue_work()`s a freed `work_struct`. These are classic heap-spray and control-flow-hijack primitives leading to arbitrary kernel write.\nA:H - The reported symptom is `refcount_warn_saturate` from `smc_cdc_msg_recv()`, which is an immediate kernel panic on `panic_on_warn` systems, and dereferencing freed memory in softirq context otherwise oopses. The attacker can trigger it repeatedly without authentication."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:57:17.774Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8de4f665d0febfb92803dece377791a563fc7041"
},
{
"url": "https://git.kernel.org/stable/c/8145b432136285e01091815b48ceb2dae261f262"
},
{
"url": "https://git.kernel.org/stable/c/1951bffbc6493ec34cff3956b29d4bc6606904a6"
},
{
"url": "https://git.kernel.org/stable/c/647b19e5cc145a2f1f685ae8ff3805a17356888c"
},
{
"url": "https://git.kernel.org/stable/c/472e9d7c0d5b03be3ff91ff941f57da822b031bc"
},
{
"url": "https://git.kernel.org/stable/c/3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb"
},
{
"url": "https://git.kernel.org/stable/c/ce5aa8084329351086894aa34d77e40301d5bd3d"
},
{
"url": "https://git.kernel.org/stable/c/9d160b35cc34a2ba8229d07651468a7848325135"
}
],
"title": "net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64541",
"datePublished": "2026-07-27T20:10:34.439Z",
"dateReserved": "2026-07-19T15:36:31.795Z",
"dateUpdated": "2026-08-17T04:57:17.774Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64287 (GCVE-0-2026-64287)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-08-17 04:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU
flush_hyp_vcpu() copies the host vGIC state into the hyp's private vCPU
on every run. The vGIC list register save and restore use used_lrs as
their loop bound and expect it to stay within the number of implemented
list registers. While this is generally the case, flush_hyp_vcpu()
copies vgic_v3 verbatim and does not enforce this, so a value provided
by the host is used at EL2 to index vgic_lr[] and access ICH_LR<n>_EL2
(host -> EL2).
Fix by clamping used_lrs to the number of implemented list registers
after the copy, as the trusted path already does in
vgic_flush_lr_state(). The number of implemented list registers is
constant after init, so it is replicated once from
kvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on
every entry.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/include/asm/kvm_hyp.h",
"arch/arm64/kvm/arm.c",
"arch/arm64/kvm/hyp/nvhe/hyp-main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
},
{
"lessThan": "9fa301d8298778dd799fa4dcf7a7f440715d146e",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
},
{
"lessThan": "c646431865f4b1a5b14067233fa27b11e05e0d46",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
},
{
"lessThan": "7fca3fcef81c713bc82a37bf741e0f28e6d04a6f",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
},
{
"lessThan": "8cc8bbbfab14c22c5551d0dd19b208a44b141c76",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/include/asm/kvm_hyp.h",
"arch/arm64/kvm/arm.c",
"arch/arm64/kvm/hyp/nvhe/hyp-main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.40",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU\n\nflush_hyp_vcpu() copies the host vGIC state into the hyp\u0027s private vCPU\non every run. The vGIC list register save and restore use used_lrs as\ntheir loop bound and expect it to stay within the number of implemented\nlist registers. While this is generally the case, flush_hyp_vcpu()\ncopies vgic_v3 verbatim and does not enforce this, so a value provided\nby the host is used at EL2 to index vgic_lr[] and access ICH_LR\u003cn\u003e_EL2\n(host -\u003e EL2).\n\nFix by clamping used_lrs to the number of implemented list registers\nafter the copy, as the trusted path already does in\nvgic_flush_lr_state(). The number of implemented list registers is\nconstant after init, so it is replicated once from\nkvm_vgic_global_state.nr_lr into hyp_gicv3_nr_lr rather than read on\nevery entry."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A malicious or compromised arm64 EL1 host reaches the flaw through the local KVM vCPU-run hypercall into pKVM EL2. No network or adjacent protocol directly controls this internal field.\nAC:L - On a pKVM/GICv3 system, the host can directly select an oversized used_lrs value and deterministically trigger the unchecked loops. No race or condition outside the attacker\u0027s control is required.\nPR:H - Normal KVM paths keep used_lrs hardware-bounded, and neither an unprivileged KVM user nor a user namespace can assign it directly. Exploitation requires control of the host kernel at EL1, equivalent to real administrative privileges.\nUI:N - The malicious host can load and run a vCPU itself without any action by a protected-VM user or another victim.\nS:C - Exploitation crosses pKVM\u0027s EL1-host-to-EL2 isolation boundary and can affect hypervisor-private state and protected VMs outside the host\u0027s security authority.\nC:H - The restore and synchronization paths can read beyond vgic_lr[] and transfer hyp-private vCPU data back into host-visible memory. EL2 compromise could expose protected-VM memory and other hypervisor secrets.\nI:H - The save path writes beyond vgic_lr[] into adjacent hyp-private vCPU metadata, including pointer, lock, and list state. This memory corruption is plausibly usable for EL2 control-flow hijacking and protected-VM modification.\nA:H - Large bounds can cause extensive loops, invalid EL2 memory accesses, or corruption of critical hypervisor metadata. An nVHE hypervisor panic explicitly escalates to a host kernel panic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:43.106Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c5e72b9fbf83fdfa724e9f1af0f418ccf8739b8"
},
{
"url": "https://git.kernel.org/stable/c/9fa301d8298778dd799fa4dcf7a7f440715d146e"
},
{
"url": "https://git.kernel.org/stable/c/c646431865f4b1a5b14067233fa27b11e05e0d46"
},
{
"url": "https://git.kernel.org/stable/c/7fca3fcef81c713bc82a37bf741e0f28e6d04a6f"
},
{
"url": "https://git.kernel.org/stable/c/8cc8bbbfab14c22c5551d0dd19b208a44b141c76"
}
],
"title": "KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64287",
"datePublished": "2026-07-25T08:49:28.168Z",
"dateReserved": "2026-07-19T15:36:31.778Z",
"dateUpdated": "2026-08-17T04:52:43.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64416 (GCVE-0-2026-64416)
Vulnerability from cvelistv5
Published
2026-07-25 08:50
Modified
2026-08-17 04:55
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host
lookup_swap_cgroup_id() passes swap_cgroup_ctrl[type].map to
__swap_cgroup_id_lookup() without checking that the type was ever
registered via swap_cgroup_swapon(). On a swapless host every ctrl->map
is NULL, so __swap_cgroup_id_lookup() dereferences NULL + a scaled
swp_offset().
Since commit bea67dcc5eea ("mm: attempt to batch free swap entries for
zap_pte_range()"), zap_pte_range() -> swap_pte_batch() calls
lookup_swap_cgroup_id() on any non-present, non-none PTE that decodes as a
real swap entry, without first validating it against swap_info[]. A
single PTE corrupted into a type-0 swap entry takes the host down at
process exit.
We hit this in production on a swapless 6.12.58 host: ~1s of
"get_swap_device: Bad swap file entry 3f800204222bb" (do_swap_page() being
correctly defensive about the same entry) followed by
BUG: unable to handle page fault for address: 000003f800204220
RIP: 0010:lookup_swap_cgroup_id+0x2b/0x60
Call Trace:
swap_pte_batch+0xbf/0x230
zap_pte_range+0x4c8/0x780
unmap_page_range+0x190/0x3e0
exit_mmap+0xd9/0x3c0
do_exit+0x20c/0x4b0
syzbot has reported the identical stack.
The source of the PTE corruption is a separate bug; this change makes the
teardown path as robust as the fault path already is. Every other caller
of lookup_swap_cgroup_id() is downstream of a get_swap_device() that has
already validated the entry, so the new branch is cold.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/swap_cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "818416fef38759f23210de449663cd9d7e293d39",
"status": "affected",
"version": "bea67dcc5eea0f6a213897a59b9e644977cd07e6",
"versionType": "git"
},
{
"lessThan": "b415c00bf23df577a4a95673d00ae76687bcc1d4",
"status": "affected",
"version": "bea67dcc5eea0f6a213897a59b9e644977cd07e6",
"versionType": "git"
},
{
"lessThan": "6a4196d19f477524d2f92adca90fc1fbe9a0420a",
"status": "affected",
"version": "bea67dcc5eea0f6a213897a59b9e644977cd07e6",
"versionType": "git"
},
{
"lessThan": "63b02a9409cb5180398491b093e48bcb5315f5fb",
"status": "affected",
"version": "bea67dcc5eea0f6a213897a59b9e644977cd07e6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/swap_cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host\n\nlookup_swap_cgroup_id() passes swap_cgroup_ctrl[type].map to\n__swap_cgroup_id_lookup() without checking that the type was ever\nregistered via swap_cgroup_swapon(). On a swapless host every ctrl-\u003emap\nis NULL, so __swap_cgroup_id_lookup() dereferences NULL + a scaled\nswp_offset().\n\nSince commit bea67dcc5eea (\"mm: attempt to batch free swap entries for\nzap_pte_range()\"), zap_pte_range() -\u003e swap_pte_batch() calls\nlookup_swap_cgroup_id() on any non-present, non-none PTE that decodes as a\nreal swap entry, without first validating it against swap_info[]. A\nsingle PTE corrupted into a type-0 swap entry takes the host down at\nprocess exit.\n\nWe hit this in production on a swapless 6.12.58 host: ~1s of\n\"get_swap_device: Bad swap file entry 3f800204222bb\" (do_swap_page() being\ncorrectly defensive about the same entry) followed by\n\n BUG: unable to handle page fault for address: 000003f800204220\n RIP: 0010:lookup_swap_cgroup_id+0x2b/0x60\n Call Trace:\n swap_pte_batch+0xbf/0x230\n zap_pte_range+0x4c8/0x780\n unmap_page_range+0x190/0x3e0\n exit_mmap+0xd9/0x3c0\n do_exit+0x20c/0x4b0\n\nsyzbot has reported the identical stack.\n\nThe source of the PTE corruption is a separate bug; this change makes the\nteardown path as robust as the fault path already is. Every other caller\nof lookup_swap_cgroup_id() is downstream of a get_swap_device() that has\nalready validated the entry, so the new branch is cold."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:55:15.618Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/818416fef38759f23210de449663cd9d7e293d39"
},
{
"url": "https://git.kernel.org/stable/c/b415c00bf23df577a4a95673d00ae76687bcc1d4"
},
{
"url": "https://git.kernel.org/stable/c/6a4196d19f477524d2f92adca90fc1fbe9a0420a"
},
{
"url": "https://git.kernel.org/stable/c/63b02a9409cb5180398491b093e48bcb5315f5fb"
}
],
"title": "mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64416",
"datePublished": "2026-07-25T08:50:55.997Z",
"dateReserved": "2026-07-19T15:36:31.786Z",
"dateUpdated": "2026-08-17T04:55:15.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64286 (GCVE-0-2026-64286)
Vulnerability from cvelistv5
Published
2026-07-25 08:49
Modified
2026-08-17 04:52
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU
flush_hyp_vcpu() copies the host vCPU context into the hyp's private
vCPU on every run. ctxt_to_vcpu() expects a guest context to have a
NULL __hyp_running_vcpu, which is only ever set on the host context, so
that it resolves the vCPU via container_of(). While this is generally
the case, flush_hyp_vcpu() copies the context verbatim and does not
enforce this, so a value provided by the host is dereferenced at EL2
(host -> EL2).
Fix by clearing __hyp_running_vcpu after the copy.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/hyp/nvhe/hyp-main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "477145860dba4c30f0b4e36f02f4c5291c1c888b",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
},
{
"lessThan": "dfaef40d8a1533940fc1af788d70fce07362b4ce",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
},
{
"lessThan": "6bea2f8becdb20d34378493c3b77a9b9cf8c6cfa",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
},
{
"lessThan": "d4f4d61715d1061ba83b88196a3605662be30750",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
},
{
"lessThan": "e8042f6e1d7befb2fb6b10a75918642bcd0acf9a",
"status": "affected",
"version": "be66e67f175096f283c9d5614c4991fc9e7ed975",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm64/kvm/hyp/nvhe/hyp-main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.145",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.39",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.4",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU\n\nflush_hyp_vcpu() copies the host vCPU context into the hyp\u0027s private\nvCPU on every run. ctxt_to_vcpu() expects a guest context to have a\nNULL __hyp_running_vcpu, which is only ever set on the host context, so\nthat it resolves the vCPU via container_of(). While this is generally\nthe case, flush_hyp_vcpu() copies the context verbatim and does not\nenforce this, so a value provided by the host is dereferenced at EL2\n(host -\u003e EL2).\n\nFix by clearing __hyp_running_vcpu after the copy."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - A malicious or compromised local EL1 host can place the pointer in the host vCPU context and trigger the vulnerable pKVM path through KVM_RUN; no remote input path reaches it.\nAC:L - The attacker-selected pointer is copied and dereferenced deterministically on every vCPU run, without a race, and EL2 addresses of host-donated metadata are derivable by the host.\nPR:H - Exploitation requires host-kernel control or an equivalent arbitrary kernel write. The KVM userspace register API does not expose __hyp_running_vcpu, and user namespaces do not bypass this restriction.\nUI:N - Once the malicious host context is prepared, invoking the vCPU run path requires no action by another user.\nS:C - The vulnerability crosses the intended isolation boundary from the untrusted EL1 host into the pKVM hypervisor at EL2 and can affect protected-VM resources.\nC:H - The forged pointer drives EL2-private memory dereferences during system-register restoration. Chaining these reads with the write-side corruption can compromise EL2 and expose hypervisor or protected-guest memory.\nI:H - The system-register save path can write through the attacker-selected vCPU pointer into EL2-accessible memory. This can corrupt trusted hypervisor metadata and plausibly enable control-flow or protected-guest state modification.\nA:H - An invalid or unmapped pointer causes a synchronous EL2 fault followed by the nVHE HYP panic handler, which explicitly panics the host kernel."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T04:52:42.012Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/477145860dba4c30f0b4e36f02f4c5291c1c888b"
},
{
"url": "https://git.kernel.org/stable/c/dfaef40d8a1533940fc1af788d70fce07362b4ce"
},
{
"url": "https://git.kernel.org/stable/c/6bea2f8becdb20d34378493c3b77a9b9cf8c6cfa"
},
{
"url": "https://git.kernel.org/stable/c/d4f4d61715d1061ba83b88196a3605662be30750"
},
{
"url": "https://git.kernel.org/stable/c/e8042f6e1d7befb2fb6b10a75918642bcd0acf9a"
}
],
"title": "KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64286",
"datePublished": "2026-07-25T08:49:27.542Z",
"dateReserved": "2026-07-19T15:36:31.778Z",
"dateUpdated": "2026-08-17T04:52:42.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53365 (GCVE-0-2026-53365)
Vulnerability from cvelistv5
Published
2026-07-13 17:33
Modified
2026-08-18 13:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: fix zerocopy completion for multi-skb sends
When a large message is fragmented into multiple skbs, the zerocopy
uarg is only allocated and attached to the last skb in the loop.
Non-final skbs carry pinned user pages with no completion tracking,
so the kernel has no way to notify userspace when those pages are safe
to reuse. If the loop breaks early the uarg is never allocated at all,
leaking pinned pages with no completion notification.
Fix this by following the approach used by TCP: allocate the zerocopy
uarg (if not provided by the caller) before the send loop and attach
it to every skb via skb_zcopy_set(), which takes a reference per skb.
Each skb's completion properly decrements the refcount, and the
notification only fires after the last skb is freed.
On failure, if no data was sent, the uarg is cleanly aborted via
net_zcopy_put_abort().
This issue was initially discovered by sashiko while reviewing commit
1cb36e252211 ("vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting")
but was pre-existing.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-53365",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T03:55:24.397803Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "CWE-404 Improper Resource Shutdown or Release",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T13:29:37.454Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/MaherAzzouzi/vsockdrop"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/virtio_transport_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "293fe8f2d1b5ac464ca16a8eba09571bbbb34ba9",
"status": "affected",
"version": "581512a6dc939ef122e49336626ae159f3b8a345",
"versionType": "git"
},
{
"lessThan": "76b995bc57bd90cb6e954e1966fbd8786da47f0d",
"status": "affected",
"version": "581512a6dc939ef122e49336626ae159f3b8a345",
"versionType": "git"
},
{
"lessThan": "b3155f2b78db21e99256bcf7eb902f24ff6d5338",
"status": "affected",
"version": "581512a6dc939ef122e49336626ae159f3b8a345",
"versionType": "git"
},
{
"lessThan": "ae38d9179190a956e2a87a69ef1dd6f451b51c4d",
"status": "affected",
"version": "581512a6dc939ef122e49336626ae159f3b8a345",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/vmw_vsock/virtio_transport_common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.97",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: fix zerocopy completion for multi-skb sends\n\nWhen a large message is fragmented into multiple skbs, the zerocopy\nuarg is only allocated and attached to the last skb in the loop.\nNon-final skbs carry pinned user pages with no completion tracking,\nso the kernel has no way to notify userspace when those pages are safe\nto reuse. If the loop breaks early the uarg is never allocated at all,\nleaking pinned pages with no completion notification.\n\nFix this by following the approach used by TCP: allocate the zerocopy\nuarg (if not provided by the caller) before the send loop and attach\nit to every skb via skb_zcopy_set(), which takes a reference per skb.\nEach skb\u0027s completion properly decrements the refcount, and the\nnotification only fires after the last skb is freed.\nOn failure, if no data was sent, the uarg is cleanly aborted via\nnet_zcopy_put_abort().\n\nThis issue was initially discovered by sashiko while reviewing commit\n1cb36e252211 (\"vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting\")\nbut was pre-existing."
}
],
"providerMetadata": {
"dateUpdated": "2026-07-24T14:33:53.406Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/293fe8f2d1b5ac464ca16a8eba09571bbbb34ba9"
},
{
"url": "https://git.kernel.org/stable/c/76b995bc57bd90cb6e954e1966fbd8786da47f0d"
},
{
"url": "https://git.kernel.org/stable/c/b3155f2b78db21e99256bcf7eb902f24ff6d5338"
},
{
"url": "https://git.kernel.org/stable/c/ae38d9179190a956e2a87a69ef1dd6f451b51c4d"
}
],
"title": "vsock/virtio: fix zerocopy completion for multi-skb sends",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-53365",
"datePublished": "2026-07-13T17:33:52.863Z",
"dateReserved": "2026-06-09T07:44:35.400Z",
"dateUpdated": "2026-08-18T13:29:37.454Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…