{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a796ba4e61d5e14e07b79a359faac69f8f9b22a3",
              "status": "affected",
              "version": "b7063c7426ea5a4d15e01b60538718765392f49d",
              "versionType": "git"
            },
            {
              "lessThan": "b8e274e69ab09222c7a552c7c0c1eef9ce627fc1",
              "status": "affected",
              "version": "0da2e073f9cbf4985a0fd9acb71bc5ff599f8afd",
              "versionType": "git"
            },
            {
              "lessThan": "ddb9239828336b36d8a3ef5943fdffb2f55b6508",
              "status": "affected",
              "version": "89ae9df09d2c1fb4a4eb495c113a7ce1dca34147",
              "versionType": "git"
            },
            {
              "lessThan": "94083db751930b1540ddff2b54d4677549c57f81",
              "status": "affected",
              "version": "14d2eee0193ac3cd1bf3d014373449f0b8d35d6d",
              "versionType": "git"
            },
            {
              "lessThan": "12c36c99655f325befe50c26842f7deca414c381",
              "status": "affected",
              "version": "f580d27e8928828693df44ba2db0fffdbe11dfea",
              "versionType": "git"
            },
            {
              "lessThan": "10f293a07f9e10e988b0ae44e2e99c631f5a68e0",
              "status": "affected",
              "version": "f580d27e8928828693df44ba2db0fffdbe11dfea",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2b2eda2821cff1d1b5a423b6ee7d8fc6fbc8e694",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.178",
              "status": "affected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.96",
              "status": "affected",
              "version": "6.12.94",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.39",
              "status": "affected",
              "version": "6.18.36",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "7.0.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1.176",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.143",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.12.94",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.18.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "7.0.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL\n\nCommit f580d27e8928 (\"ksmbd: fix use-after-free of a deferred file_lock on\ndouble SMB2_CANCEL\") made smb2_cancel() skip a work whose state is\nKSMBD_WORK_CANCELLED, so its cancel_fn cannot be fired a second time. But\nKSMBD_WORK has three states (ACTIVE, CANCELLED, CLOSED), and the same\nfreeing producer path is reached for CLOSED too:\n\n  SMB2_CLOSE on the locking handle -\u003e set_close_state_blocked_works() sets\n  the deferred work\u0027s state to KSMBD_WORK_CLOSED and wakes the smb2_lock()\n  worker. The worker takes the non-ACTIVE early-exit, locks_free_lock()s\n  the file_lock and, because the state is not KSMBD_WORK_CANCELLED, takes\n  the STATUS_RANGE_NOT_LOCKED branch with \"goto out2\" -- which, like the\n  cancelled branch, skips release_async_work(). The work stays on\n  conn-\u003easync_requests with a live cancel_fn = smb2_remove_blocked_lock\n  pointing at the freed file_lock.\n\nA subsequent SMB2_CANCEL for the same AsyncId then passes the\nKSMBD_WORK_CANCELLED-only guard (its state is KSMBD_WORK_CLOSED), so\nsmb2_cancel() fires cancel_fn again over the freed file_lock -- the same\nuse-after-free fixed, via SMB2_CLOSE instead of a first SMB2_CANCEL:\n\n  BUG: KASAN: slab-use-after-free in __locks_delete_block\n    __locks_delete_block\n    locks_delete_block\n    ksmbd_vfs_posix_lock_unblock\n    smb2_remove_blocked_lock\n    smb2_cancel                 \u003c- 2nd SMB2_CANCEL fires cancel_fn\n    handle_ksmbd_work\n  Allocated by ...: locks_alloc_lock \u003c- smb2_lock\n  Freed by ...:     locks_free_lock  \u003c- smb2_lock (non-ACTIVE early-exit)\n  ... cache file_lock_cache of size 192\n\nReproduced on mainline 7.1-rc7 (which already contains f580d27e8928) with\nKASAN by an authenticated SMB client; the double-SMB2_CANCEL control is\nsilent on that kernel, so the splat is attributable to the CLOSE trigger.\n\nOnly an ACTIVE deferred work may have its cancel_fn fired: both terminal\nstates (CANCELLED and CLOSED) reach the smb2_lock() early-exit that frees\nthe file_lock and skips release_async_work(). Guard on KSMBD_WORK_ACTIVE\nso any non-active work is skipped."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - ksmbd processes attacker-supplied SMB2 requests over TCP port 445, so the complete vulnerable path is remotely network-reachable.\nAC:L - The attacker controls the conflicting file handles, deferred LOCK, CLOSE, and CANCEL requests and can pipeline or repeat them to win the cleanup race without relying on victim-controlled conditions.\nPR:L - The sequence is post-authentication: LOCK and CLOSE require a valid SMB session, authorized tree connection, and usable file handle, but only ordinary share-user rights and no administrative capabilities.\nUI:N - No victim action is required because the authenticated SMB client can create the conflicting locks and send the complete triggering sequence.\nS:U - The corruption occurs within the host kernel serving SMB and does not inherently cross a separate virtualization, sandbox, or IOMMU security authority.\nC:H - The stale 192-byte file_lock is dereferenced through attacker-timed slab reuse, including linked-list and waitqueue pointers, making kernel-memory disclosure reasonably exploitable.\nI:H - Operations such as list unlinking and waitqueue handling on the reclaimed object can corrupt kernel pointers and potentially provide arbitrary writes or control-flow hijacking.\nA:H - The confirmed slab use-after-free can cause a kernel oops or panic, and the remote client can repeatedly trigger the sequence."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:38.646Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a796ba4e61d5e14e07b79a359faac69f8f9b22a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8e274e69ab09222c7a552c7c0c1eef9ce627fc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddb9239828336b36d8a3ef5943fdffb2f55b6508"
        },
        {
          "url": "https://git.kernel.org/stable/c/94083db751930b1540ddff2b54d4677549c57f81"
        },
        {
          "url": "https://git.kernel.org/stable/c/12c36c99655f325befe50c26842f7deca414c381"
        },
        {
          "url": "https://git.kernel.org/stable/c/10f293a07f9e10e988b0ae44e2e99c631f5a68e0"
        }
      ],
      "title": "ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64437",
    "datePublished": "2026-07-25T08:51:11.072Z",
    "dateReserved": "2026-07-19T15:36:31.788Z",
    "dateUpdated": "2026-08-17T04:55:38.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "25377f369688dd0bd814dc8965ed26d44238ecaa",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "3072d82461f498c85daea8766e9d8bfbada31605",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "ca53bb17f4e8232cfaece3953d3cef62c559b039",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "deffa929086d7902e30918adf3dd27ccfe9c08b1",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            },
            {
              "lessThan": "3320ba068198adc144c89d6661b805acce01735b",
              "status": "affected",
              "version": "e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: add a permission check for FSCTL_SET_ZERO_DATA\n\nFSCTL_SET_ZERO_DATA in smb2_ioctl() destroys file data via\nksmbd_vfs_zero_data() -\u003e vfs_fallocate(PUNCH_HOLE/ZERO_RANGE) after\nchecking only the share-level KSMBD_TREE_CONN_FLAG_WRITABLE, with no\nper-handle access check. A handle opened with only FILE_WRITE_ATTRIBUTES\nstill yields an FMODE_WRITE filp (FILE_WRITE_ATTRIBUTES is part of\nFILE_WRITE_DESIRE_ACCESS_LE, so smb2_create_open_flags() opens it\nO_WRONLY), so the vfs_fallocate FMODE_WRITE check does not stop it; only\nthe missing fp-\u003edaccess gate would. Reproduced on mainline 7.1-rc7 with\nKASAN by an authenticated SMB client: a FILE_WRITE_ATTRIBUTES-only handle\nzeroed 4096 bytes of file data it had no FILE_WRITE_DATA right to\n(6/6; a FILE_READ_DATA-only handle was correctly denied).\n\nThis is the unfixed sibling of commit cc57232cae23 (\"ksmbd: fix FSCTL\npermission bypass by adding a permission check for FSCTL_SET_SPARSE\").\nBecause SET_ZERO_DATA writes data (not an attribute), require\nFILE_WRITE_DATA."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable ksmbd handler processes SMB2 IOCTL requests received remotely over SMB on TCP port 445.\nAC:L - An attacker can deterministically open a metadata-only handle and submit one or more SET_ZERO_DATA requests with attacker-controlled ranges; no race or uncontrollable condition is required.\nPR:L - The path requires a valid SMB session, access to a writable share, and permission to open the target with FILE_WRITE_ATTRIBUTES, but it does not require administrative privileges.\nUI:N - Exploitation occurs entirely through attacker-generated SMB requests and requires no victim action.\nS:U - The flaw corrupts files managed by the same ksmbd host and does not cross a VM, sandbox, or other security-authority boundary.\nC:N - The operation only zeros or deallocates file ranges; it provides no data-read primitive, information disclosure, or kernel-memory corruption.\nI:H - The attacker can persistently zero arbitrary selected ranges, including an entire file, despite lacking FILE_WRITE_DATA permission; SET_ZERO_DATA is explicitly a file-content modification operation ([Microsoft MS-FSCC](https://learn.microsoft.com/en-us/openspecs/windows_protoco ls/ms-fscc/6be5164f-3eb6-4149-b997-c37df1444779)).\nA:H - Repeatedly erasing critical databases, configurations, firmware images, or application data on an SMB share can cause complete and persistent service or resource unavailability until restoration."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:54.292Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/25377f369688dd0bd814dc8965ed26d44238ecaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/3072d82461f498c85daea8766e9d8bfbada31605"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca53bb17f4e8232cfaece3953d3cef62c559b039"
        },
        {
          "url": "https://git.kernel.org/stable/c/57f2042fd87d7ce8fc3ac8b6c176e554df68b1a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/deffa929086d7902e30918adf3dd27ccfe9c08b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/3320ba068198adc144c89d6661b805acce01735b"
        }
      ],
      "title": "ksmbd: add a permission check for FSCTL_SET_ZERO_DATA",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64398",
    "datePublished": "2026-07-25T08:50:42.221Z",
    "dateReserved": "2026-07-19T15:36:31.785Z",
    "dateUpdated": "2026-08-17T04:54:54.292Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/netfilter/ebtables.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2ade612967e2cdfb9290ebcb773f302c82f311fa",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "42bef500d07b5769d916e9122a3e3fa3fd2245ef",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "fc7f105451044501a50cfd530cfa3b472c54acbc",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9e6c5169db423e51dcc66a73fd15409c0d38e088",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "29bf41a9b59aff9f6197df58641a00037d567ca8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9f74d28e903fa4fdf82f870d0aeadddc8196e41c",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "5ee856e4208acafaaaf7b84824d39b78c21345d6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cbfe53599eebffd188938ab6774cc41794f6f9d5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/netfilter/ebtables.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebtables: zero chainstack array\n\nsashiko reports:\n looking at ebtables table\n translation, could a sparse cpu_possible_mask lead to an uninitialized pointer\n free?\n\n If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible,\n but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at\n CPU 2, the cleanup loop will blindly decrement and call vfree() on\n newinfo-\u003echainstack[1].\n\nNot a real-world bug, such allocation isn\u0027t expected to fail\nin the first place."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable translation path is reached through a local SOL_IP setsockopt(EBT_SO_SET_ENTRIES) call on an IPv4 socket, not through received network traffic.\nAC:H - Exploitation requires a boot-fixed sparse cpu_possible_mask and a per-CPU vmalloc failure after an earlier allocation succeeds. Although memory pressure is attacker-influenceable, these uncommon conditions are not fully attacker-controlled.\nPR:L - The path requires CAP_NET_ADMIN in the socket network namespace, which an unprivileged user can obtain through an owned user and network namespace where unprivileged user namespaces are enabled.\nUI:N - The attacker directly submits the crafted ebtables replacement; no victim action is required.\nS:U - This is ordinary user-namespace-to-kernel privilege escalation within the host security authority, without crossing a VM, hypervisor, or IOMMU boundary.\nC:H - The uninitialized slot can alias a live vmalloc allocation, causing it to be freed and leaving its owner with a groomable use-after-free capable of exposing arbitrary kernel memory.\nI:H - Freeing a live vmalloc-backed kernel object can enable controlled reallocation, arbitrary memory modification, and kernel control-flow hijacking.\nA:H - An invalid vfree can panic kernels configured with panic_on_warn, while freeing a live allocation creates a use-after-free that can crash or panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:12.351Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2ade612967e2cdfb9290ebcb773f302c82f311fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/42bef500d07b5769d916e9122a3e3fa3fd2245ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc7f105451044501a50cfd530cfa3b472c54acbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e6c5169db423e51dcc66a73fd15409c0d38e088"
        },
        {
          "url": "https://git.kernel.org/stable/c/29bf41a9b59aff9f6197df58641a00037d567ca8"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f74d28e903fa4fdf82f870d0aeadddc8196e41c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ee856e4208acafaaaf7b84824d39b78c21345d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/cbfe53599eebffd188938ab6774cc41794f6f9d5"
        }
      ],
      "title": "netfilter: ebtables: zero chainstack array",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64413",
    "datePublished": "2026-07-25T08:50:53.759Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-08-17T04:55:12.351Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/rtl8723bs/core/rtw_wlan_util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "6dd5e8c3011ebabf417257d7f07901a7c4311539",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "9193c34f75fd9e1ea8a590d7cced464c3380dc29",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "bd953d52d587d42365e399b96c52dbdb13032070",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "69f174a0673b6b7a29b851adb60bc450cdc0ecc4",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "b5cc2f999927f69723ca53f1f2a3aa37dbeda907",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "ed51de4a86e173c3b0ef78e039c2e49e08b11f16",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/rtl8723bs/core/rtw_wlan_util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB read in update_beacon_info() IE loop\n\nThe IE parsing loop in update_beacon_info() advances by\n(pIE-\u003elength + 2) each iteration but only guards on i \u003c len.\nWhen a malicious AP sends a Beacon whose last IE has only one byte\nremaining in the frame (the element_id byte lands at len-1), the loop\nreads pIE-\u003elength from one byte past the allocated receive buffer.\n\nAdditionally, even when the header bytes are in bounds, pIE-\u003elength\nitself can extend the data window beyond len, passing a truncated IE\nto the handler functions.\n\nAdd two guards at the top of the loop body:\n  1. Break if fewer than sizeof(*pIE) bytes remain (can\u0027t read header).\n  2. Break if the IE\u0027s declared data extends past len.\n\nAlso replace i += (pIE-\u003elength + 2) with i += sizeof(*pIE) + pIE-\u003elength\nfor consistency with the sizeof(*pIE) guards added above."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - An attacker within WiFi radio range can inject a crafted beacon spoofing the associated AP\u0027s BSSID. WiFi management-frame injection is an adjacent attack vector.\nAC:L - The malformed IE deterministically triggers the faulty parsing, and the attacker can send repeated beacons to satisfy the every-sixteenth-packet processing condition. No race or condition outside attacker control is required.\nPR:N - Ordinary beacon frames are not authenticated, even on WPA-protected networks. The driver checks association state, addresses, and BSSID, all of which an adjacent attacker can spoof without credentials or host privileges.\nUI:N - Once the interface is associated or operating in IBSS mode, crafted beacons are processed without victim action. Continuously connected embedded and mobile deployments provide this state automatically.\nS:U - The vulnerable driver and affected kernel resources belong to the same operating-system security authority. No guest-host, sandbox, or IOMMU boundary is crossed.\nC:H - Truncated WMM or HT elements can make handlers consume roughly 22 to 24 bytes beyond the logical frame from adjacent kernel skb memory. Under conservative treatment of this nontrivial kernel out-of-bounds read, confidentiality impact is High.\nI:N - The flaw performs out-of-bounds reads but provides no out-of-bounds write or control-flow primitive. Handler copies target correctly sized driver state fields.\nA:H - Out-of-bounds accesses in the kernel receive tasklet can produce an oops or panic on hardened or unfavorable memory layouts. An unauthenticated adjacent attacker can repeatedly transmit triggering beacons."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:45.615Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5e8db4cff5b45c7c4edc8ae3f302027c3bb32b25"
        },
        {
          "url": "https://git.kernel.org/stable/c/6dd5e8c3011ebabf417257d7f07901a7c4311539"
        },
        {
          "url": "https://git.kernel.org/stable/c/9193c34f75fd9e1ea8a590d7cced464c3380dc29"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd953d52d587d42365e399b96c52dbdb13032070"
        },
        {
          "url": "https://git.kernel.org/stable/c/69f174a0673b6b7a29b851adb60bc450cdc0ecc4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5cc2f999927f69723ca53f1f2a3aa37dbeda907"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed51de4a86e173c3b0ef78e039c2e49e08b11f16"
        }
      ],
      "title": "staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64443",
    "datePublished": "2026-07-25T08:51:15.234Z",
    "dateReserved": "2026-07-19T15:36:31.788Z",
    "dateUpdated": "2026-08-17T04:55:45.615Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/usbip/vudc.h",
            "drivers/usb/usbip/vudc_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9858c91d9ee6a13c45311569039413729fc9b757",
              "status": "affected",
              "version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
              "versionType": "git"
            },
            {
              "lessThan": "1226293ec9bed3d4cc5b05eeeb811d315ca51652",
              "status": "affected",
              "version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
              "versionType": "git"
            },
            {
              "lessThan": "3750f75f29f99c0223601e2ee73ad084adec47bd",
              "status": "affected",
              "version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
              "versionType": "git"
            },
            {
              "lessThan": "d0ebf9cc7c2ddf95a7cfc654b940bdacb7edde97",
              "status": "affected",
              "version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
              "versionType": "git"
            },
            {
              "lessThan": "0025276175fbbe0dcbf3f84d090b0adee769e9d9",
              "status": "affected",
              "version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
              "versionType": "git"
            },
            {
              "lessThan": "347b59e9f96719d89b6ef555d02a18ada1a5846f",
              "status": "affected",
              "version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
              "versionType": "git"
            },
            {
              "lessThan": "0443e4416aa1ee97748d1ed904eaf3352c60045e",
              "status": "affected",
              "version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
              "versionType": "git"
            },
            {
              "lessThan": "c5371e0b91b24159a3ebaa61e70b0980bcf03c0a",
              "status": "affected",
              "version": "b6a0ca11186759ad7045d68a5447b1e89f658384",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/usbip/vudc.h",
            "drivers/usb/usbip/vudc_dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: vudc: fix NULL deref in vep_dequeue()\n\nvep_alloc_request() wasn\u0027t initializing vrequest-\u003eudc, so cancellations\non the FunctionFS AIO path were arriving in vep_dequeue without a valid\nUDC reference.\n\nSince vrequest-\u003eudc is never actually properly used anywhere, we opt to\nremove it, and update vep_dequeue to obtain a reference to the udc with\nep_to_vudc(), consistent with the other vep_ ops.\n\nAFAICT this bug has existed for ~10 years. Seems that nobody has really\nstressed the FunctionFS AIO path on usbip\u0027s vudc.\n\nI tested this fix in a QEMU aarch64 guest driving FunctionFS endpoints\nvia AIO. Before the fix, running `usbip attach` from the host would\ncause the guest to oops with the following backtrace:\n\nCall trace:\n vep_dequeue+0x1c/0xe4 (P)\n usb_ep_dequeue+0x14/0x20\n ffs_aio_cancel+0x24/0x34\n __arm64_sys_io_cancel+0xb0/0x124\n do_el0_svc+0x68/0x100\n el0_svc+0x18/0x5c\n el0t_64_sync_handler+0x98/0xdc\n el0t_64_sync+0x154/0x158"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:53:33.891Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9858c91d9ee6a13c45311569039413729fc9b757"
        },
        {
          "url": "https://git.kernel.org/stable/c/1226293ec9bed3d4cc5b05eeeb811d315ca51652"
        },
        {
          "url": "https://git.kernel.org/stable/c/3750f75f29f99c0223601e2ee73ad084adec47bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0ebf9cc7c2ddf95a7cfc654b940bdacb7edde97"
        },
        {
          "url": "https://git.kernel.org/stable/c/0025276175fbbe0dcbf3f84d090b0adee769e9d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/347b59e9f96719d89b6ef555d02a18ada1a5846f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0443e4416aa1ee97748d1ed904eaf3352c60045e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5371e0b91b24159a3ebaa61e70b0980bcf03c0a"
        }
      ],
      "title": "usbip: vudc: fix NULL deref in vep_dequeue()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64331",
    "datePublished": "2026-07-25T08:49:58.370Z",
    "dateReserved": "2026-07-19T15:36:31.781Z",
    "dateUpdated": "2026-08-17T04:53:33.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-goodix-spi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad47ad624f2fce0bc44bbadb664242461a97d774",
              "status": "affected",
              "version": "75e16c8ce283bb88e77704dc8fa041c577caac0f",
              "versionType": "git"
            },
            {
              "lessThan": "dae1d000ddfd5c2140b036e47fff0c497ae9c64b",
              "status": "affected",
              "version": "75e16c8ce283bb88e77704dc8fa041c577caac0f",
              "versionType": "git"
            },
            {
              "lessThan": "835fcc8655569737e3f057d42875a96259db74c2",
              "status": "affected",
              "version": "75e16c8ce283bb88e77704dc8fa041c577caac0f",
              "versionType": "git"
            },
            {
              "lessThan": "db0a0768d09273aadadeb76730cd658d720333a4",
              "status": "affected",
              "version": "75e16c8ce283bb88e77704dc8fa041c577caac0f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-goodix-spi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hid-goodix-spi: validate report size to prevent stack buffer overflow\n\ngoodix_hid_set_raw_report() builds a protocol frame in a 128-byte stack\nbuffer (tmp_buf), writing an 11-12 byte header followed by the\ncaller-supplied report data.  The HID core caps report size at\nHID_MAX_BUFFER_SIZE (16384) by default, while the driver does not set\nhid_ll_driver.max_buffer_size and performs no bounds checking before\ncopying the payload:\n\n    memcpy(tmp_buf + tx_len, buf, len);\n\nA hidraw SET_REPORT ioctl with a report larger than ~116 bytes\noverflows the stack buffer.\n\nAdd a size check after constructing the header, rejecting reports that\nwould exceed the buffer capacity.\n\nDiscovered by Atuin - Automated Vulnerability Discovery Engine."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An attacker reaches the flaw locally through a SET_REPORT operation on the Goodix touchscreen\u0027s /dev/hidraw device.\nAC:L - A single attacker-controlled report exceeding the 116-117 byte safe payload limit deterministically triggers the overwrite, with no race or external condition required.\nPR:L - The kernel path has no capability or namespace checks; an unprivileged user granted access to the hidraw node can trigger it.\nUI:N - No victim action is required once the attacker can access the device node.\nS:U - Any privilege escalation or kernel compromise remains within the host kernel\u0027s security authority.\nC:H - The attacker-controlled stack overwrite can corrupt control data and enable kernel code execution, thereby exposing arbitrary kernel memory.\nI:H - The attacker can overwrite far beyond the 128-byte stack buffer with controlled data, potentially hijacking control flow and modifying arbitrary kernel state.\nA:H - The overflow can reliably trigger stack-canary failure, kernel oops, or panic, and can be repeated through additional SET_REPORT requests."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:16.646Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad47ad624f2fce0bc44bbadb664242461a97d774"
        },
        {
          "url": "https://git.kernel.org/stable/c/dae1d000ddfd5c2140b036e47fff0c497ae9c64b"
        },
        {
          "url": "https://git.kernel.org/stable/c/835fcc8655569737e3f057d42875a96259db74c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/db0a0768d09273aadadeb76730cd658d720333a4"
        }
      ],
      "title": "HID: hid-goodix-spi: validate report size to prevent stack buffer overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64367",
    "datePublished": "2026-07-25T08:50:21.214Z",
    "dateReserved": "2026-07-19T15:36:31.783Z",
    "dateUpdated": "2026-08-17T04:54:16.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipset/ip_set_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a7a299277959683204d73333c32c092fd69327d4",
              "status": "affected",
              "version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
              "versionType": "git"
            },
            {
              "lessThan": "1bc67c3fc98e9fc07032cc56afcdbc690c47d11e",
              "status": "affected",
              "version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
              "versionType": "git"
            },
            {
              "lessThan": "e8a9976b61f1bc4aa7fd25fa26726dfdf2adf710",
              "status": "affected",
              "version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
              "versionType": "git"
            },
            {
              "lessThan": "96fbafc20ebd9a613736c2998b89c539fe3042f5",
              "status": "affected",
              "version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
              "versionType": "git"
            },
            {
              "lessThan": "ff86ea9b7fdf70564e60436fbee68c96bc459943",
              "status": "affected",
              "version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
              "versionType": "git"
            },
            {
              "lessThan": "81d54c766337b923eec26da0a13406760b091093",
              "status": "affected",
              "version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
              "versionType": "git"
            },
            {
              "lessThan": "e8ee198bbc04a32d336e79160fde980e0235b39f",
              "status": "affected",
              "version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
              "versionType": "git"
            },
            {
              "lessThan": "7cd9103283b26b917360ec99d7d2f2d761bcf1ab",
              "status": "affected",
              "version": "8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2f6bf7917f55f9dae913193e49672b3598620eab",
              "versionType": "git"
            },
            {
              "lessThan": "4.20",
              "status": "affected",
              "version": "4.19.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipset/ip_set_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.19.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: fix race between dump and ip_set_list resize\n\nThe release path of ip_set_dump_do() and ip_set_dump_done() read\ninst-\u003eip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw()\nof the array pointer. These run from netlink_recvmsg() without the nfnl\nmutex and without an RCU read-side critical section.\n\nA concurrent ip_set_create() can grow the array: it publishes the new\narray, calls synchronize_net() and then kvfree()s the old one. Since the\ndump paths read the array outside any RCU reader, synchronize_net() does\nnot wait for them and the old array can be freed while they still index\ninto it, causing a use-after-free.\n\nThe dumped set itself stays pinned via set-\u003eref_netlink, so only the\narray load needs protecting. Take rcu_read_lock() around it, matching\nip_set_get_byname() and __ip_set_put_byindex().\n\n  BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)\n  Read of size 8 at addr ffff88800b5c4018 by task exploit/150\n  Call Trace:\n   ...\n   kasan_report (mm/kasan/report.c:595)\n   ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)\n   netlink_dump (net/netlink/af_netlink.c:2325)\n   netlink_recvmsg (net/netlink/af_netlink.c:1976)\n   sock_recvmsg (net/socket.c:1159)\n   __sys_recvfrom (net/socket.c:2315)\n   ...\n  Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI\n  KASAN: maybe wild-memory-access in range [0x02d6...d0-0x02d6...d7]\n  RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698)\n  Kernel panic - not syncing: Fatal exception"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable dump and resize paths are reached through local NETLINK_NETFILTER send and receive syscalls, not through remotely received packets.\nAC:L - The attacker controls both sides by issuing an ipset dump and concurrent CREATE requests that grow ip_set_list, and can repeat the race without any victim-controlled condition.\nPR:L - NFNETLINK requires CAP_NET_ADMIN in the network namespace\u0027s owning user namespace, which an unprivileged user can obtain through user and network namespaces on deployments permitting unprivileged user namespaces.\nUI:N - After obtaining local execution, the attacker can trigger both racing operations without any action by another user.\nS:U - Exploitation compromises the kernel of the same host and constitutes standard local privilege escalation rather than crossing a VM, hypervisor, or IOMMU boundary.\nC:H - Reclaiming the freed array can make the loaded struct ip_set pointer attacker-influenced, after which variant-pointer dereferences can enable kernel code execution and arbitrary memory disclosure.\nI:H - The release path performs an indirect uref callback and decrements ref_netlink through the stale pointer, providing control-flow and kernel-memory-write opportunities after heap reclamation.\nA:H - The reported use-after-free produced a general-protection fault and kernel panic, and an attacker can trigger the race repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:49.683Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a7a299277959683204d73333c32c092fd69327d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bc67c3fc98e9fc07032cc56afcdbc690c47d11e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8a9976b61f1bc4aa7fd25fa26726dfdf2adf710"
        },
        {
          "url": "https://git.kernel.org/stable/c/96fbafc20ebd9a613736c2998b89c539fe3042f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ff86ea9b7fdf70564e60436fbee68c96bc459943"
        },
        {
          "url": "https://git.kernel.org/stable/c/81d54c766337b923eec26da0a13406760b091093"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8ee198bbc04a32d336e79160fde980e0235b39f"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cd9103283b26b917360ec99d7d2f2d761bcf1ab"
        }
      ],
      "title": "netfilter: ipset: fix race between dump and ip_set_list resize",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64189",
    "datePublished": "2026-07-20T16:27:47.767Z",
    "dateReserved": "2026-07-19T07:54:57.040Z",
    "dateUpdated": "2026-08-17T04:51:49.683Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/pci/ymfpci/ymfpci_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d7c71dfd4b80f0eacac2c157a8a3a4c6e8b2e0d1",
              "status": "affected",
              "version": "1f6c520932bca5be9e8dec137fccb2fc094a80fe",
              "versionType": "git"
            },
            {
              "lessThan": "91095474eea29b95c9a8bceb9b501a2702b6c55f",
              "status": "affected",
              "version": "c9b83ae4a1609b1914ba7fc70826a3f3a8b234db",
              "versionType": "git"
            },
            {
              "lessThan": "02f33c2062c75e28abc7ad58ce86451cf3140455",
              "status": "affected",
              "version": "c9b83ae4a1609b1914ba7fc70826a3f3a8b234db",
              "versionType": "git"
            },
            {
              "lessThan": "f6538a318947b627710b08a268bc80a48c23bde7",
              "status": "affected",
              "version": "c9b83ae4a1609b1914ba7fc70826a3f3a8b234db",
              "versionType": "git"
            },
            {
              "lessThan": "18ec7d7785be7a4ee8ea11e355122282caad4267",
              "status": "affected",
              "version": "c9b83ae4a1609b1914ba7fc70826a3f3a8b234db",
              "versionType": "git"
            },
            {
              "lessThan": "e64d170346d00b580c0043de3e5ccb3e331c47d4",
              "status": "affected",
              "version": "c9b83ae4a1609b1914ba7fc70826a3f3a8b234db",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cf671d2462d9af50c328bcc185d2c7b9726f8093",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.178",
              "status": "affected",
              "version": "6.1.34",
              "versionType": "semver"
            },
            {
              "lessThan": "6.4",
              "status": "affected",
              "version": "6.3.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/pci/ymfpci/ymfpci_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ymfpci: check snd_ctl_new1() return value\n\nsnd_ctl_new1() can return NULL when memory allocation fails.\nsnd_ymfpci_create_spdif_controls() does not check the return value\nbefore dereferencing kctl-\u003eid.device, which can lead to a NULL pointer\ndereference.\n\nAdd NULL checks after snd_ctl_new1() calls and return -ENOMEM if any\nfails."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:56:37.102Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d7c71dfd4b80f0eacac2c157a8a3a4c6e8b2e0d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/91095474eea29b95c9a8bceb9b501a2702b6c55f"
        },
        {
          "url": "https://git.kernel.org/stable/c/02f33c2062c75e28abc7ad58ce86451cf3140455"
        },
        {
          "url": "https://git.kernel.org/stable/c/f6538a318947b627710b08a268bc80a48c23bde7"
        },
        {
          "url": "https://git.kernel.org/stable/c/18ec7d7785be7a4ee8ea11e355122282caad4267"
        },
        {
          "url": "https://git.kernel.org/stable/c/e64d170346d00b580c0043de3e5ccb3e331c47d4"
        }
      ],
      "title": "ALSA: ymfpci: check snd_ctl_new1() return value",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64489",
    "datePublished": "2026-07-25T08:51:48.161Z",
    "dateReserved": "2026-07-19T15:36:31.792Z",
    "dateUpdated": "2026-08-17T04:56:37.102Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/glob.h",
            "kernel/trace/trace_events_filter.c",
            "lib/glob.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "265f3a690f6c7d69ef7d2ca50b04b4853a211df3",
              "status": "affected",
              "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
              "versionType": "git"
            },
            {
              "lessThan": "ee5b8888d3248618251fb69a2fad92afcb81557e",
              "status": "affected",
              "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
              "versionType": "git"
            },
            {
              "lessThan": "56d4c9ab84714eebb285a2fee68aaedf81e3ef15",
              "status": "affected",
              "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
              "versionType": "git"
            },
            {
              "lessThan": "35ae19764eabfe9c29029d3b5713c86e6855acdf",
              "status": "affected",
              "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
              "versionType": "git"
            },
            {
              "lessThan": "ebb55902856973906c8bb339a3a34824ed4a5086",
              "status": "affected",
              "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
              "versionType": "git"
            },
            {
              "lessThan": "2dad64a97e1df47f5d9ccb17fa319aa348617226",
              "status": "affected",
              "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
              "versionType": "git"
            },
            {
              "lessThan": "e5d5f3bd053a5f14787526c9f0f55ef900d43ac6",
              "status": "affected",
              "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
              "versionType": "git"
            },
            {
              "lessThan": "0a6070839b1ef276d5b05bedfb787743e140fb17",
              "status": "affected",
              "version": "60f1d5e3bac44b598f67d36062da96c095d2b700",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/glob.h",
            "kernel/trace/trace_events_filter.c",
            "lib/glob.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Prevent out-of-bounds read in glob matching\n\nString event fields are not necessarily NUL-terminated, so the filter\npredicate functions (filter_pred_string(), filter_pred_strloc() and\nfilter_pred_strrelloc()) pass the field length to the regex match\ncallbacks, and the length-aware matchers honour it.\n\nregex_match_glob() was the exception: it ignored the length and called\nglob_match(), which scans the string until it hits a NUL byte. Some\nstring fields are not NUL-terminated. One example is the dynamic char\narray of the xfs_* namespace tracepoints, which is copied without a\ntrailing NUL. For such a field, glob matching reads past the end of\nthe event field, causing a KASAN slab-out-of-bounds read in\nglob_match(), reached via regex_match_glob() and filter_match_preds()\nfrom the xfs_lookup tracepoint.\n\nAdd a length-bounded glob_match_len() and use it from regex_match_glob()\nso glob matching always stops at the field boundary. The matching loop\nis factored into a shared helper so glob_match() keeps its behaviour."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker installs a glob filter through tracefs or perf_event_open and triggers it using a local pathname syscall on an affected filesystem such as XFS. Network clients cannot normally install or observe the required tracing filter.\nAC:L - No race or uncontrollable timing is required; the attacker selects a full-glob pattern and triggers a non-NUL-terminated event field repeatedly. Reused per-CPU trace buffers can also be groomed by attacker-controlled events.\nPR:L - Although user namespaces alone cannot bypass tracefs or initial-namespace perf capability checks, ordinary users can install filters when tracefs access is delegated to a tracing group or perf_event_paranoid permits kernel events. These are supported and reasonable deployments requiring only basic user privileges.\nUI:N - The attacker can install the filter and trigger pathname lookups directly without another user\u0027s action.\nS:U - The out-of-bounds read affects the host kernel within the same security authority and does not cross a guest-host, hypervisor, or IOMMU boundary.\nC:H - glob_match() ignores the supplied field length and scans until an incidental NUL, allowing filter results to act as an oracle over adjacent or reused kernel trace-buffer data. The read is not strictly bounded to a few bytes.\nI:N - The vulnerable code only reads memory and changes the Boolean filter result; it provides no out-of-bounds write or other memory-modification primitive.\nA:H - The repeatable unbounded scan can cross the event allocation or page boundary, producing the reported KASAN invalid access and potentially an oops or panic on inaccessible or poisoned memory. Panic-on-warning configurations make total availability loss directly achievable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:57.094Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/265f3a690f6c7d69ef7d2ca50b04b4853a211df3"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee5b8888d3248618251fb69a2fad92afcb81557e"
        },
        {
          "url": "https://git.kernel.org/stable/c/56d4c9ab84714eebb285a2fee68aaedf81e3ef15"
        },
        {
          "url": "https://git.kernel.org/stable/c/35ae19764eabfe9c29029d3b5713c86e6855acdf"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebb55902856973906c8bb339a3a34824ed4a5086"
        },
        {
          "url": "https://git.kernel.org/stable/c/2dad64a97e1df47f5d9ccb17fa319aa348617226"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5d5f3bd053a5f14787526c9f0f55ef900d43ac6"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a6070839b1ef276d5b05bedfb787743e140fb17"
        }
      ],
      "title": "tracing: Prevent out-of-bounds read in glob matching",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64299",
    "datePublished": "2026-07-25T08:49:35.742Z",
    "dateReserved": "2026-07-19T15:36:31.778Z",
    "dateUpdated": "2026-08-17T04:52:57.094Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/misc/ldusb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fc55923a972e715f9a27187b47d4920709e23d85",
              "status": "affected",
              "version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
              "versionType": "git"
            },
            {
              "lessThan": "e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69",
              "status": "affected",
              "version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
              "versionType": "git"
            },
            {
              "lessThan": "af59829e67e11ba2511a9f8e4b9111afc7d1f550",
              "status": "affected",
              "version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
              "versionType": "git"
            },
            {
              "lessThan": "02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4",
              "status": "affected",
              "version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
              "versionType": "git"
            },
            {
              "lessThan": "d8f69404e1d671326f86d378b9f5bfbd56490e9d",
              "status": "affected",
              "version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
              "versionType": "git"
            },
            {
              "lessThan": "2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915",
              "status": "affected",
              "version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
              "versionType": "git"
            },
            {
              "lessThan": "a3e794136ab5e3ad1e7019175a4b837aec86db4b",
              "status": "affected",
              "version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
              "versionType": "git"
            },
            {
              "lessThan": "19bdfc7b3c179331eafa423d87e1336f43bbfeb8",
              "status": "affected",
              "version": "ce0d7d3f575fc1ba6a89c3c651e710355590daff",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/misc/ldusb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.26"
            },
            {
              "lessThan": "2.6.26",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: ldusb: fix use-after-free on disconnect race\n\nmutex_unlock() may access the mutex structure after releasing the lock\nand therefore cannot be used to manage lifetime of objects directly\n(unlike spinlocks and refcounts). [1][2]\n\nUse a kref to release the driver data to avoid use-after-free in\nmutex_unlock() when release() races with disconnect().\n\n[1] a51749ab34d9 (\"locking/mutex: Document that mutex_unlock() is\n                   non-atomic\")\n[2] 2b9d9e0a9ba0 (\"locking/mutex: Clarify that mutex_unlock(), and most\n                   other sleeping locks, can still use the lock object\n                   after it\u0027s unlocked\")"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:53:47.172Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fc55923a972e715f9a27187b47d4920709e23d85"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5a9bdce4bfd3e2226b5f3df5fb8385d6935ee69"
        },
        {
          "url": "https://git.kernel.org/stable/c/af59829e67e11ba2511a9f8e4b9111afc7d1f550"
        },
        {
          "url": "https://git.kernel.org/stable/c/02ca08fff74cf9b0a3c4d2cacde1c6edeeb95bb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8f69404e1d671326f86d378b9f5bfbd56490e9d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2107a4fc8ff1cf1d52f416c1e5cc8e97413a5915"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3e794136ab5e3ad1e7019175a4b837aec86db4b"
        },
        {
          "url": "https://git.kernel.org/stable/c/19bdfc7b3c179331eafa423d87e1336f43bbfeb8"
        }
      ],
      "title": "USB: ldusb: fix use-after-free on disconnect race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64343",
    "datePublished": "2026-07-25T08:50:05.828Z",
    "dateReserved": "2026-07-19T15:36:31.781Z",
    "dateUpdated": "2026-08-17T04:53:47.172Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/bpa10x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1813add71e386f77b3040e6c8dc9b7b3ff965a6c",
              "status": "affected",
              "version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
              "versionType": "git"
            },
            {
              "lessThan": "bd56c23f1f8681a2857ee924a8bd3abf87c8913b",
              "status": "affected",
              "version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
              "versionType": "git"
            },
            {
              "lessThan": "7a64f39ebe1bacd9004a62eceadac0b122ec3cc2",
              "status": "affected",
              "version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
              "versionType": "git"
            },
            {
              "lessThan": "f80b4afe893dffa9fabdbf80fb4d6782b24a6793",
              "status": "affected",
              "version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
              "versionType": "git"
            },
            {
              "lessThan": "4b4008dda1d0c6e598d7865631ad4eda63a560f0",
              "status": "affected",
              "version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
              "versionType": "git"
            },
            {
              "lessThan": "bfc9e7be289df11e8e38c98cd78019d67fdd0bd5",
              "status": "affected",
              "version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
              "versionType": "git"
            },
            {
              "lessThan": "a8e169d308775039200bb9c905c7ce420db6e8c5",
              "status": "affected",
              "version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
              "versionType": "git"
            },
            {
              "lessThan": "dd068ef044128db655f48323a4acfd5907e04903",
              "status": "affected",
              "version": "ddd68ec8f4847b460c9f580076eafe13b031a6fd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bluetooth/bpa10x.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()\n\nbpa10x_setup() sends the vendor command 0xfc0e and passes the response\nto bt_dev_info() and hci_set_fw_info() as a \"%s\" string starting at\nskb-\u003edata + 1, without checking the length:\n\n\tbt_dev_info(hdev, \"%s\", (char *)(skb-\u003edata + 1));\n\thci_set_fw_info(hdev, \"%s\", skb-\u003edata + 1);\n\nA device that returns a one-byte response (status only) leaves\nskb-\u003edata + 1 past the end of the data, and the %s walk reads adjacent\nslab memory until it meets a NUL. The same happens when the payload is\nnot NUL-terminated within skb-\u003elen. The out-of-bounds bytes end up in\nthe kernel log and the firmware-info debugfs file.\n\nPrint the revision string with a bounded \"%.*s\" limited to skb-\u003elen - 1\ninstead. This keeps the string readable for well-behaved devices while\nnever reading past the received data, and does not fail setup, so a\ndevice returning a short or unterminated response keeps working."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:57:26.570Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1813add71e386f77b3040e6c8dc9b7b3ff965a6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd56c23f1f8681a2857ee924a8bd3abf87c8913b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a64f39ebe1bacd9004a62eceadac0b122ec3cc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/f80b4afe893dffa9fabdbf80fb4d6782b24a6793"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b4008dda1d0c6e598d7865631ad4eda63a560f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfc9e7be289df11e8e38c98cd78019d67fdd0bd5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8e169d308775039200bb9c905c7ce420db6e8c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd068ef044128db655f48323a4acfd5907e04903"
        }
      ],
      "title": "Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64549",
    "datePublished": "2026-07-27T20:10:38.894Z",
    "dateReserved": "2026-07-19T15:36:31.795Z",
    "dateUpdated": "2026-08-17T04:57:26.570Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1f9156714592356b4fda57beac7eab9c2a462dd3",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "5630da218a45ba80f0aba0846cbe8aa655da122b",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "1ca605cfa59377f0143fb35b5b01360f37d1b7c4",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "0e4a5a000123d81234e27a2f8187688cf608f755",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "e6aa539720c3d8def69683ed0c07cf9faea4e8be",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "be353caffa8640f5e25fb3714ce8b0cef5e410e5",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "65a1c2551f7e16085acbb54aedde1feaa559ba7a",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            },
            {
              "lessThan": "b5befa80fdbe287a98480effed9564712924add5",
              "status": "affected",
              "version": "c3021629a0d820247ee12b6c5192a1d5380e21c6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.35"
            },
            {
              "lessThan": "2.6.35",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: re-lock request before returning from fuse_ref_folio()\n\nfuse_ref_folio() unlocks the request but does not re-lock it before\nreturning. fuse_chan_abort() can end the request and the async end\ncallback (eg fuse_writepage_free()) can free the args while the\nsubsequent copy chain logic after fuse_ref_folio() accesses them,\nleading to use-after-free issues.\n\nFix this by locking the request in fuse_ref_folio() before returning."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A local attacker reaches the flaw by serving a self-created FUSE mount and invoking splice() on its associated /dev/fuse descriptor.\nAC:L - The attacker controls writeback generation, splice processing, and concurrent connection abort, allowing repeated attempts at the race without an uncontrollable prerequisite.\nPR:L - FUSE supports user-namespace mounts, and an unprivileged mount owner can operate /dev/fuse and abort their own connection without init-namespace root.\nUI:N - The attacker can create and exercise their own FUSE connection without any victim action.\nS:U - Exploitation compromises the kernel within the same operating-system security authority and does not inherently cross a virtualization boundary.\nC:H - The freed argument and folio arrays are subsequently dereferenced, permitting attacker-influenced stale folio pointers and potential arbitrary kernel-memory disclosure through pipe buffers.\nI:H - Heap reclamation can replace the freed folio pointers and loop metadata, enabling attacker-directed memory or refcount operations that may support arbitrary writes and kernel code execution.\nA:H - The repeatable use-after-free and invalid folio operations can cause an oops, panic, or other complete system failure."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:20.108Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1f9156714592356b4fda57beac7eab9c2a462dd3"
        },
        {
          "url": "https://git.kernel.org/stable/c/5630da218a45ba80f0aba0846cbe8aa655da122b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ca605cfa59377f0143fb35b5b01360f37d1b7c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e4a5a000123d81234e27a2f8187688cf608f755"
        },
        {
          "url": "https://git.kernel.org/stable/c/e6aa539720c3d8def69683ed0c07cf9faea4e8be"
        },
        {
          "url": "https://git.kernel.org/stable/c/be353caffa8640f5e25fb3714ce8b0cef5e410e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/65a1c2551f7e16085acbb54aedde1feaa559ba7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5befa80fdbe287a98480effed9564712924add5"
        }
      ],
      "title": "fuse: re-lock request before returning from fuse_ref_folio()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64266",
    "datePublished": "2026-07-25T08:49:15.142Z",
    "dateReserved": "2026-07-19T15:36:31.775Z",
    "dateUpdated": "2026-08-17T04:52:20.108Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/shrinker.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b9a280a9a454ed514636351d53fe2a233dc5054b",
              "status": "affected",
              "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
              "versionType": "git"
            },
            {
              "lessThan": "6465ff3ce65131c774a312d450abe10f4b9f3875",
              "status": "affected",
              "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
              "versionType": "git"
            },
            {
              "lessThan": "284c267f013e45d8c89d9fb9373105dc8e6c0947",
              "status": "affected",
              "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
              "versionType": "git"
            },
            {
              "lessThan": "65476d31d8056e859c48580f82295ce159196ffe",
              "status": "affected",
              "version": "307bececcd1205bcb67a3c0d53a69db237ccc9d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/shrinker.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: shrinker: fix shrinker_info teardown race with expansion\n\nexpand_shrinker_info() iterates all visible memcgs under shrinker_mutex,\nincluding memcgs that have not finished -\u003ecss_online() yet.\n\nOnce pn-\u003eshrinker_info has been published, teardown must stay serialized\nwith expand_shrinker_info() until that memcg is either fully online or no\nlonger visible to iteration.  Today alloc_shrinker_info() breaks that rule\nby dropping shrinker_mutex before freeing a partially initialized\nshrinker_info array, which may cause the following race:\n\nCPU0                   CPU1\n====                   ====\n\ncss_create\n--\u003e list_add_tail_rcu(\u0026css-\u003esibling, \u0026parent_css-\u003echildren);\n    online_css\n    --\u003e mem_cgroup_css_online\n        --\u003e alloc_shrinker_info\n            --\u003e alloc node0 info\n                rcu_assign_pointer(C-\u003enode0-\u003eshrinker_info, old0)\n                alloc node1 info -\u003e FAIL -\u003e goto err\n                mutex_unlock(shrinker_mutex)\n\n                       shrinker_alloc()\n                       --\u003e shrinker_memcg_alloc\n                           --\u003e mutex_lock(shrinker_mutex)\n                               expand_shrinker_info\n                               --\u003e mem_cgroup_iter see the memcg\n                                   expand_one_shrinker_info\n                                   --\u003e old0 = C-\u003enode0-\u003eshrinker_info\n                                       memcpy(new-\u003eunit, old0-\u003eunit, ...);\n\n                free_shrinker_info\n                --\u003e kvfree(old0);\n\n                                       /* double free !! */\n                                       kvfree_rcu(old0, rcu);\n\nThe same problem exists later in mem_cgroup_css_online().  If\nalloc_shrinker_info() succeeds but a subsequent objcg allocation fails,\nthe free_objcg -\u003e free_shrinker_info() unwind path tears down the already\npublished pn-\u003eshrinker_info arrays without shrinker_mutex.  The\nexpand_one_shrinker_info() can race with that teardown in the same way,\nleading to use-after-free or double-free of the old shrinker_info.\n\nFix this by serializing shrinker_info teardown with shrinker_mutex, and by\nkeeping alloc_shrinker_info() error cleanup inside the locked section."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reachable through local cgroup mkdir operations raced against memcg-aware shrinker allocation, such as mounting new tmpfs instances.\nAC:L - An attacker can repeatedly create cgroups, induce allocation pressure, and concurrently allocate shrinkers, controlling both sides of the race and widening it through repetition.\nPR:L - An unprivileged user with a delegated cgroup v2 subtree can create memory cgroups, while user namespaces provide the capability needed to mount user-namespace-enabled filesystems.\nUI:N - Exploitation requires no action by another user once the attacker can execute the concurrent local operations.\nS:U - The corruption occurs within the kernel and represents ordinary local privilege escalation within the same security authority.\nC:H - The use-after-free and delayed double-free permit heap reuse and manipulation of dangling shrinker unit pointers, potentially enabling arbitrary kernel-memory disclosure.\nI:H - The dangling pointers, atomic operations on freed units, and double-free can provide arbitrary kernel-memory corruption and control-flow hijacking.\nA:H - The use-after-free or double-free can directly cause a kernel oops, panic, or other system-wide failure."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:17.788Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b9a280a9a454ed514636351d53fe2a233dc5054b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6465ff3ce65131c774a312d450abe10f4b9f3875"
        },
        {
          "url": "https://git.kernel.org/stable/c/284c267f013e45d8c89d9fb9373105dc8e6c0947"
        },
        {
          "url": "https://git.kernel.org/stable/c/65476d31d8056e859c48580f82295ce159196ffe"
        }
      ],
      "title": "mm: shrinker: fix shrinker_info teardown race with expansion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64418",
    "datePublished": "2026-07-25T08:50:57.594Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-08-17T04:55:17.788Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f6f2241034f189c69d4d0b5f8fe24a0c25b0c14",
              "status": "affected",
              "version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
              "versionType": "git"
            },
            {
              "lessThan": "ee2216dbdf0c677e89bb43e03247dba590ed00ef",
              "status": "affected",
              "version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
              "versionType": "git"
            },
            {
              "lessThan": "f511807feee7cb29b61bdfa86472c7e9e2e5df94",
              "status": "affected",
              "version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
              "versionType": "git"
            },
            {
              "lessThan": "08c600b7e1818539ba5efee4cdb06215c245ca78",
              "status": "affected",
              "version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
              "versionType": "git"
            },
            {
              "lessThan": "b84e002e0df26bbc6cbd3ca01b8212601fe0ae7d",
              "status": "affected",
              "version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
              "versionType": "git"
            },
            {
              "lessThan": "c6c484a7d5bff6b929a86d7ed5130f29834c6a0d",
              "status": "affected",
              "version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
              "versionType": "git"
            },
            {
              "lessThan": "f80add1bfb3425100a325b14f19648e75669a954",
              "status": "affected",
              "version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
              "versionType": "git"
            },
            {
              "lessThan": "e3d9c7160d483fc8f9e225aafad8ecbbc43f3151",
              "status": "affected",
              "version": "e2f8fbfb8d09c06decde162090fac3ee220aa280",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/cifsacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: mask server-provided mode to 07777 in modefromsid\n\nWhen modefromsid is active, parse_dacl() applies the server-provided\nsub_auth[2] value from the NFS mode SID to cf_mode without masking to\n07777. Apply the correct masking, same as in the read path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious or compromised SMB server can supply the crafted NFS mode SID through a network-delivered QUERY_INFO security descriptor.\nAC:L - With modefromsid enabled, the server directly controls sub_auth[2], and the invalid inode-type bits are applied deterministically without a race or memory-layout dependency.\nPR:N - The attacker acting as the SMB server needs no privileges on the client; client authentication to the share is a victim-side condition rather than an attacker privilege.\nUI:R - A victim administrator or service must mount the SMB share with modefromsid, or subsequently access a crafted object on an existing mount.\nS:U - The corrupted mode and resulting VFS behavior remain within the Linux kernel\u0027s existing security authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:N - The flaw only injects bits into the 16-bit mode field and provides no out-of-bounds read, memory disclosure, or direct mechanism for returning client data to the attacker.\nI:L - The attacker can alter S_IFMT bits in cf_mode and thereby change the inode\u0027s perceived type and selected VFS operations, but this is a constrained metadata modification rather than an arbitrary write or control-flow primitive.\nA:H - Forging the root or widespread inode types can prevent the share from mounting or render its objects unusable; for CIFS-root or critical SMB-backed deployments this can cause complete service availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:30.613Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f6f2241034f189c69d4d0b5f8fe24a0c25b0c14"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee2216dbdf0c677e89bb43e03247dba590ed00ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/f511807feee7cb29b61bdfa86472c7e9e2e5df94"
        },
        {
          "url": "https://git.kernel.org/stable/c/08c600b7e1818539ba5efee4cdb06215c245ca78"
        },
        {
          "url": "https://git.kernel.org/stable/c/b84e002e0df26bbc6cbd3ca01b8212601fe0ae7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6c484a7d5bff6b929a86d7ed5130f29834c6a0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f80add1bfb3425100a325b14f19648e75669a954"
        },
        {
          "url": "https://git.kernel.org/stable/c/e3d9c7160d483fc8f9e225aafad8ecbbc43f3151"
        }
      ],
      "title": "smb: client: mask server-provided mode to 07777 in modefromsid",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64379",
    "datePublished": "2026-07-25T08:50:29.717Z",
    "dateReserved": "2026-07-19T15:36:31.784Z",
    "dateUpdated": "2026-08-17T04:54:30.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "100fb7c455fa86d248b8bd7bb9de757c192870b4",
              "status": "affected",
              "version": "433042a91f9373241307725b52de573933ffedbf",
              "versionType": "git"
            },
            {
              "lessThan": "3c81dda84799f76b42aec598564316e2964440db",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "f1add4acb656f5a82806a1ab0e63fed3d8b1bfca",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "89234773e8348918111aa15f6922b58cf3843364",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "2a88561d66eb855813cf004a0abe648bbb17de5e",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix query_info() replay double-free\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_query_info_init() fails before the next send,\ncleanup retains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious or compromised SMB2/3 server can remotely return a response-bearing replayable error and manipulate the subsequent connection state, reaching the vulnerable client over TCP.\nAC:L - The server controls the error response, disconnect, and reconnection sequence and can repeat it until the stale free occurs. Replay-enabled hard or retrans-configured SMB mounts are a reasonable deployment.\nPR:N - The malicious SMB peer needs no privileges or credentials on the client; SMB session setup authenticates the client to the server, not the attacker to the victim kernel.\nUI:N - Once the share is mounted, ordinary or automated file and metadata operations issue query-info requests, and exploitation requires no human action during the crafted response and reconnect sequence.\nS:U - The corruption and resulting impacts occur within the same Linux kernel security authority, without crossing a VM, sandbox, or IOMMU boundary.\nC:H - The double-free corrupts SMB response-buffer slab and mempool state, enabling aliased or use-after-free buffers that can be leveraged to expose kernel memory.\nI:H - Allocator freelist corruption and reuse of one buffer by concurrent SMB operations can provide attacker-controlled modification of live kernel memory and support control-flow hijacking.\nA:H - The repeated free can immediately cause allocator corruption, a BUG, kernel oops, or panic, and the malicious server can trigger the sequence repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:38.353Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/100fb7c455fa86d248b8bd7bb9de757c192870b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c81dda84799f76b42aec598564316e2964440db"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1add4acb656f5a82806a1ab0e63fed3d8b1bfca"
        },
        {
          "url": "https://git.kernel.org/stable/c/89234773e8348918111aa15f6922b58cf3843364"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a88561d66eb855813cf004a0abe648bbb17de5e"
        }
      ],
      "title": "smb: client: fix query_info() replay double-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64386",
    "datePublished": "2026-07-25T08:50:34.729Z",
    "dateReserved": "2026-07-19T15:36:31.784Z",
    "dateUpdated": "2026-08-17T04:54:38.353Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/bnep/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "390b5db3ff8745187f094c4e915663b7b1f98944",
              "status": "affected",
              "version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
              "versionType": "git"
            },
            {
              "lessThan": "46a88784c4c9b96954dd86f747ce93f65efa1302",
              "status": "affected",
              "version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
              "versionType": "git"
            },
            {
              "lessThan": "551ae773ec64045b4e72099132654887e0270bcc",
              "status": "affected",
              "version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
              "versionType": "git"
            },
            {
              "lessThan": "ae215c5b6422d8eda443b861b124bd1be6969c31",
              "status": "affected",
              "version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
              "versionType": "git"
            },
            {
              "lessThan": "df22adc7eafc22e651561813c11dc51a796b12ee",
              "status": "affected",
              "version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
              "versionType": "git"
            },
            {
              "lessThan": "a6b22dbd80926556290ad2243be25218d6956a19",
              "status": "affected",
              "version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
              "versionType": "git"
            },
            {
              "lessThan": "563a8573047182f550b1e1e030615755cd8c41da",
              "status": "affected",
              "version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
              "versionType": "git"
            },
            {
              "lessThan": "bb067a99a0356196c0b89a95721985485ebce5a5",
              "status": "affected",
              "version": "65f53e9802dbfae0e5758a91793c3f5f8bece49b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/bnep/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: bnep: pin L2CAP connection during netdev registration\n\nbnep_add_connection() reads the L2CAP connection without holding the\nchannel lock, then passes its HCI device to register_netdev(). Controller\nteardown can clear and release that connection concurrently, leaving the\nnetwork device registration path to dereference a freed parent device.\n\nTake a reference to the L2CAP connection while holding the channel lock.\nRetain it until register_netdev() has taken the parent device reference."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - An adjacent Bluetooth peer can initiate a BNEP/PAN connection that causes privileged bluetoothd to issue BNEPCONNADD, then tear down the ACL link during netdev registration. Exploitation therefore requires Bluetooth radio adjacency.\nAC:L - The peer controls both the connection setup that triggers the ioctl and the competing disconnect, and can repeat attempts until the lifetime window is hit. No condition beyond the attacker\u0027s practical control is required.\nPR:N - The adjacent peer needs no Linux credentials or capabilities because root bluetoothd performs the CAP_NET_ADMIN ioctl on its behalf in an enabled, auto-authorized PAN deployment. The direct ioctl requires CAP_NET_ADMIN in the initial user namespace, but the adjacent path does not.\nUI:N - An enabled PAN service can automatically accept or pre-authorize connections, after which setup and teardown require no victim action. Prior service configuration is not user interaction during exploitation.\nS:U - The memory corruption occurs in the host kernel and compromises resources governed by that same kernel security authority. It does not cross a VM, IOMMU, or comparable security boundary.\nC:H - The stale parent points into a freed hci_conn allocation, and reclaiming that use-after-free object can enable disclosure of arbitrary kernel memory. Confidentiality impact is therefore High.\nI:H - device_add() calls get_device() on the freed parent, producing a refcount write into reclaimed memory and potentially further device-list corruption. The use-after-free can support arbitrary kernel-memory corruption or control-flow hijacking.\nA:H - The use-after-free can cause a kernel oops, panic, or corrupted device hierarchy during netdev registration. An adjacent peer can repeatedly initiate and terminate connections to crash the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:06.785Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/390b5db3ff8745187f094c4e915663b7b1f98944"
        },
        {
          "url": "https://git.kernel.org/stable/c/46a88784c4c9b96954dd86f747ce93f65efa1302"
        },
        {
          "url": "https://git.kernel.org/stable/c/551ae773ec64045b4e72099132654887e0270bcc"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae215c5b6422d8eda443b861b124bd1be6969c31"
        },
        {
          "url": "https://git.kernel.org/stable/c/df22adc7eafc22e651561813c11dc51a796b12ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6b22dbd80926556290ad2243be25218d6956a19"
        },
        {
          "url": "https://git.kernel.org/stable/c/563a8573047182f550b1e1e030615755cd8c41da"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb067a99a0356196c0b89a95721985485ebce5a5"
        }
      ],
      "title": "Bluetooth: bnep: pin L2CAP connection during netdev registration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64408",
    "datePublished": "2026-07-25T08:50:49.807Z",
    "dateReserved": "2026-07-19T15:36:31.786Z",
    "dateUpdated": "2026-08-17T04:55:06.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpio-eic-sprd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "96612bf2712cd961dbd9b52f3a9b4ab668f57628",
              "status": "affected",
              "version": "25518e024e3a6e5715d672f1daa91e1d100f7436",
              "versionType": "git"
            },
            {
              "lessThan": "581ac2ad001ff1128931191f249a7f2074672b7a",
              "status": "affected",
              "version": "25518e024e3a6e5715d672f1daa91e1d100f7436",
              "versionType": "git"
            },
            {
              "lessThan": "e244cd8b51001ba480f274c44dba9002813a4739",
              "status": "affected",
              "version": "25518e024e3a6e5715d672f1daa91e1d100f7436",
              "versionType": "git"
            },
            {
              "lessThan": "19d63fd528719ce7d06d9aeb88d25b7d6478198a",
              "status": "affected",
              "version": "25518e024e3a6e5715d672f1daa91e1d100f7436",
              "versionType": "git"
            },
            {
              "lessThan": "6112fba4150039ccd90e29f2d1b788c73ad7b3dd",
              "status": "affected",
              "version": "25518e024e3a6e5715d672f1daa91e1d100f7436",
              "versionType": "git"
            },
            {
              "lessThan": "4750909a40da9016185e0ac991510a278cecb1e7",
              "status": "affected",
              "version": "25518e024e3a6e5715d672f1daa91e1d100f7436",
              "versionType": "git"
            },
            {
              "lessThan": "5c3c9ec1172a4c3384b8b800b3a8896cc2c1b20e",
              "status": "affected",
              "version": "25518e024e3a6e5715d672f1daa91e1d100f7436",
              "versionType": "git"
            },
            {
              "lessThan": "90f0109019e6817eb40a486671b7722d1544ae29",
              "status": "affected",
              "version": "25518e024e3a6e5715d672f1daa91e1d100f7436",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpio-eic-sprd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: eic-sprd: use raw_spinlock_t in the irq startup path\n\nsprd_eic_irq_unmask() enables the GPIO IRQ and then updates controller\nstate through sprd_eic_update(), which takes sprd_eic-\u003elock with\nspin_lock_irqsave().  The callback can be reached from irq_startup()\nwhile setting up a requested IRQ.  That path is not sleepable, but on\nPREEMPT_RT a regular spinlock_t becomes a sleeping lock.\n\nThis issue was found by our static analysis tool and then manually\nreviewed against the current tree.\n\nThe grounded PoC kept the request_threaded_irq() -\u003e __setup_irq() -\u003e\nirq_startup() -\u003e sprd_eic_irq_unmask() -\u003e sprd_eic_update() carrier and\nused the original spin_lock_irqsave(\u0026sprd_eic-\u003elock) edge.  Lockdep\n\n  BUG: sleeping function called from invalid context\n  hardirqs last disabled at ... __setup_irq.constprop.0 ... [vuln_msv]\n  sprd_rt_spin_lock_irqsave+0x1c/0x30 [vuln_msv]\n  sprd_eic_update.constprop.0+0x48/0x90 [vuln_msv]\n  sprd_eic_irq_unmask.constprop.0+0x35/0x50 [vuln_msv]\n  __setup_irq.constprop.0+0xd/0x30 [vuln_msv]\n\nConvert the Spreadtrum EIC controller lock to raw_spinlock_t.  The\nlocked section only serializes MMIO register updates and does not contain\nsleepable operations, so keeping it non-sleeping is appropriate for the\nirqchip callbacks."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:29.849Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/96612bf2712cd961dbd9b52f3a9b4ab668f57628"
        },
        {
          "url": "https://git.kernel.org/stable/c/581ac2ad001ff1128931191f249a7f2074672b7a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e244cd8b51001ba480f274c44dba9002813a4739"
        },
        {
          "url": "https://git.kernel.org/stable/c/19d63fd528719ce7d06d9aeb88d25b7d6478198a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6112fba4150039ccd90e29f2d1b788c73ad7b3dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/4750909a40da9016185e0ac991510a278cecb1e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c3c9ec1172a4c3384b8b800b3a8896cc2c1b20e"
        },
        {
          "url": "https://git.kernel.org/stable/c/90f0109019e6817eb40a486671b7722d1544ae29"
        }
      ],
      "title": "gpio: eic-sprd: use raw_spinlock_t in the irq startup path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64429",
    "datePublished": "2026-07-25T08:51:06.016Z",
    "dateReserved": "2026-07-19T15:36:31.787Z",
    "dateUpdated": "2026-08-17T04:55:29.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/mips/kernel/smp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f8a1ef884013dc99f712d3eb75624c7cd3fd94f6",
              "status": "affected",
              "version": "2dc79362302922cb18f35e262712b5e58de65442",
              "versionType": "git"
            },
            {
              "lessThan": "e1919d026706544cb6e7251ec06e908edd6f34ee",
              "status": "affected",
              "version": "eef4f71b46a9929ac33e968538c9dd5d96a02460",
              "versionType": "git"
            },
            {
              "lessThan": "6eda71977ee11c222f8ad4cae4d18d50448e56f4",
              "status": "affected",
              "version": "684a78183c54c23e70d1cba320f7fc184604210b",
              "versionType": "git"
            },
            {
              "lessThan": "f9b57a0015c241274651f4b36627f56b1b5a8651",
              "status": "affected",
              "version": "18c0456ea2615b1a743a6db739c74411c3b42bc6",
              "versionType": "git"
            },
            {
              "lessThan": "9fef09df42df55ab819b285ea892e0fc1b95a9c4",
              "status": "affected",
              "version": "91840be8f710370607f949a627e070896faeddb8",
              "versionType": "git"
            },
            {
              "lessThan": "9f3f3bdc6d9dac1a5a8262ee7ad0f2ff1527a7e7",
              "status": "affected",
              "version": "91840be8f710370607f949a627e070896faeddb8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "81b582784518196eff1050212a046bc29d3a05dd",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.178",
              "status": "affected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.95",
              "status": "affected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.38",
              "status": "affected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThan": "7.1",
              "status": "affected",
              "version": "7.0.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/mips/kernel/smp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1.175",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.142",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "6.12.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "6.18.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "7.0.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nMIPS: smp: report dying CPU to RCU in stop_this_cpu()\n\nsmp_send_stop() parks all secondary CPUs in stop_this_cpu(). The function\nmarks the CPU offline for the scheduler via set_cpu_online(false) but\nnever informs RCU, so RCU keeps expecting a quiescent state from CPUs\nthat are now spinning forever with interrupts disabled.\n\nAs long as nothing waits for an RCU grace period after smp_send_stop()\nthis is harmless, which is why it went unnoticed. Since commit\n91840be8f710 (\"irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT\")\nhowever, irq_work_sync() calls synchronize_rcu() on architectures without\nan irq_work self-IPI, i.e. where arch_irq_work_has_interrupt() returns\nfalse. That is the asm-generic default used by MIPS. Any irq_work_sync()\nissued in the reboot/shutdown path after smp_send_stop() then blocks on\na grace period that can never complete, hanging the reboot:\n\n  WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on\n  ...\n  rcu: INFO: rcu_sched detected stalls on CPUs/tasks:\n  rcu: Offline CPU 1 blocking current GP.\n  rcu: Offline CPU 2 blocking current GP.\n  rcu: Offline CPU 3 blocking current GP.\n\nThis issue was noticed on several Realtek MIPS switch SoCs (MIPS\ninterAptiv) and came up during kernel bump downstream in OpenWrt from\n6.18.33 to 6.18.34, after the backport of the patch to the 6.18 stable\nbranch. The patch also has been backported all the way back to 6.1.\n\nCall rcutree_report_cpu_dead() once interrupts are disabled, mirroring the\ngeneric CPU-hotplug offline path, so RCU stops waiting on the parked CPUs\nand grace periods can still complete. MIPS shuts down all CPUs here\nwithout going through the CPU-hotplug mechanism, so this report is not\notherwise issued. Reporting a dying CPU to RCU outside the regular hotplug\noffline path is not unprecedented: arm64 does the same in cpu_die_early().\nThere it is an exception for a CPU that was coming online and is aborting\nbringup, rather than the default shutdown action as on MIPS."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:59.618Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f8a1ef884013dc99f712d3eb75624c7cd3fd94f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1919d026706544cb6e7251ec06e908edd6f34ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/6eda71977ee11c222f8ad4cae4d18d50448e56f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9b57a0015c241274651f4b36627f56b1b5a8651"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fef09df42df55ab819b285ea892e0fc1b95a9c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f3f3bdc6d9dac1a5a8262ee7ad0f2ff1527a7e7"
        }
      ],
      "title": "MIPS: smp: report dying CPU to RCU in stop_this_cpu()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64248",
    "datePublished": "2026-07-24T15:31:15.892Z",
    "dateReserved": "2026-07-19T15:36:31.772Z",
    "dateUpdated": "2026-08-17T04:51:59.618Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1f96f8c0a6ed4f6d01d3dd29ad0cbf08dde96082",
              "status": "affected",
              "version": "7a4408c6bd3eb1dafba67986259191be081e3efb",
              "versionType": "git"
            },
            {
              "lessThan": "df1a17abba8d6fac5f965adcb8113ceace6e4949",
              "status": "affected",
              "version": "7a4408c6bd3eb1dafba67986259191be081e3efb",
              "versionType": "git"
            },
            {
              "lessThan": "38e1a71728e5795b670cc159c18e286a40aeebb4",
              "status": "affected",
              "version": "7a4408c6bd3eb1dafba67986259191be081e3efb",
              "versionType": "git"
            },
            {
              "lessThan": "faa070c7ad8ba25dcd0b12d7cdbb419e336f5391",
              "status": "affected",
              "version": "7a4408c6bd3eb1dafba67986259191be081e3efb",
              "versionType": "git"
            },
            {
              "lessThan": "e63032dc715026a96bcaa13d375a8e15c91caa84",
              "status": "affected",
              "version": "7a4408c6bd3eb1dafba67986259191be081e3efb",
              "versionType": "git"
            },
            {
              "lessThan": "ea02df466df60ecd758eb3b4df3f0cadc5c886ce",
              "status": "affected",
              "version": "7a4408c6bd3eb1dafba67986259191be081e3efb",
              "versionType": "git"
            },
            {
              "lessThan": "ef5439ba5b9ac93349f5df12ef88b42a0ce26340",
              "status": "affected",
              "version": "7a4408c6bd3eb1dafba67986259191be081e3efb",
              "versionType": "git"
            },
            {
              "lessThan": "114a116aaa5f0295376cdf12da743c5bce3b20ce",
              "status": "affected",
              "version": "7a4408c6bd3eb1dafba67986259191be081e3efb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/android/binder.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix UAF in binder_thread_release()\n\nWhen a thread exits, binder_thread_release() walks its transaction stack\nto clear the t-\u003efrom and t-\u003eto_proc that correspond with the exiting\nthread. However, a process dying in parallel might attempt to kfree some\nof these transactions. And if one of them has no associated t-\u003eto_proc,\nthe t-\u003eto_proc-\u003einner_lock will not be acquired.\n\nThis means that transaction accesses in binder_thread_release() after\nt-\u003eto_proc has been cleared might race with binder_free_transaction()\nand cause a use-after-free error as reported by KASAN:\n\n  ==================================================================\n  BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798\n  Write of size 8 at addr ffff000016627500 by task X/715\n\n  CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT\n  Hardware name: linux,dummy-virt (DT)\n  Call trace:\n   binder_thread_release+0x5d0/0x798\n   binder_ioctl+0x12c0/0x299c\n   [...]\n\n  Allocated by task 717 on cpu 18 at 67.267803s:\n   __kasan_kmalloc+0xa0/0xbc\n   __kmalloc_cache_noprof+0x174/0x444\n   binder_transaction+0x554/0x8150\n   binder_thread_write+0xa30/0x4354\n   binder_ioctl+0x20f0/0x299c\n   [...]\n\n  Freed by task 202 on cpu 18 at 90.416221s:\n   __kasan_slab_free+0x58/0x80\n   kfree+0x1a0/0x4a4\n   binder_free_transaction+0x150/0x294\n   binder_send_failed_reply+0x398/0x6d8\n   binder_release_work+0x3e4/0x4ec\n   binder_deferred_func+0xbd8/0x104c\n   [...]\n  ==================================================================\n\nIn order to avoid this, make sure that binder_free_transaction() reads\nthe t-\u003eto_proc under the transaction lock. This will serialize the\ntransaction release with the accesses in binder_thread_release(). Plus,\nit matches the documented locking rules for @to_proc."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation is reached through local Binder device ioctls, including BINDER_WRITE_READ and BINDER_THREAD_EXIT, rather than network input.\nAC:L - The attacker can control the communicating processes, nested synchronous transactions, thread exit, and concurrent target-process death, allowing repeated attempts at the race.\nPR:L - No capability check protects the vulnerable ioctls; ordinary Android applications can access Binder, and unprivileged user-namespace root can create private Binder devices through BinderFS.\nUI:N - The attacker directly creates the transaction stack and triggers both teardown paths without requiring any victim action.\nS:U - Exploitation compromises the kernel hosting the vulnerable Binder subsystem and constitutes standard local privilege escalation within the same security authority.\nC:H - The freed binder_transaction can be reclaimed with attacker-influenced contents, enabling kernel-memory access primitives and ultimately disclosure of arbitrary kernel or process memory.\nI:H - binder_thread_release() continues writing through the freed transaction, including pointer fields and the attacker-influenceable t-\u003ebuffer path, permitting kernel-memory corruption and potential arbitrary write or code execution.\nA:H - The UAF can directly cause a kernel oops or panic and can be triggered repeatedly by an unprivileged local attacker."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:56:14.927Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1f96f8c0a6ed4f6d01d3dd29ad0cbf08dde96082"
        },
        {
          "url": "https://git.kernel.org/stable/c/df1a17abba8d6fac5f965adcb8113ceace6e4949"
        },
        {
          "url": "https://git.kernel.org/stable/c/38e1a71728e5795b670cc159c18e286a40aeebb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/faa070c7ad8ba25dcd0b12d7cdbb419e336f5391"
        },
        {
          "url": "https://git.kernel.org/stable/c/e63032dc715026a96bcaa13d375a8e15c91caa84"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea02df466df60ecd758eb3b4df3f0cadc5c886ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef5439ba5b9ac93349f5df12ef88b42a0ce26340"
        },
        {
          "url": "https://git.kernel.org/stable/c/114a116aaa5f0295376cdf12da743c5bce3b20ce"
        }
      ],
      "title": "binder: fix UAF in binder_thread_release()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64469",
    "datePublished": "2026-07-25T08:51:34.025Z",
    "dateReserved": "2026-07-19T15:36:31.790Z",
    "dateUpdated": "2026-08-17T04:56:14.927Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/bluetooth/l2cap.h",
            "net/bluetooth/6lowpan.c",
            "net/bluetooth/l2cap_core.c",
            "net/bluetooth/l2cap_sock.c",
            "net/bluetooth/smp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b39298044e5534612511a2ff5de03ba5f6e7a820",
              "status": "affected",
              "version": "8ffb929098a56939ac71509302eeab5b207bf262",
              "versionType": "git"
            },
            {
              "lessThan": "8c37e4338c801ebb8cee52436c01c41e009f6e87",
              "status": "affected",
              "version": "8ffb929098a56939ac71509302eeab5b207bf262",
              "versionType": "git"
            },
            {
              "lessThan": "84e718b6a814edc84159361f9f454a4e92ae91ae",
              "status": "affected",
              "version": "8ffb929098a56939ac71509302eeab5b207bf262",
              "versionType": "git"
            },
            {
              "lessThan": "36da806f7fbaee56ad9e81859deec203f9728700",
              "status": "affected",
              "version": "8ffb929098a56939ac71509302eeab5b207bf262",
              "versionType": "git"
            },
            {
              "lessThan": "733e76e74e406c1d1ddc7369420dd8a47f48bb8a",
              "status": "affected",
              "version": "8ffb929098a56939ac71509302eeab5b207bf262",
              "versionType": "git"
            },
            {
              "lessThan": "6fef032af0092ed5ccb767239a9ac1bc38c08a40",
              "status": "affected",
              "version": "8ffb929098a56939ac71509302eeab5b207bf262",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/bluetooth/l2cap.h",
            "net/bluetooth/6lowpan.c",
            "net/bluetooth/l2cap_core.c",
            "net/bluetooth/l2cap_sock.c",
            "net/bluetooth/smp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\n\nl2cap_sock_new_connection_cb() returned l2cap_pi(sk)-\u003echan after\nrelease_sock(parent). Once the parent lock is dropped the newly\nenqueued child socket sk is reachable via the accept queue, so another\ntask can accept and free it before the callback dereferences sk,\nresulting in a use-after-free.\n\nRework the -\u003enew_connection() op so the core, rather than the callback,\nowns the child channel\u0027s lifetime. The op now receives a pre-allocated\nnew_chan and returns an errno instead of allocating and returning a\nchannel. l2cap_new_connection() allocates the child channel and links\nit into the conn list via __l2cap_chan_add() before invoking the\ncallback, so the conn-list reference keeps the channel alive once\nrelease_sock(parent) exposes the socket to other tasks.\n\nChannel configuration that was duplicated in l2cap_sock_init() and the\nvarious new_connection callbacks is consolidated into\nl2cap_chan_set_defaults(), which now inherits from the parent channel\nwhen one is supplied."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The vulnerable callback is reached only from L2CAP signalling handlers (`l2cap_connect`, `l2cap_le_connect_req`, `l2cap_ecred_conn_req`, `l2cap_connect_cfm`) processing connection requests received from a remote Bluetooth peer. Bluetooth radio range constitutes an adjacent network.\nAC:L - The attacker drives one side of the race by sending unlimited L2CAP connect requests and can induce the other side, since the local daemon accepts (immediately, for DEFER_SETUP listeners) and closes rejected/unauthorized children; on SMP the accepting task runs truly concurrently while the callback is still inside `release_sock()`, so the window is hit reliably with repeated attempts.\nPR:N - `l2cap_connect()` bypasses the link-mode and encryption-key-size checks entirely for PSM 0x0001 (SDP), where bluetoothd holds a listening L2CAP socket, so an unpaired and unauthenticated remote device can reach `l2cap_sock_new_connection_cb()`; LE CoC and low-security BR/EDR listeners are likewise reachable without credentials.\nUI:N - Incoming L2CAP connection requests are processed automatically by the kernel and accepted by the always-running Bluetooth daemon with no victim action, no pairing prompt, and no user confirmation.\nS:U - The corrupted `l2cap_chan`/`sock` objects and the resulting memory corruption are confined to the kernel\u0027s own security authority, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - This is a use-after-free: the freed `l2cap_chan` slab object can be reallocated with attacker-groomed data and its fields are subsequently read back and transmitted to the attacker via the connect response and `l2cap_build_conf_req()`, and `__l2cap_chan_add()` deposits kernel list pointers into the reallocated object, giving a kernel-memory disclosure primitive.\nI:H - After the free, `l2cap_connect()`/`l2cap_le_connect_req()` write attacker-supplied PSM, SCID, MTU/MPS and BD_ADDR values plus list pointers into the freed object, and `__set_chan_timer()` arms delayed work whose function pointers live in that freed memory \u2014 a controlled write primitive suitable for heap spraying and control-flow hijack.\nA:H - Even without successful exploitation, the use-after-free reads and writes into freed slab memory and links a dead object into the conn list, reliably producing kernel oops/panic and corrupted list traversal on subsequent L2CAP operations."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:57:35.594Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b39298044e5534612511a2ff5de03ba5f6e7a820"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c37e4338c801ebb8cee52436c01c41e009f6e87"
        },
        {
          "url": "https://git.kernel.org/stable/c/84e718b6a814edc84159361f9f454a4e92ae91ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/36da806f7fbaee56ad9e81859deec203f9728700"
        },
        {
          "url": "https://git.kernel.org/stable/c/733e76e74e406c1d1ddc7369420dd8a47f48bb8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fef032af0092ed5ccb767239a9ac1bc38c08a40"
        }
      ],
      "title": "Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64557",
    "datePublished": "2026-07-29T08:01:47.462Z",
    "dateReserved": "2026-07-19T15:36:31.796Z",
    "dateUpdated": "2026-08-17T04:57:35.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fbcon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cb016bcb40c81e7b19c4ae6143babb366dae8e20",
              "status": "affected",
              "version": "868749a7456dc48e93887a8474194e2ee6d6c21f",
              "versionType": "git"
            },
            {
              "lessThan": "ac562193c36696513ae196171892e9338475c4bc",
              "status": "affected",
              "version": "ebd6f886aa2447fcfcdce5450c9e1028e1d681bb",
              "versionType": "git"
            },
            {
              "lessThan": "3618a4c5b2591cfa83efe74f5b18c2d02b35c3f5",
              "status": "affected",
              "version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
              "versionType": "git"
            },
            {
              "lessThan": "a7a526fbc847f07ad3a503c7382189be5ab68574",
              "status": "affected",
              "version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
              "versionType": "git"
            },
            {
              "lessThan": "b5bb2c696e140c399cb874def2feedf61dee27d6",
              "status": "affected",
              "version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
              "versionType": "git"
            },
            {
              "lessThan": "076b1aa65f77a49bce5a48a4a55a397cfcafa2b8",
              "status": "affected",
              "version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
              "versionType": "git"
            },
            {
              "lessThan": "39815715cbcfabb16fc8c5f4a23deeda20f5df62",
              "status": "affected",
              "version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
              "versionType": "git"
            },
            {
              "lessThan": "8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2",
              "status": "affected",
              "version": "a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f08ccb792d3eaf1dc62d8cbf6a30d6522329f660",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.261",
              "status": "affected",
              "version": "5.10.249",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.212",
              "status": "affected",
              "version": "5.15.64",
              "versionType": "semver"
            },
            {
              "lessThan": "5.20",
              "status": "affected",
              "version": "5.19.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/video/fbdev/core/fbcon.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.10.249",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15.64",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.19.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()\n\nWhen fbcon_do_set_font() fails (e.g., due to a memory allocation failure\ninside vc_resize() under heavy memory pressure), it jumps to the `err_out`\nlabel to roll back the console state. However, the current rollback logic\nforgets to restore the `hi_font` state, leading to a severe state machine\ncorruption.\n\nEarlier in the function, `set_vc_hi_font()` might be called to change\n`vc-\u003evc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`\nsubsequently fails, the `err_out` path restores `vc_font.charcount`\nbut entirely skips rolling back the `vc_hi_font_mask` and the screen\nbuffer.\n\nThis mismatch leaves the terminal in a desynchronized state. Because\n`vc_hi_font_mask` remains set, the VT subsystem will still accept\ncharacter indices greater than 255 from userspace and write them to the\nscreen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will\nthen use these inflated indices to access the reverted, 256-character\nfont array, leading to a deterministic out-of-bounds read and potential\nkernel memory disclosure.\n\nFix this by adding the missing rollback logic for the `hi_font` mask\nand screen buffer in the error path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through the KDFONTOP ioctl on a framebuffer-console virtual terminal (/dev/ttyN), which is a local syscall path with no network or physical-access vector.\nAC:L - An attacker who controls a session on an fbcon-backed VT can reliably trigger the bug by issuing a font-change ioctl with different dimensions and a 256\u2194512 glyph transition, then inducing vc_resize() failure through self-controlled memory pressure; no race or victim-dependent timing is required.\nPR:L - KDFONTOP font-set operations require only that the caller owns the controlling TTY (current-\u003esignal-\u003etty == tty), which any unprivileged local user with a console or VT session has; CAP_SYS_TTY_CONFIG is not required on that path.\nUI:N - Exploitation requires only the attacker\u0027s own ioctl and memory-pressure actions on their TTY; no action by another user or administrator is needed.\nS:U - Impact is confined to kernel memory disclosure and potential kernel crash within the same kernel security authority; there is no VM escape, sandbox escape, or cross-security-boundary effect.\nC:H - The desynchronized hi_font_mask causes deterministic out-of-bounds reads from the kernel font glyph buffer during fbcon rendering (e.g., bit_cursor and rotated putcs paths), enabling disclosure of adjacent kernel memory.\nI:N - The flaw is an out-of-bounds read with console state desynchronization; it does not provide an arbitrary kernel write, code execution, or other data-modification primitive.\nA:H - Out-of-bounds reads from kernel font data can cause kernel page faults and oopses, consistent with the prior syzkaller-reported fbcon font/resize failure class that produced unhandled page faults."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:55.659Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cb016bcb40c81e7b19c4ae6143babb366dae8e20"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac562193c36696513ae196171892e9338475c4bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/3618a4c5b2591cfa83efe74f5b18c2d02b35c3f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7a526fbc847f07ad3a503c7382189be5ab68574"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5bb2c696e140c399cb874def2feedf61dee27d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/076b1aa65f77a49bce5a48a4a55a397cfcafa2b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/39815715cbcfabb16fc8c5f4a23deeda20f5df62"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2"
        }
      ],
      "title": "fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53402",
    "datePublished": "2026-07-19T12:02:01.795Z",
    "dateReserved": "2026-06-09T07:44:35.403Z",
    "dateUpdated": "2026-08-17T04:50:55.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/nfit/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ee82078e776ae31266cc70fdf62ac17c3c6f100a",
              "status": "affected",
              "version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
              "versionType": "git"
            },
            {
              "lessThan": "6ff054cc02a763914773b026cacb429e5fbf64fa",
              "status": "affected",
              "version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
              "versionType": "git"
            },
            {
              "lessThan": "b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4",
              "status": "affected",
              "version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
              "versionType": "git"
            },
            {
              "lessThan": "c127dbd832bd4b9aef8a749d9f491b74042f9b47",
              "status": "affected",
              "version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
              "versionType": "git"
            },
            {
              "lessThan": "df7c92216a1583a76cb0cbf2f21cd68870609b05",
              "status": "affected",
              "version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
              "versionType": "git"
            },
            {
              "lessThan": "3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa",
              "status": "affected",
              "version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
              "versionType": "git"
            },
            {
              "lessThan": "7d69235bdc581a4346e9bcd6a8bea37d3e1abd25",
              "status": "affected",
              "version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
              "versionType": "git"
            },
            {
              "lessThan": "38bf27511ef41bffebd157ec3eba41fc89ba59cd",
              "status": "affected",
              "version": "a61fe6f7902ecaa89d5e6c709490fc4324927134",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/acpi/nfit/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: NFIT: core: Fix acpi_nfit_init() error cleanup\n\nIf acpi_nfit_init() fails after adding the acpi_desc object to the\nacpi_descs list, that object is never removed from that list because\nthe acpi_nfit_shutdown() devm action is not added for the NFIT device\nin that case.  Next, the acpi_nfit_init() failure causes\nacpi_nfit_probe() to fail, the acpi_desc object is freed, and a\ndangling pointer is left behind in the acpi_descs.  Any subsequent\nACPI Machine Check Exception will trigger nfit_handle_mce() which\niterates over acpi_descs and so a use-after-free will occur.\n\nMoreover, if acpi_nfit_probe() returns 0 after installing a notify\nhandler for the NFIT device and without allocating the acpi_desc\nobject and setting the NFIT device\u0027s driver data pointer, the\nacpi_desc object will be allocated by acpi_nfit_update_notify()\nand acpi_nfit_init() will be called to initialize it.  Regardless\nof whether or not acpi_nfit_init() fails in that case, the\nacpi_nfit_shutdown() devm action is not added for the NFIT device\nand acpi_desc is never removed from the acpi_descs list.  If the\nacpi_desc object is freed subsequently on driver removal, any\nsubsequent ACPI MCE will lead to a use-after-free like in the\nprevious case.\n\nTo address the first issue mentioned above, make acpi_nfit_probe()\ncall acpi_nfit_shutdown() directly on acpi_nfit_init() failures and\nto address the other one, add a remove callback to the driver and\nmake it call acpi_nfit_shutdown().  Also, since it is now possible to\npass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it\nmay not have been initialized, add checks against NULL for acpi_desc and\nits nvdimm_bus field to that function and make acpi_nfit_unregister()\nclear the latter after unregistering the NVDIMM bus."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - No network, wireless, or user-namespace interface reaches this path; the highest reasonable attack path is a local process triggering a qualifying MCE through an accessible poisoned memory mapping.\nAC:H - Exploitation requires a descriptor already made stale by NFIT initialization failure or late initialization followed by removal, plus a usable-address uncorrectable MCE. An unprivileged attacker cannot reliably create all these firmware and hardware conditions.\nPR:L - Once the stale state and poisoned mapping exist, a basic local account can trigger the MCE and spray reclaimed heap memory without capabilities. Deterministic driver removal or software MCE injection is root-only, but is unnecessary in this higher-severity plausible scenario.\nUI:N - No action by another user is required after the vulnerable system state exists; the attacker can access the relevant memory directly.\nS:U - The UAF compromises the same host kernel and does not inherently cross a VM, IOMMU, or other security-authority boundary.\nC:H - The freed descriptor and its subordinate SPA objects contain attacker-reclaimable pointers and linked lists, permitting controlled kernel-memory dereferences and potential arbitrary disclosure.\nI:H - Locking the freed embedded mutex already writes to reclaimed memory, while controlled bus, region, and list pointers can provide stronger write primitives and potential kernel code execution.\nA:H - The dangling descriptor is traversed during MCE processing and can cause an invalid mutex operation, invalid pointer dereference, deadlock, oops, or kernel panic, as established by the [published record](https://nvd.nist.gov/vuln/detail/CVE-2026-64510)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:57:01.009Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ee82078e776ae31266cc70fdf62ac17c3c6f100a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ff054cc02a763914773b026cacb429e5fbf64fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/b07d22a2d17ad6465c87bd5752bc70e4c16e0ee4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c127dbd832bd4b9aef8a749d9f491b74042f9b47"
        },
        {
          "url": "https://git.kernel.org/stable/c/df7c92216a1583a76cb0cbf2f21cd68870609b05"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b2628f7682aea8d9ce09ad4b9a3bd144b451eaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d69235bdc581a4346e9bcd6a8bea37d3e1abd25"
        },
        {
          "url": "https://git.kernel.org/stable/c/38bf27511ef41bffebd157ec3eba41fc89ba59cd"
        }
      ],
      "title": "ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64510",
    "datePublished": "2026-07-25T08:52:03.208Z",
    "dateReserved": "2026-07-19T15:36:31.793Z",
    "dateUpdated": "2026-08-17T04:57:01.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/fs.h",
            "mm/filemap.c",
            "mm/madvise.c",
            "mm/mincore.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7368bec565bac3e536cd43579dbde1e715e6ba61",
              "status": "affected",
              "version": "9caccd41541a6f7d6279928d9f971f6642c361af",
              "versionType": "git"
            },
            {
              "lessThan": "b2f3d94ea310bea9d36d53e9d9b3f45e86c1d893",
              "status": "affected",
              "version": "9caccd41541a6f7d6279928d9f971f6642c361af",
              "versionType": "git"
            },
            {
              "lessThan": "744b23aa430d52f5c8e4dbff7d71496d6643bed2",
              "status": "affected",
              "version": "9caccd41541a6f7d6279928d9f971f6642c361af",
              "versionType": "git"
            },
            {
              "lessThan": "8344bdf0629457e532797b42d9d2bbf2a2900bbf",
              "status": "affected",
              "version": "9caccd41541a6f7d6279928d9f971f6642c361af",
              "versionType": "git"
            },
            {
              "lessThan": "5c942ad7df75925ee166e7f0fb36892d8dde376b",
              "status": "affected",
              "version": "9caccd41541a6f7d6279928d9f971f6642c361af",
              "versionType": "git"
            },
            {
              "lessThan": "04ba248d02d9eaa3d9077b00a6134caa75fa3e90",
              "status": "affected",
              "version": "9caccd41541a6f7d6279928d9f971f6642c361af",
              "versionType": "git"
            },
            {
              "lessThan": "e187bc02f8fa4226d62814592cf064ee4557c470",
              "status": "affected",
              "version": "9caccd41541a6f7d6279928d9f971f6642c361af",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/fs.h",
            "mm/filemap.c",
            "mm/madvise.c",
            "mm/mincore.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: do file ownership checks with the proper mount idmap\n\nEver since idmapped mounts were introduced, inode ownership checks (for\nside-channel protection) in mincore() and madvise(MADV_PAGEOUT) were done\nagainst the nop_mnt_idmap, which completely ignores the file\u0027s mount\u0027s\nidmap.  This results in odd edgecases like:\n\n1) mount/bind-mount with an idmap userA:userB:1\n2) userB runs an owner_or_capable() check on file that is owned by userA\non-disk/in-memory, but owned by userB after idmap translation\n3) owner_or_capable() mysteriously fails as the correct idmap wasn\u0027t supplied\n\nIn the case of mincore/madvise MADV_PAGEOUT, this is usually benign,\nbecause file_permission(file, MAY_WRITE) will probably succeed, as it uses\nthe proper idmap internally, but it does not need to be the case on e.g a\n0444 file where even the owner itself doesn\u0027t have permissions to write to\nit.\n\nSince this is clearly not trivial to get right, introduce a\nfile_owner_or_capable() that can carry the correct semantics, and switch\nthe various users in mm to it.\n\nThe issue was found by manual code inspection \u0026 an off-list discussion\nwith Jan Kara."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:40.258Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7368bec565bac3e536cd43579dbde1e715e6ba61"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2f3d94ea310bea9d36d53e9d9b3f45e86c1d893"
        },
        {
          "url": "https://git.kernel.org/stable/c/744b23aa430d52f5c8e4dbff7d71496d6643bed2"
        },
        {
          "url": "https://git.kernel.org/stable/c/8344bdf0629457e532797b42d9d2bbf2a2900bbf"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c942ad7df75925ee166e7f0fb36892d8dde376b"
        },
        {
          "url": "https://git.kernel.org/stable/c/04ba248d02d9eaa3d9077b00a6134caa75fa3e90"
        },
        {
          "url": "https://git.kernel.org/stable/c/e187bc02f8fa4226d62814592cf064ee4557c470"
        }
      ],
      "title": "mm: do file ownership checks with the proper mount idmap",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64294",
    "datePublished": "2026-07-25T08:49:32.570Z",
    "dateReserved": "2026-07-19T15:36:31.778Z",
    "dateUpdated": "2026-08-23T12:45:40.258Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/6lowpan/nhc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9c2f5c0829a8c8b904dae36be6d8056b719ac605",
              "status": "affected",
              "version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
              "versionType": "git"
            },
            {
              "lessThan": "80b5c8779acee0550845394fb3e5176a398aa24c",
              "status": "affected",
              "version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
              "versionType": "git"
            },
            {
              "lessThan": "cc27aea4d454abfb385ee2c9499c78b96db9b728",
              "status": "affected",
              "version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
              "versionType": "git"
            },
            {
              "lessThan": "a8e3a94711134e898c6021a6b77374efa91b3639",
              "status": "affected",
              "version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
              "versionType": "git"
            },
            {
              "lessThan": "593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168",
              "status": "affected",
              "version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
              "versionType": "git"
            },
            {
              "lessThan": "0beccbcf50de125be5520d0ffc59af4bb8655482",
              "status": "affected",
              "version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
              "versionType": "git"
            },
            {
              "lessThan": "b713aa0cc344f10f7a9928a230b5f5e780d04078",
              "status": "affected",
              "version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
              "versionType": "git"
            },
            {
              "lessThan": "1720db928e5a58ca7d75ac1d514c3b73fd7061a7",
              "status": "affected",
              "version": "92aa7c65d295f3cbb96904afe335f683e55584b8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/6lowpan/nhc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.1"
            },
            {
              "lessThan": "4.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\n6lowpan: fix NHC entry use-after-free on error path\n\nlowpan_nhc_do_uncompression() looks up an NHC descriptor while holding\nlowpan_nhc_lock.  If the descriptor has no uncompress callback, the error\npath drops the lock before printing nhc-\u003ename.\n\nlowpan_nhc_del() removes descriptors under the same lock and then relies\non synchronize_net() before the owning module can be unloaded.  That only\nwaits for net RX RCU readers.  lowpan_header_decompress() is also exported\nand can be reached from callers that are not necessarily covered by the net\ncore RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive\npath.\n\nThis leaves a race where one task drops lowpan_nhc_lock in the error path,\nanother task unregisters and frees the matching descriptor after\nsynchronize_net() returns, and the first task then dereferences nhc-\u003ename\nfor the warning.\n\nWith the post-unlock window widened, KASAN reports:\n\n  BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220\n  Read of size 8\n  lowpan_nhc_do_uncompression\n  lowpan_header_decompress\n\nFix this by printing the warning before dropping lowpan_nhc_lock, so the\ndescriptor name is read while unregister is still excluded.  The malformed\npacket is still rejected with -ENOTSUPP."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - An adjacent Bluetooth LE peer can deliver a crafted IPHC/NHC frame through the unauthenticated L2CAP IPSP receive path to the vulnerable decompressor.\nAC:H - Exploitation requires the matching loadable NHC descriptor to be unregistered and freed during the tiny post-unlock window, and the adjacent attacker cannot independently force that module-unload side of the race.\nPR:N - The Bluetooth packet-processing path requires no attacker privileges or authenticated pairing because the IPSP channel uses BT_SECURITY_LOW; CAP_SYS_MODULE belongs to the victim-side unload actor.\nUI:R - Successful triggering requires a victim administrator or module-management action to unload the matching NHC module while the malicious packet is being processed.\nS:U - The vulnerability compromises the affected host kernel without crossing a separate virtualization, IOMMU, or security-authority boundary.\nC:H - The freed descriptor\u0027s name pointer is dereferenced as a string, so reused contents can cause an unbounded kernel-memory read and disclosure through the kernel log.\nI:H - As a kernel-space use-after-free, freed-object replacement is conservatively treated as potentially enabling memory-corruption or control-flow compromise.\nA:H - Dereferencing an invalid freed descriptor or string pointer can produce a kernel oops or panic and render the system unavailable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:56.222Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9c2f5c0829a8c8b904dae36be6d8056b719ac605"
        },
        {
          "url": "https://git.kernel.org/stable/c/80b5c8779acee0550845394fb3e5176a398aa24c"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc27aea4d454abfb385ee2c9499c78b96db9b728"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8e3a94711134e898c6021a6b77374efa91b3639"
        },
        {
          "url": "https://git.kernel.org/stable/c/593b78bb3c7ef0c6e9ae6fdf5afa80a5f7573168"
        },
        {
          "url": "https://git.kernel.org/stable/c/0beccbcf50de125be5520d0ffc59af4bb8655482"
        },
        {
          "url": "https://git.kernel.org/stable/c/b713aa0cc344f10f7a9928a230b5f5e780d04078"
        },
        {
          "url": "https://git.kernel.org/stable/c/1720db928e5a58ca7d75ac1d514c3b73fd7061a7"
        }
      ],
      "title": "6lowpan: fix NHC entry use-after-free on error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64452",
    "datePublished": "2026-07-25T08:51:21.754Z",
    "dateReserved": "2026-07-19T15:36:31.788Z",
    "dateUpdated": "2026-08-17T04:55:56.222Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7fe895e0a9651518c4fc082487da770ff9c14c7f",
              "status": "affected",
              "version": "18d6b32fca3841f7cd9479b4024abd8a9b299281",
              "versionType": "git"
            },
            {
              "lessThan": "0de6ebbabfbbc9c28350283dc97d8a519d5c6dd7",
              "status": "affected",
              "version": "18d6b32fca3841f7cd9479b4024abd8a9b299281",
              "versionType": "git"
            },
            {
              "lessThan": "cb19e54ebe9baf3c3243083ade65c937339ccb7b",
              "status": "affected",
              "version": "18d6b32fca3841f7cd9479b4024abd8a9b299281",
              "versionType": "git"
            },
            {
              "lessThan": "d5631081be07f20e764d3cb5c98ac0a1004fba51",
              "status": "affected",
              "version": "18d6b32fca3841f7cd9479b4024abd8a9b299281",
              "versionType": "git"
            },
            {
              "lessThan": "c36393b0d14e1e9783888f821ffe29381b8f46dc",
              "status": "affected",
              "version": "18d6b32fca3841f7cd9479b4024abd8a9b299281",
              "versionType": "git"
            },
            {
              "lessThan": "69faa3779250df14f51d5084f938a99809546e52",
              "status": "affected",
              "version": "18d6b32fca3841f7cd9479b4024abd8a9b299281",
              "versionType": "git"
            },
            {
              "lessThan": "ba1867999dbc4085e6d8c52ac5266005b8b2bf07",
              "status": "affected",
              "version": "18d6b32fca3841f7cd9479b4024abd8a9b299281",
              "versionType": "git"
            },
            {
              "lessThan": "3137b243c93982fe3460335e12f9247739766e10",
              "status": "affected",
              "version": "18d6b32fca3841f7cd9479b4024abd8a9b299281",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_fs: initialize reset_work at allocation time\n\nffs_fs_kill_sb() unconditionally calls cancel_work_sync() on\nffs-\u003ereset_work when a functionfs instance is unmounted:\n\n\tffs_data_reset(ffs);\n\tcancel_work_sync(\u0026ffs-\u003ereset_work);\n\nHowever ffs-\u003ereset_work is only ever initialized via INIT_WORK() in\nffs_func_set_alt() and ffs_func_disable(), and only on the\nFFS_DEACTIVATED path. That state is reached solely by ffs_data_closed()\nwhen the instance is mounted with the \"no_disconnect\" option, so for the\ncommon case (no \"no_disconnect\", or mounted and unmounted without ever\nbeing deactivated) reset_work is never initialized.\n\nffs_data_new() allocates the ffs_data with kzalloc_obj() and does not\ninitialize reset_work, and ffs_data_reset()/ffs_data_clear() do not touch\nit either, so reset_work.func is left NULL. cancel_work_sync() on such a\nwork then trips the WARN_ON(!work-\u003efunc) guard in __flush_work():\n\n  WARNING: kernel/workqueue.c:4301 at __flush_work+0x330/0x360, CPU#3: umount\n  Call trace:\n   __flush_work\n   cancel_work_sync\n   ffs_fs_kill_sb [usb_f_fs]\n   deactivate_locked_super\n   deactivate_super\n   cleanup_mnt\n   __cleanup_mnt\n   task_work_run\n   exit_to_user_mode_loop\n   el0_svc\n\nOn older kernels cancel_work_sync() on a zero-initialized work struct was\na silent no-op, which hid the missing initialization.\n\nInitialize reset_work once in ffs_data_new() so it is always valid for\nthe lifetime of the ffs_data, and drop the now-redundant INIT_WORK()\ncalls from the two deactivation paths."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:58:16.410Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7fe895e0a9651518c4fc082487da770ff9c14c7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0de6ebbabfbbc9c28350283dc97d8a519d5c6dd7"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb19e54ebe9baf3c3243083ade65c937339ccb7b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5631081be07f20e764d3cb5c98ac0a1004fba51"
        },
        {
          "url": "https://git.kernel.org/stable/c/c36393b0d14e1e9783888f821ffe29381b8f46dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/69faa3779250df14f51d5084f938a99809546e52"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba1867999dbc4085e6d8c52ac5266005b8b2bf07"
        },
        {
          "url": "https://git.kernel.org/stable/c/3137b243c93982fe3460335e12f9247739766e10"
        }
      ],
      "title": "usb: gadget: f_fs: initialize reset_work at allocation time",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64594",
    "datePublished": "2026-08-06T07:13:50.309Z",
    "dateReserved": "2026-07-19T15:36:31.799Z",
    "dateUpdated": "2026-08-17T04:58:16.410Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3409aedf3c81a810243da94164f6621c9d205c98",
              "status": "affected",
              "version": "433042a91f9373241307725b52de573933ffedbf",
              "versionType": "git"
            },
            {
              "lessThan": "1665f25b1dea30bf2d02e16245d203a944c9d994",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "00b0fa425941438b664950a8ee65dfba2def4336",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "3317a5d015fca976475aa71df224056777316fde",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "9647492b5e41954be59d5157eddbcd4cdc1656f7",
              "status": "affected",
              "version": "4f1fffa2376922f3d1d506e49c0fd445b023a28e",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.32",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/client/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix query directory replay double-free\n\nA response-bearing attempt can return a replayable error and free its\nresponse buffer. If SMB2_query_directory_init() fails before the next send,\ncleanup retains the previous buffer type and frees that response again.\n\nReset response bookkeeping before each attempt to prevent the stale free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious remote SMB server can trigger the flaw through crafted responses to SMB2 QUERY_DIRECTORY requests over the established network connection.\nAC:L - On a hard/retrans-enabled mount, the server controls the replayable error and can repeatedly induce disconnect/reconnect conditions before request reinitialization, without relying on an uncontrollable race.\nPR:N - The attacker needs no account or privilege on the client; the client authenticates to the attacker-controlled SMB server, and ordinary accessible-share enumeration reaches the code.\nUI:N - In a reasonable auto-mounted deployment, routine directory enumeration can be performed automatically by a daemon or application without human participation.\nS:U - The corruption occurs within the client kernel and compromises resources governed by that same kernel security authority.\nC:H - Double-freeing the attacker-influenced CIFS response object can poison the slab freelist or create overlapping allocations, providing UAF-style primitives capable of exposing arbitrary kernel memory.\nI:H - Allocator corruption and aliased CIFS buffers can enable attacker-influenced writes and potentially control-flow hijacking or kernel code execution.\nA:H - The double-free can immediately trigger allocator diagnostics, an oops, or a kernel panic, and corrupted freelists can cause subsequent fatal faults."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:39.446Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3409aedf3c81a810243da94164f6621c9d205c98"
        },
        {
          "url": "https://git.kernel.org/stable/c/1665f25b1dea30bf2d02e16245d203a944c9d994"
        },
        {
          "url": "https://git.kernel.org/stable/c/00b0fa425941438b664950a8ee65dfba2def4336"
        },
        {
          "url": "https://git.kernel.org/stable/c/3317a5d015fca976475aa71df224056777316fde"
        },
        {
          "url": "https://git.kernel.org/stable/c/9647492b5e41954be59d5157eddbcd4cdc1656f7"
        }
      ],
      "title": "smb: client: fix query directory replay double-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64387",
    "datePublished": "2026-07-25T08:50:35.543Z",
    "dateReserved": "2026-07-19T15:36:31.784Z",
    "dateUpdated": "2026-08-17T04:54:39.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/vmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c15ff206ba78820bf2873d0c668a882e99f4b631",
              "status": "affected",
              "version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
              "versionType": "git"
            },
            {
              "lessThan": "687ccdf582169cd680aeaf24cc953807c4cd4345",
              "status": "affected",
              "version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
              "versionType": "git"
            },
            {
              "lessThan": "12f2341b4c235d5593a433abac201c1c6725787f",
              "status": "affected",
              "version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
              "versionType": "git"
            },
            {
              "lessThan": "ec05f51f1e65bce95528543eb73fda56fd201d94",
              "status": "affected",
              "version": "7679ba6b36dbb300b757b672d6a32a606499e14b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/vmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: take vmap_purge_lock in shrinker\n\ndecay_va_pool_node() can be invoked concurrently from two paths:\n__purge_vmap_area_lazy() when pools are being purged, and the shrinker via\nvmap_node_shrink_scan().\n\nHowever, decay_va_pool_node() is not safe to run concurrently, and the\nshrinker path currently lacks serialization, leading to races and possible\nleaks.\n\nProtect decay_va_pool_node() by taking vmap_purge_lock in the shrinker\npath to ensure serialization with purge users."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable race is in core MM internals (vmap pool decay) reached only via local memory-management activity \u2014 inducing vmalloc/vfree churn (purge path) and memory pressure (shrinker path). No network-delivered data reaches the vulnerable function.\nAC:L - An unprivileged attacker controls both sides: one thread forces direct reclaim (shrinker\u2192decay) while another drives vmalloc/vfree churn past the lazy-free threshold (purge\u2192decay), and both can loop indefinitely to repeatedly attempt and win the narrow race.\nPR:L - Any unprivileged local process can allocate/free memory and induce reclaim; no capabilities or root are required to drive either racing path.\nUI:N - The race is triggered entirely by the attacker\u0027s own memory activity; no victim action is needed.\nS:U - The corruption stays within the kernel\u0027s own memory-management structures and does not cross into another security authority (no VM/IOMMU boundary escape).\nC:H - The data race corrupts the vmap pool linked list and free-area tree metadata; per kernel guidance, allocator memory corruption can be leveraged to read freed/adjacent kernel memory.\nI:H - Concurrent unserialized list_replace_init plus double-merge of vmap_area objects into the global free tree corrupts kernel free-list/tree state, a write/corruption primitive over allocator metadata.\nA:H - Corrupted lists and inconsistent len accounting (and the documented leaks) cause kernel crashes/oops and resource exhaustion when the corrupted pool is subsequently traversed or reused."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:29:35.424Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c15ff206ba78820bf2873d0c668a882e99f4b631"
        },
        {
          "url": "https://git.kernel.org/stable/c/687ccdf582169cd680aeaf24cc953807c4cd4345"
        },
        {
          "url": "https://git.kernel.org/stable/c/12f2341b4c235d5593a433abac201c1c6725787f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec05f51f1e65bce95528543eb73fda56fd201d94"
        }
      ],
      "title": "mm/vmalloc: take vmap_purge_lock in shrinker",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46093",
    "datePublished": "2026-05-27T12:58:43.458Z",
    "dateReserved": "2026-05-13T15:03:33.097Z",
    "dateUpdated": "2026-08-05T12:29:35.424Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fs-writeback.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "087d5b8b501c570f84bf655164e6698c3ce146e0",
              "status": "affected",
              "version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
              "versionType": "git"
            },
            {
              "lessThan": "3c9c9648f77e4d14e50676bc51c2174ba9c8d361",
              "status": "affected",
              "version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
              "versionType": "git"
            },
            {
              "lessThan": "5c3265f3252b2ee50707adaaa3f9bd0df3df72de",
              "status": "affected",
              "version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
              "versionType": "git"
            },
            {
              "lessThan": "c923cc3cb5cd8945ceaf08252754110643446593",
              "status": "affected",
              "version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
              "versionType": "git"
            },
            {
              "lessThan": "685fc15a410885b6d4dee64de0dce721b9428b12",
              "status": "affected",
              "version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
              "versionType": "git"
            },
            {
              "lessThan": "53eeaf4d63068dbc7708b0c7adb20151c812feca",
              "status": "affected",
              "version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
              "versionType": "git"
            },
            {
              "lessThan": "cba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d",
              "status": "affected",
              "version": "a1a0e23e49037c23ea84bc8cc146a03584d13577",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c5cbbec54fe71c4de2d34f8c0ec8fbfdd7f17339",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fs-writeback.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.5"
            },
            {
              "lessThan": "4.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: fix race between cgroup_writeback_umount() and inode_switch_wbs()\n\nWhen a container exits, the following BUG_ON() is occasionally triggered:\n\n==================================================================\n VFS: Busy inodes after unmount of sdb (ext4)\n ------------[ cut here ]------------\n kernel BUG at fs/super.c:695!\n CPU: 3 PID: 6 Comm: containerd-shim Tainted: G OE K 6.6 #1\n pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)\n pc : generic_shutdown_super+0xf0/0x100\n lr : generic_shutdown_super+0xf0/0x100\n Call trace:\n  generic_shutdown_super+0xf0/0x100\n  kill_block_super+0x20/0x48\n  ext4_kill_sb+0x28/0x60\n  deactivate_locked_super+0x54/0x130\n  deactivate_super+0x84/0xa0\n  cleanup_mnt+0xa4/0x140\n  __cleanup_mnt+0x18/0x28\n  task_work_run+0x78/0xe0\n  do_notify_resume+0x204/0x240\n==================================================================\n\nThe root cause is a race between cgroup_writeback_umount() and\ninode_switch_wbs()/cleanup_offline_cgwb(). There is a window between\ninode_prepare_wbs_switch() returning true and the subsequent\nwb_queue_isw() call. Following is the process that triggers the issue:\n\n      CPU A (umount)           |          CPU B (writeback)\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n                                 inode_switch_wbs/cleanup_offline_cgwb\n                                  atomic_inc(\u0026isw_nr_in_flight)\n                                  inode_prepare_wbs_switch\n                                   -\u003e passes SB_ACTIVE check\n                                   __iget(inode)\n generic_shutdown_super\n  sb-\u003es_flags \u0026= ~SB_ACTIVE\n  cgroup_writeback_umount(sb)\n   smp_mb()\n   atomic_read(\u0026isw_nr_in_flight)\n   rcu_barrier()\n    -\u003e no pending RCU callbacks\n   flush_workqueue(isw_wq)\n    -\u003e nothing queued, returns\n  evict_inodes(sb)\n   -\u003e Inode skipped as isw still holds a ref.\n  sop-\u003eput_super(sb)\n   /* destroys percpu counters */\n  -\u003e VFS: Busy inodes after unmount!\n                                  wb_queue_isw()\n                                   queue_work(isw_wq, ...)\n                                  /* later in work function */\n                                  inode_switch_wbs_work_fn\n                                   process_inode_switch_wbs\n                                    iput() -\u003e evict\n                                     percpu_counter_dec() // UAF!\n\nFix this by extending the RCU read-side critical section in\ninode_switch_wbs() and cleanup_offline_cgwb() to cover from\ninode_prepare_wbs_switch() through wb_queue_isw().  Since there is\nno sleep in this window, rcu_read_lock() can be used.  Then add a\nsynchronize_rcu() in cgroup_writeback_umount() before the existing\nrcu_barrier(), so that all in-flight switchers that have passed the\nSB_ACTIVE check have completed queue_work() before flush_workqueue()\nis called.\n\nThe existing rcu_barrier() is intentionally retained so this fix can\nbe backported unchanged to stable kernels (5.10.y, 6.6.y, ...) that\nstill queue switches via queue_rcu_work(). It is a no-op on current\nmainline (since commit e1b849cfa6b6 (\"writeback: Avoid contention on\nwb-\u003elist_lock when switching inodes\")) and is removed in a follow-up\npatch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through local filesystem writes, cgroup teardown, and mount-namespace or filesystem unmount paths; no network protocol directly reaches the race.\nAC:L - An attacker can churn cgroup writeback switches while repeatedly triggering container or mount teardown, controlling both racing activities and amplifying the timing window.\nPR:L - A basic local or container user can dirty writable files and initiate its own cgroup or namespace teardown; lifecycle infrastructure can perform the privileged final unmount automatically.\nUI:N - The attacker can generate the writeback state and trigger teardown without requiring another user to perform an action.\nS:U - The resulting corruption affects the same host kernel security authority and does not inherently cross a VM or hardware isolation boundary.\nC:H - The delayed worker can access superblock-private state after it and its per-CPU counters have been freed, creating an exploitable use-after-free capable of exposing arbitrary kernel memory.\nI:H - The freed superblock and per-CPU counter pointers are subsequently dereferenced and modified, potentially providing attacker-influenced kernel writes and control-flow hijacking.\nA:H - The race demonstrably triggers the busy-inode BUG_ON, and configurations continuing past that check encounter a use-after-free capable of causing an oops or kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:29.511Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/087d5b8b501c570f84bf655164e6698c3ce146e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c9c9648f77e4d14e50676bc51c2174ba9c8d361"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c3265f3252b2ee50707adaaa3f9bd0df3df72de"
        },
        {
          "url": "https://git.kernel.org/stable/c/c923cc3cb5cd8945ceaf08252754110643446593"
        },
        {
          "url": "https://git.kernel.org/stable/c/685fc15a410885b6d4dee64de0dce721b9428b12"
        },
        {
          "url": "https://git.kernel.org/stable/c/53eeaf4d63068dbc7708b0c7adb20151c812feca"
        },
        {
          "url": "https://git.kernel.org/stable/c/cba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d"
        }
      ],
      "title": "writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64378",
    "datePublished": "2026-07-25T08:50:29.006Z",
    "dateReserved": "2026-07-19T15:36:31.784Z",
    "dateUpdated": "2026-08-17T04:54:29.511Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/discovery.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "33b974eb626154ae9348f2bac7de84cb2a3d9dd4",
              "status": "affected",
              "version": "a07b4970f464f13640e28e16dad6cfa33647cc99",
              "versionType": "git"
            },
            {
              "lessThan": "56c021a0869260d04c4b65d1471936aaf9177114",
              "status": "affected",
              "version": "a07b4970f464f13640e28e16dad6cfa33647cc99",
              "versionType": "git"
            },
            {
              "lessThan": "a29b316b9bbfd269f323ab4ba9906a894025680f",
              "status": "affected",
              "version": "a07b4970f464f13640e28e16dad6cfa33647cc99",
              "versionType": "git"
            },
            {
              "lessThan": "53cd102a7a56079b11b897835bd9b94c14e6322c",
              "status": "affected",
              "version": "a07b4970f464f13640e28e16dad6cfa33647cc99",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/nvme/target/discovery.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page\n\nnvmet_execute_disc_get_log_page() validates only the dword alignment\nof the host-supplied Log Page Offset (lpo).  The 64-bit offset is then\nadded to a small kzalloc\u0027d buffer that holds the discovery log page\nand the result is passed straight to nvmet_copy_to_sgl(), which\nmemcpy()s data_len bytes out to the host with no source-side bound\ncheck:\n\n    u64 offset      = nvmet_get_log_page_offset(req-\u003ecmd);  /* 64-bit host */\n    size_t data_len = nvmet_get_log_page_len(req-\u003ecmd);     /* 32-bit host */\n    ...\n    if (offset \u0026 0x3) { ... }                               /* only check */\n    ...\n    alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req);\n    buffer = kzalloc(alloc_len, GFP_KERNEL);\n    ...\n    status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len);\n\nThe Discovery controller is unauthenticated -- nvmet_host_allowed()\nreturns true unconditionally for the discovery subsystem -- so the call\nis reachable pre-authentication by any TCP/RDMA/FC peer that can reach\nthe nvmet target.  With a discovery log page of ~1 KiB, an attacker\nrequesting up to 4 KiB starting at offset == alloc_len reads the next\nslab page out and gets its content returned over the fabric (an\nempirical run on a default nvmet-tcp loopback target leaked 81\ncanonical kernel pointers in one Get Log Page response).  Pointing the\noffset at unmapped kernel memory faults the in-kernel memcpy and\ncrashes (or panics, on panic_on_oops=1) the target host instead.\n\nThe attacker-controlled source-side offset pattern\n\"nvmet_copy_to_sgl(req, 0, buffer + ATTACKER_OFFSET, ...)\" is unique\nto nvmet_execute_disc_get_log_page in the entire nvmet codebase: every\nother Get Log Page handler in admin-cmd.c either ignores lpo (and\nsilently starts every response at offset 0) or tracks a local\ndestination offset with a fixed source pointer.\n\nValidate the host-supplied offset against the log page size, cap the\ncopy length to what is actually available, and zero-fill any remainder\nof the host transfer buffer.  The zero-fill matches the existing\nshort-response pattern in nvmet_execute_get_log_changed_ns()\n(admin-cmd.c) and prevents leaking transport SGL contents when the\nhost asks for more bytes than the log page contains."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable discovery command is remotely reachable through routable NVMe/TCP, as well as NVMe/RDMA and FC transports.\nAC:L - The attacker controls the protocol sequence, transfer length, and aligned 64-bit offset, with no race or condition outside their control.\nPR:N - The discovery subsystem accepts every Host NQN and explicitly skips DH-HMAC-CHAP authentication, making the command reachable pre-authentication.\nUI:N - No victim action is required after the NVMe-oF target port is available.\nS:U - The disclosure and crash affect the vulnerable target kernel within the same security authority.\nC:H - The unbounded offset permits repeated multi-kilobyte kernel heap disclosures; testing cited by the fix exposed 81 canonical kernel pointers in one response.\nI:N - The primitive reads target memory into transport response pages but provides no attacker-selected write to target memory.\nA:H - An offset resolving to unmapped or noncanonical memory faults the in-kernel memcpy, causing an oops or target-host panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:53:20.999Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/33b974eb626154ae9348f2bac7de84cb2a3d9dd4"
        },
        {
          "url": "https://git.kernel.org/stable/c/56c021a0869260d04c4b65d1471936aaf9177114"
        },
        {
          "url": "https://git.kernel.org/stable/c/a29b316b9bbfd269f323ab4ba9906a894025680f"
        },
        {
          "url": "https://git.kernel.org/stable/c/53cd102a7a56079b11b897835bd9b94c14e6322c"
        }
      ],
      "title": "nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64320",
    "datePublished": "2026-07-25T08:49:48.908Z",
    "dateReserved": "2026-07-19T15:36:31.780Z",
    "dateUpdated": "2026-08-17T04:53:20.999Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/rtnetlink.h",
            "net/core/rtnetlink.c",
            "net/ipv4/ip_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "19275943d8fe903eb7b9aa53e380e41efd042ada",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "866b0f5ae599490bd496fd84581c68ac8b94e6af",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "92b766fc55156e0da2ecd0c2302c971118f8a229",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "e54c05ed3d9c28733fb9e5837219aca3691defa3",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "9831bc9ecb402957810c2045c663fbfe9b09e296",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "1697957eb0971d420dde42862b88eb43506a1105",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "47b5d3d506609b08b2e1f7c14f0b681a1953d572",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            },
            {
              "lessThan": "8165f7ff57d9667d2bb477ef6af83ede7fed4ad7",
              "status": "affected",
              "version": "b57708add31494175be741ed3fd24023b50c3423",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/rtnetlink.h",
            "net/core/rtnetlink.c",
            "net/ipv4/ip_gre.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.38",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.38",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ip_gre: require CAP_NET_ADMIN in the device netns for changelink\n\nA tunnel changelink() operates on at most two netns, dev_net(dev) and\nthe tunnel link netns t-\u003enet. They differ once the device is created in\nor moved to a netns other than the one the request runs in. The rtnl\nchangelink path checks CAP_NET_ADMIN only against dev_net(dev), so a\ncaller privileged there but not in t-\u003enet can rewrite a tunnel that\nlives in t-\u003enet.\n\nAdd rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in\nnet/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is\nskipped when the link netns is dev_net(dev), where the rtnl path already\nchecked it. The other patches in this series use the same helper.\n\nGate ipgre_changelink() and erspan_changelink() with it, at the top of\nthe op before any attribute is parsed, because the parsers update live\ntunnel fields first. ipgre_netlink_parms() sets t-\u003ecollect_md before\nip_tunnel_changelink() runs.\n\nCommit 8b484efd5cb4 (\"ip6: vti: Use ip6_tnl.net in\nvti6_siocdevprivate().\") added the same check on the ioctl path. This\nadds it on RTM_NEWLINK."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires sending RTM_NEWLINK changelink requests over rtnetlink (netlink socket), matching the kernel guidance that tc/netlink configuration paths are Local.\nAC:L - Once a cross-namespace GRE/ERSPAN device is present in the caller\u0027s netns, triggering the bug is a single deterministic netlink changelink with no races or attacker-uncontrollable timing.\nPR:L - The rtnl entry path requires CAP_NET_ADMIN in dev_net(dev), which an unprivileged user can obtain inside a user namespace via unshare --user --map-root-user --net without real init-namespace root.\nUI:N - Exploitation is fully programmatic through netlink; no victim user action such as opening a file or mounting a filesystem is required.\nS:C - The changelink mutates tunnel state in t-\u003enet while authorization is checked only against dev_net(dev), crossing from the attacker\u0027s net/user namespace into another tenant\u0027s or the host\u0027s network namespace tunnel tables.\nC:H - An attacker can rewrite IFLA_GRE_REMOTE/LOCAL, keys, and related tunnel parameters to redirect GRE/ERSPAN traffic through attacker-controlled endpoints and read tunneled payloads.\nI:H - Unauthorized changelink updates live tunnel fields (including collect_md and encap parameters parsed before the missing check), enabling arbitrary redirection or injection of traffic in the victim link netns.\nA:H - Rewriting tunnel endpoints, keys, or metadata handling can break production GRE/ERSPAN overlays and VPN paths, causing sustained loss of connectivity for dependent services."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:51:37.933Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/19275943d8fe903eb7b9aa53e380e41efd042ada"
        },
        {
          "url": "https://git.kernel.org/stable/c/866b0f5ae599490bd496fd84581c68ac8b94e6af"
        },
        {
          "url": "https://git.kernel.org/stable/c/92b766fc55156e0da2ecd0c2302c971118f8a229"
        },
        {
          "url": "https://git.kernel.org/stable/c/e54c05ed3d9c28733fb9e5837219aca3691defa3"
        },
        {
          "url": "https://git.kernel.org/stable/c/9831bc9ecb402957810c2045c663fbfe9b09e296"
        },
        {
          "url": "https://git.kernel.org/stable/c/1697957eb0971d420dde42862b88eb43506a1105"
        },
        {
          "url": "https://git.kernel.org/stable/c/47b5d3d506609b08b2e1f7c14f0b681a1953d572"
        },
        {
          "url": "https://git.kernel.org/stable/c/8165f7ff57d9667d2bb477ef6af83ede7fed4ad7"
        }
      ],
      "title": "net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63829",
    "datePublished": "2026-07-19T12:02:23.191Z",
    "dateReserved": "2026-07-19T07:54:57.014Z",
    "dateUpdated": "2026-08-17T04:51:37.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4layouts.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d788ef40a7517d22c97ab01700e4ae4c611b6f2f",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "2e0a5d6d62600b8c614d1b55e50ef94035d6adf9",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "7bbb7ce74051c8be4b69ff44ce3db370600dae61",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "48a586e382e4db1dbf958d44b63e081df5f8ed04",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "d369e5edfaaf83a448016e2f1da392b2174be801",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "83c2b7797742339bb768f83935f7ca33950db138",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            },
            {
              "lessThan": "30d55c8aabb261bc3f427d6b9aae7ef6206063f9",
              "status": "affected",
              "version": "c5c707f96fc9a6e5a57ca5baac892673270abe3d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/nfsd/nfs4layouts.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.3",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: release layout stid on setlease failure\n\nnfs4_alloc_stid() publishes the new stid into cl-\u003ecl_stateids via\nidr_alloc_cyclic() under cl_lock before returning to\nnfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then\nfails, the error path frees the layout stateid directly with\nkmem_cache_free() without ever calling idr_remove(), leaving the\nIDR slot pointing at freed slab memory. Any subsequent IDR walker\n(states_show, client teardown) dereferences the dangling pointer.\n\nThe correct teardown for an IDR-published stid is nfs4_put_stid(),\nwhich removes the IDR slot under cl_lock, dispatches sc_free\n(nfsd4_free_layout_stateid) to release ls-\u003els_file via\nnfsd4_close_layout(), and drops the nfs4_file reference in its\ntail.\n\nA second issue blocks that switch: nfsd4_free_layout_stateid()\nunconditionally inspects ls-\u003els_fence_work via\ndelayed_work_pending() under ls_lock, but\nINIT_DELAYED_WORK(\u0026ls-\u003els_fence_work, ...) currently runs only\nafter the setlease call. On the setlease-failure path the\ndestructor would touch an uninitialized delayed_work.\n\n    nfsd4_alloc_layout_stateid()\n      nfs4_alloc_stid()           /* idr_alloc_cyclic under cl_lock */\n      nfsd4_layout_setlease()     /* fails */\n        nfs4_put_stid()\n          nfsd4_free_layout_stateid()\n            delayed_work_pending(\u0026ls-\u003els_fence_work)  /* needs INIT */\n            nfsd4_close_layout()  /* nfsd_file_put(ls-\u003els_file) */\n          put_nfs4_file()\n\nFix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK\ninitialization above the nfsd4_layout_setlease() call, and replace\nthe manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup\nwith a single nfs4_put_stid(stp)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached through nfsd\u0027s NFSv4 OP_LAYOUTGET handler, which processes attacker-controlled RPC compounds over the network on TCP port 2049.\nAC:L - An authenticated NFS client can reliably trigger the fault by issuing LAYOUTGET on block/SCSI pNFS exports so that nfsd4_layout_setlease() fails (e.g., -ENOMEM or -EINVAL), and can retry, spray the slab, and race concurrent compounds to exploit the dangling IDR entry.\nPR:N - Exploitation requires only the ability to act as a remote NFSv4 client against an export with pNFS enabled, not local shell access or elevated privileges on the Linux host.\nUI:N - No end-user or administrator action on the server is required; the vulnerability is triggered entirely through malicious NFS protocol traffic from a network client.\nS:U - Impact is confined to kernel memory corruption and nfsd state within the same kernel security boundary, not a cross-boundary escape such as VM or container breakout.\nC:H - The IDR retains a pointer to freed layout stateid slab memory, creating a use-after-free that can be leveraged for arbitrary kernel memory reads after heap reuse.\nI:H - UAF on the layout stateid object enables controlled slab reuse and corruption of adjacent kernel structures, supporting arbitrary write or control-flow hijack primitives.\nA:H - Dereferencing the dangling IDR pointer during state iteration or stateid lookup can cause kernel oops/panic, and UAF exploitation can crash or hang the server."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:50:51.453Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d788ef40a7517d22c97ab01700e4ae4c611b6f2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e0a5d6d62600b8c614d1b55e50ef94035d6adf9"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bbb7ce74051c8be4b69ff44ce3db370600dae61"
        },
        {
          "url": "https://git.kernel.org/stable/c/48a586e382e4db1dbf958d44b63e081df5f8ed04"
        },
        {
          "url": "https://git.kernel.org/stable/c/d369e5edfaaf83a448016e2f1da392b2174be801"
        },
        {
          "url": "https://git.kernel.org/stable/c/8dee7c278f1c2b5bb80e17a6281c3812fc8b0cdd"
        },
        {
          "url": "https://git.kernel.org/stable/c/83c2b7797742339bb768f83935f7ca33950db138"
        },
        {
          "url": "https://git.kernel.org/stable/c/30d55c8aabb261bc3f427d6b9aae7ef6206063f9"
        }
      ],
      "title": "nfsd: release layout stid on setlease failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53399",
    "datePublished": "2026-07-19T12:02:00.055Z",
    "dateReserved": "2026-06-09T07:44:35.402Z",
    "dateUpdated": "2026-08-17T04:50:51.453Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/pressure/mpl115.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5022f4ed5aae974ec530e3cbf0bd223be13055f7",
              "status": "affected",
              "version": "0c3a333524a3e5ba4b6c7b2638faef8420cfdb2a",
              "versionType": "git"
            },
            {
              "lessThan": "aab0fed636b14a5fd52fcae58b484f1cb96b841d",
              "status": "affected",
              "version": "0c3a333524a3e5ba4b6c7b2638faef8420cfdb2a",
              "versionType": "git"
            },
            {
              "lessThan": "b3f1af4ba8e9cf33aa08c4cdcaa5a17b140521ec",
              "status": "affected",
              "version": "0c3a333524a3e5ba4b6c7b2638faef8420cfdb2a",
              "versionType": "git"
            },
            {
              "lessThan": "46e69d3dd429b33e50e2731913239f6af4ea2705",
              "status": "affected",
              "version": "0c3a333524a3e5ba4b6c7b2638faef8420cfdb2a",
              "versionType": "git"
            },
            {
              "lessThan": "fbe67ff37a6fd855a6c097f84f3738bd13d0a898",
              "status": "affected",
              "version": "0c3a333524a3e5ba4b6c7b2638faef8420cfdb2a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/pressure/mpl115.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: pressure: mpl115: fix runtime PM leak on read error\n\nmpl115_read_raw() takes a runtime PM reference with pm_runtime_get_sync()\nbefore reading the processed pressure or raw temperature, but on the read\nerror path it returns without calling pm_runtime_put_autosuspend(). Each\nfailed read therefore leaks a runtime PM reference and prevents the device\nfrom autosuspending.\n\nDrop the reference before checking the return value so both the success\nand error paths are balanced."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:56:41.512Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5022f4ed5aae974ec530e3cbf0bd223be13055f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/aab0fed636b14a5fd52fcae58b484f1cb96b841d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3f1af4ba8e9cf33aa08c4cdcaa5a17b140521ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/46e69d3dd429b33e50e2731913239f6af4ea2705"
        },
        {
          "url": "https://git.kernel.org/stable/c/fbe67ff37a6fd855a6c097f84f3738bd13d0a898"
        }
      ],
      "title": "iio: pressure: mpl115: fix runtime PM leak on read error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64493",
    "datePublished": "2026-07-25T08:51:51.036Z",
    "dateReserved": "2026-07-19T15:36:31.792Z",
    "dateUpdated": "2026-08-17T04:56:41.512Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-multitouch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "12e90656e330ff8bbaf2f29c535fdb8a11cc6f55",
              "status": "affected",
              "version": "fc488f675344931ffab6a51c43691065ec006567",
              "versionType": "git"
            },
            {
              "lessThan": "152983d87387f6a8ae72b73474cfa55fbcf1ec75",
              "status": "affected",
              "version": "77711d850bed75ae7142c3d1f22c1a8b4d049c33",
              "versionType": "git"
            },
            {
              "lessThan": "b5c037d6b807017e74a115288f81bc9cd5a5aab8",
              "status": "affected",
              "version": "6acfe25968913788d30ec0eedd80178c4ea3f1d0",
              "versionType": "git"
            },
            {
              "lessThan": "a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d",
              "status": "affected",
              "version": "d280c138e66be87d1fccfed42593f02fdb893905",
              "versionType": "git"
            },
            {
              "lessThan": "e24918ee67c4dc3d20d4670750e46e9b160365f4",
              "status": "affected",
              "version": "f32fea4c0234c971c12e46d76612cdc2dd4bb046",
              "versionType": "git"
            },
            {
              "lessThan": "37daa8c96bd563d03150e23f094cb60703594a6d",
              "status": "affected",
              "version": "46f781e0d151844589dc2125c8cce3300546f92a",
              "versionType": "git"
            },
            {
              "lessThan": "6493ebf9489efef0105078377b973ab33d51af22",
              "status": "affected",
              "version": "46f781e0d151844589dc2125c8cce3300546f92a",
              "versionType": "git"
            },
            {
              "lessThan": "8813b0612275cc61fe9e6603d0ee019247ade6be",
              "status": "affected",
              "version": "46f781e0d151844589dc2125c8cce3300546f92a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "59bd04163e6451b9c7275277882ed9f4abfa2051",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.261",
              "status": "affected",
              "version": "5.10.246",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.212",
              "status": "affected",
              "version": "5.15.196",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.178",
              "status": "affected",
              "version": "6.1.158",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.114",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.97",
              "status": "affected",
              "version": "6.12.55",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18",
              "status": "affected",
              "version": "6.17.5",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-multitouch.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.10.246",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15.196",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1.158",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.114",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.12.55",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.17.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: multitouch: fix out-of-bounds bit access on mt_io_flags\n\nmt_io_flags is a single unsigned long, but mt_process_slot(),\nmt_release_pending_palms() and mt_release_contacts() use it as a\nper-slot bitmap indexed by the slot number. That slot number is only\nbounded by td-\u003emaxcontacts, which is taken from the device\u0027s\nContactCountMaximum feature report and can be up to 255, not by\nBITS_PER_LONG.\n\nAs a result, a multitouch device that advertises a large contact count\nmakes set_bit()/clear_bit() operate past the mt_io_flags word and\ncorrupt the adjacent members of struct mt_device. The sticky-fingers\nrelease timer is the easiest way to reach this. mt_release_contacts()\nruns\n\n\tfor (i = 0; i \u003c mt-\u003enum_slots; i++)\n\t\tclear_bit(i, \u0026td-\u003emt_io_flags);\n\nwith num_slots == maxcontacts. For maxcontacts around 250 the loop\nclears the bits that overlap td-\u003eapplications.next, zeroing that list\nhead, and the list_for_each_entry() that immediately follows then\ndereferences NULL. The kernel panics from timer (softirq) context. On a\nKASAN build this shows up as a general protection fault in\nmt_release_contacts() with a null-ptr-deref at offset 0x58, which is\noffsetof(struct mt_application, num_received).\n\nThe state is reachable from an untrusted USB or Bluetooth HID\nmultitouch device; no local privileges are required.\n\nStore the per-slot active state in a separately allocated bitmap sized\nfor maxcontacts, the same pattern already used for pending_palm_slots,\nand keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two\n\"mt_io_flags \u0026 MT_IO_SLOTS_MASK\" arming checks become\nbitmap_empty(td-\u003eactive_slots, td-\u003emaxcontacts).\n\nMove MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the\nsame commit to leave the low byte for the slot bits; with the slot bits\ngone it fits in bit 0 again, which also keeps it within the unsigned\nlong on 32-bit."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - A malicious Bluetooth HID multitouch peripheral within radio range can supply the descriptor, feature value, and input reports; malicious USB devices provide an additional physical path.\nAC:L - Advertising 250 contacts, sending one active contact, and remaining silent for 100 ms deterministically triggers the timer path without a race, heap grooming, or uncontrollable condition.\nPR:N - The external HID device needs no target-system account or capability, and normal HID connection handling delivers its attacker-controlled data to the driver.\nUI:N - An already-connected or automatically reconnecting Bluetooth peripheral can trigger the flaw without victim action; report processing itself requires no file, prompt, or application interaction.\nS:U - The corruption occurs in the host kernel and compromises resources governed by that same kernel security authority.\nC:H - Attacker-controlled out-of-bounds bit operations cover adjacent list pointers and can redirect subsequent kernel memory accesses, supporting kernel compromise and arbitrary disclosure.\nI:H - The device obtains attacker-directed set/clear operations over adjacent pointer fields, enabling crafted pointer corruption, further kernel writes, and potentially code execution.\nA:H - The deterministic timeout path corrupts the applications list and causes a kernel panic from softirq context, and a malicious peripheral can trigger it repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:11.199Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/12e90656e330ff8bbaf2f29c535fdb8a11cc6f55"
        },
        {
          "url": "https://git.kernel.org/stable/c/152983d87387f6a8ae72b73474cfa55fbcf1ec75"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5c037d6b807017e74a115288f81bc9cd5a5aab8"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6d5ce2e1a2d7bf189bde8a659d04b65f0b0725d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e24918ee67c4dc3d20d4670750e46e9b160365f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/37daa8c96bd563d03150e23f094cb60703594a6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6493ebf9489efef0105078377b973ab33d51af22"
        },
        {
          "url": "https://git.kernel.org/stable/c/8813b0612275cc61fe9e6603d0ee019247ade6be"
        }
      ],
      "title": "HID: multitouch: fix out-of-bounds bit access on mt_io_flags",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64364",
    "datePublished": "2026-07-25T08:50:19.441Z",
    "dateReserved": "2026-07-19T15:36:31.783Z",
    "dateUpdated": "2026-08-17T04:54:11.199Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/light/gp2ap002.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "62e0d74821a02f0e0c5c79b99ae64dc83a9a90f5",
              "status": "affected",
              "version": "f6dbf83c17cb223ceabd7c42d441414f3e0e8a86",
              "versionType": "git"
            },
            {
              "lessThan": "7110201c6b21455240c63388f30113f3baafacfc",
              "status": "affected",
              "version": "f6dbf83c17cb223ceabd7c42d441414f3e0e8a86",
              "versionType": "git"
            },
            {
              "lessThan": "2593f0c6ea37df168975694a3b17e7086f11453e",
              "status": "affected",
              "version": "f6dbf83c17cb223ceabd7c42d441414f3e0e8a86",
              "versionType": "git"
            },
            {
              "lessThan": "f350883989ced96d6da7f582f9a6f9c6ffc94e34",
              "status": "affected",
              "version": "f6dbf83c17cb223ceabd7c42d441414f3e0e8a86",
              "versionType": "git"
            },
            {
              "lessThan": "29137052c4485c74bc2d1b0717f69ca4de14274f",
              "status": "affected",
              "version": "f6dbf83c17cb223ceabd7c42d441414f3e0e8a86",
              "versionType": "git"
            },
            {
              "lessThan": "0c655d067ac69ee24e2e9d706c54179ea58a43db",
              "status": "affected",
              "version": "f6dbf83c17cb223ceabd7c42d441414f3e0e8a86",
              "versionType": "git"
            },
            {
              "lessThan": "2ebaea7f3089decb01a8294d89d7e0cf288146c4",
              "status": "affected",
              "version": "f6dbf83c17cb223ceabd7c42d441414f3e0e8a86",
              "versionType": "git"
            },
            {
              "lessThan": "38b72267b7e22768a1f26d9935de4e1752a1dc85",
              "status": "affected",
              "version": "f6dbf83c17cb223ceabd7c42d441414f3e0e8a86",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f3e84bf3f86bb3b7bd50666bb8ef7a203a656ca3",
              "versionType": "git"
            },
            {
              "lessThan": "5.8",
              "status": "affected",
              "version": "5.7.6",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/light/gp2ap002.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.7.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: light: gp2ap002: fix runtime PM leak on read error\n\ngp2ap002_read_raw() calls pm_runtime_get_sync() before reading the\nlux value, but if gp2ap002_get_lux() fails, it returns directly. This\nskips the pm_runtime_put_autosuspend() call at the \"out\" label,\npermanently leaking a runtime PM reference and preventing the device\nfrom autosuspending.\n\nReplace the direct return with a \"goto out\" to ensure the reference\nis properly dropped on the error path."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:56:42.612Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/62e0d74821a02f0e0c5c79b99ae64dc83a9a90f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/7110201c6b21455240c63388f30113f3baafacfc"
        },
        {
          "url": "https://git.kernel.org/stable/c/2593f0c6ea37df168975694a3b17e7086f11453e"
        },
        {
          "url": "https://git.kernel.org/stable/c/f350883989ced96d6da7f582f9a6f9c6ffc94e34"
        },
        {
          "url": "https://git.kernel.org/stable/c/29137052c4485c74bc2d1b0717f69ca4de14274f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c655d067ac69ee24e2e9d706c54179ea58a43db"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ebaea7f3089decb01a8294d89d7e0cf288146c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/38b72267b7e22768a1f26d9935de4e1752a1dc85"
        }
      ],
      "title": "iio: light: gp2ap002: fix runtime PM leak on read error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64494",
    "datePublished": "2026-07-25T08:51:51.747Z",
    "dateReserved": "2026-07-19T15:36:31.792Z",
    "dateUpdated": "2026-08-17T04:56:42.612Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/chemical/scd30_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0ccff849bde90973e6c13a666f6ceab5c55b30d4",
              "status": "affected",
              "version": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99",
              "versionType": "git"
            },
            {
              "lessThan": "1821bcacd8ac5b214c53be16cbb8172bf193f0b6",
              "status": "affected",
              "version": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99",
              "versionType": "git"
            },
            {
              "lessThan": "40bb0fdb37f441c9c9f52bf58bbd8a0ca3cc9598",
              "status": "affected",
              "version": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99",
              "versionType": "git"
            },
            {
              "lessThan": "b131f0011dfef72350f4e3f11df94dc3e6b46065",
              "status": "affected",
              "version": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99",
              "versionType": "git"
            },
            {
              "lessThan": "8d4a46e971cf846bda98b20d4cabfa21c1276e5f",
              "status": "affected",
              "version": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99",
              "versionType": "git"
            },
            {
              "lessThan": "82accdd57404399eddf3d56fd9beda7c61307388",
              "status": "affected",
              "version": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99",
              "versionType": "git"
            },
            {
              "lessThan": "d49ff54b2784aa56a7c97982de713604de89d23a",
              "status": "affected",
              "version": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99",
              "versionType": "git"
            },
            {
              "lessThan": "60d877910a43c305b5165131b258a17b1d772d57",
              "status": "affected",
              "version": "64b3d8b1b0f5c16c19045785e4da8391ae35ec99",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iio/chemical/scd30_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: chemical: scd30: Cleanup initializations and fix sign-extension bug\n\nInclude linux/bitfield.h for FIELD_GET().\n\nCreate new macros for bit manipulation in combination with manual bit\nmanipulation being replaced with FIELD_GET().\n\nThe current variable declaration and initializations are barely readable\nand use comma separations across multiple lines. Refactor the\ninitializations so that mantissa and exp have separate declarations and\nsign gets initialized later.\n\nIn addition (and due to the nature of the cleanup), fix a sign-extension\nbug where, float32 would get bitwise anded with ~BIT(31)\n(which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:56:45.940Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0ccff849bde90973e6c13a666f6ceab5c55b30d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/1821bcacd8ac5b214c53be16cbb8172bf193f0b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/40bb0fdb37f441c9c9f52bf58bbd8a0ca3cc9598"
        },
        {
          "url": "https://git.kernel.org/stable/c/b131f0011dfef72350f4e3f11df94dc3e6b46065"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d4a46e971cf846bda98b20d4cabfa21c1276e5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/82accdd57404399eddf3d56fd9beda7c61307388"
        },
        {
          "url": "https://git.kernel.org/stable/c/d49ff54b2784aa56a7c97982de713604de89d23a"
        },
        {
          "url": "https://git.kernel.org/stable/c/60d877910a43c305b5165131b258a17b1d772d57"
        }
      ],
      "title": "iio: chemical: scd30: Cleanup initializations and fix sign-extension bug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64497",
    "datePublished": "2026-07-25T08:51:53.917Z",
    "dateReserved": "2026-07-19T15:36:31.792Z",
    "dateUpdated": "2026-08-17T04:56:45.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/vfs.c",
            "fs/smb/server/vfs_cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f08b3f451f12eee4abd8a5981803bc36db84458b",
              "status": "affected",
              "version": "f44158485826c076335d6860d35872271a83791d",
              "versionType": "git"
            },
            {
              "lessThan": "18c59109bb6fb816d5102171666f87cf1e29901d",
              "status": "affected",
              "version": "f44158485826c076335d6860d35872271a83791d",
              "versionType": "git"
            },
            {
              "lessThan": "e72c15085b6d86f45d224d98aa75b5cace4aaab9",
              "status": "affected",
              "version": "f44158485826c076335d6860d35872271a83791d",
              "versionType": "git"
            },
            {
              "lessThan": "4b7059974549d278e30fe70e2a4e421f9839817d",
              "status": "affected",
              "version": "f44158485826c076335d6860d35872271a83791d",
              "versionType": "git"
            },
            {
              "lessThan": "52e2f21911158ec961cd5aae19c56460db382af0",
              "status": "affected",
              "version": "f44158485826c076335d6860d35872271a83791d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/vfs.c",
            "fs/smb/server/vfs_cache.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: use opener credentials for delete-on-close\n\nDelete-on-close can be completed by deferred or durable handle teardown,\nwhere no request work is available. Both the base-file unlink and the ADS\nxattr removal consequently run with the ksmbd worker credentials and can\nbypass filesystem permission checks.\n\nRun both operations with the credentials captured in struct file when the\nhandle was opened. This preserves the authenticated user\u0027s fsuid, fsgid,\nsupplementary groups and capability restrictions at final close."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote SMB client reaches the vulnerable CREATE, SET_INFO, and CLOSE paths through ksmbd over TCP/445.\nAC:L - The attacker can deterministically request delete-on-close and close or disconnect the handle; no race or condition outside attacker control is required.\nPR:N - Although a valid SMB session and writable tree are required, ksmbd supports anonymous guest sessions, making exploitation possible without prior privileges on a reasonably configured writable guest share.\nUI:N - Exploitation requires only attacker-generated SMB requests and no action by another user.\nS:U - The unauthorized filesystem operations occur within the same host and kernel security authority, without crossing a VM, sandbox, or IOMMU boundary.\nC:N - The flaw only unlinks filesystem objects or removes ADS xattrs; it provides no read primitive, information disclosure, or memory corruption.\nI:H - The privileged worker can delete attacker-selected files, empty directories, or ADS data despite the opener\u0027s filesystem restrictions, permitting complete destruction or replacement of protected exported data.\nA:H - The attacker can repeatedly and recursively delete exported resources, potentially causing complete loss of critical share data or services that depend on it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:44.931Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f08b3f451f12eee4abd8a5981803bc36db84458b"
        },
        {
          "url": "https://git.kernel.org/stable/c/18c59109bb6fb816d5102171666f87cf1e29901d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e72c15085b6d86f45d224d98aa75b5cace4aaab9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b7059974549d278e30fe70e2a4e421f9839817d"
        },
        {
          "url": "https://git.kernel.org/stable/c/52e2f21911158ec961cd5aae19c56460db382af0"
        }
      ],
      "title": "ksmbd: use opener credentials for delete-on-close",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64392",
    "datePublished": "2026-07-25T08:50:38.634Z",
    "dateReserved": "2026-07-19T15:36:31.785Z",
    "dateUpdated": "2026-08-17T04:54:44.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2d2ab6983620c2d60ce7db72133984ca3873b929",
              "status": "affected",
              "version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
              "versionType": "git"
            },
            {
              "lessThan": "67bdad9cf01b25030e3bf00bbce6c309319d6663",
              "status": "affected",
              "version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
              "versionType": "git"
            },
            {
              "lessThan": "b0d4d5cb846a1ddb7aaab9adfb5986e4540e6e5f",
              "status": "affected",
              "version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
              "versionType": "git"
            },
            {
              "lessThan": "db231af842868268839f9f9619c68cb27830d8be",
              "status": "affected",
              "version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
              "versionType": "git"
            },
            {
              "lessThan": "a10942af27832c2761d020863a46e79bebe0567d",
              "status": "affected",
              "version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
              "versionType": "git"
            },
            {
              "lessThan": "cedff600f1642aa982178503552f0d007bc829c8",
              "status": "affected",
              "version": "eb817368f50c1cbe1bd07044124aad7db6330e3a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/smb/server/smb2pdu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: require source read access for duplicate extents\n\nFSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to\nvfs_clone_file_range() or vfs_copy_file_range() without checking the SMB\naccess mask granted to the source handle. A handle opened with attribute\naccess can consequently be used to copy file contents into an\nattacker-readable destination.\n\nRequire FILE_READ_DATA on the source handle before either VFS operation,\nmatching other ksmbd data-copy paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable SMB2 IOCTL is remotely reachable through ksmbd over TCP, normally port 445.\nAC:L - The attacker controls both handles, offsets, and copy length; no race is required, and exploitation is reliable on common reflink-capable filesystems such as XFS and Btrfs.\nPR:N - In a reasonable guest-enabled writable-share deployment, an unauthenticated remote attacker can establish a guest session without credentials and obtain the required attribute-only source and writable destination handles.\nUI:N - After connecting to the share, the attacker can open both handles and issue the IOCTL without any victim action.\nS:U - The bypass discloses files governed by the same kernel and SMB server security authority and does not cross a virtualization or other security scope.\nC:H - Attacker-controlled offsets and lengths allow complete copying of otherwise unreadable files into an attacker-readable destination, causing total confidentiality loss for protected share contents.\nI:N - The source is not modified, and the destination must already be on a writable tree and opened with FILE_WRITE_DATA, so the flaw adds no unauthorized modification capability.\nA:N - The operation does not corrupt memory, crash the kernel, or inherently disrupt service; any destination writes are already authorized by the required handle permissions."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:49.007Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2d2ab6983620c2d60ce7db72133984ca3873b929"
        },
        {
          "url": "https://git.kernel.org/stable/c/67bdad9cf01b25030e3bf00bbce6c309319d6663"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0d4d5cb846a1ddb7aaab9adfb5986e4540e6e5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/db231af842868268839f9f9619c68cb27830d8be"
        },
        {
          "url": "https://git.kernel.org/stable/c/a10942af27832c2761d020863a46e79bebe0567d"
        },
        {
          "url": "https://git.kernel.org/stable/c/cedff600f1642aa982178503552f0d007bc829c8"
        }
      ],
      "title": "ksmbd: require source read access for duplicate extents",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64395",
    "datePublished": "2026-07-25T08:50:40.393Z",
    "dateReserved": "2026-07-19T15:36:31.785Z",
    "dateUpdated": "2026-08-17T04:54:49.007Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "889ca6000ac7fa73457b041848fcb08e0d51b809",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "1a52a05471494546f955a58e8c170c0c796c52d5",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "0406d746574e875d8778552eb674fcfbf5330bfb",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "0970dd47726a57e52013594e9fbf667586eb3673",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "04f612dc03427e0b1ac80a2611b5ac0ba93ac446",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "7e7741c8315e4160aead00a60cdd6f81ab880717",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "f9654207e92283e0acac5d64fe5f8835383b5a23",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/rtl8723bs/core/rtw_mlme_ext.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop\n\nThe IE parsing loop in OnAssocRsp() advances by (pIE-\u003elength + 2) each\niteration but only guards on i \u003c pkt_len. When a malicious AP sends an\nAssocResponse whose last IE has only one byte remaining in the frame\n(the element_id byte lands at pkt_len-1), the loop reads pIE-\u003elength\nfrom pframe[pkt_len], which is one byte past the allocated receive buffer.\n\nAdditionally, even when the header bytes are in bounds, pIE-\u003elength\nitself can extend the data window beyond pkt_len, silently passing a\ntruncated IE to the handler functions.\n\nAdd two guards at the top of the loop body:\n  1. Break if fewer than sizeof(*pIE) bytes remain (can\u0027t read header).\n  2. Break if the IE\u0027s declared data extends past pkt_len."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - An attacker within WiFi radio range can inject a spoofed 802.11 association response to an RTL8723BS station. WiFi management-frame injection is an adjacent attack vector.\nAC:L - The malformed final IE or oversized declared IE deterministically triggers the faulty parsing, and the attacker can observe and answer an association request. No race or condition outside attacker control is required.\nPR:N - Association responses are processed before WPA or 802.1X key establishment, without credentials or capabilities. The path checks the destination and association state but does not validate the response source or BSSID.\nUI:N - Auto-connecting phones, embedded devices, and IoT systems associate or reassociate without human action. An attacker can wait for or induce an automatic reconnect.\nS:U - The vulnerable driver and affected kernel resources belong to the same security authority. No VM, sandbox, or IOMMU boundary is crossed.\nC:H - Truncated HT or WMM elements can make handlers consume up to approximately 26 bytes beyond the logical receive frame from adjacent kernel skb memory. Under the required conservative treatment of a nontrivial out-of-bounds read, confidentiality impact is High.\nI:N - This flaw performs out-of-bounds reads but provides no out-of-bounds write or control-flow primitive. The separate HT capability overwrite was already fixed in the upstream parent and is not attributed to this CVE.\nA:H - Out-of-bounds accesses in the kernel receive tasklet can produce an oops or panic on hardened or unfavorable memory layouts. An unauthenticated adjacent attacker can repeat the trigger during association or reassociation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:46.699Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/889ca6000ac7fa73457b041848fcb08e0d51b809"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a52a05471494546f955a58e8c170c0c796c52d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/0406d746574e875d8778552eb674fcfbf5330bfb"
        },
        {
          "url": "https://git.kernel.org/stable/c/0970dd47726a57e52013594e9fbf667586eb3673"
        },
        {
          "url": "https://git.kernel.org/stable/c/04f612dc03427e0b1ac80a2611b5ac0ba93ac446"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e7741c8315e4160aead00a60cdd6f81ab880717"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9654207e92283e0acac5d64fe5f8835383b5a23"
        }
      ],
      "title": "staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64444",
    "datePublished": "2026-07-25T08:51:15.968Z",
    "dateReserved": "2026-07-19T15:36:31.788Z",
    "dateUpdated": "2026-08-17T04:55:46.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-08-22T04:12:18.141Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/28/8"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/31/17"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/01/1"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/01/3"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/08/22/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/flow_netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ab855641241387db062a5e41d9ad6b8561542572",
              "status": "affected",
              "version": "057dbc5b72e9fcac439cd561c3a539b8a0edeb92",
              "versionType": "git"
            },
            {
              "lessThan": "c66bd2626c2764f23764ff0f8277f44a9cfe8349",
              "status": "affected",
              "version": "2532adbfe917c0e71dba2650ffc6efe396314c87",
              "versionType": "git"
            },
            {
              "lessThan": "d573250d228401f707f4dbc09d11227a6215ee5f",
              "status": "affected",
              "version": "4b1a0ee6164c7204c68ab5a9c48c07bfe8852485",
              "versionType": "git"
            },
            {
              "lessThan": "f1efff8858403191361a01269c6fe8dd7f55a385",
              "status": "affected",
              "version": "e6610f9c08b4c04cf7949c10fc246c071d00e935",
              "versionType": "git"
            },
            {
              "lessThan": "dbd14f736be02cfe73049bd801af89becd1a0749",
              "status": "affected",
              "version": "a1e64addf3ff9257b45b78bc7d743781c3f41340",
              "versionType": "git"
            },
            {
              "lessThan": "1b41cbe05b184f8861712f0806cc0c4f5d8c6dfe",
              "status": "affected",
              "version": "a1e64addf3ff9257b45b78bc7d743781c3f41340",
              "versionType": "git"
            },
            {
              "lessThan": "3f1f755366687d051174739fb99f7d560202f60b",
              "status": "affected",
              "version": "a1e64addf3ff9257b45b78bc7d743781c3f41340",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6b099d285d7ed324494b6d684f377aa103856118",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.212",
              "status": "affected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.178",
              "status": "affected",
              "version": "6.1.132",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.145",
              "status": "affected",
              "version": "6.6.84",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.97",
              "status": "affected",
              "version": "6.12.20",
              "versionType": "semver"
            },
            {
              "lessThan": "6.14",
              "status": "affected",
              "version": "6.13.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/flow_netlink.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.15.180",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "6.1.132",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.6.84",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.12.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.13.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: reject oversized nested action attrs\n\nOpen vSwitch stores generated flow actions as nlattrs, whose nla_len\nfield is u16. Commit a1e64addf3ff (\"net: openvswitch: remove\nmisbehaving actions length check\") allowed the total sw_flow_actions\nstream to grow beyond 64 KiB, which is valid, but also removed the last\nguard preventing a generated nested action attribute from exceeding\nU16_MAX.\n\nAn oversized generated container can thus be closed with a truncated\nnla_len. A later dump or teardown then walks a structurally different\nstream than the one that was validated. In particular, an oversized\nnested CLONE/CT action may cause subsequent bytes in the generated\nstream to be interpreted as independent actions.\n\nKeep the larger total-action-stream behavior, but make nested action\nclose reject generated containers that do not fit in nla_len, and return\nthe error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and\nCHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse\nconstruction order before discarding failed wrappers, so resources copied\ninto the rejected tails are released before the wrappers are removed.\n\nMost failed outer wrappers are discarded by truncating actions_len after\nchild resources have been released. CHECK_PKT_LEN also trims its parent\nafter branch resources are gone. SET/TUNNEL close failures unwind their\nknown tun_dst ownership directly, and SET_TO_MASKED has no external\nownership and truncates on close failure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable action builder is reached through local Generic Netlink requests such as OVS_FLOW_CMD_NEW or OVS_PACKET_CMD_EXECUTE. Remote packets cannot construct the malformed action stream.\nAC:L - The attacker deterministically controls the nested-action expansion, wrapped length, and resulting parser alignment; no race or uncontrollable condition is required.\nPR:L - The operations require CAP_NET_ADMIN but use GENL_UNS_ADMIN_PERM in namespace-aware families. An unprivileged user can obtain the required capability through an allowed user and network namespace.\nUI:N - Once the attacker sends the crafted netlink request, vulnerable dumping, teardown, or execution occurs without another user\u0027s participation.\nS:U - The vulnerability and its effects remain within the host kernel\u0027s security authority. Kernel privilege escalation from a user namespace does not constitute a CVSS scope change.\nC:H - Length truncation can reinterpret attacker-controlled userdata as an internal SET or CT action. The dump path can consequently dereference an attacker-selected kernel pointer and serialize referenced memory.\nI:H - Fake SET or CT actions can make execution or teardown perform reference-count operations, releases, and frees through attacker-controlled pointers. This provides exploitable memory-corruption primitives capable of kernel code execution.\nA:H - Attacker-controlled invalid pointers can cause a kernel oops or panic, while zero-length misparsed actions can cause a non-advancing execution loop and soft lockup."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:57:08.992Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ab855641241387db062a5e41d9ad6b8561542572"
        },
        {
          "url": "https://git.kernel.org/stable/c/c66bd2626c2764f23764ff0f8277f44a9cfe8349"
        },
        {
          "url": "https://git.kernel.org/stable/c/d573250d228401f707f4dbc09d11227a6215ee5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1efff8858403191361a01269c6fe8dd7f55a385"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbd14f736be02cfe73049bd801af89becd1a0749"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b41cbe05b184f8861712f0806cc0c4f5d8c6dfe"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f1f755366687d051174739fb99f7d560202f60b"
        }
      ],
      "title": "net: openvswitch: reject oversized nested action attrs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64531",
    "datePublished": "2026-07-27T06:32:32.596Z",
    "dateReserved": "2026-07-19T15:36:31.794Z",
    "dateUpdated": "2026-08-22T04:12:18.141Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/touchscreen/touchwin.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ed9b66905407eb3d02df1aaeed82eb7a7f0eb508",
              "status": "affected",
              "version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
              "versionType": "git"
            },
            {
              "lessThan": "044167cba2384bcd783547ad5e30ecd292b30919",
              "status": "affected",
              "version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
              "versionType": "git"
            },
            {
              "lessThan": "6c9f29f128dd4057404838259af4c645318487e1",
              "status": "affected",
              "version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
              "versionType": "git"
            },
            {
              "lessThan": "431ad239f2924dff337c3fccb9246597c1b63185",
              "status": "affected",
              "version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
              "versionType": "git"
            },
            {
              "lessThan": "70e4248793762df9832fd4fc2fc6ac7924572c36",
              "status": "affected",
              "version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
              "versionType": "git"
            },
            {
              "lessThan": "3e6f007b43e2fc6546e21fa74ee62c38984a6672",
              "status": "affected",
              "version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
              "versionType": "git"
            },
            {
              "lessThan": "a8d87184576c889759e3aab899799a482f1e1a5b",
              "status": "affected",
              "version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
              "versionType": "git"
            },
            {
              "lessThan": "478cdd736f2ce3114f90e775d7358136d3977b94",
              "status": "affected",
              "version": "11ea3173d5f2de71d037ef58ac43395795fed2bc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/touchscreen/touchwin.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.19"
            },
            {
              "lessThan": "2.6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: touchwin - reset the packet index on every complete packet\n\ntw_interrupt() accumulates each non-zero serial byte into a fixed\nthree-byte buffer with a running index that is only reset once a full\npacket has been received *and* the device\u0027s two Y bytes agree:\n\n\ttw-\u003edata[tw-\u003eidx++] = data;\n\tif (tw-\u003eidx == TW_LENGTH \u0026\u0026 tw-\u003edata[1] == tw-\u003edata[2]) {\n\t\t...\n\t\ttw-\u003eidx = 0;\n\t}\n\nThe reset is gated on tw-\u003edata[1] == tw-\u003edata[2], a value the device\ncontrols.  A malicious, malfunctioning or counterfeit Touchwindow\nperipheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the\nindex reaches TW_LENGTH without the equality holding, is never reset, and\nkeeps growing, so tw-\u003edata[tw-\u003eidx++] walks off the end of the three-byte\narray and the rest of the heap-allocated struct tw, one attacker-chosen\nbyte at a time -- an unbounded, device-driven heap out-of-bounds write.\n\nReset the index on every completed packet and report an event only when\nthe two Y bytes match, like the other serio touchscreen drivers do."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:25.592Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ed9b66905407eb3d02df1aaeed82eb7a7f0eb508"
        },
        {
          "url": "https://git.kernel.org/stable/c/044167cba2384bcd783547ad5e30ecd292b30919"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c9f29f128dd4057404838259af4c645318487e1"
        },
        {
          "url": "https://git.kernel.org/stable/c/431ad239f2924dff337c3fccb9246597c1b63185"
        },
        {
          "url": "https://git.kernel.org/stable/c/70e4248793762df9832fd4fc2fc6ac7924572c36"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e6f007b43e2fc6546e21fa74ee62c38984a6672"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8d87184576c889759e3aab899799a482f1e1a5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/478cdd736f2ce3114f90e775d7358136d3977b94"
        }
      ],
      "title": "Input: touchwin - reset the packet index on every complete packet",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64271",
    "datePublished": "2026-07-25T08:49:18.160Z",
    "dateReserved": "2026-07-19T15:36:31.775Z",
    "dateUpdated": "2026-08-17T04:52:25.592Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/intel/qat/qat_common/adf_accel_devices.h",
            "drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
            "drivers/crypto/intel/qat/qat_common/adf_isr.c",
            "drivers/crypto/intel/qat/qat_common/adf_sriov.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "218c2836b3987f3fa1d9eac505462cded0821e4c",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "446b4d77599cf1a168573f7fb32a4a6aa4f09219",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "5d916c1eae1933511a69bffe243b4ee5d7da399c",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "f344a369d0380d54c8d6c8d24734a78dd5a89817",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "51144032248cc4ea22917370565650670b8b4e9b",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "49cd5ac6de8de39a14ead609bb552d372d5602cd",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "6e92b28cd74fa433658efeadf21b9d4b01023d7d",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            },
            {
              "lessThan": "277281c10c63791067d24d421f7c43a15faa9096",
              "status": "affected",
              "version": "ed8ccaef52fa03fb03cff45b380f72c9f869f273",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/intel/qat/qat_common/adf_accel_devices.h",
            "drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
            "drivers/crypto/intel/qat/qat_common/adf_isr.c",
            "drivers/crypto/intel/qat/qat_common/adf_sriov.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.3"
            },
            {
              "lessThan": "4.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - fix VF2PF work teardown race in adf_disable_sriov()\n\nThe VF2PF interrupt handler queues PF-side response work that stores a\nraw pointer to per-VF state (struct adf_accel_vf_info). Currently,\nadf_disable_sriov() destroys per-VF mutexes and frees vf_info without\nstopping new VF2PF work or waiting for in-flight workers to complete. A\nconcurrently scheduled or already queued worker can then dereference\nfreed memory.\n\nThis manifests as a use-after-free when KASAN is enabled:\n\n  BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0\n  Write of size 8 at addr 0000000000000260 by task kworker/24:2/...\n  Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]\n  Call Trace:\n    kasan_report+0x119/0x140\n    mutex_lock+0x76/0xe0\n    adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]\n    adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]\n    adf_iov_send_resp+0x8c/0xe0 [intel_qat]\n    process_one_work+0x6ac/0xfd0\n    worker_thread+0x4dd/0xd30\n    kthread+0x326/0x410\n    ret_from_fork+0x33b/0x670\n\nAdd a PF-local flag, vf2pf_disabled, that gates work queueing, worker\nprocessing, and interrupt re-enabling during teardown. Set this flag\natomically with the hardware interrupt mask inside\nadf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE\ncluster MSI-X interrupt and flush the PF response workqueue before\ntearing down per-VF locks and state so all in-flight work completes\nbefore vf_info is destroyed.\n\nIntroduce adf_enable_all_vf2pf_interrupts() to clear the flag and\nunmask all VF2PF interrupts under the same lock when SR-IOV is\nre-enabled. This ensures the software flag and hardware state transition\natomically on both the enable and disable paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation originates from a local process or guest with direct access to an assigned QAT VF, using VF MMIO or the VF driver to generate VF2PF messages; it is not network-reachable.\nAC:L - The VF controls mailbox generation, restart-complete signaling, and acknowledgement behavior, and can keep response work active for up to one second while teardown proceeds. VF removal itself also emits shutdown traffic, making the race repeatedly attacker-alignable.\nPR:L - The attacker needs authorized access to an assigned QAT VF, which can be delegated through VFIO to an unprivileged process or tenant VM. No host administrative capability is required during management-initiated teardown or reset.\nUI:N - Exploitation requires no victim-user action; device teardown, hot-unplug, shutdown, or automatic error recovery supplies the concurrent lifecycle event.\nS:C - In a virtualized deployment, a tenant controlling an assigned VF corrupts memory in the host PF kernel, crossing the guest-to-host isolation boundary.\nC:H - The freed VF-state allocation contains kernel pointers and synchronization state, and reclamation of the stale object can support disclosure of arbitrary host-kernel memory.\nI:H - The worker performs writes through destroyed mutexes and stale pointers into freed or reallocated memory, providing memory-corruption primitives potentially usable for host-kernel code execution.\nA:H - The observed use-after-free produces invalid kernel writes and NULL-pointer dereferences, allowing a kernel oops or panic and complete host availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:39.854Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/218c2836b3987f3fa1d9eac505462cded0821e4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/446b4d77599cf1a168573f7fb32a4a6aa4f09219"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d916c1eae1933511a69bffe243b4ee5d7da399c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f344a369d0380d54c8d6c8d24734a78dd5a89817"
        },
        {
          "url": "https://git.kernel.org/stable/c/51144032248cc4ea22917370565650670b8b4e9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/49cd5ac6de8de39a14ead609bb552d372d5602cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e92b28cd74fa433658efeadf21b9d4b01023d7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/277281c10c63791067d24d421f7c43a15faa9096"
        }
      ],
      "title": "crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64438",
    "datePublished": "2026-07-25T08:51:11.740Z",
    "dateReserved": "2026-07-19T15:36:31.788Z",
    "dateUpdated": "2026-08-17T04:55:39.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/caam/caamalg_qi2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1ec775f6a124cce6278ae58b7d1c78a3bc6eef23",
              "status": "affected",
              "version": "8d818c1055013d355d36188f21c7535687374f6c",
              "versionType": "git"
            },
            {
              "lessThan": "bcf3cf74dfb6981e18b22cbf561f859a0f7faa26",
              "status": "affected",
              "version": "8d818c1055013d355d36188f21c7535687374f6c",
              "versionType": "git"
            },
            {
              "lessThan": "6407dc85d0a4306681cf6c9be7f05e05dcb67a37",
              "status": "affected",
              "version": "8d818c1055013d355d36188f21c7535687374f6c",
              "versionType": "git"
            },
            {
              "lessThan": "c8cfe11e48b2a4646fa662fcaa92e14810a28d46",
              "status": "affected",
              "version": "8d818c1055013d355d36188f21c7535687374f6c",
              "versionType": "git"
            },
            {
              "lessThan": "8904b425cfcafe6a820c94b9bdf4b10f7d70f9d7",
              "status": "affected",
              "version": "8d818c1055013d355d36188f21c7535687374f6c",
              "versionType": "git"
            },
            {
              "lessThan": "d0b8cafd529b4ec759190c6081f7a76efb563a8f",
              "status": "affected",
              "version": "8d818c1055013d355d36188f21c7535687374f6c",
              "versionType": "git"
            },
            {
              "lessThan": "59057f5d4e9a195c6dd61695ad3bc4481ddf4f14",
              "status": "affected",
              "version": "8d818c1055013d355d36188f21c7535687374f6c",
              "versionType": "git"
            },
            {
              "lessThan": "8005dc808bcce7d6cc2ae015a3cde1683bee602d",
              "status": "affected",
              "version": "8d818c1055013d355d36188f21c7535687374f6c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/caam/caamalg_qi2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: caam - use print_hex_dump_devel to guard key hex dumps\n\nUse print_hex_dump_devel() for dumping sensitive key material in\n*_setkey() to avoid leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG\nis enabled."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The exposed keys are obtained through local kernel-log interfaces such as /dev/kmsg or syslog; network consumers can cause key installation, but the secret is not returned remotely.\nAC:H - The DPAA2 CAAM implementation must be selected and its normally disabled dynamic-debug callsite must have been enabled by boot configuration or an administrator, a condition an unprivileged attacker cannot create.\nPR:L - On systems with dmesg_restrict disabled, an ordinary local user can read the global kernel log and can invoke the affected callbacks through AF_ALG without capabilities.\nUI:N - No victim action is required after the vulnerable logging configuration is active; services and protocol stacks install keys during normal operation.\nS:U - The disclosure and resulting compromise of kernel-protected cryptographic sessions remain within the host kernel\u0027s security authority.\nC:H - The dumps contain complete encryption and authentication keys, including RFC4106/RFC4543 salt material, enabling decryption of protected IPsec, SMB, or other traffic.\nI:H - Disclosed AEAD or authentication keys permit valid ciphertexts and authentication tags to be forged, enabling unauthorized modification of protected communications.\nA:H - An AF_ALG caller can trigger the unratelimited dumps continuously, potentially stalling systems using slow debug consoles, while stolen authentication keys can also sustain disruption of protected IPsec or SMB sessions."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:53:15.471Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1ec775f6a124cce6278ae58b7d1c78a3bc6eef23"
        },
        {
          "url": "https://git.kernel.org/stable/c/bcf3cf74dfb6981e18b22cbf561f859a0f7faa26"
        },
        {
          "url": "https://git.kernel.org/stable/c/6407dc85d0a4306681cf6c9be7f05e05dcb67a37"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8cfe11e48b2a4646fa662fcaa92e14810a28d46"
        },
        {
          "url": "https://git.kernel.org/stable/c/8904b425cfcafe6a820c94b9bdf4b10f7d70f9d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0b8cafd529b4ec759190c6081f7a76efb563a8f"
        },
        {
          "url": "https://git.kernel.org/stable/c/59057f5d4e9a195c6dd61695ad3bc4481ddf4f14"
        },
        {
          "url": "https://git.kernel.org/stable/c/8005dc808bcce7d6cc2ae015a3cde1683bee602d"
        }
      ],
      "title": "crypto: caam - use print_hex_dump_devel to guard key hex dumps",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64315",
    "datePublished": "2026-07-25T08:49:45.787Z",
    "dateReserved": "2026-07-19T15:36:31.779Z",
    "dateUpdated": "2026-08-17T04:53:15.471Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/cpufreq/qcom-cpufreq-hw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "28a03a3f6e6cda0b0da3b43761d175dec5d14d13",
              "status": "affected",
              "version": "054a3ef683a176a509cc9b37f762029aae942495",
              "versionType": "git"
            },
            {
              "lessThan": "e904961332801c87355f5d11c65bb433e717c489",
              "status": "affected",
              "version": "054a3ef683a176a509cc9b37f762029aae942495",
              "versionType": "git"
            },
            {
              "lessThan": "9de568ef6cdfc7912d5ea8db02843c0e4ef0c75d",
              "status": "affected",
              "version": "054a3ef683a176a509cc9b37f762029aae942495",
              "versionType": "git"
            },
            {
              "lessThan": "bcb8889c4981fdde42d4fd2c29a77d510fe21da2",
              "status": "affected",
              "version": "054a3ef683a176a509cc9b37f762029aae942495",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/cpufreq/qcom-cpufreq-hw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: qcom-cpufreq-hw: Fix possible double free\n\nqcom_cpufreq.data is allocated with devm_kzalloc() in probe() as an\narray of per-domain data. qcom_cpufreq_hw_cpu_init() stores a pointer to\none element of this array in policy-\u003edriver_data.\n\nqcom_cpufreq_hw_cpu_exit() currently calls kfree() on policy-\u003edriver_data.\nThis is not valid because the memory is devm-managed. For the first\ndomain, this can free the devm-managed allocation while the devres entry\nis still active, leading to a possible double free when the platform\ndevice is later detached. For other domains, the pointer may refer to an\nelement inside the array rather than the allocation base.\n\nRemove the kfree(data) call and let devres release qcom_cpufreq.data.\n\nThis issue was found by a static analysis tool I am developing."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:54:28.396Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/28a03a3f6e6cda0b0da3b43761d175dec5d14d13"
        },
        {
          "url": "https://git.kernel.org/stable/c/e904961332801c87355f5d11c65bb433e717c489"
        },
        {
          "url": "https://git.kernel.org/stable/c/9de568ef6cdfc7912d5ea8db02843c0e4ef0c75d"
        },
        {
          "url": "https://git.kernel.org/stable/c/bcb8889c4981fdde42d4fd2c29a77d510fe21da2"
        }
      ],
      "title": "cpufreq: qcom-cpufreq-hw: Fix possible double free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64377",
    "datePublished": "2026-07-25T08:50:28.299Z",
    "dateReserved": "2026-07-19T15:36:31.784Z",
    "dateUpdated": "2026-08-17T04:54:28.396Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/attrib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ea59d9dbc5504e29d420ac4aab774cbce39b0e69",
              "status": "affected",
              "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
              "versionType": "git"
            },
            {
              "lessThan": "d68a14450783ecc5fddae957ac4e1c546dfcfb73",
              "status": "affected",
              "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
              "versionType": "git"
            },
            {
              "lessThan": "08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147",
              "status": "affected",
              "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
              "versionType": "git"
            },
            {
              "lessThan": "2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54",
              "status": "affected",
              "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
              "versionType": "git"
            },
            {
              "lessThan": "d7ea8495fd307b58f8867acd81a1b40075b1d3ba",
              "status": "affected",
              "version": "c380b52f6c5702cc4bdda5e6d456d6c19a201a0b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "406a037d93b769bca248476bd14bbe548dc1ec35",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.132",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ntfs3/attrib.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.132",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()\n\nWhen a compressed or sparse attribute has its clusters frame-aligned,\nvcn is rounded down to the frame start using cmask, which can result\nin vcn != vcn0. In this case, vcn and vcn0 may reside in different\nattribute segments.\n\nThe code already handles the case where vcn is in a different segment\nby loading its runs before allocation. However, it fails to load runs\nfor vcn0 when vcn0 resides in a different segment than vcn. This causes\nrun_lookup_entry() to return SPARSE_LCN for vcn0 since its segment was\nnever loaded into the in-memory run list, triggering the WARN_ON(1).\n\nFix this by adding a missing check for vcn0 after the existing vcn\nsegment check. If vcn0 falls outside the current segment range\n[svcn, evcn1), find and load the attribute segment containing vcn0\nbefore performing the run lookup.\n\nThe following scenario triggers the bug:\n  attr_data_get_block_locked()\n    vcn = vcn0 \u0026 cmask        \u003c- vcn != vcn0 after frame alignment\n    load runs for vcn segment \u003c- vcn0 segment not loaded!\n    attr_allocate_clusters()  \u003c- allocation succeeds\n    run_lookup_entry(vcn0)    \u003c- vcn0 not in run -\u003e SPARSE_LCN\n    WARN_ON(1)                \u003c- bug fires here!"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T14:33:47.674Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ea59d9dbc5504e29d420ac4aab774cbce39b0e69"
        },
        {
          "url": "https://git.kernel.org/stable/c/d68a14450783ecc5fddae957ac4e1c546dfcfb73"
        },
        {
          "url": "https://git.kernel.org/stable/c/08fad5d5a26cc55c0ecb68ac59ba3be5e31f4147"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b4ae1ce613ade8a7e118fba4a5a77cd23e97e54"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7ea8495fd307b58f8867acd81a1b40075b1d3ba"
        }
      ],
      "title": "fs/ntfs3: fix missing run load for vcn0 in attr_data_get_block_locked()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53027",
    "datePublished": "2026-06-24T16:29:35.740Z",
    "dateReserved": "2026-06-09T07:44:35.379Z",
    "dateUpdated": "2026-07-24T14:33:47.674Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}