{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "707664027bb9307f7268eda403af7c4ccd9b8644",
              "status": "affected",
              "version": "776f742040ca5eb6242c60f29ac73d5752a5b621",
              "versionType": "git"
            },
            {
              "lessThan": "3b02275833a0d3e6583627995d614fa99bdf364f",
              "status": "affected",
              "version": "776f742040ca5eb6242c60f29ac73d5752a5b621",
              "versionType": "git"
            },
            {
              "lessThan": "a1f0f7dc7eb15754e6931b433edb7beb754c996a",
              "status": "affected",
              "version": "776f742040ca5eb6242c60f29ac73d5752a5b621",
              "versionType": "git"
            },
            {
              "lessThan": "25e5a3fe4f15e30f74eca42cbf3bcc3a3fbeda79",
              "status": "affected",
              "version": "776f742040ca5eb6242c60f29ac73d5752a5b621",
              "versionType": "git"
            },
            {
              "lessThan": "ece2ebb34247d573142617dfc534a9dc11ba59be",
              "status": "affected",
              "version": "776f742040ca5eb6242c60f29ac73d5752a5b621",
              "versionType": "git"
            },
            {
              "lessThan": "c9dcfe6b8b71369e1d732e2ff622c3696a2f032c",
              "status": "affected",
              "version": "776f742040ca5eb6242c60f29ac73d5752a5b621",
              "versionType": "git"
            },
            {
              "lessThan": "5a21ab03829cb6d2682c127f22e2b9cd63b4393f",
              "status": "affected",
              "version": "776f742040ca5eb6242c60f29ac73d5752a5b621",
              "versionType": "git"
            },
            {
              "lessThan": "99a948382af8a225e2d5e54a7052158cd6281cc6",
              "status": "affected",
              "version": "776f742040ca5eb6242c60f29ac73d5752a5b621",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.5"
            },
            {
              "lessThan": "4.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames\n\nmwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with\nieee80211_amsdu_to_8023s() and walks the resulting subframes. For each\nsubframe it passes the subframe data pointer to\nmwifiex_process_tdls_action_frame(), but pairs it with skb-\u003elen, the\nlength of the A-MSDU parent, instead of rx_skb-\u003elen:\n\n\trx_skb = __skb_dequeue(\u0026list);\n\trx_hdr = (struct rx_packet_hdr *)rx_skb-\u003edata;\n\tif (ISSUPP_TDLS_ENABLED(priv-\u003eadapter-\u003efw_cap_info) \u0026\u0026\n\t    ntohs(rx_hdr-\u003eeth803_hdr.h_proto) == ETH_P_TDLS) {\n\t\tmwifiex_process_tdls_action_frame(priv, (u8 *)rx_hdr,\n\t\t\t\t\t\t  skb-\u003elen);\n\t}\n\nThe parent is not a valid description of that buffer, and may not be\nvalid memory at all. ieee80211_amsdu_to_8023s() ends with\n\n\tif (!reuse_skb)\n\t\tdev_kfree_skb(skb);\n\nand it only sets reuse_skb when the parent is linear, is not a\nhead_frag, and is being consumed as the *last* subframe. So when the\nparent does not qualify for reuse it has already been freed, and the\nread of skb-\u003elen is a use-after-free. When it is reused, skb-\u003elen is\nthe length of the last subframe, applied to every earlier subframe,\nwhich over-states the buffer whenever an earlier subframe is shorter.\n\nThe callee cannot absorb a wrong length, because it derives its own\nceiling from the value it is given. Each frame type computes\n\n\ties_len = len - sizeof(struct ethhdr) - TDLS_*_FIX_LEN;\n\nand the element walk is then bounded entirely against that ceiling,\n\n\tfor (end = pos + ies_len; pos + 1 \u003c end; pos += 2 + pos[1]) {\n\t\tu8 ie_len = pos[1];\n\n\t\tif (pos + 2 + ie_len \u003e end)\n\t\t\tbreak;\n\nso a too-large len moves end past the end of the subframe and the walk\nreads and copies beyond it. The A-MSDU layout is chosen by the sender,\nwhich makes the difference between the last subframe and a shorter\nearlier one remotely selectable. Reaching this requires TDLS support in\nfirmware and the TDLS ethertype on the subframe.\n\nThe other caller, mwifiex_process_rx_packet(), is correct: it passes a\npointer and a length that describe the same region of the RX buffer.\n\nPass rx_skb-\u003elen, the length of the subframe actually being parsed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is reached when the mwifiex driver processes attacker-supplied A-MSDU TDLS frames received over WiFi from a nearby peer, AP, or injector on the same wireless segment, which is an adjacent RF attack vector rather than remote Internet or local syscall access.\nAC:L - Once TDLS-capable mwifiex firmware receives an A-MSDU, the attacker fully controls subframe sizes and TDLS content to trigger either the skb use-after-free or the overstated-length out-of-bounds parse reliably without depending on uncontrollable timing or memory layout.\nPR:N - Exploitation requires only the ability to deliver crafted 802.11 data frames to the victim radio; it does not require any local account, capability, or root access on the Linux host and is not gated by user-namespace privilege boundaries.\nUI:N - No victim user action beyond normal wireless operation is required; the driver parses malicious TDLS subframes automatically during receive and A-MSDU decomposition before forwarding traffic to the network stack.\nS:U - Impact is confined to kernel memory corruption and driver state within the host kernel security authority; it does not by itself cross a VM, container, or IOMMU boundary to affect a separate security domain.\nC:H - The skb use-after-free reads freed sk_buff metadata and the inflated length drives an out-of-bounds IE walk that reads kernel memory beyond the subframe, including attacker-positioned bytes from subsequent A-MSDU subframes, enabling substantial information disclosure.\nI:H - The same out-of-bounds parse copies attacker-controlled IE data from beyond the subframe into heap-allocated sta_node/tdls_cap structures via memcpy, providing a memory-corruption primitive that can be developed into arbitrary kernel write or code execution.\nA:H - Reading skb-\u003elen after the parent A-MSDU skb may already be freed can immediately fault or corrupt memory, and the out-of-bounds TDLS element parsing can provoke kernel oopses or panics even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:37:43.361Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/707664027bb9307f7268eda403af7c4ccd9b8644"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b02275833a0d3e6583627995d614fa99bdf364f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1f0f7dc7eb15754e6931b433edb7beb754c996a"
        },
        {
          "url": "https://git.kernel.org/stable/c/25e5a3fe4f15e30f74eca42cbf3bcc3a3fbeda79"
        },
        {
          "url": "https://git.kernel.org/stable/c/ece2ebb34247d573142617dfc534a9dc11ba59be"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9dcfe6b8b71369e1d732e2ff622c3696a2f032c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a21ab03829cb6d2682c127f22e2b9cd63b4393f"
        },
        {
          "url": "https://git.kernel.org/stable/c/99a948382af8a225e2d5e54a7052158cd6281cc6"
        }
      ],
      "title": "wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74488",
    "datePublished": "2026-08-15T12:27:18.867Z",
    "dateReserved": "2026-08-15T05:44:03.905Z",
    "dateUpdated": "2026-08-19T16:37:43.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/crypto/policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "174633a468817a49bd474bcfc9067c84e54efe68",
              "status": "affected",
              "version": "14f3db5542e62bcf6fe088a09760ac52d55306c5",
              "versionType": "git"
            },
            {
              "lessThan": "0baeb730044981f5ec5fb7d62a3763835ea606f6",
              "status": "affected",
              "version": "14f3db5542e62bcf6fe088a09760ac52d55306c5",
              "versionType": "git"
            },
            {
              "lessThan": "33b7e810ce09955aa02f3b632455cf5e7ac990a9",
              "status": "affected",
              "version": "14f3db5542e62bcf6fe088a09760ac52d55306c5",
              "versionType": "git"
            },
            {
              "lessThan": "6a67c460b12315033268dce597546984fe5739e7",
              "status": "affected",
              "version": "14f3db5542e62bcf6fe088a09760ac52d55306c5",
              "versionType": "git"
            },
            {
              "lessThan": "653e888a24c87b8bbeab44d7e558a1c1a3641088",
              "status": "affected",
              "version": "14f3db5542e62bcf6fe088a09760ac52d55306c5",
              "versionType": "git"
            },
            {
              "lessThan": "98516ba8b817f34e86bdd7a5b7a383cff75c3ddf",
              "status": "affected",
              "version": "14f3db5542e62bcf6fe088a09760ac52d55306c5",
              "versionType": "git"
            },
            {
              "lessThan": "cf6c993c0feca7984797e634deba3c80342e199a",
              "status": "affected",
              "version": "14f3db5542e62bcf6fe088a09760ac52d55306c5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/crypto/policy.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()\n\nfscrypt_ioctl_set_policy() calls inode_owner_or_capable() with\n\u0026nop_mnt_idmap before allowing an encryption policy to be set, instead\nof the idmap of the mount the ioctl was issued on.\n\nfscrypt is used by filesystems that support idmapped mounts (e.g. ext4,\nf2fs), so on such a mount this compares the caller\u0027s fsuid against the\nunmapped on-disk owner rather than the mapped owner: the actual owner\ncan be wrongly denied with -EACCES and an unrelated caller wrongly\nallowed.  Use file_mnt_idmap(filp) instead."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a local process to open a directory on an idmapped ext4/f2fs filesystem and issue FS_IOC_SET_ENCRYPTION_POLICY via ioctl(); there is no network, adjacent-radio, or physical-device attack path to the vulnerable fscrypt_ioctl_set_policy() check.\nAC:L - On idmapped mounts the UID mismatch is structural, not random: any local user whose fsuid equals the inode\u0027s unmapped on-disk owner can open an empty victim directory, add their own fscrypt key, and trigger the ioctl without races or attacker-uncontrollable memory layout.\nPR:L - Only basic local user privileges are needed; the attacker must be able to open the target directory and call FS_IOC_ADD_ENCRYPTION_KEY plus FS_IOC_SET_ENCRYPTION_POLICY, with no real-root or init-namespace capability required beyond normal DAC permissions on the path.\nUI:N - Exploitation requires no action by the victim; the attacker alone issues the ioctl on an empty directory they can open, and the authorization bypass occurs entirely within the attacker\u0027s own syscall sequence.\nS:U - This is an incorrect inode_owner_or_capable() authorization check in the kernel fscrypt ioctl path on idmapped mounts; impact stays within the same kernel security authority and does not constitute VM escape, hypervisor bypass, or IOMMU boundary crossing.\nC:H - A wrongly authorized attacker can bind a victim\u0027s empty directory to an attacker-controlled fscrypt master key, then decrypt any sensitive files the victim later creates there, giving broad read access to victim data rather than a small bounded leak.\nI:H - The ioctl persistently modifies filesystem encryption policy and on-disk fscrypt context for a directory the attacker does not own, granting unauthorized control over a critical security property of victim data at rest.\nA:H - The bug both wrongly denies legitimate directory owners with -EACCES and lets attackers encrypt a victim\u0027s empty directory with an attacker-held key, preventing the real owner from using or recovering that directory and its future contents."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:22.483Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/174633a468817a49bd474bcfc9067c84e54efe68"
        },
        {
          "url": "https://git.kernel.org/stable/c/0baeb730044981f5ec5fb7d62a3763835ea606f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/33b7e810ce09955aa02f3b632455cf5e7ac990a9"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a67c460b12315033268dce597546984fe5739e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/653e888a24c87b8bbeab44d7e558a1c1a3641088"
        },
        {
          "url": "https://git.kernel.org/stable/c/98516ba8b817f34e86bdd7a5b7a383cff75c3ddf"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf6c993c0feca7984797e634deba3c80342e199a"
        }
      ],
      "title": "fscrypt: use the mount idmap for the owner check in fscrypt_ioctl_set_policy()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74595",
    "datePublished": "2026-08-22T15:31:45.649Z",
    "dateReserved": "2026-08-15T05:44:03.919Z",
    "dateUpdated": "2026-08-25T05:40:22.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/display/intel_hdcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "336cf6d80d41457442b659e7ba7a7badc0ffe79d",
              "status": "affected",
              "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
              "versionType": "git"
            },
            {
              "lessThan": "389079bf04e6f0c6f10f5b879f6d7a9cf80f0567",
              "status": "affected",
              "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
              "versionType": "git"
            },
            {
              "lessThan": "84351f12390349ba010920fc247e1a0b12e41eb3",
              "status": "affected",
              "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
              "versionType": "git"
            },
            {
              "lessThan": "2106fb490b2c6003e23ad6ff36ce823a2170e138",
              "status": "affected",
              "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
              "versionType": "git"
            },
            {
              "lessThan": "3d2ef8d389495e7889c6062d8bddc46d2a5fbdef",
              "status": "affected",
              "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
              "versionType": "git"
            },
            {
              "lessThan": "984085c5b53572e2e03fd5fc4817e86ef1effc6e",
              "status": "affected",
              "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
              "versionType": "git"
            },
            {
              "lessThan": "bbb15a6b042d02e5508a02b4847e02d2579ee7bc",
              "status": "affected",
              "version": "e03187e12cae57c09b521b6f7dd7c7f9aa2b62e9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/i915/display/intel_hdcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915/hdcp: check streams[] bounds before overflow\n\nThe data-\u003estreams[] overflow check is done after the buffer overflow has\nalready happened. Move the overflow check before the write.\n\nSide note, emitting a warning splat with a backtrace might be overkill\nhere, but prefer not changing the behaviour other than not doing the\noverrun.\n\nDiscovered using AI-assisted static analysis confirmed by Intel Product\nSecurity.\n\n(cherry picked from commit 9284ab3b6e776c315883ac2611283d263c9460fd)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is reached through a local DRM atomic modeset ioctl on /dev/dri/cardN that sets the \"Content Protection\" connector property, driving intel_hdcp_enable() -\u003e intel_hdcp_prepare_streams(); no network or remote path exists to the i915 display HDCP code.\nAC:L - Any DP MST topology with more connected MST connectors on one digital port than the device has pipes (a common dock/hub/daisy-chain setup, and easily arranged by anyone with access to the machine\u0027s display outputs) makes every HDCP enable request overflow the buffer deterministically, with no race or memory-layout condition to win.\nPR:L - The attacker only needs access to the DRM device node as DRM master, which an ordinary user in a local graphical session (video/render group, logind seat) has; no CAP_SYS_ADMIN or root is required to request HDCP content protection on an MST connector.\nUI:N - The attacker performs the atomic commit that requests content protection themselves; no action by another user is needed, and on a system already running a compositor with HDCP desired the overflow occurs automatically on the modeset.\nS:U - The corruption is confined to kernel heap memory within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The out-of-bounds write corrupts adjacent objects in a small kmalloc slab, and such heap corruption is a standard primitive for pivoting to arbitrary kernel memory disclosure by overwriting neighbouring pointers or length fields.\nI:H - This is a heap out-of-bounds write past a kzalloc\u0027d streams[] buffer sized to INTEL_NUM_PIPES, with attacker-influenced VCPI values and an attacker-controlled overflow length determined by the MST topology, giving corruption of adjacent slab objects that can be leveraged for control-flow hijack.\nA:H - Overwriting adjacent slab allocations reliably produces slab corruption, oops, or panic, and the path can be re-triggered on every HDCP enable/modeset, so the system can be crashed repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:11.002Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/336cf6d80d41457442b659e7ba7a7badc0ffe79d"
        },
        {
          "url": "https://git.kernel.org/stable/c/389079bf04e6f0c6f10f5b879f6d7a9cf80f0567"
        },
        {
          "url": "https://git.kernel.org/stable/c/84351f12390349ba010920fc247e1a0b12e41eb3"
        },
        {
          "url": "https://git.kernel.org/stable/c/2106fb490b2c6003e23ad6ff36ce823a2170e138"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d2ef8d389495e7889c6062d8bddc46d2a5fbdef"
        },
        {
          "url": "https://git.kernel.org/stable/c/984085c5b53572e2e03fd5fc4817e86ef1effc6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/bbb15a6b042d02e5508a02b4847e02d2579ee7bc"
        }
      ],
      "title": "drm/i915/hdcp: check streams[] bounds before overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68253",
    "datePublished": "2026-08-10T12:01:19.402Z",
    "dateReserved": "2026-07-30T09:28:09.377Z",
    "dateUpdated": "2026-08-23T12:46:11.002Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/libiscsi_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a51812842084fd390590ab8dc0431f10c73ddc56",
              "status": "affected",
              "version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
              "versionType": "git"
            },
            {
              "lessThan": "a8f94cc9f0e5759252551be3a172960c57f21f54",
              "status": "affected",
              "version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
              "versionType": "git"
            },
            {
              "lessThan": "f1a3a51fc5dba0e99532379665069f1700da6b44",
              "status": "affected",
              "version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
              "versionType": "git"
            },
            {
              "lessThan": "c97b5265cc47775f77fd2a23d6bde0426997b233",
              "status": "affected",
              "version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
              "versionType": "git"
            },
            {
              "lessThan": "084af0253673425ce2ae62e3c7f74f0dd023711b",
              "status": "affected",
              "version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
              "versionType": "git"
            },
            {
              "lessThan": "72815741715bd41556dac5eeb068bf0f8af06ee7",
              "status": "affected",
              "version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
              "versionType": "git"
            },
            {
              "lessThan": "b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676",
              "status": "affected",
              "version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
              "versionType": "git"
            },
            {
              "lessThan": "c1dea15f819cded9b3faf58f8bec72323568b6e6",
              "status": "affected",
              "version": "a081c13e39b5c17052a7b46fafa61019c4c110ff",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/libiscsi_tcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.29"
            },
            {
              "lessThan": "2.6.29",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.29",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer\n\niscsi_tcp_hdr_dissect() receives the data segment of several PDU types\ninto the fixed-size conn-\u003edata buffer, which is allocated for\nISCSI_DEF_MAX_RECV_SEG_LEN (8192) bytes.  For the LOGIN_RSP, TEXT_RSP,\nREJECT and ASYNC_EVENT opcodes the dissect path already rejects a PDU\nwhose DataSegmentLength exceeds that buffer.\n\nThe SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) path also copies its\ndata segment (sense/response data) into conn-\u003edata via\niscsi_tcp_data_recv_prep(), but it does so without the same check.  The\nonly upstream bound on in.datalen is conn-\u003emax_recv_dlength, the\ninitiator\u0027s advertised MaxRecvDataSegmentLength, which is commonly\nnegotiated well above 8192 (open-iscsi defaults to 262144).  A target\nthat returns a SCSI Response with a DataSegmentLength between 8193 and\nmax_recv_dlength therefore overflows the 8192-byte conn-\u003edata buffer.\n\nOnce the same bound applies, ISCSI_OP_SCSI_CMD_RSP is handled exactly\nlike those responses: bound the data segment, receive it into conn-\u003edata\nwhen present, and otherwise complete the PDU with no data.  Fold the\nopcode into that case group rather than duplicating the check."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A malicious or compromised iSCSI target delivers crafted SCSI Command Response PDUs over the established TCP iSCSI session; reception flows through iscsi_sw_tcp_recv/iscsi_tcp_recv_skb into iscsi_tcp_hdr_dissect without local access.\nAC:L - The attacker controls the target and can set DataSegmentLength between 8193 and negotiated max_recv_dlength (open-iscsi commonly 262144) on SCSI_CMD_RSP for any outstanding command ITT; no races or victim-specific heap layout are required.\nPR:N - No privileges on the victim host are needed; a remote attacker acting as or MITMing the iSCSI target sends malicious responses after session login, independent of victim user accounts or capabilities.\nUI:N - On systems with persistent iSCSI sessions (cloud VMs, SAN-boot hosts, Kubernetes iSCSI volumes), exploitation triggers automatically during normal SCSI I/O when command responses are received; no victim action is needed at attack time.\nS:U - Heap corruption is confined to the kernel iSCSI initiator on the affected host; successful exploitation yields kernel compromise or DoS within the same security authority, not a VM escape or cross-boundary scope change.\nC:H - iscsi_tcp_segment_recv memcpy writes up to max_recv_dlength bytes into an 8192-byte conn-\u003edata buffer, causing a large heap overflow whose controlled corruption can be leveraged for arbitrary kernel memory disclosure.\nI:H - Attacker-controlled response data is copied past the fixed conn-\u003edata allocation via iscsi_tcp_data_recv_prep/iscsi_segment_init_linear, enabling heap metadata/object corruption exploitable for arbitrary kernel write and privilege escalation.\nA:H - Overflowing the conn-\u003edata heap buffer can immediately corrupt adjacent kernel allocations and cause oops/panic; a malicious target can repeatedly trigger this on active sessions to deny storage availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:38:57.393Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a51812842084fd390590ab8dc0431f10c73ddc56"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8f94cc9f0e5759252551be3a172960c57f21f54"
        },
        {
          "url": "https://git.kernel.org/stable/c/f1a3a51fc5dba0e99532379665069f1700da6b44"
        },
        {
          "url": "https://git.kernel.org/stable/c/c97b5265cc47775f77fd2a23d6bde0426997b233"
        },
        {
          "url": "https://git.kernel.org/stable/c/084af0253673425ce2ae62e3c7f74f0dd023711b"
        },
        {
          "url": "https://git.kernel.org/stable/c/72815741715bd41556dac5eeb068bf0f8af06ee7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0aa3e8e2ab4ca92adb28a3ef41873b3363b8676"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1dea15f819cded9b3faf58f8bec72323568b6e6"
        }
      ],
      "title": "scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74556",
    "datePublished": "2026-08-15T12:28:01.359Z",
    "dateReserved": "2026-08-15T05:44:03.916Z",
    "dateUpdated": "2026-08-19T16:38:57.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/actions.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b77126b2915900f69f9fcf5d624a77c8e6d50c31",
              "status": "affected",
              "version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
              "versionType": "git"
            },
            {
              "lessThan": "6cc523eaee72c4e91894136cff64946ae9de2cda",
              "status": "affected",
              "version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
              "versionType": "git"
            },
            {
              "lessThan": "22e0ca88090d89c128078062186b03bb5fdc4f98",
              "status": "affected",
              "version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
              "versionType": "git"
            },
            {
              "lessThan": "736e972f3f8a304158345223ac6e816166a467ce",
              "status": "affected",
              "version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
              "versionType": "git"
            },
            {
              "lessThan": "e84dfaac50aab45ad8c670da43e3aa1f97bd2a41",
              "status": "affected",
              "version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
              "versionType": "git"
            },
            {
              "lessThan": "e0ba8eaef2a0d02a7a485e6a7157e47272b65cea",
              "status": "affected",
              "version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
              "versionType": "git"
            },
            {
              "lessThan": "393f3c72600ab6721d732a0ab245bc896c5b28fc",
              "status": "affected",
              "version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
              "versionType": "git"
            },
            {
              "lessThan": "bc62e843bc48f933da765ce47079fd992e535794",
              "status": "affected",
              "version": "ec0d043d05e6e3c0c2fac5de922c800c027c6386",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/actions.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.3"
            },
            {
              "lessThan": "4.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: fix skb leak on flow key update failure during ct\n\novs_ct_execute() always steals or frees the skb on failure while\novs_flow_key_update() does not.  So, if it fails and we return right\naway, the skb ends up leaked.\n\nFix that by breaking instead and letting the common error handling\ncode at the bottom of the loop to free the skb properly.\n\nThis is a very unlikely scenario as it requires the packet to become\nunparseable by applying a set of actions on a previously parseable skb,\nbut should be fixed nevertheless.\n\nReported by Sashiko."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:37:05.367Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b77126b2915900f69f9fcf5d624a77c8e6d50c31"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cc523eaee72c4e91894136cff64946ae9de2cda"
        },
        {
          "url": "https://git.kernel.org/stable/c/22e0ca88090d89c128078062186b03bb5fdc4f98"
        },
        {
          "url": "https://git.kernel.org/stable/c/736e972f3f8a304158345223ac6e816166a467ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/e84dfaac50aab45ad8c670da43e3aa1f97bd2a41"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0ba8eaef2a0d02a7a485e6a7157e47272b65cea"
        },
        {
          "url": "https://git.kernel.org/stable/c/393f3c72600ab6721d732a0ab245bc896c5b28fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc62e843bc48f933da765ce47079fd992e535794"
        }
      ],
      "title": "net: openvswitch: fix skb leak on flow key update failure during ct",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74464",
    "datePublished": "2026-08-15T12:27:03.786Z",
    "dateReserved": "2026-08-15T05:44:03.901Z",
    "dateUpdated": "2026-08-19T16:37:05.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/binfmt_misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "96bd5d4fea2970b9b08265293ca7a10b9b27c0fd",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9970e094e5d60f0d66914bf9a97d1ef19107ebf5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b29e3c1f375c1296362d219ff38bceddf2d2a88a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "1819f82dee766c58295ecaacdac02cdf6837d7a4",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "1853e95c9bfe69ef1dd862b3f551e68f4a1b76cc",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "840bb9c49c3e75fb32b593d67ab32f6b77122262",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "9a2d87db3898b5993b64fd258d0334e0eba9ee0d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "8e85d50ba1117fd446bf9a250bd8a97d48384bdc",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/binfmt_misc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: reject a flag character as the field delimiter\n\nThe registration string starts with a user chosen delimiter that\nseparates the individual fields. So that the field parsers terminate\neven on a truncated string create_entry() pads the buffer with that\nsame delimiter:\n\n\tmemset(buf + count, del, 8);\n\nMost fields are scanned for the delimiter with strchr()/scanarg() and\nhappily stop on the padding. The flags field is different: instead of\nscanning for the delimiter check_special_flags() consumes the flag\ncharacters \u0027P\u0027, \u0027O\u0027, \u0027C\u0027 and \u0027F\u0027 and stops at the first byte that is\nnone of them, relying on the trailing delimiter to end the scan.\n\nIf the delimiter is itself a flag character the padding no longer acts\nas a terminator. The scan swallows all eight padding bytes and keeps\nreading past the end of the allocation until it hits a byte that is\nnot a flag character. For example registering\n\n\tPaPEPPxPPiP\n\nwith \u0027P\u0027 as the delimiter (name \"a\", type extension, magic \"x\",\ninterpreter \"i\", empty flags) leaves the flag scan running off the end\nof the buffer. The registration is rejected in the end because the\nparser does not stop exactly at buf + count, but only after the out of\nbounds read has already happened. With an unlucky allocation layout the\nscan can walk into an unmapped page; under KASAN it is reported as a\nslab out of bounds read. binfmt_misc mounts are available to\nunprivileged users in a user namespace so the read is reachable without\nprivileges.\n\nReject a delimiter that is one of the flag characters up front. Such a\nregistration was always rejected anyway, only after the out of bounds\nread, so no valid registration string changes meaning."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a local write() to binfmt_misc/register via bm_register_write()-\u003ecreate_entry(); the path is a VFS syscall on a mounted filesystem, not any network protocol or remote packet handler.\nAC:L - An attacker fully controls the registration string and can deterministically choose delimiter P/O/C/F with empty flags so check_special_flags() consumes padding and reads past the kmalloc buffer on every attempt; no race or victim-specific state is required.\nPR:L - binfmt_misc has FS_USERNS_MOUNT; an unprivileged local user can unshare a user namespace, mount binfmt_misc, and write register without init-namespace root, matching the fix commit\u0027s stated unprivileged reachability.\nUI:N - Triggering is entirely attacker-driven through mounting binfmt_misc and writing a crafted registration string; no victim must open files, click links, or perform any interactive action beyond the attacker\u0027s own syscalls.\nS:U - The slab out-of-bounds read and any disclosed kernel data remain within the host kernel security authority; this is standard local kernel memory access, not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - check_special_flags() scans past buf+count+8 through adjacent kmalloc/slab memory until a non-P/O/C/F byte, a classic out-of-bounds read that can disclose kernel pointers and other sensitive heap contents for KASLR defeat.\nI:N - The defect is read-only: check_special_flags() only dereferences bytes beyond the allocation and sets flags on the soon-freed Node; it performs no out-of-bounds write, metadata corruption, or control-flow hijack primitive.\nA:H - The unbounded flag scan can walk into an unmapped page and fault the kernel; KASAN reports slab-out-of-bounds, and the single write() to register is trivially repeatable for denial-of-service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:37:40.898Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/96bd5d4fea2970b9b08265293ca7a10b9b27c0fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/9970e094e5d60f0d66914bf9a97d1ef19107ebf5"
        },
        {
          "url": "https://git.kernel.org/stable/c/b29e3c1f375c1296362d219ff38bceddf2d2a88a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1819f82dee766c58295ecaacdac02cdf6837d7a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/1853e95c9bfe69ef1dd862b3f551e68f4a1b76cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/840bb9c49c3e75fb32b593d67ab32f6b77122262"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a2d87db3898b5993b64fd258d0334e0eba9ee0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e85d50ba1117fd446bf9a250bd8a97d48384bdc"
        }
      ],
      "title": "binfmt_misc: reject a flag character as the field delimiter",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74485",
    "datePublished": "2026-08-15T12:27:16.980Z",
    "dateReserved": "2026-08-15T05:44:03.905Z",
    "dateUpdated": "2026-08-19T16:37:40.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/mmap_lock.h",
            "mm/pagewalk.c",
            "mm/vmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "39c6772b56a6bbdd62794833f74232971d94d7c9",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "lessThan": "8d7f560f4b0482d469de962fbe4b59c37561052e",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "lessThan": "7ac8a333dd41ba5e1b4e8c6edbc48b15446c5468",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "lessThan": "c5bf8cd148cfea948cfa3db71da427294b20db0f",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "lessThan": "3cc26c8907db0f5d1ff8043b5851ee572e9b3c98",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "lessThan": "26444eb71465c9934d9d418ef69c43f61185329b",
              "status": "affected",
              "version": "b6bdb7517c3d3f41f20e5c2948d6bc3f8897394e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "31895cfd79564111cdd5a9f48c5d491ae26a238e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9c7f7bdb1932f8c1e5f80d32c717184701afe701",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "acdb4981644c8e31ccee294bdefff475c0cf587b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0454e2fad9306961540ee7e84da47a8e345b7d22",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.125",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.91",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.31",
              "versionType": "semver"
            },
            {
              "lessThan": "4.16",
              "status": "affected",
              "version": "4.15.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/mmap_lock.h",
            "mm/pagewalk.c",
            "mm/vmalloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.125",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.91",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.15.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF\n\nPatch series \"mm: fix UAF caused by race between ptdump and vmap pgtable\nfreeing\", v6.\n\nKernel page table walkers fall into two broad categories - those ranges\nwhere no exclusion is required via walk_kernel_page_table_range_lockless()\nand those where exclusion is required via walk_kernel_page_table_range()\nor walk_page_range_debug().\n\nThe former category is used only by arm64 arch code operating on ranges it\nboth wholly owns and does not concurrently write.\n\nThe latter category consists of kernel page table walkers operating on\nranges that are wholly owned (but which need exclusion against concurrent\nwriters).\n\nThe lock used for exclusion is the mmap lock, and for kernel ranges this\nis the mmap lock on init_mm.\n\nptdump is a special case being both the only user of\nwalk_page_range_debug(), and the only case in which it walks ranges it\ndoes not own.\n\nThis presents a problem, as page tables may be freed under ptdump.  And\nindeed there is a use-after-free bug in the kernel as a result, which this\nseries addresses.\n\nvmap promotes page tables to huge leaf entries where possible, freeing the\nlower page table when it does.  It does this with no meaningful locks held\nagainst concurrent ptdump walks.\n\nAs a result, use-after-free can currently occur.  This series addresses\nthe issue by having the vmap huge promotion logic acquire the mmap read\nlock while both setting the huge page table entry and freeing the prior\nleaf page table.\n\nThe ptdump code already acquires the mmap write lock, so by doing so we\nensure that the ptdump walker only ever observes either the huge page\ntable entry or the existing page table entry, and nothing is freed\nunderneath it.\n\nA mitigation for this issue was already applied for arm64 in commit\nfa93b45fd397 (\"arm64: Enable vmalloc-huge with ptdump\"), which this series\nhas to deal with carefully.\n\nThis mitigation resolves the issue by acquiring the mmap read lock on\ninit_mm on vmap page table free if a ptdump is in progress.\n\nHowever the fix in this series would cause a deadlock if we were to simply\napply it for arm64 without also reverting the change.\n\nThis is because vmap may acquire the read lock before ptdump attempts to\nacquire the write lock, which then gets queued, and rwsem starvation rules\nmean that the (unacknowledged) nested mmap read lock in the arm64 code\nwould also block, meaning the original read lock is never released and\nthus deadlock.\n\nThis series works around this by #ifndef CONFIG_ARM64\u0027ing the mmap read\nlock in vmap logic, then partially reverting commit fa93b45fd397 (\"arm64:\nEnable vmalloc-huge with ptdump\"), keeping the enablement of huge vmap\nsupport, and removing the ifdeffery with the partial revert patch.\n\nThere are related issues that are also addressed in this series:\n\n* x86 page attribute logic, specifically Change Page Attributes (CPA),\n  implements a feature whereby huge ranges can be collapsed into huge leaf\n  entries. This can similarly cause a UAF when done in parallel with a\n  ptdump walk, so similarly acquire the init_mm mmap lock to avoid this.\n\n* The CPA logic allows concurrent page table manipulation and CPA\n  collapse, meaning the former risks accessing a page table the latter\n  frees. Fix this by acquiring mmap write lock on init_mm across the\n  whole CPA collapse operation and read lock on the page table\n  manipulation.\n\n* x86 and arm64 permit walks of non-kernel mm\u0027s (both allowing efi mm\n  walks, and in x86\u0027s case arbitrary mm\u0027s), so we ensure kernel mappings\n  remain stable by locking the init_mm as well as the mm being walked.\n\nThe ordering of patches is established for both strict dependencies (the\narm64 partial revert in particular has to be done after the vmap changes)\nand logical ones (the non-kernel mm fix only makes sense once the vmap/CPA\nfixes are in place).\n\n\nThis patch (of 3):\n\nCurrently there is a nasty ra\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:58.392Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/39c6772b56a6bbdd62794833f74232971d94d7c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d7f560f4b0482d469de962fbe4b59c37561052e"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ac8a333dd41ba5e1b4e8c6edbc48b15446c5468"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5bf8cd148cfea948cfa3db71da427294b20db0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3cc26c8907db0f5d1ff8043b5851ee572e9b3c98"
        },
        {
          "url": "https://git.kernel.org/stable/c/26444eb71465c9934d9d418ef69c43f61185329b"
        }
      ],
      "title": "mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74672",
    "datePublished": "2026-08-22T15:32:42.210Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-23T12:47:58.392Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21c77486f5a60bb9c0433c21de62a5f25d5091f1",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "c835f2b0b7167584832b516c9b0a26e9180d1d0b",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "ca41d9f3a21586bf29df53eec05152ecf2b2f94f",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            },
            {
              "lessThan": "b921b8613790a3f9e78ab64017fa7149ef0b750c",
              "status": "affected",
              "version": "2718d91816eeed03c09c8abe872e45f59078768c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panthor/panthor_fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: validate firmware interface structure sizes\n\niface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual\naddress points inside the shared section. The returned pointer is later\nused as a full firmware interface structure, so accepting an address near\nthe end of the shared section can still lead to out-of-bounds accesses.\n\nPass the expected object size to iface_fw_to_cpu_addr() and reject ranges\nthat do not fit entirely in the shared section."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Out-of-bounds kernel accesses occur when panthor_fw_init_ifaces() accepts firmware MCU input_va/output_va at probe, then runtime DRM paths (GROUP_SUBMIT, scheduling, job IRQ handlers) dereference those cached interface pointers via /dev/dri/renderD* ioctls; no network or physical access is involved.\nAC:L - Once malicious or mis-layouted firmware publishes interface VAs near the shared-section end, iface_fw_to_cpu_addr() deterministically returns out-of-bounds pointers and every GPU submission or firmware event reliably performs the same OOB reads/writes without races or uncontrollable heap layout.\nPR:L - Planting a crafted mali_csffw.bin that makes the MCU publish bad interface VAs is feasible for local vendor/system accounts on Mali Android, Chromebook, and embedded firmware partitions; triggering the corruption afterward requires only standard render-node access (DRM_RENDER_ALLOW), not real init-namespace root.\nUI:N - After the bad interface pointers are established at driver probe or firmware boot, exploitation is driven entirely by the attacker\u0027s own GPU ioctl submissions and does not require any separate victim to open files, mount filesystems, or perform other interactive actions.\nS:U - The bug corrupts kernel heap memory adjacent to the firmware shared-section BO and can enable local privilege escalation within the host kernel, but it does not cross a VM, IOMMU, or sandbox boundary such as a KVM guest-to-host escape.\nC:H - Kernel code routinely READ_ONCEs large panthor_fw_*_output_iface structures (fault_info, status_wait_sync_ptr, heap metadata, etc.) through pointers that can extend hundreds of bytes past the shared BO, yielding out-of-bounds kernel memory disclosure rather than a bounded leak.\nI:H - Kernel code writes full panthor_fw_*_input_iface structures (ringbuf_base, heap_start/end, req/ack fields via panthor_fw_update_reqs) through the same undersized mappings, enabling out-of-bounds kernel writes exploitable for control-flow hijacking and local privilege escalation.\nA:H - Out-of-bounds reads and writes against the vmap of the firmware shared-section BO can immediately trigger kernel oopses or panics and remain reachable on every subsequent GPU job submission or firmware interrupt until the driver is reloaded."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:47:22.050Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21c77486f5a60bb9c0433c21de62a5f25d5091f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/c835f2b0b7167584832b516c9b0a26e9180d1d0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca41d9f3a21586bf29df53eec05152ecf2b2f94f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b921b8613790a3f9e78ab64017fa7149ef0b750c"
        }
      ],
      "title": "drm/panthor: validate firmware interface structure sizes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74451",
    "datePublished": "2026-08-15T12:26:55.722Z",
    "dateReserved": "2026-08-15T05:44:03.899Z",
    "dateUpdated": "2026-08-17T05:47:22.050Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/core/ump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e84d2e53a05c78a04d1343eeb0f31a79456e79fc",
              "status": "affected",
              "version": "33cd7630782df2230529c3e8f1a6d0ae9cd6ab49",
              "versionType": "git"
            },
            {
              "lessThan": "3302aaeac4f7ee6b775850db21d5f61064ce70ad",
              "status": "affected",
              "version": "33cd7630782df2230529c3e8f1a6d0ae9cd6ab49",
              "versionType": "git"
            },
            {
              "lessThan": "032746c2dd9a4ea0774b04ac8a29e2ea628f106e",
              "status": "affected",
              "version": "33cd7630782df2230529c3e8f1a6d0ae9cd6ab49",
              "versionType": "git"
            },
            {
              "lessThan": "c57001f55f97ef856fb6527e376c5c4a056a53a4",
              "status": "affected",
              "version": "33cd7630782df2230529c3e8f1a6d0ae9cd6ab49",
              "versionType": "git"
            },
            {
              "lessThan": "70c977815af0d997feb2d0c5d284d55689bf7051",
              "status": "affected",
              "version": "33cd7630782df2230529c3e8f1a6d0ae9cd6ab49",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/core/ump.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ump: fix double free of out_cvts on rawmidi error\n\nsnd_ump_attach_legacy_rawmidi() allocates the legacy conversion array\nump-\u003eout_cvts and, on the snd_rawmidi_new() error path, frees it with\nkfree() but leaves ump-\u003eout_cvts pointing at the freed memory.  When the\nendpoint is later torn down, snd_ump_endpoint_free() frees ump-\u003eout_cvts\na second time, resulting in a double free.\n\nThe host snd-usb-audio driver attaches the legacy rawmidi for any USB\nMIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail\nreaches this path on enumeration.\n\nClear ump-\u003eout_cvts after freeing it on the error path so it is not\nfreed again during teardown.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:20:40.831Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e84d2e53a05c78a04d1343eeb0f31a79456e79fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/3302aaeac4f7ee6b775850db21d5f61064ce70ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/032746c2dd9a4ea0774b04ac8a29e2ea628f106e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c57001f55f97ef856fb6527e376c5c4a056a53a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/70c977815af0d997feb2d0c5d284d55689bf7051"
        }
      ],
      "title": "ALSA: ump: fix double free of out_cvts on rawmidi error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74502",
    "datePublished": "2026-08-15T12:27:27.586Z",
    "dateReserved": "2026-08-15T05:44:03.907Z",
    "dateUpdated": "2026-08-17T05:20:40.831Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipvs/ip_vs_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "79ffa99202c944467e28b13b513bf2998732edff",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "c9413b50204738fbc429bb86bf01353c393a6c28",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "37c61b3745129cbd682c557b51345828120972e5",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "ed246dd85ebf27c1f6b7897834d40786c0ca3006",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "6f46fc460e9316062bdcdf89199eb5d7a33da33b",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "75eec935444db4af2123e0491936f6e273d7ea00",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "384b4dae14277d369221d187e9b3af56c79d2e50",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            },
            {
              "lessThan": "e0ba936287dfe9783426aac27e5fd76fe35b38c9",
              "status": "affected",
              "version": "f2edb9f7706dcb2c0d9a362b2ba849efe3a97f5e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipvs/ip_vs_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: clear IPv4 options after rebasing tunnel ICMP errors\n\nip_vs_in_icmp() rebases an skb from the outer ICMP packet to the\nquoted original request before passing it to icmp_send(). However,\nIPCB(skb)-\u003eopt still describes the outer IPv4 header.\n\nA timestamp option in the outer header can therefore leave an offset\nthat points into the quoted transport header after the rebase.\n__ip_options_echo() treats a byte at that stale location as the option\nlength and copies it into the fixed-size option storage on the\n__icmp_send() stack, causing a stack out-of-bounds write.\n\nClear the stale option metadata after resetting the network header.\nKeep the remaining control block fields, including the ingress\ninterface used by the ICMP response path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is hit when a remote peer sends a crafted ICMP error to an IPVS load balancer; processing occurs in the IPv4 LOCAL_IN/FORWARD netfilter path on received network packets before icmp_send().\nAC:L - An attacker can reliably trigger the path by opening IPVS tunnel traffic, then sending an ICMP error whose outer IPv4 header includes a timestamp option and whose quoted payload aligns bytes at the stale option offset to a large length.\nPR:N - Exploitation requires only the ability to send IPv4/ICMP to the target; the remote attacker needs no local account, capability, or authentication on the victim host.\nUI:N - No victim user action is required beyond normal exposure of an IPVS tunnel load balancer to the network; exploitation is driven entirely by attacker-sent packets.\nS:U - Impact is confined to kernel memory/stack corruption and privilege boundaries within the host kernel; it does not cross into another security authority such as a VM guest or separate sandbox domain.\nC:H - The stale IPCB option metadata drives __ip_options_echo() to memcpy() from attacker-influenced skb bytes into a 40-byte stack buffer, enabling out-of-bounds kernel memory access that can disclose stack/kernel data.\nI:H - The stack out-of-bounds write in __icmp_send() is attacker-controlled in length and content via crafted quoted headers, providing a standard memory-corruption primitive that can corrupt return addresses and enable arbitrary kernel code execution.\nA:H - Corrupting the __icmp_send() stack frame can immediately panic or oops the kernel during ICMP processing, causing complete loss of availability on the load balancer."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:24.114Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/79ffa99202c944467e28b13b513bf2998732edff"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9413b50204738fbc429bb86bf01353c393a6c28"
        },
        {
          "url": "https://git.kernel.org/stable/c/37c61b3745129cbd682c557b51345828120972e5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed246dd85ebf27c1f6b7897834d40786c0ca3006"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f46fc460e9316062bdcdf89199eb5d7a33da33b"
        },
        {
          "url": "https://git.kernel.org/stable/c/75eec935444db4af2123e0491936f6e273d7ea00"
        },
        {
          "url": "https://git.kernel.org/stable/c/384b4dae14277d369221d187e9b3af56c79d2e50"
        },
        {
          "url": "https://git.kernel.org/stable/c/e0ba936287dfe9783426aac27e5fd76fe35b38c9"
        }
      ],
      "title": "ipvs: clear IPv4 options after rebasing tunnel ICMP errors",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74669",
    "datePublished": "2026-08-22T15:32:40.221Z",
    "dateReserved": "2026-08-15T05:44:03.924Z",
    "dateUpdated": "2026-08-25T05:41:24.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipset/ip_set_hash_gen.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6f13f4d52d06986c18f12e8bffaab944dd27ceab",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "f9d6cabff1fca010562dcdb0d22b296bdca3ba5a",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "16bfa7be2d76ca1e0aacfa363482e1bf8ab5042a",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "661ff9c0cfbe07f8eed920dde9f7781491738207",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "c710e9bf38e4e71a8db85d26a0f70c0674664207",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "4ae701848e4ba9e9713375fb7d82218cbd309da2",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "77dbb248a5cc7a5270cd37bbb0b635bf059a872a",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "f30415929be8aeb002d557c8d3f7ab2d2188003a",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5dd9488ae41070b69d2f4acb580f77db5705f9ca",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a469bab3386aebff33c59506f3a95e35b91118fd",
              "versionType": "git"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.24",
              "versionType": "semver"
            },
            {
              "lessThan": "5.6",
              "status": "affected",
              "version": "5.5.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipset/ip_set_hash_gen.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: do not update comments from kernel-side hash adds\n\nmtype_resize() copies comment pointers with memcpy(), not the comment\nobjects themselves. During the window after an entry has been copied but\nbefore the table swap and backlog replay, the old table is still\npublished for packet-side updates while the replacement-table entry\nalready holds the same ip_set_comment_rcu pointer.\n\nIf xt_SET --add-set ... --exist hits that old entry in this window,\nmtype_add() calls ip_set_init_comment() even though packet-side adds\ncarry no comment payload. That call frees the shared comment through the\nold entry, so the replacement-table entry now holds a stale pointer.\nWhen the queued add is replayed on the new table, mtype_add() calls\nip_set_init_comment() again and strlen() dereferences the stale pointer.\n\nFix this in mtype_add() by skipping ip_set_init_comment() when\next-\u003etarget marks a packet-side add. Userspace adds still update\ncomments, while packet-side adds can no longer free comment storage\nshared with a resize copy."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached via the netfilter xt_SET packet path (set_target_* -\u003e ip_set_add -\u003e kadt -\u003e mtype_add) during skb processing in iptables hooks; kernel CNA guidance treats netfilter/ipset as Local even when triggering packets arrive from the network.\nAC:L - An attacker can drive both sides of the resize race by filling a comment-enabled hash set and concurrently sending packets that hit SET --add-set --exist while mtype_resize() copies entries, making the shared-comment UAF window repeatable rather than dependent on uncontrollable timing.\nPR:N - Exploitation requires only sending traffic that matches an already-installed SET --exist rule on a comment-enabled ipset during resize; no local account or CAP_NET_ADMIN is needed, though unprivileged user namespaces can also obtain CAP_NET_ADMIN to configure the full attack chain.\nUI:N - Triggering is fully automatic through netfilter packet handling once the vulnerable ipset/iptables configuration exists; the attacker does not need the victim to click, mount, or perform any deliberate action beyond ordinary packet delivery.\nS:U - The flaw corrupts kernel heap memory and can yield host privilege escalation, but it does not cross a distinct security authority such as a VM/host, container/host, or IOMMU boundary; impact remains within the same kernel security domain.\nC:H - Packet-side mtype_add() frees a shared ip_set_comment_rcu during resize, leaving duplicate entries with dangling pointers; backlog replay calls ip_set_init_comment() and strlen() on freed kmalloc memory, a classic UAF that can disclose arbitrary kernel data with heap grooming.\nI:H - The UAF over RCU-freed comment objects lets an attacker reclaim and control freed slab memory, providing a standard path to arbitrary kernel writes, metadata corruption, and control-flow hijack rather than a bounded or crash-only integrity effect.\nA:H - Stale comment pointer dereference during resize backlog replay can immediately kernel-oops/panic the host, and the underlying UAF heap corruption can crash or hang the system even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:37:48.078Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6f13f4d52d06986c18f12e8bffaab944dd27ceab"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9d6cabff1fca010562dcdb0d22b296bdca3ba5a"
        },
        {
          "url": "https://git.kernel.org/stable/c/16bfa7be2d76ca1e0aacfa363482e1bf8ab5042a"
        },
        {
          "url": "https://git.kernel.org/stable/c/661ff9c0cfbe07f8eed920dde9f7781491738207"
        },
        {
          "url": "https://git.kernel.org/stable/c/c710e9bf38e4e71a8db85d26a0f70c0674664207"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ae701848e4ba9e9713375fb7d82218cbd309da2"
        },
        {
          "url": "https://git.kernel.org/stable/c/77dbb248a5cc7a5270cd37bbb0b635bf059a872a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f30415929be8aeb002d557c8d3f7ab2d2188003a"
        }
      ],
      "title": "netfilter: ipset: do not update comments from kernel-side hash adds",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74492",
    "datePublished": "2026-08-15T12:27:21.365Z",
    "dateReserved": "2026-08-15T05:44:03.906Z",
    "dateUpdated": "2026-08-19T16:37:48.078Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_alb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7668762bf5fd6db9397de5c0514407489d9d815",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "09add8d5cfa9c46828f51eaad162c36e86366b71",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "b82f51681a7a88c7d3c865e817a3340d42b5fa2a",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "dd148539fb4741d01c06b7d2c8bd84b01920756c",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "dccec0227ed8d9e36936d66e256b957dc2858468",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "2faf75a8a06504071b4c0aea7e45a9cc49a4e187",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            },
            {
              "lessThan": "683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d",
              "status": "affected",
              "version": "d0e81b7e2246a41d068ecaf15aac9de570816d63",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/bonding/bond_alb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor\n\nbond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and\ntakes RTNL via rtnl_trylock() before undoing the promiscuity it set on the\nactive slave. In that window the active slave can change under RTNL\n(RTM_DELLINK -\u003e __bond_release_one() -\u003e bond_alb_handle_active_change()),\nwhich already drops the promiscuity and clears primary_is_promisc. The\nmonitor still acts on the stale decision: if the slave was removed with no\nfailover, curr_active_slave is now NULL and the deref faults; if it failed\nover, the stale dev_set_promiscuity(-1) underflows the new slave\u0027s\npromiscuity counter and pins it in IFF_PROMISC.\n\n  Oops: general protection fault, probably for non-canonical address ...\n  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n  Workqueue: b42 bond_alb_monitor\n  RIP: 0010:bond_alb_monitor (drivers/net/bonding/bond_alb.c:1600)\n   process_one_work (kernel/workqueue.c:3322)\n   worker_thread (kernel/workqueue.c:3486)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n  Kernel panic - not syncing: Fatal exception\n\nRe-check primary_is_promisc (and curr_active_slave) after taking RTNL so\nthe monitor only undoes an increment it still owns. The other bonding\nmonitors already re-read state under RTNL in their commit phase\n(bond_miimon_commit/bond_ab_arp_commit); bond_alb_monitor() was the only\none acting on the pre-trylock decision."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local RTNL netlink (RTM_DELLINK) or bonding ioctl (SIOCBONDRELEASE) to remove/reconfigure slaves while bond_alb_monitor runs; the bug is in a delayed workqueue, not in packet receive or any remote network protocol path.\nAC:L - An attacker with CAP_NET_ADMIN controls both race sides\u2014timing slave removal/failover against the periodic ALB monitor after primary_is_promisc is set\u2014and can retry rapidly when rtnl_trylock fails, making NULL deref or promiscuity-counter underflow reliably winnable.\nPR:L - Triggering ALB bond setup and slave release requires CAP_NET_ADMIN, which unprivileged users can obtain inside a user+network namespace (unshare -Urn), enabling host-wide kernel panic without init-namespace root on typical distributions.\nUI:N - No victim interaction is required; the attacker programmatically creates an ALB bond, drives primary_is_promisc via slave disable/removal, and races bond_alb_monitor without any other user or administrator action.\nS:U - Impact is confined to kernel networking state and causes host kernel panic or netdev promiscuity corruption; it does not cross VM, container, or IOMMU security boundaries into another security authority.\nC:H - Beyond the NULL-deref crash path, the failover race underflows dev-\u003epromiscuity and permanently pins IFF_PROMISC on the new active slave, enabling sustained capture of all traffic on that bonded interface/segment\u2014a broad confidentiality impact on server/cloud HA deployments.\nI:L - The stale dev_set_promiscuity(-1) corrupts the netdev promiscuity counter (unsigned underflow to a huge value), improperly modifying kernel network device state even though it does not provide arbitrary memory write or code-execution primitives.\nA:H - If the active slave is removed without failover, the monitor dereferences a NULL curr_active_slave and panics the kernel, as confirmed by KASAN null-ptr-deref and \"Kernel panic - not syncing: Fatal exception\" in the fix commit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:42:07.173Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7668762bf5fd6db9397de5c0514407489d9d815"
        },
        {
          "url": "https://git.kernel.org/stable/c/09add8d5cfa9c46828f51eaad162c36e86366b71"
        },
        {
          "url": "https://git.kernel.org/stable/c/b82f51681a7a88c7d3c865e817a3340d42b5fa2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd148539fb4741d01c06b7d2c8bd84b01920756c"
        },
        {
          "url": "https://git.kernel.org/stable/c/dccec0227ed8d9e36936d66e256b957dc2858468"
        },
        {
          "url": "https://git.kernel.org/stable/c/2faf75a8a06504071b4c0aea7e45a9cc49a4e187"
        },
        {
          "url": "https://git.kernel.org/stable/c/257c4a3a34d8f51efb00f35375a0c6ce3c8f6ce2"
        },
        {
          "url": "https://git.kernel.org/stable/c/683c6ba6e58e6ed1037831ea97dd58d9c0e76b8d"
        }
      ],
      "title": "bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74726",
    "datePublished": "2026-08-22T15:33:17.128Z",
    "dateReserved": "2026-08-15T05:44:03.929Z",
    "dateUpdated": "2026-08-25T05:42:07.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/associola.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886",
              "status": "affected",
              "version": "8a07eb0a50aebc8c95478d49c28c7f8419a26cef",
              "versionType": "git"
            },
            {
              "lessThan": "fad4766a74220fe579c6fcaa10ba01c23529814f",
              "status": "affected",
              "version": "8a07eb0a50aebc8c95478d49c28c7f8419a26cef",
              "versionType": "git"
            },
            {
              "lessThan": "936658ec41c28c397ef390140e02d4c91ade92f0",
              "status": "affected",
              "version": "8a07eb0a50aebc8c95478d49c28c7f8419a26cef",
              "versionType": "git"
            },
            {
              "lessThan": "8de65194a04d2552cd39b6c67d942d490f22d174",
              "status": "affected",
              "version": "8a07eb0a50aebc8c95478d49c28c7f8419a26cef",
              "versionType": "git"
            },
            {
              "lessThan": "6160e756db81d6cb63e3e2952efcf6c5134be385",
              "status": "affected",
              "version": "8a07eb0a50aebc8c95478d49c28c7f8419a26cef",
              "versionType": "git"
            },
            {
              "lessThan": "18d704bdd809377dfd81a3c2f42426763b5da227",
              "status": "affected",
              "version": "8a07eb0a50aebc8c95478d49c28c7f8419a26cef",
              "versionType": "git"
            },
            {
              "lessThan": "4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7",
              "status": "affected",
              "version": "8a07eb0a50aebc8c95478d49c28c7f8419a26cef",
              "versionType": "git"
            },
            {
              "lessThan": "c9158ceaf27780ef64534ad72f44ffde3f8ccc49",
              "status": "affected",
              "version": "8a07eb0a50aebc8c95478d49c28c7f8419a26cef",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/associola.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: clear control chunk transport if it is being removed\n\nsctp_make_heartbeat_ack() caches the destination transport in\nchunk-\u003etransport without taking a reference. When src_out_of_asoc_ok is\nenabled, the HEARTBEAT ACK may remain queued on control_chunk_list instead\nof being transmitted immediately.\n\nIf the peer transport is removed while the chunk is still queued,\nsctp_assoc_rm_peer() drops the transport and schedules it for RCU freeing,\nbut only clears cached transport pointers in out_chunk_list.  The queued\ncontrol chunk therefore retains a dangling transport pointer.\n\nOnce an ASCONF_ACK clears the suppression and the queued control chunk is\ntransmitted, SCTP dereferences the stale transport pointer, leading to a\nuse-after-free.\n\nFix this by also clearing chunk-\u003etransport for queued control chunks in\ncontrol_chunk_list when removing the transport."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached from remotely received SCTP packets (HEARTBEAT, ASCONF, ASCONF_ACK) processed in sctp_rcv() and the association input state machine on internet-facing SCTP servers and telecom endpoints.\nAC:L - A remote SCTP peer controls packet sequencing and can send HEARTBEAT while src_out_of_asoc_ok blocks transmission, remove transports via ASCONF DEL_IP, then trigger flush when ASCONF_ACK clears suppression.\nPR:N - Exploitation requires only a network-reachable established SCTP association; the attacker needs no Linux credentials, capabilities, or namespaces\u2014only the ability to send valid SCTP traffic to the target.\nUI:N - No victim user action is required; the use-after-free is triggered entirely by SCTP protocol messages sent by a remote peer during normal association operation or address migration.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the host kernel; it does not cross VM, container, or IOMMU security boundaries.\nC:H - Stale chunk-\u003etransport pointers dereference RCU-freed sctp_transport objects in sctp_outq_select_transport() and sctp_packet_transmit(), a use-after-free that enables arbitrary kernel memory disclosure via heap grooming.\nI:H - Use-after-free of sctp_transport allows controlled reuse of freed kmalloc objects, providing a standard path to arbitrary kernel writes and local privilege escalation or remote code execution in kernel context.\nA:H - Dereferencing the freed transport during control-chunk transmission can immediately kernel oops or panic the system; use-after-free bugs inherently threaten availability even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:32.712Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dbb3f418a8665ffb0514e1a9520ab6a1c5d4d886"
        },
        {
          "url": "https://git.kernel.org/stable/c/fad4766a74220fe579c6fcaa10ba01c23529814f"
        },
        {
          "url": "https://git.kernel.org/stable/c/936658ec41c28c397ef390140e02d4c91ade92f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/8de65194a04d2552cd39b6c67d942d490f22d174"
        },
        {
          "url": "https://git.kernel.org/stable/c/6160e756db81d6cb63e3e2952efcf6c5134be385"
        },
        {
          "url": "https://git.kernel.org/stable/c/18d704bdd809377dfd81a3c2f42426763b5da227"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d6b9cac6df5e0cfef1a66b3edd7aebdb9e4b7e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9158ceaf27780ef64534ad72f44ffde3f8ccc49"
        }
      ],
      "title": "sctp: clear control chunk transport if it is being removed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74688",
    "datePublished": "2026-08-22T15:32:53.423Z",
    "dateReserved": "2026-08-15T05:44:03.926Z",
    "dateUpdated": "2026-08-25T05:41:32.712Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/rtl8723bs/core/rtw_ieee80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4fc459c5cd8767ca4d9bf2f7becbd562639ba4d9",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "b45be82387bf759931acdd21ca7dfe740f16eb97",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "c9068f82a0906b29c905e8788edb62c3208c7c8a",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "0d19f0600fbb610c42f2a86f95c35706dc04691b",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "42c5a0d454aa5b54fec17162d9a1f8c30f8af45a",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "e167a38a8a8f50f137721fef1a1fbba0f4588b5d",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "01ab275f8f3e497a13ebbe4ded44ec0623bccde3",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "1c3e23e78862493e8cf1adad02b10ffcb8b9921c",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/rtl8723bs/core/rtw_ieee80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()\n\nrtw_get_wpa_ie() reads bytes at fixed offsets into a vendor-specific\ninformation element without checking that the element is long enough,\ncausing an out-of-bounds read for a short trailing IE.\n\nThe function locates a vendor-specific IE (EID 221) with rtw_get_ie()\nand then compares a 4-byte OUI+type at pbuf + 2 and reads a 2-byte\nversion word at pbuf + 6. Those accesses require the IE body to be at\nleast 6 bytes, but rtw_get_ie() only guarantees that the element fits\nwithin the buffer; it does not enforce a minimum body length. A\nvendor-specific IE whose length byte is 0 to 5, placed at the end of\nthe buffer, therefore makes these reads run past the end of the IE and\npast the end of the buffer itself.\n\nThe buffer holds information elements taken from received management\nframes and from the IE blob passed to rtw_cfg80211_set_wpa_ie(), which\nis kmemdup\u0027d to its exact length, so the read can run off the end of\nthe allocation.\n\nThe sibling helpers rtw_get_sec_ie(), rtw_get_wapi_ie() and\nrtw_get_wps_ie() in this file already reject too-short vendor-specific\nIEs before their OUI memcmp(); rtw_get_wpa_ie() was never brought in\nline with them, and needs a minimum of 6 rather than 4 bytes because\nof the version word. Add the missing length check."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - rtw_get_wpa_ie() is reached when rtl8723bs parses attacker-controlled 802.11 management IEs from received beacons during client auth/association (OnBeacon\u2192rtw_get_bcn_info/rtw_check_bcn_info); per kernel guidance WiFi frame delivery requires an adjacent wireless attacker.\nAC:L - An adjacent attacker fully controls beacon/probe-response IE layout; placing a trailing vendor-specific IE (EID 221) with length 0\u20135 and a matching WPA OUI reliably triggers the missing minimum-length check without races or uncontrollable victim state.\nPR:N - Exploitation via malicious or spoofed over-the-air beacons requires no account, capabilities, or WPA credentials on the victim; the vulnerable parsing runs on pre-authentication and periodic beacon paths before any verified association secrets.\nUI:N - An evil-twin or rogue AP can deliver malformed beacons matching a victim\u0027s connected BSSID during automatic beacon processing without requiring new user clicks, mounts, or connect actions beyond routine WiFi operation.\nS:U - Impact is confined to kernel memory reads/crashes inside the rtl8723bs WiFi driver on the same host; there is no demonstrated VM escape, container breakout, or IOMMU boundary crossing.\nC:H - The bug performs unchecked memcmp()/memcpy() up to six bytes past the end of a kmemdup\u0027d IE buffer or declared IE length, reading adjacent kernel/heap memory; under the conservative OOB-read rule this is high confidentiality impact.\nI:N - The flaw is a read-only out-of-bounds access with no memory write, structure corruption, or demonstrated control-flow hijack primitive; it cannot modify kernel data or achieve code execution on its own.\nA:H - Reading past a kmemdup allocation or declared IE boundary can fault on unmapped pages or provoke a kernel oops during beacon/auth processing; an adjacent attacker can repeat crafted management frames to deny availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:09.288Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4fc459c5cd8767ca4d9bf2f7becbd562639ba4d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/b45be82387bf759931acdd21ca7dfe740f16eb97"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9068f82a0906b29c905e8788edb62c3208c7c8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/0d19f0600fbb610c42f2a86f95c35706dc04691b"
        },
        {
          "url": "https://git.kernel.org/stable/c/42c5a0d454aa5b54fec17162d9a1f8c30f8af45a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e167a38a8a8f50f137721fef1a1fbba0f4588b5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/01ab275f8f3e497a13ebbe4ded44ec0623bccde3"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c3e23e78862493e8cf1adad02b10ffcb8b9921c"
        }
      ],
      "title": "staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74651",
    "datePublished": "2026-08-22T15:32:27.073Z",
    "dateReserved": "2026-08-15T05:44:03.923Z",
    "dateUpdated": "2026-08-25T05:41:09.288Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/8250/8250_dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bf4fb620e02962b2b52500a4b3d8420f351eb46a",
              "status": "affected",
              "version": "0fcb7901f9d61a325b4c5b88c600383bcbeb97fe",
              "versionType": "git"
            },
            {
              "lessThan": "e10f06ee050a08930e2339b6fec7148fd0b2a8f6",
              "status": "affected",
              "version": "0fcb7901f9d61a325b4c5b88c600383bcbeb97fe",
              "versionType": "git"
            },
            {
              "lessThan": "d06cfb1add4a2d5b393e9e31f49ebbd168beea49",
              "status": "affected",
              "version": "0fcb7901f9d61a325b4c5b88c600383bcbeb97fe",
              "versionType": "git"
            },
            {
              "lessThan": "e7a5d792cf64a2096e18f1d573cc3d01cba15e92",
              "status": "affected",
              "version": "0fcb7901f9d61a325b4c5b88c600383bcbeb97fe",
              "versionType": "git"
            },
            {
              "lessThan": "9f2444f4c0e4b06f61bae38da87c9c94c78efa86",
              "status": "affected",
              "version": "0fcb7901f9d61a325b4c5b88c600383bcbeb97fe",
              "versionType": "git"
            },
            {
              "lessThan": "ae05d9e50b6b9f246c110b3bdc03676145c2d0d4",
              "status": "affected",
              "version": "0fcb7901f9d61a325b4c5b88c600383bcbeb97fe",
              "versionType": "git"
            },
            {
              "lessThan": "e7e3cc6709caa49d1d6ce6c1f7cb305e38675cc9",
              "status": "affected",
              "version": "0fcb7901f9d61a325b4c5b88c600383bcbeb97fe",
              "versionType": "git"
            },
            {
              "lessThan": "e2fe6a0efecbef00e3ecc2db64dd5afa8c212b41",
              "status": "affected",
              "version": "0fcb7901f9d61a325b4c5b88c600383bcbeb97fe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/8250/8250_dma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.19"
            },
            {
              "lessThan": "3.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250_dma: Clear stale RX state on shutdown\n\nserial8250_release_dma() terminates RX DMA and releases the channel, but\nleaves rx_running set.  If the port is closed while an RX transfer is\nactive, the stale state remains while rxchan is NULL until the channel is\nrequested again on the next open.\n\nThe DesignWare BUSY workaround added by commit a7b9ce39fbe4\n(\"serial: 8250_dw: Ensure BUSY is deasserted\") calls\nserial8250_rx_dma_flush() from the LCR write path during startup.  This\nhappens before serial8250_request_dma() obtains a new RX channel.  On\nreopen, the stale rx_running state therefore makes the flush path pass a\nNULL channel to dmaengine_pause(), causing a kernel Oops.\n\nClear rx_running after terminating RX DMA, matching the TX cleanup.  Also\nmake the flush helper return if the DMA object or RX channel is not\navailable so startup and teardown paths cannot pass a NULL channel to the\nDMAengine API."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T15:32:29.263Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bf4fb620e02962b2b52500a4b3d8420f351eb46a"
        },
        {
          "url": "https://git.kernel.org/stable/c/e10f06ee050a08930e2339b6fec7148fd0b2a8f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d06cfb1add4a2d5b393e9e31f49ebbd168beea49"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7a5d792cf64a2096e18f1d573cc3d01cba15e92"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f2444f4c0e4b06f61bae38da87c9c94c78efa86"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae05d9e50b6b9f246c110b3bdc03676145c2d0d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7e3cc6709caa49d1d6ce6c1f7cb305e38675cc9"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2fe6a0efecbef00e3ecc2db64dd5afa8c212b41"
        }
      ],
      "title": "serial: 8250_dma: Clear stale RX state on shutdown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74654",
    "datePublished": "2026-08-22T15:32:29.263Z",
    "dateReserved": "2026-08-15T05:44:03.923Z",
    "dateUpdated": "2026-08-22T15:32:29.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "16d89a63e08280abeef7218970a3bbd7ca62b021",
              "status": "affected",
              "version": "a58d0f5dac322e16cc75334d000666512341bde5",
              "versionType": "git"
            },
            {
              "lessThan": "82e982f54f962f72646868ddbb2c3bd9ea178568",
              "status": "affected",
              "version": "dc26097bdb864a0d5955b9a25e43376ffc1af99b",
              "versionType": "git"
            },
            {
              "lessThan": "3c3d5f85db80145636bb991a6005e2760012b985",
              "status": "affected",
              "version": "dc26097bdb864a0d5955b9a25e43376ffc1af99b",
              "versionType": "git"
            },
            {
              "lessThan": "200fa1629c57a3ca2b03d3ca63fd3a9bfd910c43",
              "status": "affected",
              "version": "dc26097bdb864a0d5955b9a25e43376ffc1af99b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f53e7489273dc2bb307bf50f319b3762d45534f0",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.103",
              "status": "affected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.11",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/iso.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.12.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: ISO: avoid deadlocks in iso_sock_timeout\n\niso_sock_timeout() takes lock_sock, so sync disabling the timer while\nholding that lock may deadlock.\n\niso_sock_timeout() may also run concurrently with iso_conn_del(), which\nleads to UAF\n\n        [Task 1]                      [Task hdev-\u003eworkqueue]\n        iso_sock_timeout              iso_conn_del\n          iso_conn_hold_unless_zero     iso_chan_del\n                           `------------\u003e iso_conn_put\n                                      caller frees hcon\n          iso_conn_put\n            iso_conn_free\n              conn-\u003ehcon-\u003eiso_data = NULL; /* UAF */\n\nFix the deadlock by removing the disable from the lock_sock sections.\nMove the timer from iso_conn to iso_pinfo to decouple it from iso_conn\nwhich may need to be freed in lock_sock section. Convert some of the\nclear_timer to disable_timer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is in the Bluetooth ISO socket layer (BTPROTO_ISO); iso_sock_timeout and iso_conn_del are reached via HCI disconnect/connect events from an adjacent BLE peer and local ISO socket syscalls, which per kernel guidance is Adjacent not Network.\nAC:L - Exploitation is a race between iso_sock_timeout and iso_conn_del that an attacker can reliably force by controlling ISO connect/disconnect timing and socket send timeouts (SO_SNDTIMEO) on concurrent workqueues, so success does not depend on uncontrollable conditions.\nPR:N - An adjacent Bluetooth attacker can trigger iso_conn_del through remote HCI disconnect/failure events without any credentials or privileges on the victim host; only a normal active or pending ISO/LE Audio session must exist on the target.\nUI:N - No deliberate victim interaction beyond routine Bluetooth/LE Audio operation is required; exploitation can occur in the background while an ISO connection is pending or active, without opening files or performing a separate enabling action.\nS:U - The UAF/deadlock corrupts kernel heap memory on the host and enables local privilege escalation within the kernel security boundary, not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.\nC:H - iso_conn_free dereferences conn-\u003ehcon after concurrent iso_conn_del frees the hci_conn (UAF on conn-\u003ehcon-\u003eiso_data), enabling arbitrary kernel memory read/disclosure through heap corruption per UAF guidance.\nI:H - The UAF permits writes through conn-\u003ehcon-\u003eiso_data and hci_conn_drop on freed hci_conn memory, providing heap corruption primitives that can be leveraged for arbitrary kernel writes or code execution.\nA:H - The UAF causes kernel oops/panic on freed hci_conn access, and the lock_sock versus disable_delayed_work_sync deadlock in iso_sock_timeout/iso_conn_del paths can hang the system; both crash and deadlock map to High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:48:24.441Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/16d89a63e08280abeef7218970a3bbd7ca62b021"
        },
        {
          "url": "https://git.kernel.org/stable/c/82e982f54f962f72646868ddbb2c3bd9ea178568"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c3d5f85db80145636bb991a6005e2760012b985"
        },
        {
          "url": "https://git.kernel.org/stable/c/200fa1629c57a3ca2b03d3ca63fd3a9bfd910c43"
        }
      ],
      "title": "Bluetooth: ISO: avoid deadlocks in iso_sock_timeout",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74535",
    "datePublished": "2026-08-15T12:27:48.449Z",
    "dateReserved": "2026-08-15T05:44:03.913Z",
    "dateUpdated": "2026-08-17T05:48:24.441Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/userfaultfd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d974b4b786214883bd8e56bda10b454c80fd6205",
              "status": "affected",
              "version": "54007f818206dc27309ca423df4c87dd160a7208",
              "versionType": "git"
            },
            {
              "lessThan": "495a28d5a100be1b232633f4c2dcc42ba10b3796",
              "status": "affected",
              "version": "54007f818206dc27309ca423df4c87dd160a7208",
              "versionType": "git"
            },
            {
              "lessThan": "165613191ad9d034bf17c00e3a142f9561597ec5",
              "status": "affected",
              "version": "54007f818206dc27309ca423df4c87dd160a7208",
              "versionType": "git"
            },
            {
              "lessThan": "0c26202b157f1efc3cd2f26f5c30f59b508a6a5d",
              "status": "affected",
              "version": "54007f818206dc27309ca423df4c87dd160a7208",
              "versionType": "git"
            },
            {
              "lessThan": "3c58f641e813c3c71039f8fd4d4e2a3aab713288",
              "status": "affected",
              "version": "54007f818206dc27309ca423df4c87dd160a7208",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/userfaultfd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuserfaultfd: prevent registration of special VMAs\n\nVova Tokarev says:\n\n  userfaultfd allows registration on shadow stack VMAs.  With userfaultfd\n  access, you can register on the shadow stack, discard a page ... and\n  inject a page with chosen return addresses via UFFDIO_COPY.\n\nUpdate vma_can_userfault() to reject VM_SHADOW_STACK.\n\nWhile on it, also reject VM_SPECIAL so that if a driver would implement\nvm_uffd_ops, it wouldn\u0027t be possible to register special VMAs with\nuserfaultfd.\n\nSince VM_SPECIAL includes VM_DONTEXPAND which is set but hugetlb, exclude\nhugetlb VMAs from the check for VM_SPECIAL."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:02.309Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d974b4b786214883bd8e56bda10b454c80fd6205"
        },
        {
          "url": "https://git.kernel.org/stable/c/495a28d5a100be1b232633f4c2dcc42ba10b3796"
        },
        {
          "url": "https://git.kernel.org/stable/c/165613191ad9d034bf17c00e3a142f9561597ec5"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c26202b157f1efc3cd2f26f5c30f59b508a6a5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c58f641e813c3c71039f8fd4d4e2a3aab713288"
        }
      ],
      "title": "userfaultfd: prevent registration of special VMAs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68166",
    "datePublished": "2026-08-10T11:59:34.576Z",
    "dateReserved": "2026-07-30T09:28:09.372Z",
    "dateUpdated": "2026-08-23T12:46:02.309Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ff44f2df57fb5560bdc75eb977867643e764a262",
              "status": "affected",
              "version": "69318b5215f2dc32c345a3d65b98b4b1bf29c007",
              "versionType": "git"
            },
            {
              "lessThan": "9fb17c95b8f0683570fca1fb2792264147af937a",
              "status": "affected",
              "version": "69318b5215f2dc32c345a3d65b98b4b1bf29c007",
              "versionType": "git"
            },
            {
              "lessThan": "bea8dc14de2d56aca749d368563e6888217710a5",
              "status": "affected",
              "version": "69318b5215f2dc32c345a3d65b98b4b1bf29c007",
              "versionType": "git"
            },
            {
              "lessThan": "5a42f162b857019a4c10ff687dc3bcdf51831865",
              "status": "affected",
              "version": "69318b5215f2dc32c345a3d65b98b4b1bf29c007",
              "versionType": "git"
            },
            {
              "lessThan": "281c103a8eaed59001ce952f231df1b07674215a",
              "status": "affected",
              "version": "69318b5215f2dc32c345a3d65b98b4b1bf29c007",
              "versionType": "git"
            },
            {
              "lessThan": "f807a63d0d95680c34f677700da9148a07d7c78f",
              "status": "affected",
              "version": "69318b5215f2dc32c345a3d65b98b4b1bf29c007",
              "versionType": "git"
            },
            {
              "lessThan": "f0541a775d04c88e90ba448e35ce0d743512822a",
              "status": "affected",
              "version": "69318b5215f2dc32c345a3d65b98b4b1bf29c007",
              "versionType": "git"
            },
            {
              "lessThan": "f621d6ebeebb6374342571e4ddf45fdbc420f6cd",
              "status": "affected",
              "version": "69318b5215f2dc32c345a3d65b98b4b1bf29c007",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix socket use-after-free during link group termination\n\n__smc_lgr_terminate() drops conns_lock after finding a connection in\nlgr-\u003econns_all, but before taking a reference on its socket. The connection\nis embedded in the socket, and its registration reference protects it only\nwhile the connection remains in the tree.\n\nA concurrent close can unregister the connection and drop that reference,\nfreeing the socket before the termination worker reaches sock_hold().\n\nThe race is reachable when close overlaps link group termination.\nLocal stress testing reproduced the use-after-free and KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in __smc_lgr_terminate.part.0 [smc]\n  Write of size 4 by task kworker/3:3\n  Workqueue: events smc_lgr_terminate_work [smc]\n  __smc_lgr_terminate.part.0 [smc]\n\nThe socket was allocated by smc_create(), freed through\nslab_free_after_rcu_debug(), and was followed by:\n\n  refcount_t: addition on 0; use-after-free.\n  __smc_lgr_terminate.part.0 [smc]\n\nTake the socket reference while conns_lock still protects the tree entry.\nThe unregister path then cannot drop the last reference until termination\nhas finished using the socket."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is hit in __smc_lgr_terminate() when a link group shuts down; that path is driven by SMC LLC control messages from a remote peer over RoCE/RDMA (smc_llc_rx_handler), including DELETE_LINK_ALL and protocol-violation termination, not only local syscalls.\nAC:L - An SMC peer can overlap link-group termination with connection teardown by sending DELETE_LINK_ALL (or a terminating LLC event) while aborting/closing the same session; the fix report shows reliable stress reproduction, and the attacker controls both sides of the terminate/close race.\nPR:N - Exploitation needs only completing an SMC handshake as a network peer to the victim; no local account, capabilities, or namespace admin rights on the victim host are required beyond normal remote connectivity to the SMC service.\nUI:N - No victim user action is needed; a remote peer can trigger termination and concurrent connection teardown purely through kernel protocol handling, without the user mounting filesystems, opening files, or performing other interactive steps.\nS:U - The impact stays within the host kernel boundary (memory corruption and potential local privilege escalation) and does not cross VM, container, or IOMMU security authorities into another trust domain.\nC:H - KASAN reported slab-use-after-free in __smc_lgr_terminate with refcount_t addition on 0 during sock_hold() on a freed smc_sock; UAF on kernel heap objects can be turned into arbitrary kernel memory disclosure via heap grooming.\nI:H - The UAF is a write of size 4 to freed socket memory during sock_hold(), giving a kernel heap corruption primitive that can be developed into arbitrary write or control-flow hijack for kernel code execution.\nA:H - The reported UAF occurs in the smc_lgr_terminate workqueue and can crash the kernel (oops/panic); repeated remote triggering against SMC/RoCE services can also cause sustained denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:37:50.842Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ff44f2df57fb5560bdc75eb977867643e764a262"
        },
        {
          "url": "https://git.kernel.org/stable/c/9fb17c95b8f0683570fca1fb2792264147af937a"
        },
        {
          "url": "https://git.kernel.org/stable/c/bea8dc14de2d56aca749d368563e6888217710a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a42f162b857019a4c10ff687dc3bcdf51831865"
        },
        {
          "url": "https://git.kernel.org/stable/c/281c103a8eaed59001ce952f231df1b07674215a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f807a63d0d95680c34f677700da9148a07d7c78f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0541a775d04c88e90ba448e35ce0d743512822a"
        },
        {
          "url": "https://git.kernel.org/stable/c/f621d6ebeebb6374342571e4ddf45fdbc420f6cd"
        }
      ],
      "title": "net/smc: fix socket use-after-free during link group termination",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74493",
    "datePublished": "2026-08-15T12:27:21.980Z",
    "dateReserved": "2026-08-15T05:44:03.906Z",
    "dateUpdated": "2026-08-19T16:37:50.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/usb/peak_usb/pcan_usb_fd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "276d989cd2dd88e2b7ab2c96fd10c86836b12781",
              "status": "affected",
              "version": "0a25e1f4f18566b750ebd3ae995af64e23111e63",
              "versionType": "git"
            },
            {
              "lessThan": "bf9d787b7e1ef59be19b35abca08194772deb97e",
              "status": "affected",
              "version": "0a25e1f4f18566b750ebd3ae995af64e23111e63",
              "versionType": "git"
            },
            {
              "lessThan": "89c92a8052698dbbd3652a77c04d02bbd74a3275",
              "status": "affected",
              "version": "0a25e1f4f18566b750ebd3ae995af64e23111e63",
              "versionType": "git"
            },
            {
              "lessThan": "6067c878e38d02a3d5c43497347e143f85c9064a",
              "status": "affected",
              "version": "0a25e1f4f18566b750ebd3ae995af64e23111e63",
              "versionType": "git"
            },
            {
              "lessThan": "2c8f08f3641a074da40acf05baa5a18ae2739260",
              "status": "affected",
              "version": "0a25e1f4f18566b750ebd3ae995af64e23111e63",
              "versionType": "git"
            },
            {
              "lessThan": "2427ef427bdd78d862c7c76597bfd9eda88b81f1",
              "status": "affected",
              "version": "0a25e1f4f18566b750ebd3ae995af64e23111e63",
              "versionType": "git"
            },
            {
              "lessThan": "d9c115948c3dd5fcc2d0245cec5eb76c098503c8",
              "status": "affected",
              "version": "0a25e1f4f18566b750ebd3ae995af64e23111e63",
              "versionType": "git"
            },
            {
              "lessThan": "93fcab2c6968446316bbb49548848df604d6346f",
              "status": "affected",
              "version": "0a25e1f4f18566b750ebd3ae995af64e23111e63",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/can/usb/peak_usb/pcan_usb_fd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: peak_usb: validate uCAN receive record lengths\n\npcan_usb_fd_decode_buf() walks uCAN records packed in one USB\nreceive buffer.\n\nRequire each record to contain the fixed header for its type, and verify\nCAN payload bytes before copying them into the skb."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:36:48.775Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/276d989cd2dd88e2b7ab2c96fd10c86836b12781"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf9d787b7e1ef59be19b35abca08194772deb97e"
        },
        {
          "url": "https://git.kernel.org/stable/c/89c92a8052698dbbd3652a77c04d02bbd74a3275"
        },
        {
          "url": "https://git.kernel.org/stable/c/6067c878e38d02a3d5c43497347e143f85c9064a"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c8f08f3641a074da40acf05baa5a18ae2739260"
        },
        {
          "url": "https://git.kernel.org/stable/c/2427ef427bdd78d862c7c76597bfd9eda88b81f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9c115948c3dd5fcc2d0245cec5eb76c098503c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/93fcab2c6968446316bbb49548848df604d6346f"
        }
      ],
      "title": "can: peak_usb: validate uCAN receive record lengths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74455",
    "datePublished": "2026-08-15T12:26:58.175Z",
    "dateReserved": "2026-08-15T05:44:03.900Z",
    "dateUpdated": "2026-08-19T16:36:48.775Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vxlan/vxlan_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c419af4924c1593500a40519730ed98575d04a3e",
              "status": "affected",
              "version": "e4f67addf158f98f8197e08974966b18480dc751",
              "versionType": "git"
            },
            {
              "lessThan": "6bd0a3a1b5744166946f0c551a6665c3b46b05e4",
              "status": "affected",
              "version": "e4f67addf158f98f8197e08974966b18480dc751",
              "versionType": "git"
            },
            {
              "lessThan": "214ba43faf106cb06cd3dd30999c5c809c868b53",
              "status": "affected",
              "version": "e4f67addf158f98f8197e08974966b18480dc751",
              "versionType": "git"
            },
            {
              "lessThan": "42887be7c4cf283cce02cd0fb6411221167c8b6c",
              "status": "affected",
              "version": "e4f67addf158f98f8197e08974966b18480dc751",
              "versionType": "git"
            },
            {
              "lessThan": "aa0d31376d574ac858a40078431a77127bf04ee4",
              "status": "affected",
              "version": "e4f67addf158f98f8197e08974966b18480dc751",
              "versionType": "git"
            },
            {
              "lessThan": "ee799977d7941dbfb11049e17edd9eaf4f8820f7",
              "status": "affected",
              "version": "e4f67addf158f98f8197e08974966b18480dc751",
              "versionType": "git"
            },
            {
              "lessThan": "4f3f96e771a20263635bb5e1307c112d613b4bbd",
              "status": "affected",
              "version": "e4f67addf158f98f8197e08974966b18480dc751",
              "versionType": "git"
            },
            {
              "lessThan": "26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb",
              "status": "affected",
              "version": "e4f67addf158f98f8197e08974966b18480dc751",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/vxlan/vxlan_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.8"
            },
            {
              "lessThan": "3.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: use pskb_network_may_pull() in route_shortcircuit()\n\nroute_shortcircuit() currently calls pskb_may_pull(skb, sizeof(struct iphdr))\n(or ipv6hdr), which checks if bytes are available starting from skb-\u003edata.\n\nHowever, in vxlan_xmit(), skb-\u003edata points to the MAC header, so\nskb_network_offset(skb) is ETH_HLEN (14 bytes). Using pskb_may_pull(skb, 20)\nonly checks 20 bytes from skb-\u003edata (which is 14 bytes MAC header + 6 bytes of\nIP header), leaving the rest of the IP header potentially un-pulled in non-linear\nfrags. Subsequent dereferences of ip_hdr(skb)-\u003edaddr can read beyond the pulled\nlinear buffer length.\n\nFix this by using pskb_network_may_pull(), which adds skb_network_offset(skb) to\nthe length check to ensure the full network header is present in the linear buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - route_shortcircuit() runs in vxlan_xmit() during overlay transmit; remote packets forwarded or routed onto a VXLAN netdev with route-short-circuit enabled reach this path without local access, matching net-stack guidance for network-reachable packet processing on cloud/SDN nodes.\nAC:L - An attacker can reliably craft non-linear skbs (scatter/gather/frags and size boundaries) and aim traffic at a known router MAC in the VXLAN FDB; no race or uncontrollable memory layout is required beyond targeting an RSC-enabled deployment, which is the scored scenario.\nPR:N - Exploitation needs no credentials or capabilities on the victim when VXLAN RSC is already configured; a remote peer only has to send IPv4/IPv6 frames that traverse the tunnel transmit path, with no netlink setup or CAP_NET_ADMIN in the target namespace.\nUI:N - Triggering the bug requires only attacker-controlled network traffic through the overlay; no victim mount, file open, link click, or other interactive action is needed.\nS:U - Impact is confined to the kernel hosting the VXLAN endpoint (memory disclosure, packet-header corruption, or crash); it does not cross VM, container, or IOMMU security boundaries by itself.\nC:H - The faulty pskb_may_pull() check leaves the IP/IPv6 header in non-linear frags, so ip_hdr(skb)-\u003edaddr/ipv6 daddr is read past the linear head and can disclose adjacent kernel memory per OOB-read guidance.\nI:H - The out-of-bounds destination address feeds neigh_lookup() and may rewrite eth_hdr()-\u003eh_dest before encapsulation, giving attacker-influenced overlay forwarding and a memory-safety primitive in the transmit path.\nA:H - Dereferencing network-header fields beyond the pulled linear buffer can provoke kernel oops/panic on affected skb layouts, and OOB reads in xmit context are treated as high availability impact even when exploitation is not fully weaponized."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:37:25.639Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c419af4924c1593500a40519730ed98575d04a3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bd0a3a1b5744166946f0c551a6665c3b46b05e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/214ba43faf106cb06cd3dd30999c5c809c868b53"
        },
        {
          "url": "https://git.kernel.org/stable/c/42887be7c4cf283cce02cd0fb6411221167c8b6c"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa0d31376d574ac858a40078431a77127bf04ee4"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee799977d7941dbfb11049e17edd9eaf4f8820f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f3f96e771a20263635bb5e1307c112d613b4bbd"
        },
        {
          "url": "https://git.kernel.org/stable/c/26bb2dd0a8839617e2c79ffbbe1923f8e4bab9fb"
        }
      ],
      "title": "vxlan: use pskb_network_may_pull() in route_shortcircuit()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74473",
    "datePublished": "2026-08-15T12:27:09.382Z",
    "dateReserved": "2026-08-15T05:44:03.903Z",
    "dateUpdated": "2026-08-19T16:37:25.639Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/nct6775-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0d11b2a10269ace29832f584d207ff3768f79dc5",
              "status": "affected",
              "version": "29c7cb485b321c024dedc168bcbb04451176b163",
              "versionType": "git"
            },
            {
              "lessThan": "4a77f1d72c6db04cbbfab0250292ac71fdea5f0a",
              "status": "affected",
              "version": "29c7cb485b321c024dedc168bcbb04451176b163",
              "versionType": "git"
            },
            {
              "lessThan": "513d847f7a95bbdbeaaf55fb942c38992587734f",
              "status": "affected",
              "version": "29c7cb485b321c024dedc168bcbb04451176b163",
              "versionType": "git"
            },
            {
              "lessThan": "25b528816f5d83be5236dc182692369e8c9402b0",
              "status": "affected",
              "version": "29c7cb485b321c024dedc168bcbb04451176b163",
              "versionType": "git"
            },
            {
              "lessThan": "689082a4cb166a7ae9729f7b12339e69fdad6c52",
              "status": "affected",
              "version": "29c7cb485b321c024dedc168bcbb04451176b163",
              "versionType": "git"
            },
            {
              "lessThan": "1b722740ac5c2b2070f9ba922f4e0f227faf0246",
              "status": "affected",
              "version": "29c7cb485b321c024dedc168bcbb04451176b163",
              "versionType": "git"
            },
            {
              "lessThan": "4ad2972ef0e1bd1018ad7a72661a4636ed7daecc",
              "status": "affected",
              "version": "29c7cb485b321c024dedc168bcbb04451176b163",
              "versionType": "git"
            },
            {
              "lessThan": "d0b704e569ac3b8416d8e02270cdc9bf830ed395",
              "status": "affected",
              "version": "29c7cb485b321c024dedc168bcbb04451176b163",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/nct6775-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (nct6775-core) Prevent access to unsupported weight registers\n\nSashiko reports:\n\nDuring initialization of the nct6116 chip, the driver sets data-\u003epwm_num\nto 5. However, it assigns several NCT6106 register arrays (such as\nNCT6106_REG_WEIGHT_DUTY_STEP, NCT6106_REG_WEIGHT_TEMP_SEL, and\nNCT6106_REG_WEIGHT_TEMP_*) to data-\u003eREG_PWM and data-\u003eREG_WEIGHT_TEMP.\nThese arrays only contain 3 elements.\n\nIn nct6775_update_pwm(), the driver iterates up to data-\u003epwm_num. If\ndata-\u003ehas_pwm has bits 3 or 4 set (which is structurally possible for\nnct6116), the loop attempts to read elements at index 3 and 4 from these\n3-element arrays. This results in a global out-of-bounds read, which can\nbe caught by KASAN.\n\nFurthermore, the driver uses these garbage out-of-bounds values as\nhardware register addresses for subsequent read and write operations. This\nleads to invalid hardware register access, potentially causing hardware\nmisconfiguration or system crashes.\n\nThe underlying problem is that the chip does support up to five fan\ncontrol channels, but only the first three support weight control.\nFix the problem by extending the affected weight register arrays with\nzeroed fields. The driver uses zeroed register addresses to determine\nif a register is supported or not, and skips accesses for unsupported\nregisters."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local access to hwmon sysfs under /sys/class/hwmon/; any read or write of sensor attributes invokes nct6775_update_device() and reaches the vulnerable nct6775_update_pwm() path via the platform Super I/O driver.\nAC:L - On affected NCT6116 systems with PWM channels 4-5 enabled (has_pwm bits 3-4), triggering is reliable by reading or writing any exposed hwmon attribute; no race or special victim state is required beyond standard sysfs access.\nPR:L - Fan and PWM sysfs attributes are created with mode 0644 and the driver performs no capability or permission checks beyond standard file permissions, so any unprivileged local user can trigger the vulnerable update and store paths.\nUI:N - No victim interaction is required; the attacker directly reads or writes hwmon sysfs files to invoke nct6775_update_pwm() and associated store handlers without needing another user to perform any action.\nS:U - The vulnerability corrupts kernel driver state and on-chip Super I/O fan/thermal registers on the same host; it does not cross a VM, container, or IOMMU security boundary to impact a separate authority.\nC:H - Indexing past the three-element NCT6106 weight register arrays causes a global out-of-bounds read in kernel .rodata (KASAN-detectable), and the resulting bogus register addresses drive unintended hardware reads whose values are cached and returned through sysfs.\nI:H - Out-of-bounds indices supply valid but incorrect Super I/O register addresses (e.g. auto-temperature registers of other PWM channels) to nct6775_write_value() via writable 0644 sysfs stores, enabling cross-channel fan/thermal misconfiguration.\nA:H - Misdirected reads and writes to wrong Super I/O control registers can corrupt active fan/thermal management on industrial/embedded systems with five PWM channels, potentially causing kernel faults, thermal emergency shutdown, or sustained denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:38:42.442Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0d11b2a10269ace29832f584d207ff3768f79dc5"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a77f1d72c6db04cbbfab0250292ac71fdea5f0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/513d847f7a95bbdbeaaf55fb942c38992587734f"
        },
        {
          "url": "https://git.kernel.org/stable/c/25b528816f5d83be5236dc182692369e8c9402b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/689082a4cb166a7ae9729f7b12339e69fdad6c52"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b722740ac5c2b2070f9ba922f4e0f227faf0246"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ad2972ef0e1bd1018ad7a72661a4636ed7daecc"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0b704e569ac3b8416d8e02270cdc9bf830ed395"
        }
      ],
      "title": "hwmon: (nct6775-core) Prevent access to unsupported weight registers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74549",
    "datePublished": "2026-08-15T12:27:56.993Z",
    "dateReserved": "2026-08-15T05:44:03.915Z",
    "dateUpdated": "2026-08-19T16:38:42.442Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/lm90.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "31ce62d36d859423dc39f9902f7c4c307b2e00e3",
              "status": "affected",
              "version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
              "versionType": "git"
            },
            {
              "lessThan": "4eed33c7db5c0c573928d28d8a2c003642c679b8",
              "status": "affected",
              "version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
              "versionType": "git"
            },
            {
              "lessThan": "70d9a71aa407044d70b50d356b6decf6659c4d56",
              "status": "affected",
              "version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
              "versionType": "git"
            },
            {
              "lessThan": "075fce376cf852db9293481edce07c181a9b1f46",
              "status": "affected",
              "version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
              "versionType": "git"
            },
            {
              "lessThan": "f0b791a006512a48b6348494cb6960598fa99a58",
              "status": "affected",
              "version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
              "versionType": "git"
            },
            {
              "lessThan": "aa9429edf9fc0e90d6f4da19ea4b5495a54ab117",
              "status": "affected",
              "version": "f6d0775119fb905fb02eafa98d575cf8ee792d46",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwmon/lm90.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (lm90) Only report alarms if driver is ready\n\nUserspace can read sysfs attributes before driver registration is complete,\nimmediately after devm_hwmon_device_register_with_info() has been called.\nAt that time, data-\u003ehwmon_dev is not yet initialized. This can trigger\na NULL pointer access since lm90_update_device() and with it\nlm90_update_alarms_locked() will be called. This call schedules\nreport_work and lm90_report_alarms(), which passes the still-NULL\ndata-\u003ehwmon_dev to hwmon_notify_event() and triggers a NULL pointer\ndereference.\n\nFix the problem by only scheduling the report and alert workers\ndata-\u003ehwmon_dev is set."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:38:49.811Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/31ce62d36d859423dc39f9902f7c4c307b2e00e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/4eed33c7db5c0c573928d28d8a2c003642c679b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/70d9a71aa407044d70b50d356b6decf6659c4d56"
        },
        {
          "url": "https://git.kernel.org/stable/c/075fce376cf852db9293481edce07c181a9b1f46"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0b791a006512a48b6348494cb6960598fa99a58"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa9429edf9fc0e90d6f4da19ea4b5495a54ab117"
        }
      ],
      "title": "hwmon: (lm90) Only report alarms if driver is ready",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74552",
    "datePublished": "2026-08-15T12:27:58.829Z",
    "dateReserved": "2026-08-15T05:44:03.915Z",
    "dateUpdated": "2026-08-19T16:38:49.811Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/keys/keyring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "414bcf37d81ce9b3823aabc06b04c97fdcbe489b",
              "status": "affected",
              "version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
              "versionType": "git"
            },
            {
              "lessThan": "abe43c661efb753d5ee35ad8ace4bbb16fa9afd0",
              "status": "affected",
              "version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
              "versionType": "git"
            },
            {
              "lessThan": "f81920917074e3c4ad4fba06fe8c56738d010606",
              "status": "affected",
              "version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
              "versionType": "git"
            },
            {
              "lessThan": "bd0f976ef89dce6db458bf75bc2cf51127becc41",
              "status": "affected",
              "version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
              "versionType": "git"
            },
            {
              "lessThan": "7269df3e7fcfa308e6a456305162f7788747bdbd",
              "status": "affected",
              "version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
              "versionType": "git"
            },
            {
              "lessThan": "3d9f16c0b643ceac305526b2e2fe25c2c6166926",
              "status": "affected",
              "version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
              "versionType": "git"
            },
            {
              "lessThan": "7e5397a3fed0dee7779bd084bec3c0584db3c930",
              "status": "affected",
              "version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
              "versionType": "git"
            },
            {
              "lessThan": "58565eef0f8d861aae92abfb7658458d661cee17",
              "status": "affected",
              "version": "f771fde82051976a6fc0fd570f8b86de4a92124b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/keys/keyring.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nkeys: make keyring key-chunk byte order agree with keyring_diff_objects()\n\nkeyring_get_key_chunk() loads description bytes into the index chunk low\naddress first, while keyring_diff_objects() numbers the first differing\nbit from the low end and folds the absolute byte index into the level\nwithout removing the inline-prefix offset the level already carries.\nThe two disagree on byte order and bit position, so the array can be\ntold two keys first differ at a bit that does not differ in the chunk\nthe walker uses, letting crafted descriptions collide into one node.\n\nLoad the chunk in the order keyring_diff_objects() assumes and drop the\ninline-prefix length when folding the byte index into the level.  This\nonly changes the in-memory ordering used to place keys within a keyring;\nadd, search and read of non-colliding keys are unaffected."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:39:06.890Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/414bcf37d81ce9b3823aabc06b04c97fdcbe489b"
        },
        {
          "url": "https://git.kernel.org/stable/c/abe43c661efb753d5ee35ad8ace4bbb16fa9afd0"
        },
        {
          "url": "https://git.kernel.org/stable/c/f81920917074e3c4ad4fba06fe8c56738d010606"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd0f976ef89dce6db458bf75bc2cf51127becc41"
        },
        {
          "url": "https://git.kernel.org/stable/c/7269df3e7fcfa308e6a456305162f7788747bdbd"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d9f16c0b643ceac305526b2e2fe25c2c6166926"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e5397a3fed0dee7779bd084bec3c0584db3c930"
        },
        {
          "url": "https://git.kernel.org/stable/c/58565eef0f8d861aae92abfb7658458d661cee17"
        }
      ],
      "title": "keys: make keyring key-chunk byte order agree with keyring_diff_objects()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74566",
    "datePublished": "2026-08-15T12:28:07.628Z",
    "dateReserved": "2026-08-15T05:44:03.917Z",
    "dateUpdated": "2026-08-19T16:39:06.890Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "security/integrity/ima/ima_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f46705d96eb60587aa7035acfcbec977e08d620",
              "status": "affected",
              "version": "3323eec921efd815178a23107ab63588c605c0b2",
              "versionType": "git"
            },
            {
              "lessThan": "dd21c96a71e876c8df9ec546b885a2c5f47bbb05",
              "status": "affected",
              "version": "3323eec921efd815178a23107ab63588c605c0b2",
              "versionType": "git"
            },
            {
              "lessThan": "0baed1fa2184c81e4baf76f445d3faa4b738c8f7",
              "status": "affected",
              "version": "3323eec921efd815178a23107ab63588c605c0b2",
              "versionType": "git"
            },
            {
              "lessThan": "b80bed5c871a80151351342c065579405ce77145",
              "status": "affected",
              "version": "3323eec921efd815178a23107ab63588c605c0b2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "security/integrity/ima/ima_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nima: Instantiate file_truncate and path_truncate hooks\n\nInstantiate the file_truncate and path_truncate LSM hooks to reset the\naction cache flags (IMA_DONE_MASK) as soon as truncation is requested,\nso the file, based on policy, is re-collected, re-measured, re-audited,\nand re-appraised on next access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The missing IMA hook is hit from vfs_truncate() via truncate/ftruncate/O_TRUNC syscalls and from ksmbd vfs_truncate on TCP/445; on IMA-enforced servers a remote SMB client with write access can truncate appraised files without clearing IMA_DONE_MASK, the highest-impact reachable path.\nAC:L - Once IMA policy is active, an attacker with write access can deterministically truncate a target file; security_path_truncate/file_truncate always run before do_truncate, so stale IMA_DONE_MASK persists reliably with no races or special memory layout.\nPR:L - Exploitation requires only standard file write permission (MAY_WRITE) on the target inode\u2014via local truncate/ftruncate or an authenticated ksmbd/NFS client with write ACL\u2014not real root or init-namespace capabilities beyond normal write access to the appraised file.\nUI:N - The attacker directly issues truncate/ftruncate or remote SETATTR/truncate operations; no victim must mount media, open a file, or perform any separate action beyond the attacker\u0027s own write/truncate request.\nS:U - The flaw defeats IMA measurement/appraisal caching within the same kernel integrity authority; it does not cross VM, hypervisor, IOMMU, or container sandbox boundaries.\nC:H - Stale IMA_APPRAISED flags let process_measurement() skip re-appraisal on exec/open, so attacker-modified truncated content in hash-appraised executables runs with a cached pass and can access any data reachable by that code.\nI:H - Without clearing IMA_DONE_MASK on truncation, modified file content retains cached IMA_MEASURED/IMA_APPRAISED state and bypasses re-measurement, re-audit, and re-appraisal, defeating the core IMA integrity guarantee for affected files.\nA:N - The bug is a stale-cache integrity bypass with no kernel memory corruption, oops, panic, hang, or deadlock; truncation may change individual file availability but does not inherently crash or deny the host kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:20.017Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f46705d96eb60587aa7035acfcbec977e08d620"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd21c96a71e876c8df9ec546b885a2c5f47bbb05"
        },
        {
          "url": "https://git.kernel.org/stable/c/0baed1fa2184c81e4baf76f445d3faa4b738c8f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b80bed5c871a80151351342c065579405ce77145"
        }
      ],
      "title": "ima: Instantiate file_truncate and path_truncate hooks",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74592",
    "datePublished": "2026-08-22T15:31:43.419Z",
    "dateReserved": "2026-08-15T05:44:03.919Z",
    "dateUpdated": "2026-08-25T05:40:20.017Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/virtio_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a7658508f5fe8f1077a65e8cb9535d3426f37a2f",
              "status": "affected",
              "version": "b917507e5ad983085d29069369778b16aa03a0a8",
              "versionType": "git"
            },
            {
              "lessThan": "1aa21e7c8702a7c37cd7d3cace1a652cfa5e8171",
              "status": "affected",
              "version": "b917507e5ad983085d29069369778b16aa03a0a8",
              "versionType": "git"
            },
            {
              "lessThan": "4d37e3525cc346a1421c1bdeaad5848e249fc60c",
              "status": "affected",
              "version": "b917507e5ad983085d29069369778b16aa03a0a8",
              "versionType": "git"
            },
            {
              "lessThan": "9d80a04129a6c27a690cb69de3fe3f50be5aa8b9",
              "status": "affected",
              "version": "b917507e5ad983085d29069369778b16aa03a0a8",
              "versionType": "git"
            },
            {
              "lessThan": "a309b74e3fc052352ab778500449cb9c3853c363",
              "status": "affected",
              "version": "b917507e5ad983085d29069369778b16aa03a0a8",
              "versionType": "git"
            },
            {
              "lessThan": "38c7763fdc533edb34dc8f4489c260e8ba2ccae9",
              "status": "affected",
              "version": "b917507e5ad983085d29069369778b16aa03a0a8",
              "versionType": "git"
            },
            {
              "lessThan": "e82a5faea2e3886dfb2a65ce092a132e7e896915",
              "status": "affected",
              "version": "b917507e5ad983085d29069369778b16aa03a0a8",
              "versionType": "git"
            },
            {
              "lessThan": "a31e0ad444698d8aa7534a0f89fda543730f97a5",
              "status": "affected",
              "version": "b917507e5ad983085d29069369778b16aa03a0a8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/vmw_vsock/virtio_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvsock/virtio: avoid refilling the RX queue after teardown\n\nCommit b917507e5ad9 (\"vsock/virtio: stop workers during the .remove()\")\nmade the RX worker jump to its common exit when rx_run is clear.  That\nexit still refills the RX queue when the buffer count is low, so work\nqueued across virtio_vsock_vqs_del() can add buffers after the virtqueues\nhave been deleted.\n\nBUG: KASAN: slab-use-after-free in virtqueue_add_sgs\nRead of size 4 by task kworker/0:1\nWorkqueue: virtio_vsock virtio_transport_rx_work\nCall Trace:\n virtqueue_add_sgs (drivers/virtio/virtio_ring.c:2796)\n virtio_vsock_rx_fill (net/vmw_vsock/virtio_transport.c:332)\n virtio_transport_rx_work (net/vmw_vsock/virtio_transport.c:701)\n process_one_work (kernel/workqueue.c:3314)\n worker_thread (kernel/workqueue.c:3478)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:158)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n...\nFreed by task 141:\n kfree (mm/slub.c:6566)\n vp_del_vq (drivers/virtio/virtio_pci_common.c:259)\n vp_del_vqs (drivers/virtio/virtio_pci_common.c:285)\n virtio_vsock_freeze (net/vmw_vsock/virtio_transport.c:912)\n virtio_device_freeze (drivers/virtio/virtio.c:658)\n virtio_pci_freeze (drivers/virtio/virtio_pci_common.c:601)\n pci_pm_freeze (drivers/pci/pci-driver.c:1098)\n device_suspend (drivers/base/power/main.c:1968)\nKernel panic - not syncing: KASAN: panic_on_warn set ...\n\nJump to a no-refill exit when rx_run is clear, leaving the normal exit\nto replenish a running queue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the virtio-vsock guest driver reached via AF_VSOCK sockets and virtio virtqueue callbacks, not via remote network packets; kernel guidance classifies vsock as Local attack vector.\nAC:L - An attacker can reliably queue virtio_transport_rx_work by maintaining active vsock traffic while virtqueues are torn down; this slab UAF race is attacker-influenced and does not depend on uncontrollable memory layout.\nPR:L - Triggering the vulnerable RX refill path requires only normal unprivileged AF_VSOCK use to drive virtio RX work; teardown can coincide with host-driven suspend, migration, or device removal without guest root.\nUI:N - Exploitation requires no victim interaction beyond the attacker opening and using vsock sockets to generate virtio RX work during device teardown.\nS:U - The use-after-free corrupts guest-kernel virtio state and can panic the guest kernel; it does not directly cross a VM/host security boundary or enable guest-to-host escape.\nC:H - KASAN reports a slab use-after-free read in virtqueue_add_sgs on freed virtqueue metadata; UAF of kernel heap objects can be leveraged for arbitrary kernel memory disclosure.\nI:H - Use-after-free of virtqueue structures during virtio_vsock_rx_fill enables heap corruption and can be developed into arbitrary kernel writes or control-flow hijack, not merely a benign read.\nA:H - The reported reproducer triggers KASAN slab-use-after-free and kernel panic during virtio_vsock freeze/teardown; UAF in kernel workqueue context causes high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:39.724Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a7658508f5fe8f1077a65e8cb9535d3426f37a2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1aa21e7c8702a7c37cd7d3cace1a652cfa5e8171"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d37e3525cc346a1421c1bdeaad5848e249fc60c"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d80a04129a6c27a690cb69de3fe3f50be5aa8b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/a309b74e3fc052352ab778500449cb9c3853c363"
        },
        {
          "url": "https://git.kernel.org/stable/c/38c7763fdc533edb34dc8f4489c260e8ba2ccae9"
        },
        {
          "url": "https://git.kernel.org/stable/c/e82a5faea2e3886dfb2a65ce092a132e7e896915"
        },
        {
          "url": "https://git.kernel.org/stable/c/a31e0ad444698d8aa7534a0f89fda543730f97a5"
        }
      ],
      "title": "vsock/virtio: avoid refilling the RX queue after teardown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74613",
    "datePublished": "2026-08-22T15:31:59.062Z",
    "dateReserved": "2026-08-15T05:44:03.920Z",
    "dateUpdated": "2026-08-25T05:40:39.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aa8b14647721b5a4958712b35cf43e3125d47753",
              "status": "affected",
              "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842",
              "versionType": "git"
            },
            {
              "lessThan": "f634289a0b557a197c5f37284b623cefedfe73d5",
              "status": "affected",
              "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842",
              "versionType": "git"
            },
            {
              "lessThan": "3fc5044796dd87b8d68be4207046f5ce2748174c",
              "status": "affected",
              "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842",
              "versionType": "git"
            },
            {
              "lessThan": "3c5f8f2aa57c647b83add4896aab64aac5fdedad",
              "status": "affected",
              "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842",
              "versionType": "git"
            },
            {
              "lessThan": "7bca91d63341274e857f4aeaad54d229405e93dc",
              "status": "affected",
              "version": "fe1e81d4f73b6cbaed4fcc476960d26770642842",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tls/tls_sw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: don\u0027t leave a full plaintext sk_msg ring unpushed\n\nWhen the copy path in tls_sw_sendmsg_locked() adds the fragment that fills\nthe plaintext sk_msg ring, it does not set full_record, so the record is\nleft full and unpushed.  A later splice() then adds to an already full\nring: sk_msg_page_add() has no fullness check of its own, so sg.end wraps\nonto sg.start and the ring appears empty.  Fragments added after that\noverwrite live entries, and sg.size no longer matches what is reachable\nbetween sg.start and sg.end, so pushing the record runs the scatterwalk off\nthe end of the scatterlist.\n\nAn unprivileged user can trigger this on a loopback TCP socket with the\n\"tls\" ULP attached:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000008\n  RIP: 0010:memcpy_from_scatterwalk+0x32/0xc0\n  Call Trace:\n   skcipher_walk_next+0x1d1/0x2c0\n   gcm_encrypt_aesni_avx+0x1e9/0x220\n   bpf_exec_tx_verdict+0x3bb/0x860\n   tls_sw_sendmsg+0xa1a/0xca0\n   __sys_sendto+0x1da/0x1f0\n\nSet full_record in the copy path when the ring becomes full, and push a\nrecord that is already full on entry to the sendmsg loop."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached from tls_sw_sendmsg() via local sendmsg/sendto/splice syscalls on a TCP socket with the tls ULP; the copy-then-splice sequence is driven by the sending process (commit repro: unprivileged user on loopback), not by remote TLS ciphertext on RX.\nAC:L - An attacker fully controls the vulnerable send path by crafting alternating copy and MSG_SPLICE_PAGES splice sequences on their kTLS socket until the plaintext sk_msg ring fills without full_record then wraps; no privileged races or special memory layout are required.\nPR:L - Any unprivileged local user can create a TCP socket, attach the tls ULP with TCP_ULP and SOL_TLS setsockopt (no capability checks in net/tls), and trigger the bug with sendmsg/splice as demonstrated on loopback.\nUI:N - Exploitation requires only the attacker\u0027s own socket I/O to sequence copy and splice operations; no action by another user or administrator is needed.\nS:U - Memory corruption occurs within kernel TLS/sk_msg state of the attacking process\u0027s connection context; there is no crossing of VM, container, or IOMMU security boundaries beyond ordinary kernel compromise.\nC:H - Corrupting a full sk_msg ring overwrites live scatterlist entries and desynchronizes sg.size from reachable fragments, so tls_push_record/AEAD scatterwalk can read past the scatterlist end; this class of kernel heap corruption is exploitable for arbitrary memory disclosure beyond the observed NULL deref.\nI:H - The wrap corrupts scatterlist metadata and drives out-of-bounds scatterwalk during GCM encryption, giving attacker-influenced overwrite primitives on kernel heap objects adjacent to sk_msg data, enabling control-flow hijack beyond the demonstrated crash.\nA:H - Pushing a corrupted record runs the AEAD scatterwalk off the scatterlist end, producing a kernel NULL pointer dereference in memcpy_from_scatterwalk during gcm_encrypt and crashing the host (commit oops trace)."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:36.026Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aa8b14647721b5a4958712b35cf43e3125d47753"
        },
        {
          "url": "https://git.kernel.org/stable/c/f634289a0b557a197c5f37284b623cefedfe73d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fc5044796dd87b8d68be4207046f5ce2748174c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c5f8f2aa57c647b83add4896aab64aac5fdedad"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bca91d63341274e857f4aeaad54d229405e93dc"
        }
      ],
      "title": "tls: don\u0027t leave a full plaintext sk_msg ring unpushed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74610",
    "datePublished": "2026-08-22T15:31:56.813Z",
    "dateReserved": "2026-08-15T05:44:03.920Z",
    "dateUpdated": "2026-08-25T05:40:36.026Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/vt/keyboard.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b84fd400f80adf4d1c88fbce50ae1cf2f8119e65",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "38400673c9bfb39cfc87539e1a072087e98f4e4f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cab5a342f0589334046741006d8a280514f94235",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "38a0aa593ebc275aea6f79534d07f44e43768ce6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3f6b1d3fcfc26dc3fc85262f753439df93b055b4",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b664592e9ba8c47c9e23408db7ba52eb9f946c8a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "cc4a1a2ce0c58eafd477effb055863935260ddc1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e25d47a526939ad44b75f778b8a7500562b84fc1",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/vt/keyboard.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: stabilize tty reference in kbd_keycode with tty_port_tty_get\n\nkbd_keycode() reads vc-\u003eport.tty without acquiring a tty reference,\nracing against con_shutdown() which clears port.tty under a different\nlock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference\nfor the duration the tty pointer is needed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through local virtual-console and input paths: kbd_keycode runs from the VT keyboard input handler on key/key-repeat events while con_shutdown runs during final close(2) on /dev/ttyN; there is no network, Bluetooth-only, or remote-protocol reachability to both sides of the race.\nAC:L - The attacker controls both race participants: one thread can loop open/close a console tty to drive release_tty/con_shutdown while another holds a key for repeat events (down==2) or injects EV_KEY via uinput, retrying until kbd_keycode uses a freed tty_struct.\nPR:L - No real-root capability is required; a console-logged-in user with normal DAC access to /dev/ttyN (typical tty-group membership) can close their VT tty and generate foreground key events, and vt_ioctl grants perm to the controlling-tty owner without CAP_SYS_TTY_CONFIG.\nUI:N - The attacker performs every step from its own console session\u2014opening/closing the VT tty and generating key or key-repeat input\u2014so no separate victim or administrator action is required.\nS:U - The slab use-after-free corrupts kernel heap memory within the same kernel security authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - After the tty is freed, kbd_keycode reads freed tty_struct fields (termios for L_ECHO and optionally tty-\u003eops via tty_chars_in_buffer), giving a use-after-free read primitive and enabling disclosure of kernel memory once the slab object is reclaimed.\nI:H - The path writes tty-\u003edriver_data on a freed tty_struct and may indirect-call through tty-\u003eops in tty_chars_in_buffer, enabling heap spray and control-flow hijack for arbitrary kernel modification or privilege escalation.\nA:H - Use-after-free on tty_struct reliably produces kernel oops or panic on illegal dereference through freed memory, and the open/close versus key-repeat race can be retriggered at will for repeatable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:27.811Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b84fd400f80adf4d1c88fbce50ae1cf2f8119e65"
        },
        {
          "url": "https://git.kernel.org/stable/c/38400673c9bfb39cfc87539e1a072087e98f4e4f"
        },
        {
          "url": "https://git.kernel.org/stable/c/cab5a342f0589334046741006d8a280514f94235"
        },
        {
          "url": "https://git.kernel.org/stable/c/38a0aa593ebc275aea6f79534d07f44e43768ce6"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f6b1d3fcfc26dc3fc85262f753439df93b055b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b664592e9ba8c47c9e23408db7ba52eb9f946c8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc4a1a2ce0c58eafd477effb055863935260ddc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/e25d47a526939ad44b75f778b8a7500562b84fc1"
        }
      ],
      "title": "vt: stabilize tty reference in kbd_keycode with tty_port_tty_get",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74675",
    "datePublished": "2026-08-22T15:32:44.493Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-25T05:41:27.811Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/atm/cxacru.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6133b461058316e3ccba7331f974d110d4c08b23",
              "status": "affected",
              "version": "1b0e614652344a2d39eb336f3dc07651782883bf",
              "versionType": "git"
            },
            {
              "lessThan": "61093d7f1144f6a15bac505df35e5f535ade2ac1",
              "status": "affected",
              "version": "1b0e614652344a2d39eb336f3dc07651782883bf",
              "versionType": "git"
            },
            {
              "lessThan": "645d98dbccdbfdbf0129f48822af7183492de091",
              "status": "affected",
              "version": "1b0e614652344a2d39eb336f3dc07651782883bf",
              "versionType": "git"
            },
            {
              "lessThan": "993f7677949e3d72e360e86eed1f41c2511f75ed",
              "status": "affected",
              "version": "1b0e614652344a2d39eb336f3dc07651782883bf",
              "versionType": "git"
            },
            {
              "lessThan": "939b6a41f681aea52af678053072ee443068e93e",
              "status": "affected",
              "version": "1b0e614652344a2d39eb336f3dc07651782883bf",
              "versionType": "git"
            },
            {
              "lessThan": "2f73a065791d2a8e3f0bdf29248e33600359e865",
              "status": "affected",
              "version": "1b0e614652344a2d39eb336f3dc07651782883bf",
              "versionType": "git"
            },
            {
              "lessThan": "0af047703dbed8224552587ed436f14a24371b46",
              "status": "affected",
              "version": "1b0e614652344a2d39eb336f3dc07651782883bf",
              "versionType": "git"
            },
            {
              "lessThan": "c2f811314be351d86b6ab41e9297ae80d8da6f86",
              "status": "affected",
              "version": "1b0e614652344a2d39eb336f3dc07651782883bf",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/atm/cxacru.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.13"
            },
            {
              "lessThan": "2.6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()\n\nIf cxacru_cm() encounters an error while submitting or waiting for snd_urb,\nit aborts and returns the error without killing the already submitted\nrcv_urb. This leaves the rcv_urb active.\n\nWhen this happens during initialization (e.g., in cxacru_atm_start()), the\ndriver may ignore the error and proceed to call cxacru_poll_status(), which\ninvokes cxacru_cm() again. Attempting to submit the still-active rcv_urb\ntriggers a warning in usb_submit_urb():\n\ncxacru 1-1:1.0: send of cm 0x84 failed (-104)\nATM dev 0: cxacru_atm_start: CHIP_ADSL_LINE_START returned -104\n------------[ cut here ]------------\nURB ffff88812658d200 submitted while active\nWARNING: drivers/usb/core/urb.c:379 at usb_submit_urb+0x79/0x18b0\ndrivers/usb/core/urb.c:379\n...\nCall Trace:\n \u003cTASK\u003e\n cxacru_cm+0x21a/0xf10 drivers/usb/atm/cxacru.c:631\n cxacru_cm_get_array drivers/usb/atm/cxacru.c:722 [inline]\n cxacru_poll_status+0x178/0x1110 drivers/usb/atm/cxacru.c:828\n cxacru_atm_start+0x185/0x360 drivers/usb/atm/cxacru.c:814\n usbatm_atm_init+0x144/0x3a0 drivers/usb/atm/usbatm.c:927\n usbatm_usb_probe+0x15cb/0x1db0 drivers/usb/atm/usbatm.c:1178\n cxacru_usb_probe+0x17f/0x220 drivers/usb/atm/cxacru.c:1370\n...\n\nTo fix this, ensure that rcv_urb is properly killed if cxacru_cm() aborts\nearly. We can safely call usb_kill_urb() on rcv_urb in the error path, as\nit is safe to call even if the URB is not active (e.g., if it failed to\nsubmit in the first place, or if it already completed)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T15:32:48.230Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6133b461058316e3ccba7331f974d110d4c08b23"
        },
        {
          "url": "https://git.kernel.org/stable/c/61093d7f1144f6a15bac505df35e5f535ade2ac1"
        },
        {
          "url": "https://git.kernel.org/stable/c/645d98dbccdbfdbf0129f48822af7183492de091"
        },
        {
          "url": "https://git.kernel.org/stable/c/993f7677949e3d72e360e86eed1f41c2511f75ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/939b6a41f681aea52af678053072ee443068e93e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f73a065791d2a8e3f0bdf29248e33600359e865"
        },
        {
          "url": "https://git.kernel.org/stable/c/0af047703dbed8224552587ed436f14a24371b46"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2f811314be351d86b6ab41e9297ae80d8da6f86"
        }
      ],
      "title": "usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74680",
    "datePublished": "2026-08-22T15:32:48.230Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-22T15:32:48.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/flow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e85278afd4890dd190ba3c7a1b1a712b801c9fe1",
              "status": "affected",
              "version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
              "versionType": "git"
            },
            {
              "lessThan": "81f9b09f0ea3ba9ab966dd17e9f32625a14555e9",
              "status": "affected",
              "version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
              "versionType": "git"
            },
            {
              "lessThan": "831471718f6e19aed1a330b03b53190a90e06466",
              "status": "affected",
              "version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
              "versionType": "git"
            },
            {
              "lessThan": "d8bea341b183190ce6c055ab0e64ab78eb9a7290",
              "status": "affected",
              "version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
              "versionType": "git"
            },
            {
              "lessThan": "0b60b55652ba772b173dddc63f3851e1d2dd5927",
              "status": "affected",
              "version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
              "versionType": "git"
            },
            {
              "lessThan": "a8139285c8925efe59af28a9169bb2fda91bff15",
              "status": "affected",
              "version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
              "versionType": "git"
            },
            {
              "lessThan": "9b8cfbb58b85bfa7a78fac47fdc77396cd01f699",
              "status": "affected",
              "version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
              "versionType": "git"
            },
            {
              "lessThan": "cf6f8b29befb92173659bcef6a441d274947bfae",
              "status": "affected",
              "version": "217ac77a3c2524d999730b2a80b61fcc2d0f734a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/flow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/openvswitch: check Ethernet header length in key_extract()\n\nWhen a packet arrives on an ARPHRD_NONE device (e.g. TUN),\novs_flow_key_extract() trusts the user-provided skb-\u003eprotocol field: if\nit is ETH_P_TEB, the packet is classified as MAC_PROTO_ETHERNET and\nkey_extract() is called without ensuring the skb has ETH_HLEN (14) bytes\nof linear data. key_extract() unconditionally pulls 2 * ETH_ALEN bytes\nfor MAC addresses and parse_ethertype() pulls 2 more, either of which\ntriggers a kernel BUG in __skb_pull() when the linear area is too small.\n\n  kernel BUG at include/linux/skbuff.h:2848!\n  RIP: 0010:key_extract+0xa7e/0xd90 net/openvswitch/flow.c:933\n  ovs_flow_key_extract+0x419/0xa70\n  ovs_vport_receive+0x222/0x390\n  netdev_frame_hook+0x3e0/0x630\n  tun_get_user+0x2d0c/0x38e0\n\nFixed by calling check_header() in key_extract() before accessing the\nEthernet header."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The crash is reached when a crafted skb is processed in ovs_flow_key_extract() via ovs_vport_receive(); the documented reproducer injects it through tun_get_user() (write to a TUN fd), and the alternate path is OVS_PACKET_CMD_EXECUTE netlink\u2014both require local syscall access, not remote packet delivery.\nAC:L - The attacker fully controls skb length, skb-\u003eprotocol (ETH_P_TEB), and linear versus fragmented layout; sending a sub-14-byte payload with ETH_P_TEB on an ARPHRD_NONE OVS port deterministically reaches key_extract() and triggers __skb_pull() BUG() without races or special heap layout.\nPR:L - Attaching an ARPHRD_NONE netdev to an OVS datapath and using OVS_PACKET_CMD_EXECUTE require CAP_NET_ADMIN (GENL_UNS_ADMIN_PERM, netnsok); CAP_NET_ADMIN is obtainable inside an unprivileged user+network namespace, and TUN injection likewise requires CAP_NET_ADMIN or a TUN fd granted by a privileged setup.\nUI:N - No victim interaction is required; once OVS bridges an ARPHRD_NONE port (e.g. TUN), the attacker triggers the bug by injecting a single malformed packet via write() or netlink without any other user action.\nS:U - Impact is a kernel BUG/panic in the same kernel security authority as the attacker; this is not a VM escape, IOMMU bypass, or cross-namespace privilege boundary crossing.\nC:H - Before the BUG, key_extract() calls ether_addr_copy() and parse_ethertype() on skb-\u003edata without validating ETH_HLEN, performing out-of-bounds reads of kernel skb buffer memory beyond the actual packet payload.\nI:H - Unchecked __skb_pull() on an undersized skb corrupts skb-\u003edata and skb-\u003elen metadata; this memory corruption of kernel packet state can be leveraged for further integrity violations beyond a simple controlled crash.\nA:H - The flaw triggers kernel BUG() at __skb_pull() in include/linux/skbuff.h, producing a kernel oops/panic and denying all system availability on affected hosts running Open vSwitch with ARPHRD_NONE ports."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:43.778Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e85278afd4890dd190ba3c7a1b1a712b801c9fe1"
        },
        {
          "url": "https://git.kernel.org/stable/c/81f9b09f0ea3ba9ab966dd17e9f32625a14555e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/831471718f6e19aed1a330b03b53190a90e06466"
        },
        {
          "url": "https://git.kernel.org/stable/c/d8bea341b183190ce6c055ab0e64ab78eb9a7290"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b60b55652ba772b173dddc63f3851e1d2dd5927"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8139285c8925efe59af28a9169bb2fda91bff15"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b8cfbb58b85bfa7a78fac47fdc77396cd01f699"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf6f8b29befb92173659bcef6a441d274947bfae"
        }
      ],
      "title": "net/openvswitch: check Ethernet header length in key_extract()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74701",
    "datePublished": "2026-08-22T15:33:01.585Z",
    "dateReserved": "2026-08-15T05:44:03.927Z",
    "dateUpdated": "2026-08-25T05:41:43.778Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b89ca4bba820f79dde52af15ee139fe6e8bbc314",
              "status": "affected",
              "version": "7a73ba7469cbea631050094fd14f73acebb97cf9",
              "versionType": "git"
            },
            {
              "lessThan": "bef30317fcb4c838a37bceb2fc76256eb6b975c1",
              "status": "affected",
              "version": "7a73ba7469cbea631050094fd14f73acebb97cf9",
              "versionType": "git"
            },
            {
              "lessThan": "112c6ff29a56f3a22db4d5af869697aa07035ad6",
              "status": "affected",
              "version": "7a73ba7469cbea631050094fd14f73acebb97cf9",
              "versionType": "git"
            },
            {
              "lessThan": "2666cddf0dd218aa9bd1f99db688d1b532eac21a",
              "status": "affected",
              "version": "7a73ba7469cbea631050094fd14f73acebb97cf9",
              "versionType": "git"
            },
            {
              "lessThan": "fc0c02f510e41650df3479f96e257acf87d8a20a",
              "status": "affected",
              "version": "7a73ba7469cbea631050094fd14f73acebb97cf9",
              "versionType": "git"
            },
            {
              "lessThan": "dc0be7662b7b0ce28cb5eea864737793ed7b9e70",
              "status": "affected",
              "version": "7a73ba7469cbea631050094fd14f73acebb97cf9",
              "versionType": "git"
            },
            {
              "lessThan": "c77cf8edae2bd3a1599115301cc7c98d0c78e731",
              "status": "affected",
              "version": "7a73ba7469cbea631050094fd14f73acebb97cf9",
              "versionType": "git"
            },
            {
              "lessThan": "85891d174707d8bddcec7a888fb4e1d17def34f3",
              "status": "affected",
              "version": "7a73ba7469cbea631050094fd14f73acebb97cf9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.33"
            },
            {
              "lessThan": "2.6.33",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: validate DRAW_PRIMITIVES header size before division\n\nvmw_cmd_draw() computes\n\n\tmaxnum = (header-\u003esize - sizeof(cmd-\u003ebody)) / sizeof(*decl);\n\nwhere header-\u003esize is u32 and is taken straight from the user-supplied\ncommand stream.  When header-\u003esize is less than sizeof(cmd-\u003ebody) the\nunsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum.\nAny user-controlled cmd-\u003ebody.numVertexDecls then passes the bound and\nthe loop dereferences decl[i] far past the end of the kernel command\nbounce buffer, producing an out-of-bounds read of kernel memory.\n\nReject undersized headers up front."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through the local DRM_IOCTL_VMW_EXECBUF ioctl (vmw_execbuf_ioctl -\u003e vmw_execbuf_process -\u003e vmw_cmd_check_all -\u003e vmw_cmd_draw); it is not reachable from network, adjacent wireless, or physical buses.\nAC:L - An attacker fully controls the user command stream and can set header-\u003esize below sizeof(cmd-\u003ebody) to underflow maxnum and bypass numVertexDecls bounds; no races or victim-dependent timing are required.\nPR:L - VMW_EXECBUF is registered with DRM_RENDER_ALLOW, so any local process with access to the vmwgfx render node (/dev/dri/renderD*) and a user-created 3D context can submit the malicious DRAW_PRIMITIVES command without real root.\nUI:N - Exploitation requires only the attacker opening the render device and issuing crafted execbuf ioctls; no additional actions by another user or administrator are needed.\nS:U - Impact is confined to the guest kernel address space running vmwgfx (VMware SVGA virtual GPU); successful exploitation yields guest-kernel memory disclosure/corruption and privilege escalation, not a direct hypervisor/host escape.\nC:H - Unsigned underflow makes maxnum enormous, so the vertex-declaration loop dereferences decl[i] far beyond the vmalloc command bounce buffer and reads adjacent kernel heap memory (e.g., decl-\u003earray.surfaceId) into validation paths.\nI:H - Beyond disclosure, leaked/adjacent surfaceId values can satisfy vmw_user_resource_lookup_handle and vmw_resource_relocations_apply then writes resource IDs to offsets past the bounce buffer, giving an out-of-bounds kernel write primitive.\nA:H - Setting a large numVertexDecls after the bound bypass can walk far past the vmalloc allocation and fault on unmapped pages, and extensive heap corruption from relocation writes can also trigger kernel oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:36:38.535Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b89ca4bba820f79dde52af15ee139fe6e8bbc314"
        },
        {
          "url": "https://git.kernel.org/stable/c/bef30317fcb4c838a37bceb2fc76256eb6b975c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/112c6ff29a56f3a22db4d5af869697aa07035ad6"
        },
        {
          "url": "https://git.kernel.org/stable/c/2666cddf0dd218aa9bd1f99db688d1b532eac21a"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc0c02f510e41650df3479f96e257acf87d8a20a"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc0be7662b7b0ce28cb5eea864737793ed7b9e70"
        },
        {
          "url": "https://git.kernel.org/stable/c/c77cf8edae2bd3a1599115301cc7c98d0c78e731"
        },
        {
          "url": "https://git.kernel.org/stable/c/85891d174707d8bddcec7a888fb4e1d17def34f3"
        }
      ],
      "title": "drm/vmwgfx: validate DRAW_PRIMITIVES header size before division",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74444",
    "datePublished": "2026-08-15T12:26:51.443Z",
    "dateReserved": "2026-08-15T05:44:03.898Z",
    "dateUpdated": "2026-08-19T16:36:38.535Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/ax88179_178a.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "1c63303659a2264bd55d9813df74cb4caeed5922",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "2be5091fa693b9119ad25a8bb8c149d236a23ade",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "58733b1dd46bb231d9d279c132a20ee46da1b664",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "4039cd807a5a46dc5f7618fffae926b8ad8455eb",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            },
            {
              "lessThan": "1f428e30947395d9b9aacee03e25a4e6cfcad7a4",
              "status": "affected",
              "version": "16b1c4e01c89ba07367461e0bc4cb84993c2d027",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/ax88179_178a.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()\n\nWhen the interface has NETIF_F_SG enabled and skb_linearize() fails in\nax88179_tx_fixup(), the function returns NULL without freeing the skb.\n\nusbnet_start_xmit() treats a NULL return from tx_fixup() as a drop\n(info-\u003eflags does not set FLAG_MULTI_PACKET for this driver), jumping\nto the \"drop\" label where it does `if (skb) dev_kfree_skb_any(skb)`.\nBecause tx_fixup() returned NULL, the local skb variable in\nusbnet_start_xmit() is NULL, so the original skb is never freed \u2014 a\nmemory leak on every TX frame whose linearization fails (i.e. under\nmemory pressure).\n\nFree the skb before returning, matching the error handling already used\nfor the pskb_expand_head() failure path in the same function."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On systems using the common ASIX AX88179/AX88178A USB 3.0 GbE adapter as their uplink, remote peers induce outbound TSO/GSO traffic that reaches ax88179_tx_fixup() via __dev_queue_xmit\u2192netdev_start_xmit\u2192usbnet_start_xmit; attacker-supplied or reply traffic over the bound NIC is standard network reachability.\nAC:L - NETIF_F_SG and NETIF_F_TSO are always enabled at bind; an attacker can send non-linear egress skbs and deliberately exhaust GFP_ATOMIC/slab memory so skb_linearize() fails on demand\u2014both prerequisites are fully under attacker control without races or rare layout.\nPR:N - No capability or authentication gates the netdev TX path; any remote host exchanging IP traffic with a victim whose ax88179 interface is up can trigger usbnet_start_xmit without local shell access, credentials, or init-namespace privileges.\nUI:N - Exploitation needs only that the adapter is plugged in and carrying traffic\u2014the normal always-on state for USB-Ethernet docks, kiosks, and laptops\u2014not any one-time victim action such as mounting media or opening a file.\nS:U - Leaked sk_buff objects remain in kernel SLAB caches within the same kernel security authority; there is no VM escape, container breakout, IOMMU bypass, or cross-boundary corruption.\nC:N - Orphaned skbs are not freed but are not exposed to userspace or adjacent objects; there is no out-of-bounds read, use-after-free, or other disclosure primitive\u2014only silent kernel heap consumption.\nI:N - The defect drops an skb reference on an error return without corrupting heap metadata, overwriting kernel objects, or enabling arbitrary writes or control-flow hijacking.\nA:H - Each skb_linearize() failure permanently leaks one skb; under attacker-driven memory pressure an unauthenticated remote peer can repeat TSO egress to exhaust kernel memory, provoking OOM-killer thrashing and denial of service on the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:29.048Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/83a765cbd7b4d11b0b9fa1bb9d941ae911a2159b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1c63303659a2264bd55d9813df74cb4caeed5922"
        },
        {
          "url": "https://git.kernel.org/stable/c/2be5091fa693b9119ad25a8bb8c149d236a23ade"
        },
        {
          "url": "https://git.kernel.org/stable/c/58733b1dd46bb231d9d279c132a20ee46da1b664"
        },
        {
          "url": "https://git.kernel.org/stable/c/4039cd807a5a46dc5f7618fffae926b8ad8455eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f428e30947395d9b9aacee03e25a4e6cfcad7a4"
        }
      ],
      "title": "net: usb: ax88179_178a: fix skb leak in ax88179_tx_fixup()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74678",
    "datePublished": "2026-08-22T15:32:46.765Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-25T05:41:29.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_reg_whitelist.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9852aa87ecba95d7bf9fb94a9d6c4f69312c9682",
              "status": "affected",
              "version": "828a8eaf37c3fac6ba048995f55f1647a4ac542d",
              "versionType": "git"
            },
            {
              "lessThan": "7982678fa21eda02a9111d2646be6762b5e3a64d",
              "status": "affected",
              "version": "828a8eaf37c3fac6ba048995f55f1647a4ac542d",
              "versionType": "git"
            },
            {
              "lessThan": "1e6d07abbc0c41cb3259042794ad3deca79dd14e",
              "status": "affected",
              "version": "828a8eaf37c3fac6ba048995f55f1647a4ac542d",
              "versionType": "git"
            },
            {
              "lessThan": "e70086a3a06d276b4a5d9a2c51c9330c6cf72780",
              "status": "affected",
              "version": "828a8eaf37c3fac6ba048995f55f1647a4ac542d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_reg_whitelist.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists\n\nUnconditionally whitelisting OA registers is a security violation. Set\nRING_FORCE_TO_NONPRIV_DENY bit in OA nonpriv slots, so that OA registers\ndon\u0027t get whitelisted by default after probe, gt reset, resume and engine\nreset.\n\n(cherry picked from commit 90511bdcfda97211c01f1d945d4ea616578d8fca)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:02:00.297Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9852aa87ecba95d7bf9fb94a9d6c4f69312c9682"
        },
        {
          "url": "https://git.kernel.org/stable/c/7982678fa21eda02a9111d2646be6762b5e3a64d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e6d07abbc0c41cb3259042794ad3deca79dd14e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e70086a3a06d276b4a5d9a2c51c9330c6cf72780"
        }
      ],
      "title": "drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68267",
    "datePublished": "2026-08-10T12:01:42.551Z",
    "dateReserved": "2026-07-30T09:28:09.378Z",
    "dateUpdated": "2026-08-17T05:02:00.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/ipheth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d07133fe1befae9a1e4c4c5e46ef0b73d2992020",
              "status": "affected",
              "version": "bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1",
              "versionType": "git"
            },
            {
              "lessThan": "2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45",
              "status": "affected",
              "version": "bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1",
              "versionType": "git"
            },
            {
              "lessThan": "48303f3ae0fa6e102f3fc7dbf1688cc179131962",
              "status": "affected",
              "version": "bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1",
              "versionType": "git"
            },
            {
              "lessThan": "fde39b8a521780391fb4e5bda2c0aa4928947f12",
              "status": "affected",
              "version": "bb1b40c7cb863f0800a6410c7dcb86cf3f28d3b1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4f2df9fd07698bece3321fbf9e4b6dbcb9babccc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ea7d6be58c2e6c1f426b48994bb22b2393c90963",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f5bca75dc46701f4c0d1dcbaae401233ae7ff06b",
              "versionType": "git"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.180",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.173",
              "versionType": "semver"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.116",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/usb/ipheth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.15"
            },
            {
              "lessThan": "4.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.180",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.173",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.116",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: ipheth: fix carrier_work UAF on disconnect\n\nipheth_sndbulk_callback() re-arms the carrier-check work on any\nnon-zero URB status:\n\n\telse\n\t\tschedule_delayed_work(\u0026dev-\u003ecarrier_work, 0);\n\nNothing ties that to the interface being up, so the work can be armed\nagain after ipheth_close() has already drained it, and stay armed\nuntil the netdev whose private area embeds it is freed.\n\nOn unplug with a TX URB in flight, ipheth_disconnect() drains the work\nthrough unregister_netdev() -\u003e ipheth_close() -\u003e\ncancel_delayed_work_sync() and only then calls ipheth_kill_urbs().\nusb_kill_urb() completes the in-flight TX URB with -ENOENT, so\nipheth_sndbulk_callback() runs after the drain and re-arms\ncarrier_work.\n\nThe same completion also re-arms the work if the interface is only\nbrought down while a TX URB is in flight, and\nipheth_carrier_check_work() then keeps re-queueing itself once a\nsecond. unregister_netdev() does not call ipheth_close() for an\nalready-down interface, so nothing drains it on the later unplug\neither.\n\nIn both cases free_netdev() frees the netdev while carrier_work is\nstill pending, and ipheth_carrier_check_work() dereferences freed\nmemory.\n\nTie the work to the interface state instead of chasing the completion:\ndisable it in ipheth_close() and enable it in ipheth_open(), so a\nschedule_delayed_work() from the URB completion is a no-op whenever\nthe interface is not up. disable_delayed_work_sync() also waits for a\nrunning instance, so it fully replaces the cancel_delayed_work_sync()\nit takes the place of. The work starts out disabled in ipheth_probe()\nso the enable/disable counts balance from the first open.\n\nReproduced under KASAN on linux-next (next-20260731) with dummy_hcd and\nraw-gadget standing in for the device, driving the second path above (the\ninterface is already down, so unregister_netdev() does not call\nipheth_close()): 15 of 15 unpatched boots report a slab-use-after-free in\n__run_timers(), freed by ipheth_disconnect() and re-armed from\nipheth_sndbulk_callback() via queue_delayed_work_on(). The\nsame trigger on a kernel differing only by this patch reports 0 of 15,\nand the carrier check still functions across open/close cycles.\n\nThe reproducer needs an attached USB device that stops draining bulk OUT,\nplus a link down and unplug, driven as root. It is not a privilege\nboundary crossing and no exploit primitive was developed.\n\nFound by 0sec (https://0sec.ai)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T15:32:46.001Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d07133fe1befae9a1e4c4c5e46ef0b73d2992020"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c7496124e94c7f9c3daa5c5b1fb563ca9d62c45"
        },
        {
          "url": "https://git.kernel.org/stable/c/48303f3ae0fa6e102f3fc7dbf1688cc179131962"
        },
        {
          "url": "https://git.kernel.org/stable/c/fde39b8a521780391fb4e5bda2c0aa4928947f12"
        }
      ],
      "title": "net: usb: ipheth: fix carrier_work UAF on disconnect",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74677",
    "datePublished": "2026-08-22T15:32:46.001Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-22T15:32:46.001Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/scsi_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7b615fc139e35c81077046df44725c532f7e2404",
              "status": "affected",
              "version": "ebacb44cb2042b90951140eda806bedad23ef554",
              "versionType": "git"
            },
            {
              "lessThan": "5d3e1d006bbb543259f9e31824caadbfff6a5465",
              "status": "affected",
              "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
              "versionType": "git"
            },
            {
              "lessThan": "49e5b25a0b74dbac595f122e5608fdce2918cc4e",
              "status": "affected",
              "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
              "versionType": "git"
            },
            {
              "lessThan": "495058429ca55ab7fcc21977b63b92907ad68066",
              "status": "affected",
              "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
              "versionType": "git"
            },
            {
              "lessThan": "2047ed09bf13453b7d6f9431b112ec07984dd69b",
              "status": "affected",
              "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
              "versionType": "git"
            },
            {
              "lessThan": "d6e6da6bc3b53231fac77ffab428da8173ee729c",
              "status": "affected",
              "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
              "versionType": "git"
            },
            {
              "lessThan": "93dde0bf2f39a0f9f57fd610aa3201ce5b753433",
              "status": "affected",
              "version": "7db0e0c8190a086ef92ce5bb960836cde49540aa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c4d2d7c935a4ad20e8e726ca10499cefe4537103",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.217",
              "status": "affected",
              "version": "5.15.8",
              "versionType": "semver"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.85",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/scsi_debug.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.15.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.85",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write\n\nresp_report_zones() sizes the reply buffer from the CDB allocation\nlength. The v3 fix rounds alloc_len up with ALIGN() before deriving the\ndescriptor count:\n\n\trep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) -\n\t\t\t RZONES_DESC_HD) \u003e\u003e ilog2(RZONES_DESC_HD);\n\tarr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1);\n\nFor alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to\n0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()\u0027s size_t is 32-bit\nand truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which\npasses the !arr check, and desc = arr + 64 is then dereferenced in the\nloop -\u003e out-of-bounds write / panic.\n\nClamp rep_max_zones to devip-\u003enr_zones. The loop already stops at\nsdebug_capacity (after nr_zones zones), so a report can never hold more\nthan nr_zones descriptors; the clamp does not change the report, it only\nbounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device\nproperty that can never reach 0x100000000."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached by sending a crafted ZONE IN REPORT ZONES SCSI CDB through local SG_IO/BSG ioctl on a scsi_debug zoned LUN; scsi_debug is a pseudo host simulator with no native network protocol handler.\nAC:L - Once scsi_debug is loaded in host-managed zoned mode, a single REPORT ZONES command with ALLOCATION LENGTH 1-63 reliably underflows rep_max_zones and forces heap writes past a tiny kzalloc buffer; no races or victim-dependent timing are required.\nPR:L - ZBC_IN is whitelisted in scsi_cmd_allowed() without CAP_SYS_RAWIO, so any local user who can open the scsi_debug /dev/sg or BSG node (e.g., disk group) can issue the malicious CDB; module load and zoned setup are environmental, not exploit-time privileges.\nUI:N - Exploitation requires only the attacker issuing SG_IO/BSG with a malicious REPORT ZONES CDB; no separate victim interaction such as mounting media or clicking a prompt is needed.\nS:U - The out-of-bounds write corrupts kernel heap memory in the same host kernel security authority; it is not a VM escape, IOMMU bypass, or other cross-boundary compromise.\nC:H - The kmalloc heap out-of-bounds write can corrupt adjacent slab objects and be groomed into arbitrary kernel memory disclosure primitives; per kernel guidance, exploitable out-of-bounds writes warrant High confidentiality impact.\nI:H - Attacker-controlled REPORT ZONES allocation length drives rep_max_zones and causes repeated 64-byte descriptor writes far beyond the allocated buffer, providing a kernel heap out-of-bounds write suitable for control-data corruption and privilege escalation.\nA:H - Writing zone descriptors from arr+64 when the buffer is smaller than 64 bytes immediately corrupts out-of-bounds kernel memory and commonly triggers KASAN faults, kernel oops, or panic, satisfying High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:20.125Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7b615fc139e35c81077046df44725c532f7e2404"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d3e1d006bbb543259f9e31824caadbfff6a5465"
        },
        {
          "url": "https://git.kernel.org/stable/c/49e5b25a0b74dbac595f122e5608fdce2918cc4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/495058429ca55ab7fcc21977b63b92907ad68066"
        },
        {
          "url": "https://git.kernel.org/stable/c/2047ed09bf13453b7d6f9431b112ec07984dd69b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6e6da6bc3b53231fac77ffab428da8173ee729c"
        },
        {
          "url": "https://git.kernel.org/stable/c/93dde0bf2f39a0f9f57fd610aa3201ce5b753433"
        }
      ],
      "title": "scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74470",
    "datePublished": "2026-08-15T12:27:07.504Z",
    "dateReserved": "2026-08-15T05:44:03.902Z",
    "dateUpdated": "2026-08-23T12:47:20.125Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-mq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "23d8ea1e303b5f32d883757a4a707e791dbc9808",
              "status": "affected",
              "version": "b0077e269f6c152e807fdac90b58caf012cdbaab",
              "versionType": "git"
            },
            {
              "lessThan": "97e2d08de282ef76f84ab4ccd00f1acb3f5f999e",
              "status": "affected",
              "version": "b0077e269f6c152e807fdac90b58caf012cdbaab",
              "versionType": "git"
            },
            {
              "lessThan": "388468f7e7d1eab092cf2a39fdfb502e52019ec6",
              "status": "affected",
              "version": "b0077e269f6c152e807fdac90b58caf012cdbaab",
              "versionType": "git"
            },
            {
              "lessThan": "dc278e9bf2b9513a763353e6b9cc21e0f532954e",
              "status": "affected",
              "version": "b0077e269f6c152e807fdac90b58caf012cdbaab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b5c8e0ff76d10f6bf70a7237678f27c20cf59bc9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e9c309ded295b7f8849097d71ae231456ca79f78",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b80056bd75a16e4550873ecefe12bc8fd190b1cf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "33cf52b6e53a6aa55883aa7fb9ceffceff8488a6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8b6075046470c8756242dfe3fd058813636f69a3",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.72",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6",
              "status": "affected",
              "version": "6.5.13",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.3",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-mq.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.75",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-mq: pop cached request if it is usable\n\nWhen submitting a bio to blk-mq, if the task should sleep after peeking\na cached request, but before it pops it, the plug flushes and calls\nblk_mq_free_plug_rqs, freeing the cached_rqs. This creates a\nuse-after-free bug. Fix this by popping the cached request before any\npossible blocking calls if it is suitable for use.\n\nPopping this request first holds a queue reference, so avoid any\nserialization races with queue freezes and can safely proceed with\ndispatching that request to the driver. This potentially increases a\ntiming window from when a driver wants to freeze its queue to when\nrequests stop being dispatched. That scenario is off the fast path\nthough, and drivers need to appropriately handle requests during a\nfreeze request anyway.\n\nThe downside is the popped element needs to be individually freed when\nwe performed a bio plug merge. The cached request would have had to be\nfreed later anyway, but this patch does it inline with building the plug\nlist instead of after flushing it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in `blk_mq_submit_bio()`, reached from local block I/O submission (`submit_bio` via read/write, filesystem I/O, or io_uring). Reliable exploitation requires a `blk_plug` with populated `cached_rqs`, which occurs when io_uring submits batches of 3+ plugged read/write operations (`blk_start_plug_nr_ios`); remote-only paths like nfsd/ksmbd/nvmet typically use `blk_start_plug()` with `nr_ios=1` and do not populate the cached-request list needed to hit the peek-without-pop window.\nAC:L - An attacker controls both sides of the race by batching io_uring I/O and inducing a sleep between peek and pop (e.g., memory pressure during bio split/allocation, or `bio_integrity_prep()` blocking on PI-capable enterprise/cloud NVMe). Plug flush on any schedule is deterministic kernel behavior, not an uncontrollable environmental condition.\nPR:L - Triggering requires only an unprivileged local process able to perform block-backed I/O (normal file read/write or io_uring readv/writev to accessible storage); no root, `CAP_SYS_ADMIN`, or special kernel capabilities are needed beyond standard filesystem/device access available to any local user.\nUI:N - Exploitation is driven entirely by the attacker\u0027s own I/O submissions through io_uring or direct block I/O; no action by another user or administrator is required.\nS:U - Impact is confined to kernel memory via a block-layer use-after-free on `struct request`; this is standard kernel privilege escalation territory and does not cross a VM, IOMMU, or sandbox security boundary.\nC:H - This is a use-after-free of a `struct request` object; the attacker can influence post-free heap contents and dereference freed fields (`rq-\u003eq`, `rq-\u003emq_hctx`, `rq-\u003ebio`), enabling arbitrary kernel memory read primitives.\nI:H - UAF on `struct request` permits controlled writes through subsequent use of the dangling object (`rq-\u003ecmd_flags`, `queuelist`, bio attachment in `blk_mq_bio_to_request`), enabling heap corruption and potential arbitrary code execution in kernel context.\nA:H - The freed request is dereferenced during `blk_mq_use_cached_rq()` and subsequent request setup, causing kernel oops/panic; even without full exploitation, UAF reliably threatens system availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:28:11.145Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/23d8ea1e303b5f32d883757a4a707e791dbc9808"
        },
        {
          "url": "https://git.kernel.org/stable/c/97e2d08de282ef76f84ab4ccd00f1acb3f5f999e"
        },
        {
          "url": "https://git.kernel.org/stable/c/388468f7e7d1eab092cf2a39fdfb502e52019ec6"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc278e9bf2b9513a763353e6b9cc21e0f532954e"
        }
      ],
      "title": "blk-mq: pop cached request if it is usable",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64017",
    "datePublished": "2026-07-19T15:39:11.989Z",
    "dateReserved": "2026-07-19T07:54:57.027Z",
    "dateUpdated": "2026-08-19T16:28:11.145Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9c7e8ff48c377bef18c3d178748aea0575b69ede",
              "status": "affected",
              "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
              "versionType": "git"
            },
            {
              "lessThan": "2a73b2c37ee3060a880b53cd24783d93fc7be5f8",
              "status": "affected",
              "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
              "versionType": "git"
            },
            {
              "lessThan": "e79f59a8527a49078cfaf8fe8fb5fcefc20c76d2",
              "status": "affected",
              "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
              "versionType": "git"
            },
            {
              "lessThan": "d85d2fd54e901637c81d847811e03c662aee13cd",
              "status": "affected",
              "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
              "versionType": "git"
            },
            {
              "lessThan": "016763e829cac37b3234eace86fd0a4c560de4a7",
              "status": "affected",
              "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
              "versionType": "git"
            },
            {
              "lessThan": "27e068d1b35dbec10a3cf268887c94407be4badc",
              "status": "affected",
              "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
              "versionType": "git"
            },
            {
              "lessThan": "d48ea5c9c4c34dc0df621f0e39ed3a16b644621a",
              "status": "affected",
              "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
              "versionType": "git"
            },
            {
              "lessThan": "21b5953e7494c16a42e6cd8cf110e18d13ae4a6b",
              "status": "affected",
              "version": "69e3c75f4d541a6eb151b3ef91f34033cb3ad6e1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/packet/af_packet.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.267",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use consistent hard_header_len in TX_RING send path\n\ntpacket_snd() reads dev-\u003ehard_header_len independently for skb\nallocation and header construction in tpacket_fill_skb(). Concurrent\nnetdevice reconfiguration can therefore make the reserved headroom\nsmaller than the amount later pushed, or make copylen - hard_header_len\nnegative.\n\nSnapshot hard_header_len once before processing ring frames and use it\nfor the frame limit, headroom allocation, copy length, and skb\nconstruction. Pass the snapshot to tpacket_fill_skb().\n\nThe separate SOCK_DGRAM consistency problem between hard_header_len and\nheader_ops-\u003ecreate is not addressed here."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached only via local syscalls on an AF_PACKET socket with PACKET_TX_RING configured (sendmsg on mmap ring frames); it is not triggered by processing remotely received network traffic.\nAC:L - An attacker can open the TX_RING socket and concurrently reconfigure the bound netdev (e.g., VLAN/bonding/macvlan changes) in a user+network namespace, controlling both sides of the hard_header_len race without depending on external timing.\nPR:L - Exploitation requires CAP_NET_RAW to create AF_PACKET sockets and CAP_NET_ADMIN to change netdev hard_header_len; both are obtainable by an unprivileged user inside a user namespace without init-namespace root.\nUI:N - No victim interaction is required; the attacker triggers the bug using their own packet socket, TX_RING, and netdev reconfiguration threads.\nS:U - Impact is kernel heap corruption and local privilege escalation within the same kernel security domain; it does not constitute a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:H - Racing hard_header_len can make skb_push exceed reserved headroom or skb_put use a negative length (huge unsigned), and subsequent skb_store_bits writes before skb-\u003ehead or far past skb-\u003etail, corrupting adjacent slab objects and enabling kernel memory disclosure.\nI:H - Inconsistent hard_header_len between skb allocation and tpacket_fill_skb causes out-of-bounds linear expansion and data writes in the skb buffer, yielding heap corruption primitives suitable for control-flow hijacking and local privilege escalation.\nA:H - Corrupted skb_push/put operations invoke skb_under_panic or skb_over_panic (BUG), causing kernel oops/panic and reliable denial of service even when exploitation is not completed."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:40:01.903Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9c7e8ff48c377bef18c3d178748aea0575b69ede"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a73b2c37ee3060a880b53cd24783d93fc7be5f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/e79f59a8527a49078cfaf8fe8fb5fcefc20c76d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/d85d2fd54e901637c81d847811e03c662aee13cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/016763e829cac37b3234eace86fd0a4c560de4a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/27e068d1b35dbec10a3cf268887c94407be4badc"
        },
        {
          "url": "https://git.kernel.org/stable/c/d48ea5c9c4c34dc0df621f0e39ed3a16b644621a"
        },
        {
          "url": "https://git.kernel.org/stable/c/21b5953e7494c16a42e6cd8cf110e18d13ae4a6b"
        }
      ],
      "title": "packet: use consistent hard_header_len in TX_RING send path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74668",
    "datePublished": "2026-08-22T15:32:39.583Z",
    "dateReserved": "2026-08-15T05:44:03.924Z",
    "dateUpdated": "2026-08-27T12:40:01.903Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f03398d835f5249c49546f0eb0d0df6792b95d5f",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "a3ac6d849de5f7abe14761d741bbb843ac793454",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "7edd3adb0c80d70b4237640275c559610f438476",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "c5e5d78743992e235b76d2ebe5a403d60315aa8a",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "7b0f62d2986a28e5e4188366bc2f4e2868b14790",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "8b3e4ed9c35d3d3b64fcc23f4a1f22b37c1865b1",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "bd88f6289b7e483216a9c1df15a0460ef9b02cb6",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            },
            {
              "lessThan": "6829665d050983907b560173e49dcc6c11cb2730",
              "status": "affected",
              "version": "554c0a3abf216c991c5ebddcdb2c08689ecd290b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: rtl8723bs: validate monitor transmit frame lengths\n\nrtw_cfg80211_monitor_if_xmit_entry() removes the radiotap header and\nthen reads the 802.11 frame control field without checking that a base\n802.11 header remains.\n\nThe data path also pulls the calculated 802.11, QoS and SNAP header\nspan before confirming that the skb contains it. A truncated frame can\ntherefore cause out-of-bounds reads or leave insufficient data for the\nEthernet address writes.\n\nReject frames that do not contain the base 802.11 header and data\nframes that do not contain their complete calculated header span."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is only reachable via local userspace transmitting crafted radiotap skbs to the rtl8723bs monitor netdev ndo_start_xmit handler (cfg80211 NEW_INTERFACE + packet socket/dev_queue_xmit); remote WiFi peers cannot drive this transmit-only parsing path.\nAC:L - An attacker fully controls monitor TX skb length and 802.11 header fields after the fixed 14-byte radiotap prefix; sending a truncated frame (e.g., radiotap-only or short DATA header) reliably triggers the missing bounds checks without races or layout dependencies.\nPR:L - Exploitation requires creating a monitor virtual interface via nl80211 (GENL_UNS_ADMIN_PERM/CAP_NET_ADMIN) and injecting frames via CAP_NET_RAW packet sockets; per kernel CNA guidance these capabilities are PR:L when obtainable through user namespaces on embedded rtl8723bs systems.\nUI:N - No victim interaction is required once the attacker can create or access the monitor interface; exploitation is a direct syscall/netlink and packet-socket operation without needing the user to connect, mount, or approve an action.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the host kernel running the rtl8723bs SDIO WiFi driver; it does not cross VM, container, or IOMMU security boundaries.\nC:H - Reading dot11_hdr-\u003eframe_control and memcpy of addr1/addr2 without verifying at least 24 bytes remain after radiotap removal causes out-of-bounds kernel reads of adjacent skb and kmalloc memory, enabling information disclosure.\nI:H - On the DATA path, skb_pull and subsequent memcpy of 12-byte Ethernet addresses into skb-\u003edata without ensuring sufficient tail room can write past the skb buffer end, providing exploitable heap corruption for arbitrary kernel writes.\nA:H - Out-of-bounds reads and writes in kernel softirq transmit context on SDIO WiFi embedded devices (CHIP, Intel Compute Stick, ARM SBCs) can trigger kernel oops, panic, or hang, causing complete loss of availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:06.779Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f03398d835f5249c49546f0eb0d0df6792b95d5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3ac6d849de5f7abe14761d741bbb843ac793454"
        },
        {
          "url": "https://git.kernel.org/stable/c/7edd3adb0c80d70b4237640275c559610f438476"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5e5d78743992e235b76d2ebe5a403d60315aa8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7b0f62d2986a28e5e4188366bc2f4e2868b14790"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b3e4ed9c35d3d3b64fcc23f4a1f22b37c1865b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd88f6289b7e483216a9c1df15a0460ef9b02cb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6829665d050983907b560173e49dcc6c11cb2730"
        }
      ],
      "title": "staging: rtl8723bs: validate monitor transmit frame lengths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74648",
    "datePublished": "2026-08-22T15:32:24.858Z",
    "dateReserved": "2026-08-15T05:44:03.923Z",
    "dateUpdated": "2026-08-25T05:41:06.779Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/udp_offload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6a733a38b983d8c2e222f13968209010cf44de87",
              "status": "affected",
              "version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
              "versionType": "git"
            },
            {
              "lessThan": "19d89b13a43640b2da2f277ee462d919d988cb6f",
              "status": "affected",
              "version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
              "versionType": "git"
            },
            {
              "lessThan": "b3df61bb745eb5201eac22679a2839d4ccbf3442",
              "status": "affected",
              "version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
              "versionType": "git"
            },
            {
              "lessThan": "1ae134c012e10384cdac420b5cc6e0615cde0b55",
              "status": "affected",
              "version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
              "versionType": "git"
            },
            {
              "lessThan": "5161e67c561c4f28a5d9335a6e859b02511de92b",
              "status": "affected",
              "version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
              "versionType": "git"
            },
            {
              "lessThan": "64d322c288577793eedd352b96ef75234ed380fe",
              "status": "affected",
              "version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
              "versionType": "git"
            },
            {
              "lessThan": "588d4a6795d99d080f74ef0b5f391ea8c453ae5d",
              "status": "affected",
              "version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
              "versionType": "git"
            },
            {
              "lessThan": "d0f86fb36eb260abd10007b62c9dcc1028e03e61",
              "status": "affected",
              "version": "dbef491ebe7f3a4fb1b9111878b86a426fd540b7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/udp_offload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: fix potential use-after-free in tunnel segmentation\n\n__skb_udp_tunnel_segment() gets the UDP header before ensuring the\ntunnel header is in the skb head. If the pull reallocates skb-\u003ehead,\nthe saved UDP header pointer is no longer valid.\n\nGet the UDP header after the pull to avoid a potential use-after-free."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Remote peers reach __skb_udp_tunnel_segment on egress when GRO-coalesced VXLAN/Geneve/FOU GSO superpackets are forwarded or re-encapsulated through dev_queue_xmit, and malicious virtio-net/cloud tenants can inject VIRTIO_NET_HDR_GSO_UDP_TUNNEL frames the host later segments on physical or overlay NICs.\nAC:L - Triggering is deterministic once a GSO UDP-tunnel skb has tunnel headers beyond skb_headlen so pskb_may_pull reallocates skb-\u003ehead; attackers control that layout via fragmented or GRO-built outer/encap headers and can repeat crafted sends until segmentation dereferences the stale UDP pointer.\nPR:N - No host authentication or credentials are required to send UDP tunnel traffic to listening overlay ports on cloud/DC nodes, and co-resident virtio-net guests or tenant VMs can emit GSO UDP-tunnel frames into the host datapath without CAP_NET_ADMIN on the victim host.\nUI:N - Exploitation needs only crafted encapsulated GSO traffic into an already-running overlay, bridge, IPVS, OVS, or virtio forwarding path; no victim file open, mount, link click, or other interactive action beyond normal network or VM I/O.\nS:C - In cloud/Kubernetes and virtio-net multitenant deployments, remote or guest/tenant senders can corrupt hypervisor kernel heap during host-side UDP-tunnel GSO segmentation on egress, crossing the VM/container-to-host security boundary rather than staying within the attacker\u0027s own namespace.\nC:H - After pskb_may_pull reallocates skb-\u003ehead, the pre-pull udp_hdr pointer is stale yet uh-\u003elen and uh-\u003echeck are read for checksum adjustment, yielding a classic heap use-after-free read primitive that can disclose kernel memory and support further exploitation.\nI:H - UAF on the UDP header allows attacker-influenced heap reuse and corruption of header fields and checksum state during tunnel GSO segmentation, providing a write/control primitive suitable for kernel code execution rather than a benign checksum miscalculation.\nA:H - Dereferencing the freed UDP header during GSO segmentation can immediately oops or panic the kernel, and repeated exploitation attempts against this UAF commonly crash or hang the host even when full control is not achieved."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:48.767Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6a733a38b983d8c2e222f13968209010cf44de87"
        },
        {
          "url": "https://git.kernel.org/stable/c/19d89b13a43640b2da2f277ee462d919d988cb6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3df61bb745eb5201eac22679a2839d4ccbf3442"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ae134c012e10384cdac420b5cc6e0615cde0b55"
        },
        {
          "url": "https://git.kernel.org/stable/c/5161e67c561c4f28a5d9335a6e859b02511de92b"
        },
        {
          "url": "https://git.kernel.org/stable/c/64d322c288577793eedd352b96ef75234ed380fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/588d4a6795d99d080f74ef0b5f391ea8c453ae5d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d0f86fb36eb260abd10007b62c9dcc1028e03e61"
        }
      ],
      "title": "udp: fix potential use-after-free in tunnel segmentation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74705",
    "datePublished": "2026-08-22T15:33:04.110Z",
    "dateReserved": "2026-08-15T05:44:03.927Z",
    "dateUpdated": "2026-08-25T05:41:48.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/fib_semantics.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "57195f0ab5cfbb5ee0864e5aff15ceb48f5a5e28",
              "status": "affected",
              "version": "d15662682db232da77136cd348f4c9df312ca6f9",
              "versionType": "git"
            },
            {
              "lessThan": "0f0ca602941d0a81ae9514943ca06c55159c6385",
              "status": "affected",
              "version": "d15662682db232da77136cd348f4c9df312ca6f9",
              "versionType": "git"
            },
            {
              "lessThan": "5307a53599fa762c06e475ee4a375252074fd324",
              "status": "affected",
              "version": "d15662682db232da77136cd348f4c9df312ca6f9",
              "versionType": "git"
            },
            {
              "lessThan": "7f80ad373ce4a7af5367ff273cea0f16e91387f3",
              "status": "affected",
              "version": "d15662682db232da77136cd348f4c9df312ca6f9",
              "versionType": "git"
            },
            {
              "lessThan": "4a5dfbae5179f6574695012a980476254df2d295",
              "status": "affected",
              "version": "d15662682db232da77136cd348f4c9df312ca6f9",
              "versionType": "git"
            },
            {
              "lessThan": "a59edda6eda1252340354322d8ab318b2e9052fb",
              "status": "affected",
              "version": "d15662682db232da77136cd348f4c9df312ca6f9",
              "versionType": "git"
            },
            {
              "lessThan": "9b22f13524fa0de0d963bbd3002df6c28bae3395",
              "status": "affected",
              "version": "d15662682db232da77136cd348f4c9df312ca6f9",
              "versionType": "git"
            },
            {
              "lessThan": "4ff9548d84945d2cbf9e4c207288063a200ea397",
              "status": "affected",
              "version": "d15662682db232da77136cd348f4c9df312ca6f9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/fib_semantics.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.267",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops\n\nfib_nlmsg_size() still estimates nexthop space as if every gateway is\nencoded as an IPv4 RTA_GATEWAY attribute. IPv4 routes can also carry an\nIPv6 gateway, which fib_nexthop_info() dumps as RTA_VIA.\n\nAs a result, route notifications can allocate an skb that is too small.\nfib_dump_info() then fails with -EMSGSIZE and rtmsg_fib() hits the\nWARN_ON() that marks such failures as a fib_nlmsg_size() bug. With\npanic_on_warn set, this becomes a kernel panic.\n\nMirror the actual nexthop dump layout in fib_nlmsg_size(): account for\nIPv6 nexthop gateways dumped as RTA_VIA, for the no-header rtnexthop\nlayout used inside RTA_MULTIPATH, and for RTA_FLOW only when it is\nactually present."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:39:57.259Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/57195f0ab5cfbb5ee0864e5aff15ceb48f5a5e28"
        },
        {
          "url": "https://git.kernel.org/stable/c/0f0ca602941d0a81ae9514943ca06c55159c6385"
        },
        {
          "url": "https://git.kernel.org/stable/c/5307a53599fa762c06e475ee4a375252074fd324"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f80ad373ce4a7af5367ff273cea0f16e91387f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a5dfbae5179f6574695012a980476254df2d295"
        },
        {
          "url": "https://git.kernel.org/stable/c/a59edda6eda1252340354322d8ab318b2e9052fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/9b22f13524fa0de0d963bbd3002df6c28bae3395"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ff9548d84945d2cbf9e4c207288063a200ea397"
        }
      ],
      "title": "ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74657",
    "datePublished": "2026-08-22T15:32:31.458Z",
    "dateReserved": "2026-08-15T05:44:03.923Z",
    "dateUpdated": "2026-08-27T12:39:57.259Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b45b91db41379ee5fb36c187d6d7c37b725cbe8e",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "62978cf6347972c04130e4e841ba404504d92b32",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "7568e9e717e7540bd05bcc007f5d76fcaff3cdff",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "bf98d7b0d5a99991e47e66cee4eb1d3fa514be97",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Prevent subbuf order change when resizing is disabled\n\nBecause ring_buffer_subbuf_order_set() frees buffer pages, we can\u0027t\nallow it when resizing is disabled. A non-consuming reader is at risk of\nuse-after-free (rb_advance_iter()).\n\nReturn -EBUSY on resize_disabled, matching ring_buffer_resize()\nbehaviour."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local tracefs operations: write() to buffer_subbuf_size_kb (buffer_subbuf_size_write) while a non-consuming ring_buffer_read_start() iterator is active from reading trace/per_cpu/cpuN/trace. No network, adjacent-radio, or physical-device path reaches ring_buffer_subbuf_order_set().\nAC:L - The attacker controls both sides: one thread holds trace open for read (sets resize_disabled via ring_buffer_read_start) while another writes buffer_subbuf_size_kb to free pages still referenced by iter-\u003ehead_page. rb_advance_iter()/rb_inc_iter then dereferences freed memory; the race is reliably retried.\nPR:L - tracing_check_open_get_tr() enforces only LOCKDOWN_TRACEFS and DAC with no capability check. tracefs buffer_subbuf_size_kb and trace are mode 0640 and are routinely delegated via gid=/mode= to tracing-group members on Android/Perfetto, ChromeOS, and developer systems, matching prior CNA tracefs UAF scores (CVE-2024-50207, CVE-2025-38101).\nUI:N - Exploitation uses the attacker\u0027s own tracefs file descriptors and threads (open trace for read, write buffer_subbuf_size_kb). No separate victim mount, click, or configuration action is required beyond the attacker holding tracefs access.\nS:U - The use-after-free corrupts kernel ring-buffer heap pages and metadata within the same OS security authority. It enables local privilege escalation but does not cross VM, IOMMU, container, or hardware trust boundaries.\nC:H - ring_buffer_subbuf_order_set() frees buffer_page data pages while iterators retain head_page pointers; rb_iter_head_event() memcpy() and rb_inc_iter() read iter-\u003ehead_page-\u003epage after free_pages(), leaking recycled kernel heap contents to userspace through trace reads.\nI:H - Freed sub-buffer pages and buffer_page structures can be reused while iterators and splice paths still perform stores and list operations on them. This UAF heap corruption is exploitable for arbitrary kernel writes and control-flow hijack, not merely a crash.\nA:H - Concurrent page frees with active iterators corrupt ring-buffer lists and cause use-after-free dereferences in rb_advance_iter(), producing kernel oopses/panics. syzbot reported this failure mode and the attacker can retrigger it at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:58.185Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b45b91db41379ee5fb36c187d6d7c37b725cbe8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/62978cf6347972c04130e4e841ba404504d92b32"
        },
        {
          "url": "https://git.kernel.org/stable/c/7568e9e717e7540bd05bcc007f5d76fcaff3cdff"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf98d7b0d5a99991e47e66cee4eb1d3fa514be97"
        }
      ],
      "title": "ring-buffer: Prevent subbuf order change when resizing is disabled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74634",
    "datePublished": "2026-08-22T15:32:14.547Z",
    "dateReserved": "2026-08-15T05:44:03.922Z",
    "dateUpdated": "2026-08-25T05:40:58.185Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/evdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d2e3839419ac4047835762c4d7712bda1101b57e",
              "status": "affected",
              "version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
              "versionType": "git"
            },
            {
              "lessThan": "c6d5fa46c1ee25d068fc730fd377f0f54188d290",
              "status": "affected",
              "version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
              "versionType": "git"
            },
            {
              "lessThan": "e748811d9b80a3e101110ff4b3c612e5fca54d98",
              "status": "affected",
              "version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
              "versionType": "git"
            },
            {
              "lessThan": "06a286b320236508d02ab2ccc9496352748652a8",
              "status": "affected",
              "version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
              "versionType": "git"
            },
            {
              "lessThan": "7d17e9454a9af3ec7aebb88b41a9deedd5b19a6b",
              "status": "affected",
              "version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
              "versionType": "git"
            },
            {
              "lessThan": "bd3c4108a56de34380edab670065e86283cb3029",
              "status": "affected",
              "version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
              "versionType": "git"
            },
            {
              "lessThan": "7e55ca1080f09d9f7112c7f20ac31f682c1f2374",
              "status": "affected",
              "version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
              "versionType": "git"
            },
            {
              "lessThan": "90f305f2c7a30257c683e13f4bf7c798eea992a0",
              "status": "affected",
              "version": "6addb1d6de1968b84852f54561cc9a999909b5a9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/input/evdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: evdev - fix information leak in evdev_pass_values()\n\nIn evdev_pass_values(), the input_event structure is allocated on the\nkernel stack and populated field-by-field. However, it is never fully\ninitialized. On architectures where struct input_event contains explicit\nor implicit padding (such as the 32-bit __pad field on SPARC64), these\npadding bytes are left uninitialized.\n\nWhen this event structure is subsequently passed to the client buffer\nand later copied to userspace, the uninitialized padding bytes leak\nkernel stack memory, potentially exposing sensitive information.\n\nSimilar issues exist in __evdev_queue_syn_dropped and __pass_event.\n\nFix this by explicitly zeroing the entire event structure with memset()\nbefore populating its fields. This ensures all padding bytes are cleared\nbefore the data crosses the security boundary."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:23:15.607Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d2e3839419ac4047835762c4d7712bda1101b57e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6d5fa46c1ee25d068fc730fd377f0f54188d290"
        },
        {
          "url": "https://git.kernel.org/stable/c/e748811d9b80a3e101110ff4b3c612e5fca54d98"
        },
        {
          "url": "https://git.kernel.org/stable/c/06a286b320236508d02ab2ccc9496352748652a8"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d17e9454a9af3ec7aebb88b41a9deedd5b19a6b"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd3c4108a56de34380edab670065e86283cb3029"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e55ca1080f09d9f7112c7f20ac31f682c1f2374"
        },
        {
          "url": "https://git.kernel.org/stable/c/90f305f2c7a30257c683e13f4bf7c798eea992a0"
        }
      ],
      "title": "Input: evdev - fix information leak in evdev_pass_values()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74673",
    "datePublished": "2026-08-22T15:32:42.941Z",
    "dateReserved": "2026-08-15T05:44:03.925Z",
    "dateUpdated": "2026-08-25T05:23:15.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "201633f47b542a99bb7baafdfcda7781249fb3d9",
              "status": "affected",
              "version": "d361ad5d2fc0e4d59d5d538092c9b37889756642",
              "versionType": "git"
            },
            {
              "lessThan": "e28420e36542ae8b66a5bdcec419525f521bddf8",
              "status": "affected",
              "version": "d361ad5d2fc0e4d59d5d538092c9b37889756642",
              "versionType": "git"
            },
            {
              "lessThan": "9cd9a983769a4d0e9cc80a287316ee79685d38b3",
              "status": "affected",
              "version": "d361ad5d2fc0e4d59d5d538092c9b37889756642",
              "versionType": "git"
            },
            {
              "lessThan": "3e864bf2a32a1cbdf1e0f9c5a5a4176e8575f4a3",
              "status": "affected",
              "version": "d361ad5d2fc0e4d59d5d538092c9b37889756642",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/gfx: fix cleaner shader IB buffer overflow\n\nThe cleaner shader sysfs path allocates a 16-dword (64 byte) IB but\nincorrectly fills (align_mask + 1) dwords. On GFX rings align_mask is\n0xff, so the loop wrote 256 dwords into a 64-byte buffer, causing a\nkernel page fault.\n\nThe IB only needs to be a minimal NOP shell to schedule the job; the\ncleaner shader itself is emitted on the ring via emit_cleaner_shader().\nFill 16 dwords to match the allocation.\n\nv2: Use ib_size_dw variable (Lijo)\n\n(cherry picked from commit bf21af331ebf72d0935fd70c73192414a422c03a)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:02:10.194Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/201633f47b542a99bb7baafdfcda7781249fb3d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/e28420e36542ae8b66a5bdcec419525f521bddf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cd9a983769a4d0e9cc80a287316ee79685d38b3"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e864bf2a32a1cbdf1e0f9c5a5a4176e8575f4a3"
        }
      ],
      "title": "drm/amdgpu/gfx: fix cleaner shader IB buffer overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68276",
    "datePublished": "2026-08-10T12:01:51.789Z",
    "dateReserved": "2026-07-30T09:28:09.379Z",
    "dateUpdated": "2026-08-17T05:02:10.194Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_conn.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "64d1645f26aa49b5a86ba2fccd0bb6749ea725a6",
              "status": "affected",
              "version": "249c88e7fb45b6b705040c5af4bd0d0f2bc9735c",
              "versionType": "git"
            },
            {
              "lessThan": "963fb4b8e7d1ab07b4ae45bf15d41e667c88caca",
              "status": "affected",
              "version": "227a0cdf4a028a73dc256d0f5144b4808d718893",
              "versionType": "git"
            },
            {
              "lessThan": "e8f9fef362bab431d95371d3406bc720350290c3",
              "status": "affected",
              "version": "227a0cdf4a028a73dc256d0f5144b4808d718893",
              "versionType": "git"
            },
            {
              "lessThan": "fa812cfa81aa3d4a7b6ce8277979af57b3f79712",
              "status": "affected",
              "version": "227a0cdf4a028a73dc256d0f5144b4808d718893",
              "versionType": "git"
            },
            {
              "lessThan": "5761d003daa987ac81463f570713ce9c9dd204e5",
              "status": "affected",
              "version": "227a0cdf4a028a73dc256d0f5144b4808d718893",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7fe4d391e937c2f048a43ff4b421e677f10d83c0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "58afdc9b18871eb1d461c725be9e9f3f44a39aeb",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.151",
              "status": "affected",
              "version": "6.6.51",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11",
              "status": "affected",
              "version": "6.10.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/hci_conn.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "6.6.51",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.184",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.10.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: hold conn reference in abort_conn_sync()\n\nThere is theoretical UAF if the conn is freed while the hci_sync task is\nrunning.\n\nHold refcount to avoid that."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The flaw is in the Bluetooth HCI connection abort path reachable when a nearby attacker sends connection, authentication-failure, or disconnect traffic that drives hci_disconnect()/hci_abort_conn() through hci_event processing.\nAC:L - An adjacent attacker can repeatedly initiate, fail, and tear down connections to race asynchronous abort_conn_sync work against hci_conn_del(), controlling both sides of the timing window without depending on uncontrollable system state.\nPR:N - Exploitation requires no local account or kernel privileges; a remote Bluetooth peer within RF range can trigger hci_abort_conn() via standard HCI event handling without authenticated pairing or CAP_NET_ADMIN access.\nUI:N - No deliberate victim action beyond normal Bluetooth availability is required; exploitation works against discoverable/connectable devices and already-paired reconnections without opening files or confirming a one-off prompt.\nS:U - Impact is kernel heap corruption and potential privilege escalation within the host kernel security boundary, not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.\nC:H - Use-after-free of struct hci_conn lets an attacker read freed slab memory through abort_conn_sync/hci_abort_conn_sync field accesses, enabling disclosure of kernel pointers and adjacent heap contents.\nI:H - UAF of hci_conn is heap memory corruption that can be shaped via slab reuse and exploited for arbitrary kernel writes or control-flow hijack, not merely a bounded data change.\nA:H - Accessing a freed hci_conn during abort_conn_sync can cause kernel oops, BUG, or panic, and UAF corruption can crash or hang the system even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:47:34.295Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/64d1645f26aa49b5a86ba2fccd0bb6749ea725a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/963fb4b8e7d1ab07b4ae45bf15d41e667c88caca"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8f9fef362bab431d95371d3406bc720350290c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa812cfa81aa3d4a7b6ce8277979af57b3f79712"
        },
        {
          "url": "https://git.kernel.org/stable/c/5761d003daa987ac81463f570713ce9c9dd204e5"
        }
      ],
      "title": "Bluetooth: hci_conn: hold conn reference in abort_conn_sync()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74531",
    "datePublished": "2026-08-15T12:27:45.988Z",
    "dateReserved": "2026-08-15T05:44:03.912Z",
    "dateUpdated": "2026-08-23T12:47:34.295Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/x25/af_x25.c",
            "net/x25/x25_timer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba925a2e98ce967a0e71c5bcbcf5dbd3facaf0c8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6b79659590f0f82a9b8efd2ffd55ec6399ebfc33",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "fdd9ac50b9b61ef2b2d52c5156aff788be91454d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "1fc9f6d2c7c9fdb341bfe8ca449c990632299ea6",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "3c4919be5d910db4beebca420953858606fba7d8",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "4bc522b33438fefc3272840ae5988771863a4f1f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e92c7e2b41d1528a830bc64c5e4e46dfa8133dda",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2195424c3da2ef1829a63b807e3a900a90e57d85",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/x25/af_x25.c",
            "net/x25/x25_timer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.267",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/x25: fix use-after-free of the socket by its timers\n\nThe x25 timers are armed with mod_timer() and cancelled with\ntimer_delete(), so a pending timer holds no reference on the socket and a\ncancel does not wait for a callback already running on another CPU.\n\nx25_heartbeat_expiry() also rearms unconditionally, so it can reinstall\nsk-\u003esk_timer after __x25_destroy_socket() has passed its cancel point.\nThe following __sock_put() frees the socket while the timer is still\nqueued, and the next expiry uses freed memory.  KASAN reports a\nslab-use-after-free on the kmalloc-2k object freed by close().\n\ntimer_delete_sync() cannot be used here: x25_heartbeat_expiry() and\nx25_timer_expiry() both reach the cancels from inside the timer they\nwould wait on, through __x25_destroy_socket() and x25_disconnect().\n\nArm the timers with sk_reset_timer() and cancel them with sk_stop_timer()\nso that an armed timer owns a reference, and release it in both expiry\nhandlers.  Rearm the heartbeat only while sk_hashed(sk) is still true,\nsince __x25_destroy_socket() unlinks the socket before dropping it.  Arm\nthe deferred destroy timer the same way and drop its reference in\nx25_destroy_timer().\n\nReproduced on net with KASAN, with the heartbeat period shortened so the\nwindow recurs.  With this patch the reproducer no longer triggers a\nreport and /proc/net/x25 drains.\n\nDiscovered by XBOW, triaged by Baul Lee \u003cbaul.lee@xbow.com\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Remote X.25 frames reach x25_lapb_receive_frame() on init_net gateways, where unauthenticated CALL_REQUEST/CLEAR handling arms heartbeat timers and drives server socket teardown through __x25_destroy_socket() during close.\nAC:L - The attacker controls both sides of the race by opening/closing sockets or sending concurrent connect/clear traffic, repeatedly forcing __x25_destroy_socket() against sk_timer callbacks that re-arm via mod_timer().\nPR:N - X.25 call setup and clearing are unauthenticated on the wire; a remote peer can create sockets via CALL_REQUEST and force teardown without any local account or CAP_NET_ADMIN.\nUI:N - Exploitation requires no end-user action; automated server handling of remote X.25 connect/clear suffices to reach the vulnerable close/timer path.\nS:U - Impact stays within kernel memory via standard slab UAF on the AF_X25 socket object; this is not a guest/host or IOMMU boundary escape.\nC:H - KASAN reports slab-use-after-free on the kmalloc-2k socket freed by close(), and UAF on struct sock gives attacker-controlled reuse enabling arbitrary kernel memory disclosure.\nI:H - Use-after-free of the socket structure enables heap grooming and corrupting freed object contents for control-flow or arbitrary kernel writes/code execution.\nA:H - The freed socket timer expiry dereferences released memory and can oops/panic the kernel; UAF reliably threatens system availability even before full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:39:49.703Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ba925a2e98ce967a0e71c5bcbcf5dbd3facaf0c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b79659590f0f82a9b8efd2ffd55ec6399ebfc33"
        },
        {
          "url": "https://git.kernel.org/stable/c/fdd9ac50b9b61ef2b2d52c5156aff788be91454d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fc9f6d2c7c9fdb341bfe8ca449c990632299ea6"
        },
        {
          "url": "https://git.kernel.org/stable/c/3c4919be5d910db4beebca420953858606fba7d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/4bc522b33438fefc3272840ae5988771863a4f1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e92c7e2b41d1528a830bc64c5e4e46dfa8133dda"
        },
        {
          "url": "https://git.kernel.org/stable/c/2195424c3da2ef1829a63b807e3a900a90e57d85"
        }
      ],
      "title": "net/x25: fix use-after-free of the socket by its timers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74628",
    "datePublished": "2026-08-22T15:32:10.135Z",
    "dateReserved": "2026-08-15T05:44:03.921Z",
    "dateUpdated": "2026-08-27T12:39:49.703Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}