Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1119
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Debian trixie versions ant\u00e9rieures \u00e0 6.12.107-1",
"product": {
"name": "Debian",
"vendor": {
"name": "Debian",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-74626",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74626"
},
{
"name": "CVE-2026-80562",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80562"
},
{
"name": "CVE-2026-74653",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74653"
},
{
"name": "CVE-2026-74662",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74662"
},
{
"name": "CVE-2025-40074",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40074"
},
{
"name": "CVE-2026-64581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64581"
},
{
"name": "CVE-2026-80572",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80572"
},
{
"name": "CVE-2026-80590",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80590"
},
{
"name": "CVE-2026-64216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64216"
},
{
"name": "CVE-2026-80583",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80583"
},
{
"name": "CVE-2026-80557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80557"
},
{
"name": "CVE-2026-80725",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80725"
},
{
"name": "CVE-2026-80536",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80536"
}
],
"initial_release_date": "2026-09-04T00:00:00",
"last_revision_date": "2026-09-04T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1119",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-04T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian",
"vendor_advisories": [
{
"published_at": "2026-08-29",
"title": "Bulletin de s\u00e9curit\u00e9 Debian msg00388",
"url": "https://lists.debian.org/debian-security-announce/2026/msg00388.html"
}
]
}
CVE-2026-80590 (GCVE-0-2026-80590)
Vulnerability from cvelistv5
Published
2026-08-28 06:35
Modified
2026-08-31 06:12
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
inet: frags: strip GSO state from fragments before reassembly
A virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark
an IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.
inet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first
fragment's skb as the head of the reassembled datagram, including its
shinfo->gso_size/gso_type/gso_segs, and chain the remaining fragments
on frag_list with whatever linear/paged layout they arrived with.
After ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the
reassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and
the next software segmentation point - udp_rcv_segment() on local
delivery, validate_xmit_skb(), or the ip_finish_output_gso() slow
path - hands it to skb_segment(). skb_segment()'s frag_list walk
assumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to
a tap by an unprivileged user in its own userns are enough:
kernel BUG at net/core/skbuff.c:4899!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2
RIP: 0010:skb_segment+0x20ca/0x48b0
Call Trace:
<TASK>
__udp_gso_segment+0x29a/0x27d0
udp4_ufo_fragment+0x458/0x6c0
inet_gso_segment+0x429/0x1340
skb_mac_gso_segment+0x233/0x4f0
__skb_gso_segment+0x308/0x660
udp_queue_rcv_skb+0x440/0xad0
udp_unicast_rcv_skb+0xc7/0x2c0
udp_rcv+0x16ce/0x2260
ip_protocol_deliver_rcu+0x197/0x2d0
ip_local_deliver+0x430/0x690
ip_rcv+0x16f/0x1f0
__netif_receive_skb_one_core+0x15e/0x1c0
__netif_receive_skb+0x1e/0x110
netif_receive_skb+0xf6/0x5c0
tun_rx_batched.isra.0+0x3ab/0x790
tun_get_user+0x17c3/0x3550
tun_chr_write_iter+0xba/0x1b0
vfs_write+0x646/0x1130
</TASK>
Kernel panic - not syncing: Fatal exception in interrupt
This runs with BH disabled, so it is a panic rather than an oops. The
same is reachable with CAP_NET_RAW in a netns where a defrag point
precedes a GSO point, and from a guest whose VMM forwards
virtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by
commit 3dcbdb134f32 ("net: gso: Fix skb_segment splat when splitting
gso_size mangled skb having linear-headed frag_list") and by
commit 9e4b7a99a03a ("net: gso: fix panic on frag_list with mixed head
alloc types") do not cover it: page-backed heads skip them, and kmalloc
heads skip them when gso_size == skb_headlen(head), which the sender
controls.
An skb entering a frag queue is an IP fragment by definition and
cannot legitimately carry GSO state: GRO does not merge fragments and
the stack segments before it fragments, so only untrusted sources are
affected. This has been reachable since
commit f43798c27684 ("tun: Allow GSO using virtio_net_hdr"), the first
path that let userspace attach GSO metadata to an IP fragment. Reset
the GSO fields of every fragment as it is queued, in
inet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and
6lowpan reassembly share; then neither the head nor the frag_list
members of the reassembled skb carry them (the members matter too:
the ip_do_fragment()/ip6_fragment() fast paths send them out as they
are). The head may remain CHECKSUM_PARTIAL; that is already accepted
on receive and resolved by skb_checksum_help() in
ip_do_fragment()/ip6_fragment() on forward.
Tested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer
above, two further IPv4 frag_list geometries that reach
BUG_ON(i >= nfrags) and BUG_ON(!list_skb->head_frag), and an IPv6
fragment-header variant (udp6_ufo_fragment()) each panic the unpatched
kernel; with this patch all four datagrams are delivered intact and
nothing is logged.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 Version: f43798c27684ab925adde7d8acc34c78c6e50df8 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/inet_fragment.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "29dda278a5ed272f2230ff4eaa23cf403107bba0",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "3edf721bb4b99d272c336631b44e3d8ff9a4f31b",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "dec2edb7aaf12a8878b3a03172ea8fc277b8eaad",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "69b73b74d9eb45f5560a8fe4fa406ada580e1340",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "da857e448322a2e871ce3ecc2900027041160d43",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
},
{
"lessThan": "d5dc1e69fd7258ea605c9952e5d5947539159ae3",
"status": "affected",
"version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/inet_fragment.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.268",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.219",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.186",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.155",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.107",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.48",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.268",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.219",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.186",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.155",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.107",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.48",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.12",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.2",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: strip GSO state from fragments before reassembly\n\nA virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark\nan IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.\ninet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first\nfragment\u0027s skb as the head of the reassembled datagram, including its\nshinfo-\u003egso_size/gso_type/gso_segs, and chain the remaining fragments\non frag_list with whatever linear/paged layout they arrived with.\n\nAfter ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the\nreassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and\nthe next software segmentation point - udp_rcv_segment() on local\ndelivery, validate_xmit_skb(), or the ip_finish_output_gso() slow\npath - hands it to skb_segment(). skb_segment()\u0027s frag_list walk\nassumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to\na tap by an unprivileged user in its own userns are enough:\n\n kernel BUG at net/core/skbuff.c:4899!\n Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2\n RIP: 0010:skb_segment+0x20ca/0x48b0\n Call Trace:\n \u003cTASK\u003e\n __udp_gso_segment+0x29a/0x27d0\n udp4_ufo_fragment+0x458/0x6c0\n inet_gso_segment+0x429/0x1340\n skb_mac_gso_segment+0x233/0x4f0\n __skb_gso_segment+0x308/0x660\n udp_queue_rcv_skb+0x440/0xad0\n udp_unicast_rcv_skb+0xc7/0x2c0\n udp_rcv+0x16ce/0x2260\n ip_protocol_deliver_rcu+0x197/0x2d0\n ip_local_deliver+0x430/0x690\n ip_rcv+0x16f/0x1f0\n __netif_receive_skb_one_core+0x15e/0x1c0\n __netif_receive_skb+0x1e/0x110\n netif_receive_skb+0xf6/0x5c0\n tun_rx_batched.isra.0+0x3ab/0x790\n tun_get_user+0x17c3/0x3550\n tun_chr_write_iter+0xba/0x1b0\n vfs_write+0x646/0x1130\n \u003c/TASK\u003e\n Kernel panic - not syncing: Fatal exception in interrupt\n\nThis runs with BH disabled, so it is a panic rather than an oops. The\nsame is reachable with CAP_NET_RAW in a netns where a defrag point\nprecedes a GSO point, and from a guest whose VMM forwards\nvirtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by\ncommit 3dcbdb134f32 (\"net: gso: Fix skb_segment splat when splitting\ngso_size mangled skb having linear-headed frag_list\") and by\ncommit 9e4b7a99a03a (\"net: gso: fix panic on frag_list with mixed head\nalloc types\") do not cover it: page-backed heads skip them, and kmalloc\nheads skip them when gso_size == skb_headlen(head), which the sender\ncontrols.\n\nAn skb entering a frag queue is an IP fragment by definition and\ncannot legitimately carry GSO state: GRO does not merge fragments and\nthe stack segments before it fragments, so only untrusted sources are\naffected. This has been reachable since\ncommit f43798c27684 (\"tun: Allow GSO using virtio_net_hdr\"), the first\npath that let userspace attach GSO metadata to an IP fragment. Reset\nthe GSO fields of every fragment as it is queued, in\ninet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and\n6lowpan reassembly share; then neither the head nor the frag_list\nmembers of the reassembled skb carry them (the members matter too:\nthe ip_do_fragment()/ip6_fragment() fast paths send them out as they\nare). The head may remain CHECKSUM_PARTIAL; that is already accepted\non receive and resolved by skb_checksum_help() in\nip_do_fragment()/ip6_fragment() on forward.\n\nTested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer\nabove, two further IPv4 frag_list geometries that reach\nBUG_ON(i \u003e= nfrags) and BUG_ON(!list_skb-\u003ehead_frag), and an IPv6\nfragment-header variant (udp6_ufo_fragment()) each panic the unpatched\nkernel; with this patch all four datagrams are delivered intact and\nnothing is logged."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - A malicious cloud VM guest injects virtio_net_hdr-marked IPv4/IPv6 fragments through virtio-net/vhost-tap into the host ip_rcv() path; the same inet_frag reassembly and skb_segment() crash also fires on validate_xmit_skb()/ip_finish_output_gso() when such skbs traverse forwarding.\nAC:L - The attacker fully controls virtio_net_hdr gso_type/gso_size and fragment geometry; the commit reproduces a host panic from two tap writes with no races, timing, or uncontrollable memory layout required.\nPR:N - On typical KVM/QEMU tap-backed virtio-net deployments a tenant VM needs no host account or capability; exploitation uses only the pre-provisioned virtual NIC, not init-namespace root or CAP_NET_ADMIN on the host.\nUI:N - Packet injection, ip_defrag reassembly, and GSO segmentation run automatically in softirq once crafted virtio fragments are sent; no victim mount, click, or other cooperative action is required.\nS:C - A guest VM tenant can panic the host kernel by crossing the hypervisor virtio/tap boundary, impacting resources outside the guest security authority even though the demonstrated primitive is denial of service rather than full escape.\nC:N - Impact is an intentional BUG_ON in skb_segment() frag_list handling; there is no demonstrated out-of-bounds read, use-after-free, or other information-disclosure primitive before the assertion aborts.\nI:N - The failure aborts in skb_segment() before any out-of-bounds write, page-desc conversion, or control-flow hijack; attacker-controlled metadata only reaches a defensive assertion, not a memory modification primitive.\nA:H - Triggering skb_segment() BUG_ON from tun_rx/tun_get_user runs with BH disabled and causes a fatal kernel panic, fully and repeatedly denying availability of the affected host until reboot."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T06:12:21.989Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cfdbc8c2e6f9ef5d8b8e54859da03dfe682b0bee"
},
{
"url": "https://git.kernel.org/stable/c/29dda278a5ed272f2230ff4eaa23cf403107bba0"
},
{
"url": "https://git.kernel.org/stable/c/14a8f3e10fa9a5abd6cedcdaa0c0b7ea9a09f234"
},
{
"url": "https://git.kernel.org/stable/c/3edf721bb4b99d272c336631b44e3d8ff9a4f31b"
},
{
"url": "https://git.kernel.org/stable/c/dec2edb7aaf12a8878b3a03172ea8fc277b8eaad"
},
{
"url": "https://git.kernel.org/stable/c/c49f04e8d2b94dbb8d9fd99731dd3f00589c8ace"
},
{
"url": "https://git.kernel.org/stable/c/69b73b74d9eb45f5560a8fe4fa406ada580e1340"
},
{
"url": "https://git.kernel.org/stable/c/da857e448322a2e871ce3ecc2900027041160d43"
},
{
"url": "https://git.kernel.org/stable/c/d5dc1e69fd7258ea605c9952e5d5947539159ae3"
}
],
"title": "inet: frags: strip GSO state from fragments before reassembly",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80590",
"datePublished": "2026-08-28T06:35:12.516Z",
"dateReserved": "2026-08-26T14:34:25.770Z",
"dateUpdated": "2026-08-31T06:12:21.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80536 (GCVE-0-2026-80536)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-08-27 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfs: bounds-check buffer log item's dirty bitmap
xlog_recover_do_reg_buffer() replays each dirty region described by a
buffer log item's bitmap into the buffer read for that item:
memcpy(xfs_buf_offset(bp, (uint)bit << XFS_BLF_SHIFT),
item->ri_buf[i].iov_base,
nbits << XFS_BLF_SHIFT);
The destination offset (bit/nbits, from the logged dirty bitmap) and the
buffer size (from the logged blf_len) are both attacker-controlled and
otherwise unrelated, yet the only thing bounding the copy is an ASSERT(),
which compiles away on production kernels. A crafted image logging a
small blf_len together with a bitmap bit past the end of that buffer
drives the memcpy() past the buffer's allocation, corrupting adjacent
kernel heap during mount-time log recovery. This is reachable by anyone
who can get a crafted image mounted -- the malicious-filesystem threat
model XFS already guards against elsewhere.
Turn the ASSERT() into a real XFS_IS_CORRUPT() check that aborts recovery
of the buffer with -EFSCORRUPTED, consistent with the validate-and-fail
idiom already used in xlog_recover_do_inode_buffer() and
xfs_dquot_item_recover.c. xlog_recover_do_reg_buffer() therefore becomes
STATIC int and its three callers propagate the error.
Found and confirmed with KASAN on a CONFIG_XFS_DEBUG=n build: the crafted
image trips a slab-out-of-bounds write before this change and fails
recovery cleanly with -EFSCORRUPTED after it.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Version: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_buf_item_recover.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "acb4e26295e7f0e685815a3fd3d70bd8329cefa1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f3859c35a4fbc1c1c58431f684f808e43696891d",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f7b5fa83e2c192be922121b764415fa8c7549ea1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "b7528b42813f02724a78fce1da24d69d1bfc4d38",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "7e32d4eebae6ca24f8a673c107fd7eca1f47afc2",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "f8288214459ead7e87d26e5822f62c14a4f2ed6b",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "edaf5b6bd625356893da20d69a259b34a9de2694",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "813f8136a2ce1fee266d02a7df73db6e8a541604",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/xfs/xfs_buf_item_recover.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: bounds-check buffer log item\u0027s dirty bitmap\n\nxlog_recover_do_reg_buffer() replays each dirty region described by a\nbuffer log item\u0027s bitmap into the buffer read for that item:\n\n\tmemcpy(xfs_buf_offset(bp, (uint)bit \u003c\u003c XFS_BLF_SHIFT),\n\t\titem-\u003eri_buf[i].iov_base,\n\t\tnbits \u003c\u003c XFS_BLF_SHIFT);\n\nThe destination offset (bit/nbits, from the logged dirty bitmap) and the\nbuffer size (from the logged blf_len) are both attacker-controlled and\notherwise unrelated, yet the only thing bounding the copy is an ASSERT(),\nwhich compiles away on production kernels. A crafted image logging a\nsmall blf_len together with a bitmap bit past the end of that buffer\ndrives the memcpy() past the buffer\u0027s allocation, corrupting adjacent\nkernel heap during mount-time log recovery. This is reachable by anyone\nwho can get a crafted image mounted -- the malicious-filesystem threat\nmodel XFS already guards against elsewhere.\n\nTurn the ASSERT() into a real XFS_IS_CORRUPT() check that aborts recovery\nof the buffer with -EFSCORRUPTED, consistent with the validate-and-fail\nidiom already used in xlog_recover_do_inode_buffer() and\nxfs_dquot_item_recover.c. xlog_recover_do_reg_buffer() therefore becomes\nSTATIC int and its three callers propagate the error.\n\nFound and confirmed with KASAN on a CONFIG_XFS_DEBUG=n build: the crafted\nimage trips a slab-out-of-bounds write before this change and fails\nrecovery cleanly with -EFSCORRUPTED after it."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The OOB write is only reachable during XFS log recovery at mount time (mount\u2192xfs_mountfs\u2192xfs_log_mount\u2192xlog_recover\u2192xlog_do_recovery_pass pass2\u2192xlog_recover_buf_commit_pass2\u2192xlog_recover_do_reg_buffer); attacker data comes from a local block/loop device image, not from any network protocol handler.\nAC:L - All trigger fields (blf_len, blf_data_map bit/nbits, and logged source bytes in ri_buf) are attacker-authored on-disk log metadata; pairing a small blf_len with a bitmap region past the buffer end deterministically drives memcpy() past the xfs_buf allocation on every mount with no race or uncontrollable layout.\nPR:N - Mounting the crafted image requires no account or capability on the victim host in the malicious-filesystem threat model: an external attacker only supplies removable media or a disk image and desktop/kiosk udisks2 or systemd automount performs the privileged mount on device insertion without attacker credentials.\nUI:N - Once the crafted XFS volume is presented to the host, log recovery in xlog_recover_do_reg_buffer() runs automatically during mount (including read-only mounts) before any file access; the attacker needs no separate victim to open files, click links, or perform additional actions beyond presenting the image.\nS:U - Heap corruption occurs entirely within the mounting host kernel during log replay; impact is confined to the same kernel security authority and does not cross VM, IOMMU, or container sandbox boundaries.\nC:H - KASAN-confirmed slab-out-of-bounds write corrupts adjacent kernel heap objects; such controlled memory corruption is routinely weaponized for arbitrary kernel read primitives and pointer disclosure, not merely a crash.\nI:H - memcpy() writes attacker-controlled bytes from logged ri_buf regions to attacker-chosen offsets beyond the buffer end, giving a controllable out-of-bounds kernel heap write primitive suitable for control-flow hijacking and privilege escalation.\nA:H - The unchecked memcpy() causes slab-out-of-bounds writes during mount-time recovery (KASAN-verified on CONFIG_XFS_DEBUG=n), reliably corrupting kernel heap and capable of provoking kernel oops/panic or persistent denial of service on repeated mount attempts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:40:04.524Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/acb4e26295e7f0e685815a3fd3d70bd8329cefa1"
},
{
"url": "https://git.kernel.org/stable/c/f3859c35a4fbc1c1c58431f684f808e43696891d"
},
{
"url": "https://git.kernel.org/stable/c/f7b5fa83e2c192be922121b764415fa8c7549ea1"
},
{
"url": "https://git.kernel.org/stable/c/b7528b42813f02724a78fce1da24d69d1bfc4d38"
},
{
"url": "https://git.kernel.org/stable/c/7e32d4eebae6ca24f8a673c107fd7eca1f47afc2"
},
{
"url": "https://git.kernel.org/stable/c/f8288214459ead7e87d26e5822f62c14a4f2ed6b"
},
{
"url": "https://git.kernel.org/stable/c/edaf5b6bd625356893da20d69a259b34a9de2694"
},
{
"url": "https://git.kernel.org/stable/c/813f8136a2ce1fee266d02a7df73db6e8a541604"
}
],
"title": "xfs: bounds-check buffer log item\u0027s dirty bitmap",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80536",
"datePublished": "2026-08-26T14:37:11.584Z",
"dateReserved": "2026-08-26T14:34:25.765Z",
"dateUpdated": "2026-08-27T12:40:04.524Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64216 (GCVE-0-2026-64216)
Vulnerability from cvelistv5
Published
2026-07-24 15:23
Modified
2026-08-27 12:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()
netfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it
is wanting to unlock and compares that to rreq->no_unlock_folio so that it
doesn't unlock a folio being read for netfs_perform_write() or
netfs_write_begin().
However, given that netfs_unlock_abandoned_read_pages() is called _after_
NETFS_RREQ_IN_PROGRESS is cleared, the one folio that it's not allowed to
dereference is the one specified by ->no_unlock_folio as ownership
immediately reverts to the caller.
Fix this by storing the folio pointer instead and using that rather than
the index. Also fix netfs_unlock_read_folio() where the same applies.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/netfs/buffered_read.c",
"fs/netfs/read_collect.c",
"fs/netfs/read_retry.c",
"include/linux/netfs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d4ae8dba90b89e7bb4d1045d1cb26afbaf13ee5c",
"status": "affected",
"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
"versionType": "git"
},
{
"lessThan": "6080fa3ecfbb4448a3b47368629534c09b6ec750",
"status": "affected",
"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
"versionType": "git"
},
{
"lessThan": "3866d015f33aeedf81338dd99154703bef33faef",
"status": "affected",
"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
"versionType": "git"
},
{
"lessThan": "dbe556972100fabb8e5a1b3d2163831ff07b1e8e",
"status": "affected",
"version": "ee4cdf7ba857a894ad1650d6ab77669cbbfa329e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/netfs/buffered_read.c",
"fs/netfs/read_collect.c",
"fs/netfs/read_retry.c",
"include/linux/netfs.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"lessThan": "6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.34",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.11",
"versionStartIncluding": "6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()\n\nnetfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it\nis wanting to unlock and compares that to rreq-\u003eno_unlock_folio so that it\ndoesn\u0027t unlock a folio being read for netfs_perform_write() or\nnetfs_write_begin().\n\nHowever, given that netfs_unlock_abandoned_read_pages() is called _after_\nNETFS_RREQ_IN_PROGRESS is cleared, the one folio that it\u0027s not allowed to\ndereference is the one specified by -\u003eno_unlock_folio as ownership\nimmediately reverts to the caller.\n\nFix this by storing the folio pointer instead and using that rather than\nthe index. Also fix netfs_unlock_read_folio() where the same applies."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The vulnerable read-for-write completion is used by network filesystem clients including Ceph, SMB, 9P, and AFS. A malicious filesystem peer can induce failed or malformed reads and control completion timing.\nAC:L - Partial buffered writes and concurrent invalidation can repeatedly trigger the race, with an adjacent bug reproducing approximately 30% of repeated attempts. The attacker can influence completion, reuse, and retry timing.\nPR:N - A malicious filesystem server requires no privileges on the victim client; mount and session credentials belong to the victim.\nUI:N - Once the network filesystem is mounted, ordinary or automated writes can exercise the vulnerable path without further human action.\nS:U - The UAF corrupts resources within the host kernel\u0027s existing security authority and does not inherently cross a VM, IOMMU, or sandbox boundary.\nC:H - The stale folio can be freed and reused, and premature unlocking of a replacement page can expose page-cache or kernel contents.\nI:H - If the folio is reused, folio_unlock() can toggle PG_locked on an unrelated page, enabling concurrent memory corruption and potentially code execution.\nA:H - The condition can trigger a VM_BUG_ON_FOLIO kernel crash; incorrect PG_locked state can also cause permanent page-lock waits and system hangs."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:39:42.119Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d4ae8dba90b89e7bb4d1045d1cb26afbaf13ee5c"
},
{
"url": "https://git.kernel.org/stable/c/6080fa3ecfbb4448a3b47368629534c09b6ec750"
},
{
"url": "https://git.kernel.org/stable/c/3866d015f33aeedf81338dd99154703bef33faef"
},
{
"url": "https://git.kernel.org/stable/c/dbe556972100fabb8e5a1b3d2163831ff07b1e8e"
}
],
"title": "netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64216",
"datePublished": "2026-07-24T15:23:04.673Z",
"dateReserved": "2026-07-19T15:36:31.770Z",
"dateUpdated": "2026-08-27T12:39:42.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80562 (GCVE-0-2026-80562)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-08-27 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpio: ml-ioh: use raw_spinlock_t for the register lock
ioh_irq_type() is registered as the irq_chip .irq_set_type callback and
takes chip->spinlock with spin_lock_irqsave(). This callback is reached
from __setup_irq() -> __irq_set_trigger() -> chip->irq_set_type() while
the caller holds desc->lock, a raw_spinlock_t, with hardirqs disabled.
That context is not sleepable, but on PREEMPT_RT a regular spinlock_t is
an rtmutex-backed sleeping lock, so acquiring it there is invalid.
ioh_irq_enable() and ioh_irq_disable() take the same lock from the
.irq_enable/.irq_disable callbacks, which are likewise invoked with
desc->lock held.
Convert the register lock to raw_spinlock_t. The same lock also
serializes the GPIO direction/value callbacks and the suspend/resume
register save/restore, and those critical sections only perform short
sequences of MMIO register accesses (ioread32()/iowrite32()); the
.irq_set_type callback additionally emits a dev_warn() on an unsupported
type. None of these are sleepable operations, so keeping this register
lock non-sleeping is appropriate for the irqchip callbacks and does not
change the GPIO-side locking contract.
This is the same fix as commit a02b8950d619 ("gpio: pch: use
raw_spinlock_t for the register lock"); this driver shares the same
structure as gpio-pch.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 54be566317b6aece2389a95bb19ea209af9359be Version: 54be566317b6aece2389a95bb19ea209af9359be Version: 54be566317b6aece2389a95bb19ea209af9359be Version: 54be566317b6aece2389a95bb19ea209af9359be Version: 54be566317b6aece2389a95bb19ea209af9359be Version: 54be566317b6aece2389a95bb19ea209af9359be Version: 54be566317b6aece2389a95bb19ea209af9359be Version: 54be566317b6aece2389a95bb19ea209af9359be |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-ml-ioh.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "431b10133113537660a6090a2856b0d74d1b06de",
"status": "affected",
"version": "54be566317b6aece2389a95bb19ea209af9359be",
"versionType": "git"
},
{
"lessThan": "359e6b1168c9a62a7bd214ace476aaa2d57eebe8",
"status": "affected",
"version": "54be566317b6aece2389a95bb19ea209af9359be",
"versionType": "git"
},
{
"lessThan": "63d2230e5076c12f93d2a1d1bff2fbbf6cf32f3c",
"status": "affected",
"version": "54be566317b6aece2389a95bb19ea209af9359be",
"versionType": "git"
},
{
"lessThan": "b6505a4cea45dd92eb753581b1ad9b524b5fcc34",
"status": "affected",
"version": "54be566317b6aece2389a95bb19ea209af9359be",
"versionType": "git"
},
{
"lessThan": "84be002b40d30c56a91873b236e2d9001bbee363",
"status": "affected",
"version": "54be566317b6aece2389a95bb19ea209af9359be",
"versionType": "git"
},
{
"lessThan": "bc7934d0acd4fc1c7e5b7c68debdb4a991121628",
"status": "affected",
"version": "54be566317b6aece2389a95bb19ea209af9359be",
"versionType": "git"
},
{
"lessThan": "0559b86611c35d342dd48542ea26a9e437046bf6",
"status": "affected",
"version": "54be566317b6aece2389a95bb19ea209af9359be",
"versionType": "git"
},
{
"lessThan": "600411ea1f2443fdf5b1af9b6480f616d7aff9d0",
"status": "affected",
"version": "54be566317b6aece2389a95bb19ea209af9359be",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-ml-ioh.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: ml-ioh: use raw_spinlock_t for the register lock\n\nioh_irq_type() is registered as the irq_chip .irq_set_type callback and\ntakes chip-\u003espinlock with spin_lock_irqsave(). This callback is reached\nfrom __setup_irq() -\u003e __irq_set_trigger() -\u003e chip-\u003eirq_set_type() while\nthe caller holds desc-\u003elock, a raw_spinlock_t, with hardirqs disabled.\nThat context is not sleepable, but on PREEMPT_RT a regular spinlock_t is\nan rtmutex-backed sleeping lock, so acquiring it there is invalid.\nioh_irq_enable() and ioh_irq_disable() take the same lock from the\n.irq_enable/.irq_disable callbacks, which are likewise invoked with\ndesc-\u003elock held.\n\nConvert the register lock to raw_spinlock_t. The same lock also\nserializes the GPIO direction/value callbacks and the suspend/resume\nregister save/restore, and those critical sections only perform short\nsequences of MMIO register accesses (ioread32()/iowrite32()); the\n.irq_set_type callback additionally emits a dev_warn() on an unsupported\ntype. None of these are sleepable operations, so keeping this register\nlock non-sleeping is appropriate for the irqchip callbacks and does not\nchange the GPIO-side locking contract.\n\nThis is the same fix as commit a02b8950d619 (\"gpio: pch: use\nraw_spinlock_t for the register lock\"); this driver shares the same\nstructure as gpio-pch."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:40:17.967Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/431b10133113537660a6090a2856b0d74d1b06de"
},
{
"url": "https://git.kernel.org/stable/c/359e6b1168c9a62a7bd214ace476aaa2d57eebe8"
},
{
"url": "https://git.kernel.org/stable/c/63d2230e5076c12f93d2a1d1bff2fbbf6cf32f3c"
},
{
"url": "https://git.kernel.org/stable/c/b6505a4cea45dd92eb753581b1ad9b524b5fcc34"
},
{
"url": "https://git.kernel.org/stable/c/84be002b40d30c56a91873b236e2d9001bbee363"
},
{
"url": "https://git.kernel.org/stable/c/bc7934d0acd4fc1c7e5b7c68debdb4a991121628"
},
{
"url": "https://git.kernel.org/stable/c/0559b86611c35d342dd48542ea26a9e437046bf6"
},
{
"url": "https://git.kernel.org/stable/c/600411ea1f2443fdf5b1af9b6480f616d7aff9d0"
}
],
"title": "gpio: ml-ioh: use raw_spinlock_t for the register lock",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80562",
"datePublished": "2026-08-26T14:37:27.171Z",
"dateReserved": "2026-08-26T14:34:25.767Z",
"dateUpdated": "2026-08-27T12:40:17.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80583 (GCVE-0-2026-80583)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-08-27 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
The "DEC0 MODE" to "DEC7 MODE" controls are enumerated, but
tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their
value through ucontrol->value.integer.value[0] (a long) instead of
ucontrol->value.enumerated.item[0] (an unsigned int).
This same pattern was fixed in the sibling drivers by
commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array
out of bounds for enum type") and
commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array
out of bounds for enum type"), but tx-macro was missed.
On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value
sanity check catches the 4 bytes written past the enumerated item
and every read of these controls fails with -EINVAL:
snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: c39667ddcfc516fee084e449179d54430a558298 Version: c39667ddcfc516fee084e449179d54430a558298 Version: c39667ddcfc516fee084e449179d54430a558298 Version: c39667ddcfc516fee084e449179d54430a558298 Version: c39667ddcfc516fee084e449179d54430a558298 Version: c39667ddcfc516fee084e449179d54430a558298 Version: c39667ddcfc516fee084e449179d54430a558298 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/codecs/lpass-tx-macro.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dbc81b518f6936131bfd858be71cd4295136809c",
"status": "affected",
"version": "c39667ddcfc516fee084e449179d54430a558298",
"versionType": "git"
},
{
"lessThan": "f84f2c81d792cf1e65571108a3bdd2c29e09e995",
"status": "affected",
"version": "c39667ddcfc516fee084e449179d54430a558298",
"versionType": "git"
},
{
"lessThan": "48b76879f5bfc8584b99052510ac645c6ade8d2b",
"status": "affected",
"version": "c39667ddcfc516fee084e449179d54430a558298",
"versionType": "git"
},
{
"lessThan": "2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0",
"status": "affected",
"version": "c39667ddcfc516fee084e449179d54430a558298",
"versionType": "git"
},
{
"lessThan": "b6baab796d11fb84c0e9444ffca91af5eab22c25",
"status": "affected",
"version": "c39667ddcfc516fee084e449179d54430a558298",
"versionType": "git"
},
{
"lessThan": "3ee3c26ceee562079596abc9bc3307dd56dab4ed",
"status": "affected",
"version": "c39667ddcfc516fee084e449179d54430a558298",
"versionType": "git"
},
{
"lessThan": "1ba381759e45d5d0442452cfa5c42e836191a568",
"status": "affected",
"version": "c39667ddcfc516fee084e449179d54430a558298",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/codecs/lpass-tx-macro.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.47",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses\n\nThe \"DEC0 MODE\" to \"DEC7 MODE\" controls are enumerated, but\ntx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their\nvalue through ucontrol-\u003evalue.integer.value[0] (a long) instead of\nucontrol-\u003evalue.enumerated.item[0] (an unsigned int).\n\nThis same pattern was fixed in the sibling drivers by\ncommit bcfe5f76cc40 (\"ASoC: codecs: rx-macro: fix accessing array\nout of bounds for enum type\") and\ncommit 0ea5eff7c606 (\"ASoC: codecs: va-macro: fix accessing array\nout of bounds for enum type\"), but tx-macro was missed.\n\nOn 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value\nsanity check catches the 4 bytes written past the enumerated item\nand every read of these controls fails with -EINVAL:\n\n snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Exploitation requires local SNDRV_CTL_IOCTL_ELEM_READ or SNDRV_CTL_IOCTL_ELEM_WRITE on /dev/snd/controlC* through snd_ctl_ioctl() to tx_macro_dec_mode_get/put(); the Qualcomm LPASS TX macro audio codec driver has no network, Bluetooth, or physical-input attack path.\nAC:L - A single ioctl targeting DEC0-7 MODE deterministically triggers the 8-byte integer access against a 4-byte enumerated field on 64-bit kernels; the attacker controls both sides with no race, timing, or memory-layout dependency.\nPR:L - snd_ctl_open() performs no capability check; exploitation needs only local access to /dev/snd/controlC*, typically granted to the audio group on Qualcomm sc8250/sc8280 Chromebooks and Linux dev boards where this driver is present, not real root.\nUI:N - Once the attacker has ALSA control-device access they issue elem read/write ioctls themselves to DEC MODE controls; no separate victim action such as plugging hardware or opening a file is required.\nS:U - The out-of-bounds ctl-value access and resulting microphone ADC mode corruption remain within the host kernel and Qualcomm audio subsystem; there is no crossing of VM, container, or IOMMU security boundaries.\nC:H - tx_macro_dec_mode_put() reads ucontrol-\u003evalue.integer.value[0] (8 bytes) for ENUM controls, performing a 4-byte out-of-bounds read past enumerated.item[0]; per kernel CVSS guidance out-of-bounds reads are scored High even when bounded.\nI:H - tx_macro_dec_mode_get() writes 8 bytes via integer.value[0], overflowing enumerated.item[0] by 4 bytes in kernel memory; put stores values into tx-\u003edec_mode[] that program CDC_TXn_ADC_MODE on phone/Chromebook microphones, constituting memory corruption scored High.\nA:H - With CONFIG_SND_CTL_DEBUG every DEC0-7 MODE read fails with -EINVAL (access overflow), denying microphone ADC queries; on production 64-bit aarch64 builds the 4-byte union overrun corrupts ctl values and can break Qualcomm LPASS TX audio capture availability."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:40:21.902Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dbc81b518f6936131bfd858be71cd4295136809c"
},
{
"url": "https://git.kernel.org/stable/c/f84f2c81d792cf1e65571108a3bdd2c29e09e995"
},
{
"url": "https://git.kernel.org/stable/c/48b76879f5bfc8584b99052510ac645c6ade8d2b"
},
{
"url": "https://git.kernel.org/stable/c/2ed3601e9db08fbdb071bd3d7bd8f115d6d871b0"
},
{
"url": "https://git.kernel.org/stable/c/b6baab796d11fb84c0e9444ffca91af5eab22c25"
},
{
"url": "https://git.kernel.org/stable/c/3ee3c26ceee562079596abc9bc3307dd56dab4ed"
},
{
"url": "https://git.kernel.org/stable/c/1ba381759e45d5d0442452cfa5c42e836191a568"
}
],
"title": "ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80583",
"datePublished": "2026-08-26T14:37:39.704Z",
"dateReserved": "2026-08-26T14:34:25.769Z",
"dateUpdated": "2026-08-27T12:40:21.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80725 (GCVE-0-2026-80725)
Vulnerability from cvelistv5
Published
2026-08-29 06:39
Modified
2026-09-04 04:58
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: gro: properly validate BIG TCP aggregation criteria
When GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB),
BIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP
(with sufficient MAC header room to insert the temporary HBH jumbo header).
However, commit b1a78b9b9886 ("net: add support for ipv4 big tcp")
loosened the check in skb_gro_receive(), leading to several issues:
1. skb_gro_receive() checked skb_headroom(p) instead of the actual space
before the MAC header (p->mac_header). Because skb_headroom(p) includes
mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check
with p->mac_header < 8 bytes. When ipv6_gro_complete() inserts the
temporary HBH jumbo header, the memmove() starts before skb->head,
causing an out-of-bounds write and wrapping skb->mac_header.
2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q /
ETH_P_8021AD) to aggregate beyond 64KB because
p->protocol != ETH_P_IPV6 was true.
3. It checked p->encapsulation instead of NAPI_GRO_CB(skb)->encap_mark,
allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate
beyond 64KB.
Fix skb_gro_receive() to strictly enforce:
- NAPI_GRO_CB(skb)->proto == IPPROTO_TCP
- Not encapsulated (!NAPI_GRO_CB(skb)->encap_mark && !p->encapsulation)
- Protocol must be either ETH_P_IP or ETH_P_IPV6
- If ETH_P_IPV6, p->mac_header must be at least
sizeof(struct hop_jumbo_hdr)
Returning -E2BIG from skb_gro_receive() ensures that packets which cannot
become BIG TCP are cleanly flushed at <= 64KB and delivered intact without
dropping.
This issue does not exist in mainline (7.0+) because the subsystem was
rewritten in commit 81be30c1f5f2 ("net/ipv6: Drop HBH for BIG TCP on RX
side"), making this fix relevant only for older stable branches like
6.18.y.
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/gro.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "37a5dcd6837fc2afc44a7bc3ed8af4e983783d46",
"status": "affected",
"version": "0fe79f28bfaf73b66b7b1562d2468f94aa03bd12",
"versionType": "git"
},
{
"lessThan": "e907bf694ed55bdfe421be99dba35751a655df25",
"status": "affected",
"version": "0fe79f28bfaf73b66b7b1562d2468f94aa03bd12",
"versionType": "git"
},
{
"lessThan": "03cb8cc2961f5f781d12e903782cb3815ed84b1c",
"status": "affected",
"version": "0fe79f28bfaf73b66b7b1562d2468f94aa03bd12",
"versionType": "git"
},
{
"lessThan": "3ce832e2bd431d0c12ba525ed73ad8fbc4191da5",
"status": "affected",
"version": "0fe79f28bfaf73b66b7b1562d2468f94aa03bd12",
"versionType": "git"
},
{
"lessThan": "81be30c1f5f2bffda1f04c0efd0746af10b9643a",
"status": "affected",
"version": "0fe79f28bfaf73b66b7b1562d2468f94aa03bd12",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/gro.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.47",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gro: properly validate BIG TCP aggregation criteria\n\nWhen GRO attempts to aggregate packets beyond GRO_LEGACY_MAX_SIZE (64KB),\nBIG TCP should only be permitted for plain IPv4 TCP and plain IPv6 TCP\n(with sufficient MAC header room to insert the temporary HBH jumbo header).\n\nHowever, commit b1a78b9b9886 (\"net: add support for ipv4 big tcp\")\nloosened the check in skb_gro_receive(), leading to several issues:\n\n1. skb_gro_receive() checked skb_headroom(p) instead of the actual space\n before the MAC header (p-\u003emac_header). Because skb_headroom(p) includes\n mac_len, crafted frames (e.g. injected via AF_PACKET) can pass the check\n with p-\u003emac_header \u003c 8 bytes. When ipv6_gro_complete() inserts the\n temporary HBH jumbo header, the memmove() starts before skb-\u003ehead,\n causing an out-of-bounds write and wrapping skb-\u003emac_header.\n2. It allowed non-IP protocols such as software VLAN (ETH_P_8021Q /\n ETH_P_8021AD) to aggregate beyond 64KB because\n p-\u003eprotocol != ETH_P_IPV6 was true.\n3. It checked p-\u003eencapsulation instead of NAPI_GRO_CB(skb)-\u003eencap_mark,\n allowing encapsulated flows (e.g. SIT / IPv6-in-IPv4) to aggregate\n beyond 64KB.\n\nFix skb_gro_receive() to strictly enforce:\n- NAPI_GRO_CB(skb)-\u003eproto == IPPROTO_TCP\n- Not encapsulated (!NAPI_GRO_CB(skb)-\u003eencap_mark \u0026\u0026 !p-\u003eencapsulation)\n- Protocol must be either ETH_P_IP or ETH_P_IPV6\n- If ETH_P_IPV6, p-\u003emac_header must be at least\n sizeof(struct hop_jumbo_hdr)\n\nReturning -E2BIG from skb_gro_receive() ensures that packets which cannot\nbecome BIG TCP are cleanly flushed at \u003c= 64KB and delivered intact without\ndropping.\n\nThis issue does not exist in mainline (7.0+) because the subsystem was\nrewritten in commit 81be30c1f5f2 (\"net/ipv6: Drop HBH for BIG TCP on RX\nside\"), making this fix relevant only for older stable branches like\n6.18.y."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The flaw is in skb_gro_receive() on the netdev NAPI GRO ingress path (netif_receive_skb\u2192napi_gro_receive\u2192dev_gro_receive\u2192tcp/ipv6 gro handlers); remote peers can deliver crafted in-flow TCP streams to internet-facing interfaces without local access.\nAC:L - On Big TCP deployments with gro_max_size\u003e64KB, an attacker reliably coalesces past GRO_LEGACY_MAX_SIZE by sending many same-flow TCP segments; AF_PACKET injection also gives deterministic header layout control without races or victim-dependent heap layout.\nPR:N - RX GRO runs in softirq on all received packets before socket authentication; no target credentials or capabilities are required. Elevated gro_max_size is an admin tuning prerequisite of the Big TCP server class, not an attacker privilege.\nUI:N - Packet reception and GRO aggregation are automatic kernel network-stack processing triggered solely by attacker-sent traffic; no victim mount, file open, or other interaction is required.\nS:U - Impact is kernel skb/heap memory corruption within the host kernel security authority; exploitation does not cross VM, container, or IOMMU boundaries that would warrant scope-changed scoring.\nC:H - When undersized mac_header room passes the broken skb_headroom check, ipv6_gro_complete() memmove() for the temporary HBH jumbo header writes before skb-\u003ehead, corrupting adjacent kernel memory and enabling information disclosure from attacker-influenced out-of-bounds writes.\nI:H - The same invalid BIG TCP aggregation drives attacker-controlled memmove/header corruption that wraps skb-\u003emac_header, yielding an out-of-bounds write primitive suitable for heap object corruption, control-flow hijacking, and local privilege escalation.\nA:H - The defective memmove or invalid \u003e64KB aggregation on disallowed VLAN, encapsulated, or malformed flows can oops or panic the kernel during GRO completion, and a remote attacker can trigger this repeatedly to deny service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T04:58:15.396Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/37a5dcd6837fc2afc44a7bc3ed8af4e983783d46"
},
{
"url": "https://git.kernel.org/stable/c/e907bf694ed55bdfe421be99dba35751a655df25"
},
{
"url": "https://git.kernel.org/stable/c/03cb8cc2961f5f781d12e903782cb3815ed84b1c"
},
{
"url": "https://git.kernel.org/stable/c/3ce832e2bd431d0c12ba525ed73ad8fbc4191da5"
},
{
"url": "https://git.kernel.org/stable/c/81be30c1f5f2bffda1f04c0efd0746af10b9643a"
}
],
"title": "net: gro: properly validate BIG TCP aggregation criteria",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80725",
"datePublished": "2026-08-29T06:39:35.212Z",
"dateReserved": "2026-08-26T14:34:25.789Z",
"dateUpdated": "2026-09-04T04:58:15.396Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74653 (GCVE-0-2026-74653)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-08-27 12:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
The NXP LPC32xx UART (PORT_LPC3220) can latch an RX character-timeout
interrupt while the RX FIFO is empty: IIR reports UART_IIR_RX_TIMEOUT
(0x0c) but LSR.DR is clear. A character timeout is only cleared by
reading RHR, but serial8250_rx_chars() reads RHR only when LSR.DR is
set, so nothing ever clears the condition. The interrupt is
level-triggered and re-fires immediately, so on a single-core ARM926
the resulting interrupt storm livelocks the CPU.
It is reproducible when userspace repeatedly opens the front-panel port
(ttyS1): serial8250_do_set_termios() re-enables interrupts on unlock and
the handler then spins forever with iir=0xcc lsr=0x60 ier=0x05, tripping
the soft-lockup detector in serial8250_handle_irq_locked().
LPC32xx has no dedicated 8250 glue driver, it's driven by the generic
8250_of. Add a hardware specific handle_irq for PORT_LPC3220, wired up
in of_platform_serial_setup() the same way fsl8250_handle_irq is
installed. The handler follows dw8250_handle_irq(): on an RX timeout
with an empty FIFO (LSR.DR and LSR.BI clear) it does one throwaway RHR
read to clear the condition, then calls serial8250_handle_irq_locked().
No real received data is ever discarded, and it is a no-op on healthy
UARTs which never report a timeout with DR clear.
This is the same class of bug already worked around in other 8250 drivers;
see commit 424d79183af0 ("serial: 8250_dw: Avoid "too much work" from bogus rx timeout interrupt")
which reports the identical iir=0xcc/lsr=0x60. See also
UART_RX_TIMEOUT_QUIRK in 8250_omap, and the note in 8250_bcm7271.
References
| URL | Tags | |
|---|---|---|
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/8250/8250_of.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c321dc5172c8c66e21ffbeeb7a2ebb88ae6fd4c3",
"status": "affected",
"version": "e6e912c4964ce5976e508881207dfa96d5f856d7",
"versionType": "git"
},
{
"lessThan": "3ce24bc4d115336218e59b7e286fd3a79f4fc4c6",
"status": "affected",
"version": "e6e912c4964ce5976e508881207dfa96d5f856d7",
"versionType": "git"
},
{
"lessThan": "7795e8abedc86438cae0454602cbf9038b94bf38",
"status": "affected",
"version": "e6e912c4964ce5976e508881207dfa96d5f856d7",
"versionType": "git"
},
{
"lessThan": "1423415471274abda87024967d7fe2206ceee0ea",
"status": "affected",
"version": "e6e912c4964ce5976e508881207dfa96d5f856d7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/tty/serial/8250/8250_of.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.36"
},
{
"lessThan": "2.6.36",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "2.6.36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "2.6.36",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx\n\nThe NXP LPC32xx UART (PORT_LPC3220) can latch an RX character-timeout\ninterrupt while the RX FIFO is empty: IIR reports UART_IIR_RX_TIMEOUT\n(0x0c) but LSR.DR is clear. A character timeout is only cleared by\nreading RHR, but serial8250_rx_chars() reads RHR only when LSR.DR is\nset, so nothing ever clears the condition. The interrupt is\nlevel-triggered and re-fires immediately, so on a single-core ARM926\nthe resulting interrupt storm livelocks the CPU.\n\nIt is reproducible when userspace repeatedly opens the front-panel port\n(ttyS1): serial8250_do_set_termios() re-enables interrupts on unlock and\nthe handler then spins forever with iir=0xcc lsr=0x60 ier=0x05, tripping\nthe soft-lockup detector in serial8250_handle_irq_locked().\n\nLPC32xx has no dedicated 8250 glue driver, it\u0027s driven by the generic\n8250_of. Add a hardware specific handle_irq for PORT_LPC3220, wired up\nin of_platform_serial_setup() the same way fsl8250_handle_irq is\ninstalled. The handler follows dw8250_handle_irq(): on an RX timeout\nwith an empty FIFO (LSR.DR and LSR.BI clear) it does one throwaway RHR\nread to clear the condition, then calls serial8250_handle_irq_locked().\nNo real received data is ever discarded, and it is a no-op on healthy\nUARTs which never report a timeout with DR clear.\n\nThis is the same class of bug already worked around in other 8250 drivers;\nsee commit 424d79183af0 (\"serial: 8250_dw: Avoid \"too much work\" from bogus rx timeout interrupt\")\nwhich reports the identical iir=0xcc/lsr=0x60. See also\nUART_RX_TIMEOUT_QUIRK in 8250_omap, and the note in 8250_bcm7271."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:39:55.086Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c321dc5172c8c66e21ffbeeb7a2ebb88ae6fd4c3"
},
{
"url": "https://git.kernel.org/stable/c/3ce24bc4d115336218e59b7e286fd3a79f4fc4c6"
},
{
"url": "https://git.kernel.org/stable/c/7795e8abedc86438cae0454602cbf9038b94bf38"
},
{
"url": "https://git.kernel.org/stable/c/1423415471274abda87024967d7fe2206ceee0ea"
}
],
"title": "serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74653",
"datePublished": "2026-08-22T15:32:28.521Z",
"dateReserved": "2026-08-15T05:44:03.923Z",
"dateUpdated": "2026-08-27T12:39:55.086Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80572 (GCVE-0-2026-80572)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-08-27 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: byd - synchronize timer deletion before freeing private data
byd_disconnect() uses timer_delete() before freeing the driver's private
data. This does not wait for a running byd_clear_touch() callback, which
dereferences the private data and its psmouse pointer. A callback racing
with disconnect can therefore access the private data after it has been
freed. The timer can also still be re-armed by byd_process_byte() while
the disconnect is in progress.
Use timer_shutdown_sync() before freeing the private data: it waits for
a running callback and turns any later re-arm attempt into a no-op.
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2d5f5611dd0de52e9a52b56391a7049a52184e72 Version: 2d5f5611dd0de52e9a52b56391a7049a52184e72 Version: 2d5f5611dd0de52e9a52b56391a7049a52184e72 Version: 2d5f5611dd0de52e9a52b56391a7049a52184e72 Version: 2d5f5611dd0de52e9a52b56391a7049a52184e72 Version: 2d5f5611dd0de52e9a52b56391a7049a52184e72 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/mouse/byd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "84b205297fa15f97510342221d8c9a0119711478",
"status": "affected",
"version": "2d5f5611dd0de52e9a52b56391a7049a52184e72",
"versionType": "git"
},
{
"lessThan": "28d984a66b9e14be74986167b6ad40b5e0daf19a",
"status": "affected",
"version": "2d5f5611dd0de52e9a52b56391a7049a52184e72",
"versionType": "git"
},
{
"lessThan": "ee944a706a18322b4a2599eebe8040a2994e928f",
"status": "affected",
"version": "2d5f5611dd0de52e9a52b56391a7049a52184e72",
"versionType": "git"
},
{
"lessThan": "8dbfd8e32a13e116790780ed0be82b5a05eb9916",
"status": "affected",
"version": "2d5f5611dd0de52e9a52b56391a7049a52184e72",
"versionType": "git"
},
{
"lessThan": "2e509ef60ee41a2da0deb062c262bb530143fb37",
"status": "affected",
"version": "2d5f5611dd0de52e9a52b56391a7049a52184e72",
"versionType": "git"
},
{
"lessThan": "c83e79c0842ed29860648bcce5022ef0ba5001c6",
"status": "affected",
"version": "2d5f5611dd0de52e9a52b56391a7049a52184e72",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/mouse/byd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: byd - synchronize timer deletion before freeing private data\n\nbyd_disconnect() uses timer_delete() before freeing the driver\u0027s private\ndata. This does not wait for a running byd_clear_touch() callback, which\ndereferences the private data and its psmouse pointer. A callback racing\nwith disconnect can therefore access the private data after it has been\nfreed. The timer can also still be re-armed by byd_process_byte() while\nthe disconnect is in progress.\n\nUse timer_shutdown_sync() before freeing the private data: it waits for\na running callback and turns any later re-arm attempt into a no-op."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Reachable from local PS/2 input: BYD packets enter via serio_interrupt() from built-in touchpad hardware or userio-emulated SERIO_8042 port; byd_process_byte()/byd_disconnect() are not network-exposed.\nAC:L - An attacker can arm the 64ms byd_clear_touch timer via touch/relative packets while concurrently closing userio or unbinding the port to invoke byd_disconnect(), controlling both sides of the disconnect/timer race.\nPR:L - Exploitation needs only local access to the PS/2 touchpad or /dev/userio to inject packets and trigger teardown; no init-namespace root, CAP_SYS_ADMIN, or write access to psmouse sysfs is required.\nUI:N - The attacker supplies touchpad traffic and drives device disconnect/emulation teardown themselves; no separate victim interaction (mount, plug-in approval, or click) is needed.\nS:U - Corruption stays within the host kernel address space during PS/2 driver teardown; it is standard local privilege escalation, not a guest-to-host or sandbox boundary crossing.\nC:H - byd_clear_touch() dereferences freed byd_data (priv-\u003epsmouse) and can read attacker-reclaimed slab contents, enabling kernel pointer disclosure and broader arbitrary read primitives typical of heap use-after-free bugs.\nI:H - The timer callback writes into freed byd_data fields and may call input/report helpers through a stale psmouse pointer, giving heap corruption and a path to arbitrary kernel writes or control-flow hijacking.\nA:H - Racing the timer with disconnect can cause invalid pointer dereferences, use-after-free access, kernel oops, or panic during input teardown; the condition is repeatable by re-arming the timer."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:40:19.284Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/84b205297fa15f97510342221d8c9a0119711478"
},
{
"url": "https://git.kernel.org/stable/c/28d984a66b9e14be74986167b6ad40b5e0daf19a"
},
{
"url": "https://git.kernel.org/stable/c/ee944a706a18322b4a2599eebe8040a2994e928f"
},
{
"url": "https://git.kernel.org/stable/c/8dbfd8e32a13e116790780ed0be82b5a05eb9916"
},
{
"url": "https://git.kernel.org/stable/c/2e509ef60ee41a2da0deb062c262bb530143fb37"
},
{
"url": "https://git.kernel.org/stable/c/c83e79c0842ed29860648bcce5022ef0ba5001c6"
}
],
"title": "Input: byd - synchronize timer deletion before freeing private data",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80572",
"datePublished": "2026-08-26T14:37:33.141Z",
"dateReserved": "2026-08-26T14:34:25.768Z",
"dateUpdated": "2026-08-27T12:40:19.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-40074 (GCVE-0-2025-40074)
Vulnerability from cvelistv5
Published
2025-10-28 11:48
Modified
2026-08-27 12:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipv4: start using dst_dev_rcu()
Change icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF.
Change ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(),
ipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu().
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/icmp.c",
"net/ipv4/ip_fragment.c",
"net/ipv4/ipmr.c",
"net/ipv4/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "684efb2c86c887685f9aa65e1a21b3df6c1f822d",
"status": "affected",
"version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36",
"versionType": "git"
},
{
"lessThan": "923e0734c386984d45de508528a7a7ad91d791cc",
"status": "affected",
"version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36",
"versionType": "git"
},
{
"lessThan": "6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8",
"status": "affected",
"version": "4a6ce2b6f2ecabbddcfe47e7cf61dd0f00b10e36",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/icmp.c",
"net/ipv4/ip_fragment.c",
"net/ipv4/ipmr.c",
"net/ipv4/route.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.13"
},
{
"lessThan": "4.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.17.*",
"status": "unaffected",
"version": "6.17.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.18",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17.3",
"versionStartIncluding": "4.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18",
"versionStartIncluding": "4.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: start using dst_dev_rcu()\n\nChange icmpv4_xrlim_allow(), ip_defrag() to prevent possible UAF.\n\nChange ipmr_prepare_xmit(), ipmr_queue_fwd_xmit(), ip_mr_output(),\nipv4_neigh_lookup() to use lockdep enabled dst_dev_rcu()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - Every fixed site is on a pure packet-processing path \u2014 `icmpv4_xrlim_allow()` runs on inbound ICMP echo requests and on ICMP error generation, `ip_defrag()` runs on inbound IPv4 fragments via `ip_local_deliver()`, the conntrack/IPVS/OVS defrag hooks, and the `ipmr_*` sites forward remote multicast traffic. No local access is required to reach the vulnerable code.\nAC:L - An attacker can flood fragmented IPv4 datagrams and ICMP-error-provoking packets continuously, keeping `ip_defrag()` and `icmpv4_xrlim_allow()` executing on the unprotected `dst-\u003edev` fetch at very high rates, so the window is sampled constantly rather than once; on the common deployments where the dst-device teardown is routine and attacker-influenceable (PPPoE/L2TP session churn on a BRAS, tunnel and virtual-interface teardown in cloud/container hosts, route-exception churn the attacker drives with ICMP redirect and PMTU messages), the race is repeatable at will rather than dependent on a condition the attacker cannot reach.\nPR:N - ICMP echo replies and IPv4 fragment reassembly are handled before any authentication or authorization step exists, and there is no capability check anywhere on the path from packet receive to the unprotected `dst-\u003edev` dereference. Any unauthenticated host that can send IP packets to the target reaches this code.\nUI:N - The vulnerable code executes entirely in softirq context on packet receive and in the ICMP/multicast transmit paths; no local user or administrator has to open, mount, or click anything.\nS:U - The stale dereference and any resulting corruption stay inside the kernel\u0027s own memory and the network stack, which is a single security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Reading a freed `struct net_device` yields `dev-\u003eflags` and, through `l3mdev_master_ifindex_rcu()`, an rcu-dereferenced walk of the upper-device list and a master ifindex, all taken from reclaimed memory; an attacker who grooms the slab into that allocation gets kernel memory interpreted as device state and used to select fragment-reassembly queues and ICMP peer entries, enabling disclosure of kernel memory.\nI:H - The garbage ifindex derived from the freed device becomes the `vif` key for `ip_find()`, steering fragment reassembly into attacker-chosen queues, and the same freed-object pointer feeds `inet_getpeer_v4()`; a use-after-free of a `net_device` of this class is leverageable via heap spraying into controlled kernel writes and control-flow hijack.\nA:H - Dereferencing a released `net_device` and following its upper-device list pointers into freed memory produces an oops or panic in softirq context, taking down the entire system, and it is triggerable by ordinary remote traffic."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:39:36.800Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/684efb2c86c887685f9aa65e1a21b3df6c1f822d"
},
{
"url": "https://git.kernel.org/stable/c/923e0734c386984d45de508528a7a7ad91d791cc"
},
{
"url": "https://git.kernel.org/stable/c/6ad8de3cefdb6ffa6708b21c567df0dbf82c43a8"
}
],
"title": "ipv4: start using dst_dev_rcu()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-40074",
"datePublished": "2025-10-28T11:48:41.202Z",
"dateReserved": "2025-04-16T07:20:57.160Z",
"dateUpdated": "2026-08-27T12:39:36.800Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80557 (GCVE-0-2026-80557)
Vulnerability from cvelistv5
Published
2026-08-26 14:37
Modified
2026-08-27 12:40
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
libceph: fix OOB read in decode_watchers() via missing bounds check
ceph_start_decoding() validates that struct_len bytes remain in the
buffer after the encoding header, but accepts struct_len=0 as valid:
ceph_decode_need(p, end, 0, bad) always passes. When a malicious or
compromised OSD sends an obj_list_watch_response_t reply with
struct_len=0, ceph_start_decoding() returns success with p == end,
leaving zero bytes guaranteed for subsequent reads.
The immediately following ceph_decode_32(p) in decode_watchers() has
no preceding bounds check. With p == end this is a 4-byte read past
the validated buffer boundary. The garbage value is then passed
directly to kzalloc_objs() as the watcher count.
The sibling function decode_watcher() already uses the safe variants
(ceph_decode_copy_safe, ceph_decode_64_safe, ceph_decode_skip_32)
after its own ceph_start_decoding() call. decode_watchers() is the
only site that uses the bare variant, confirming an oversight.
Fix by replacing ceph_decode_32(p) with ceph_decode_32_safe(p, end,
*num_watchers, bad), consistent with the established pattern.
Attacker model: a malicious or compromised OSD in a multi-tenant Ceph
deployment (e.g. cloud) can trigger this against any kernel client
that calls CEPH_OSD_OP_LIST_WATCHERS, without any further privileges
beyond OSD session establishment.
[ idryomov: trim changelog ]
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: a4ed38d7a180f184a6e7aedd09db9ca4b1e6a71c Version: a4ed38d7a180f184a6e7aedd09db9ca4b1e6a71c Version: a4ed38d7a180f184a6e7aedd09db9ca4b1e6a71c Version: a4ed38d7a180f184a6e7aedd09db9ca4b1e6a71c Version: a4ed38d7a180f184a6e7aedd09db9ca4b1e6a71c Version: a4ed38d7a180f184a6e7aedd09db9ca4b1e6a71c Version: a4ed38d7a180f184a6e7aedd09db9ca4b1e6a71c Version: a4ed38d7a180f184a6e7aedd09db9ca4b1e6a71c |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ceph/osd_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "85479b7d65b4ebcb07fbbe57230976793974ab4a",
"status": "affected",
"version": "a4ed38d7a180f184a6e7aedd09db9ca4b1e6a71c",
"versionType": "git"
},
{
"lessThan": "1c824e7c75bb4adf19553dd4ea944a5d83096be8",
"status": "affected",
"version": "a4ed38d7a180f184a6e7aedd09db9ca4b1e6a71c",
"versionType": "git"
},
{
"lessThan": "f161be39201eb5f9b1f58fb8f90b8a9cd3931eb6",
"status": "affected",
"version": "a4ed38d7a180f184a6e7aedd09db9ca4b1e6a71c",
"versionType": "git"
},
{
"lessThan": "eab3eeb68bfc639d74f27256f05546af5c4f787d",
"status": "affected",
"version": "a4ed38d7a180f184a6e7aedd09db9ca4b1e6a71c",
"versionType": "git"
},
{
"lessThan": "c59219a6b62d74936963983e5815524c3de8dd79",
"status": "affected",
"version": "a4ed38d7a180f184a6e7aedd09db9ca4b1e6a71c",
"versionType": "git"
},
{
"lessThan": "cb8246e5846dbbe34930903a90c7a90dd8e5910b",
"status": "affected",
"version": "a4ed38d7a180f184a6e7aedd09db9ca4b1e6a71c",
"versionType": "git"
},
{
"lessThan": "7130d94846dadbb97b6b7f4d78a3a7bba6e3daa1",
"status": "affected",
"version": "a4ed38d7a180f184a6e7aedd09db9ca4b1e6a71c",
"versionType": "git"
},
{
"lessThan": "00ead17c7de137a692edee59f2772e6af687e8eb",
"status": "affected",
"version": "a4ed38d7a180f184a6e7aedd09db9ca4b1e6a71c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ceph/osd_client.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.47",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: fix OOB read in decode_watchers() via missing bounds check\n\nceph_start_decoding() validates that struct_len bytes remain in the\nbuffer after the encoding header, but accepts struct_len=0 as valid:\nceph_decode_need(p, end, 0, bad) always passes. When a malicious or\ncompromised OSD sends an obj_list_watch_response_t reply with\nstruct_len=0, ceph_start_decoding() returns success with p == end,\nleaving zero bytes guaranteed for subsequent reads.\n\nThe immediately following ceph_decode_32(p) in decode_watchers() has\nno preceding bounds check. With p == end this is a 4-byte read past\nthe validated buffer boundary. The garbage value is then passed\ndirectly to kzalloc_objs() as the watcher count.\n\nThe sibling function decode_watcher() already uses the safe variants\n(ceph_decode_copy_safe, ceph_decode_64_safe, ceph_decode_skip_32)\nafter its own ceph_start_decoding() call. decode_watchers() is the\nonly site that uses the bare variant, confirming an oversight.\n\nFix by replacing ceph_decode_32(p) with ceph_decode_32_safe(p, end,\n*num_watchers, bad), consistent with the established pattern.\n\nAttacker model: a malicious or compromised OSD in a multi-tenant Ceph\ndeployment (e.g. cloud) can trigger this against any kernel client\nthat calls CEPH_OSD_OP_LIST_WATCHERS, without any further privileges\nbeyond OSD session establishment.\n\n[ idryomov: trim changelog ]"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is triggered when libceph decodes a crafted MOSDOpReply for CEPH_OSD_OP_LIST_WATCHERS received over the Ceph messenger TCP session from a compromised or malicious OSD; exploitation requires no local syscall, ioctl, or device access on the victim.\nAC:L - A malicious OSD fully controls the reply encoding and can set struct_len=0 with a chosen outdata_len so ceph_start_decoding() leaves p at end and the following ceph_decode_32() deterministically reads attacker-chosen bytes as num_watchers without races or victim-specific memory layout.\nPR:N - The attacker acts as the remote Ceph OSD peer and needs no account, capabilities, or privileges on the victim Linux host; any kernel RBD client connected to a multi-tenant or attacker-controlled cluster is exposed when exclusive-lock recovery issues LIST_WATCHERS.\nUI:N - Once an RBD image with exclusive-lock is mapped, ceph_osdc_list_watchers() is invoked automatically during rbd_try_lock() lock-contention recovery; no additional victim user or administrator action is required at exploit time beyond the existing client session.\nS:U - The out-of-bounds read, attacker-sized heap allocation, and any resulting kernel memory corruption all occur within the victim host kernel Ceph client; the flaw does not cross VM, container, or IOMMU security boundaries.\nC:H - The missing bounds check causes a 4-byte out-of-bounds kernel memory read via ceph_decode_32() when p equals end; per kernel guidance any out-of-bounds read is rated High, and the attacker can place controlled bytes immediately past the validated boundary via outdata_len.\nI:H - The out-of-bounds or attacker-supplied num_watchers value is passed directly to kzalloc_objs(), giving the remote peer control over kernel heap allocation size and subsequent decode_watchers() processing of watcher structures in the RBD exclusive-lock path.\nA:H - The slab out-of-bounds read can trigger KASAN faults or kernel oops on instrumented builds, and a large attacker-chosen num_watchers can cause ENOMEM/OOM or stall the RBD lock worker during repeated decode_watcher() attempts, producing severe repeatable availability loss."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:40:16.573Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/85479b7d65b4ebcb07fbbe57230976793974ab4a"
},
{
"url": "https://git.kernel.org/stable/c/1c824e7c75bb4adf19553dd4ea944a5d83096be8"
},
{
"url": "https://git.kernel.org/stable/c/f161be39201eb5f9b1f58fb8f90b8a9cd3931eb6"
},
{
"url": "https://git.kernel.org/stable/c/eab3eeb68bfc639d74f27256f05546af5c4f787d"
},
{
"url": "https://git.kernel.org/stable/c/c59219a6b62d74936963983e5815524c3de8dd79"
},
{
"url": "https://git.kernel.org/stable/c/cb8246e5846dbbe34930903a90c7a90dd8e5910b"
},
{
"url": "https://git.kernel.org/stable/c/7130d94846dadbb97b6b7f4d78a3a7bba6e3daa1"
},
{
"url": "https://git.kernel.org/stable/c/00ead17c7de137a692edee59f2772e6af687e8eb"
}
],
"title": "libceph: fix OOB read in decode_watchers() via missing bounds check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80557",
"datePublished": "2026-08-26T14:37:24.178Z",
"dateReserved": "2026-08-26T14:34:25.767Z",
"dateUpdated": "2026-08-27T12:40:16.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-64581 (GCVE-0-2026-64581)
Vulnerability from cvelistv5
Published
2026-08-05 08:09
Modified
2026-08-27 12:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
xfrm_user_policy() clears the socket dst cache with __sk_dst_reset(),
i.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cache with
rcu_dereference_protected(), stores NULL and dst_release()s the old dst.
That is only safe if no other thread modifies sk_dst_cache concurrently.
For a connected UDP socket that does not hold: the transmit fast path
(udp_sendmsg -> sk_dst_check -> sk_dst_reset) resets the cache locklessly
with an atomic xchg(). A per-socket policy change racing a send can make
both sides observe the same old dst and each dst_release() it, dropping
the socket's single reference twice and freeing the xfrm_dst bundle while
it is still referenced:
BUG: KASAN: slab-use-after-free in dst_release
Write of size 4 at addr ffff88801897b6c0 by task exploit/155
Call Trace:
...
dst_release (... ./include/linux/rcuref.h:109)
xfrm_user_policy (./include/net/sock.h:2239 ./include/net/sock.h:2256 net/xfrm/xfrm_state.c:3053)
do_ip_setsockopt (net/ipv4/ip_sockglue.c:1347)
ip_setsockopt (net/ipv4/ip_sockglue.c:1417)
do_sock_setsockopt (net/socket.c:2368)
__sys_setsockopt (net/socket.c:2393)
__x64_sys_setsockopt (net/socket.c:2396)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Reachable by an unprivileged user via a user+network namespace.
Use the atomic sk_dst_reset() so the cache is cleared and released with a
single xchg(): whichever side wins releases the dst once, the other sees
NULL and does nothing. Behaviour is otherwise unchanged.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 Version: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 Version: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 Version: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 Version: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 Version: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 Version: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 Version: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 Version: 72f157be2f81910ae759bfe2e5c2256fc4625645 Version: 9e9fe58a92a46c6d154d2901735bf230d91b8507 Version: adc1ec6cdc20d430aa01b86497220709b9149466 Version: b54033eb1cfd77aba471269ddd804ed8d3e35dea Version: c9e82cb34c3c2ee895af01bc899c6ed0bc6eb04a Version: 5eef9b51114fcc65651d671add52f267f91b9451 Version: 3.16.52 ≤ Version: 4.4.163 ≤ Version: 3.18.101 ≤ Version: 4.1.52 ≤ Version: 4.4.123 ≤ Version: 4.9.89 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e8686fd8d18b99f3a9038683045b2f2338a7706d",
"status": "affected",
"version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
"versionType": "git"
},
{
"lessThan": "a9340ebdc13f8bb5063c0bc0b037ee7e640d4ae9",
"status": "affected",
"version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
"versionType": "git"
},
{
"lessThan": "f833821e4b52ab6335d443ede5fb79c38e61d19a",
"status": "affected",
"version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
"versionType": "git"
},
{
"lessThan": "f0ab9a71167bae308e05ab13b65e2007504a603f",
"status": "affected",
"version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
"versionType": "git"
},
{
"lessThan": "8dd8929b71c4f06c614f8f54c2cc070453faae16",
"status": "affected",
"version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
"versionType": "git"
},
{
"lessThan": "0ea8f06454012d9e7f9c6e6253df710949bf6294",
"status": "affected",
"version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
"versionType": "git"
},
{
"lessThan": "96b678d08268b5f5c6fc99d4289d9b7e334fc683",
"status": "affected",
"version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
"versionType": "git"
},
{
"lessThan": "c283e9ada7fcb7dd4b10592623086b2e6d2f9925",
"status": "affected",
"version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
"versionType": "git"
},
{
"status": "affected",
"version": "72f157be2f81910ae759bfe2e5c2256fc4625645",
"versionType": "git"
},
{
"status": "affected",
"version": "9e9fe58a92a46c6d154d2901735bf230d91b8507",
"versionType": "git"
},
{
"status": "affected",
"version": "adc1ec6cdc20d430aa01b86497220709b9149466",
"versionType": "git"
},
{
"status": "affected",
"version": "b54033eb1cfd77aba471269ddd804ed8d3e35dea",
"versionType": "git"
},
{
"status": "affected",
"version": "c9e82cb34c3c2ee895af01bc899c6ed0bc6eb04a",
"versionType": "git"
},
{
"status": "affected",
"version": "5eef9b51114fcc65651d671add52f267f91b9451",
"versionType": "git"
},
{
"lessThan": "3.17",
"status": "affected",
"version": "3.16.52",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.163",
"versionType": "semver"
},
{
"lessThan": "3.19",
"status": "affected",
"version": "3.18.101",
"versionType": "semver"
},
{
"lessThan": "4.2",
"status": "affected",
"version": "4.1.52",
"versionType": "semver"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.123",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.89",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.47",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.163",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.18.101",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.1.52",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.89",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix sk_dst_cache double-free in xfrm_user_policy()\n\nxfrm_user_policy() clears the socket dst cache with __sk_dst_reset(),\ni.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cache with\nrcu_dereference_protected(), stores NULL and dst_release()s the old dst.\nThat is only safe if no other thread modifies sk_dst_cache concurrently.\n\nFor a connected UDP socket that does not hold: the transmit fast path\n(udp_sendmsg -\u003e sk_dst_check -\u003e sk_dst_reset) resets the cache locklessly\nwith an atomic xchg(). A per-socket policy change racing a send can make\nboth sides observe the same old dst and each dst_release() it, dropping\nthe socket\u0027s single reference twice and freeing the xfrm_dst bundle while\nit is still referenced:\n\n BUG: KASAN: slab-use-after-free in dst_release\n Write of size 4 at addr ffff88801897b6c0 by task exploit/155\n Call Trace:\n ...\n dst_release (... ./include/linux/rcuref.h:109)\n xfrm_user_policy (./include/net/sock.h:2239 ./include/net/sock.h:2256 net/xfrm/xfrm_state.c:3053)\n do_ip_setsockopt (net/ipv4/ip_sockglue.c:1347)\n ip_setsockopt (net/ipv4/ip_sockglue.c:1417)\n do_sock_setsockopt (net/socket.c:2368)\n __sys_setsockopt (net/socket.c:2393)\n __x64_sys_setsockopt (net/socket.c:2396)\n do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nReachable by an unprivileged user via a user+network namespace.\n\nUse the atomic sk_dst_reset() so the cache is cleared and released with a\nsingle xchg(): whichever side wins releases the dst once, the other sees\nNULL and does nothing. Behaviour is otherwise unchanged."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - Triggered via setsockopt(IP_XFRM_POLICY/IP_IPSEC_POLICY) on a local socket racing concurrent udp_sendmsg; entry is a local syscall path (do_ip_setsockopt -\u003e xfrm_user_policy), not packet processing.\nAC:L - Attacker controls both sides of the race (one thread setsockopt to clear/apply per-socket xfrm policy, another sendmsg on the same connected UDP socket) and can create the obsolete xfrm_dst precondition in their netns, retrying until the double dst_release wins.\nPR:L - Path requires CAP_NET_ADMIN checked with sockopt_ns_capable(sock_net(sk)-\u003euser_ns), which an unprivileged user obtains via user+network namespaces; the fix commit explicitly states this reachability.\nUI:N - Exploitation uses only the attacker\u0027s own socket, threads, and setsockopt/sendmsg loops; no victim action or cooperation is required.\nS:U - Double-free/UAF of the socket\u0027s dst_entry/xfrm_dst is standard local kernel memory corruption within the host kernel authority, not a VM escape or other cross-boundary impact.\nC:H - Double dst_release frees the xfrm_dst slab object while still referenced, yielding a use-after-free that can be reclaimed/sprayed to disclose kernel memory via corrupted dst contents and ops.\nI:H - The UAF targets a dst_entry with function pointers (ops/input/output) used on transmit, enabling heap reuse for arbitrary write and control-flow hijack consistent with comparable sk_dst_cache races.\nA:H - The KASAN slab-use-after-free in dst_release demonstrates kernel memory corruption that can oops/panic, and the attacker can repeat the race freely."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:39:44.254Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e8686fd8d18b99f3a9038683045b2f2338a7706d"
},
{
"url": "https://git.kernel.org/stable/c/a9340ebdc13f8bb5063c0bc0b037ee7e640d4ae9"
},
{
"url": "https://git.kernel.org/stable/c/f833821e4b52ab6335d443ede5fb79c38e61d19a"
},
{
"url": "https://git.kernel.org/stable/c/f0ab9a71167bae308e05ab13b65e2007504a603f"
},
{
"url": "https://git.kernel.org/stable/c/8dd8929b71c4f06c614f8f54c2cc070453faae16"
},
{
"url": "https://git.kernel.org/stable/c/0ea8f06454012d9e7f9c6e6253df710949bf6294"
},
{
"url": "https://git.kernel.org/stable/c/96b678d08268b5f5c6fc99d4289d9b7e334fc683"
},
{
"url": "https://git.kernel.org/stable/c/c283e9ada7fcb7dd4b10592623086b2e6d2f9925"
}
],
"title": "xfrm: fix sk_dst_cache double-free in xfrm_user_policy()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64581",
"datePublished": "2026-08-05T08:09:35.556Z",
"dateReserved": "2026-07-19T15:36:31.798Z",
"dateUpdated": "2026-08-27T12:39:44.254Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74662 (GCVE-0-2026-74662)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-08-27 12:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
inet: frags: publish queues before arming timer
inet_frag_create() arms the fragment queue timer before inserting the
queue into the fqdir rhashtable. If the namespace fragment timeout is
zero or negative, the timer can run before the queue is published.
The timer callback then marks the queue complete, tries to remove a node
that is not in the hash table yet, and drops the anticipated hash
reference. Creation can subsequently publish the completed queue without
restoring that reference, leaving a stale hash node after the caller drops
the remaining reference.
Publish the queue first and arm the timer while holding the queue lock.
This makes timer expiry wait until the queue is visible in the hash table,
so inet_frag_kill() can remove the node and balance the hash reference.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 648700f76b03b7e8149d13cc2bdb3355035258a9 Version: 648700f76b03b7e8149d13cc2bdb3355035258a9 Version: 648700f76b03b7e8149d13cc2bdb3355035258a9 Version: 648700f76b03b7e8149d13cc2bdb3355035258a9 Version: 648700f76b03b7e8149d13cc2bdb3355035258a9 Version: 648700f76b03b7e8149d13cc2bdb3355035258a9 Version: 648700f76b03b7e8149d13cc2bdb3355035258a9 Version: 648700f76b03b7e8149d13cc2bdb3355035258a9 Version: 493107105843f299662b3b664a83804645564f12 Version: 4.4.174 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/inet_fragment.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f4e4dab62181b7fe7c011bed6fbef9fc3d48c769",
"status": "affected",
"version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
"versionType": "git"
},
{
"lessThan": "4ed0681dc2c1e0538b79d2fc56190ffcb369dacd",
"status": "affected",
"version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
"versionType": "git"
},
{
"lessThan": "08a04d7bfb9c103432561aff8a62b6872e694a6a",
"status": "affected",
"version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
"versionType": "git"
},
{
"lessThan": "d3ffb89b2944672cf7bdd8e9ee577d2043b4a956",
"status": "affected",
"version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
"versionType": "git"
},
{
"lessThan": "39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0",
"status": "affected",
"version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
"versionType": "git"
},
{
"lessThan": "9f904dd3e455750e5d4ec9b2f134835811b85a2f",
"status": "affected",
"version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
"versionType": "git"
},
{
"lessThan": "928128865e43b197e30688dc1bc991592c97edcf",
"status": "affected",
"version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
"versionType": "git"
},
{
"lessThan": "653d7ddf6cba867777a3d14c4f83ace008c5ad13",
"status": "affected",
"version": "648700f76b03b7e8149d13cc2bdb3355035258a9",
"versionType": "git"
},
{
"status": "affected",
"version": "493107105843f299662b3b664a83804645564f12",
"versionType": "git"
},
{
"lessThan": "4.5",
"status": "affected",
"version": "4.4.174",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/inet_fragment.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.174",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ninet: frags: publish queues before arming timer\n\ninet_frag_create() arms the fragment queue timer before inserting the\nqueue into the fqdir rhashtable. If the namespace fragment timeout is\nzero or negative, the timer can run before the queue is published.\n\nThe timer callback then marks the queue complete, tries to remove a node\nthat is not in the hash table yet, and drops the anticipated hash\nreference. Creation can subsequently publish the completed queue without\nrestoring that reference, leaving a stale hash node after the caller drops\nthe remaining reference.\n\nPublish the queue first and arm the timer while holding the queue lock.\nThis makes timer expiry wait until the queue is visible in the hash table,\nso inet_frag_kill() can remove the node and balance the hash reference."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - IPv4/IPv6 fragments reach inet_frag_create() via remote receive paths (ip_defrag, ipv6_frag_rcv, nf_conntrack reassembly) on any Internet-facing host performing normal fragment reassembly before transport delivery.\nAC:L - Requires per-netns fragment timeout \u22640 so the armed timer expires during queue creation; attacker-settable with CAP_NET_ADMIN in user/net namespaces, and the timer/hash race is fully attacker-controlled and repeatable via crafted fragments.\nPR:N - No authentication or capability check gates IPv4/IPv6 fragment receive/reassembly before inet_frag_find(); remote peers can deliver the triggering fragmented traffic pre-authentication to hosts processing fragments.\nUI:N - Exploitation needs only crafted fragmented packet delivery; no victim action such as opening files, clicking links, or mounting filesystems is required.\nS:U - Corruption is confined to the kernel network stack in the same security authority; this is standard kernel memory corruption/privilege escalation, not a VM escape or IOMMU boundary bypass.\nC:H - Incorrect refcounting leaves a stale rhashtable entry pointing at a freed inet_frag_queue; subsequent fragment lookups dereference freed slab memory, enabling kernel information disclosure primitives.\nI:H - Follow-on fragment handling on the stale queue writes through freed inet_frag_queue and skb linkage fields, yielding kernel heap corruption exploitable for arbitrary modification or code execution.\nA:H - Freed-queue dereferences during reassembly can kernel oops or panic; attackers can retrigger the condition repeatedly by sending additional fragmented datagrams matching the same fragment key."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:39:58.332Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f4e4dab62181b7fe7c011bed6fbef9fc3d48c769"
},
{
"url": "https://git.kernel.org/stable/c/4ed0681dc2c1e0538b79d2fc56190ffcb369dacd"
},
{
"url": "https://git.kernel.org/stable/c/08a04d7bfb9c103432561aff8a62b6872e694a6a"
},
{
"url": "https://git.kernel.org/stable/c/d3ffb89b2944672cf7bdd8e9ee577d2043b4a956"
},
{
"url": "https://git.kernel.org/stable/c/39c6c4b267b65f00e0b0335a2ae00cbe9e3174f0"
},
{
"url": "https://git.kernel.org/stable/c/9f904dd3e455750e5d4ec9b2f134835811b85a2f"
},
{
"url": "https://git.kernel.org/stable/c/928128865e43b197e30688dc1bc991592c97edcf"
},
{
"url": "https://git.kernel.org/stable/c/653d7ddf6cba867777a3d14c4f83ace008c5ad13"
}
],
"title": "inet: frags: publish queues before arming timer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74662",
"datePublished": "2026-08-22T15:32:35.151Z",
"dateReserved": "2026-08-15T05:44:03.924Z",
"dateUpdated": "2026-08-27T12:39:58.332Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74626 (GCVE-0-2026-74626)
Vulnerability from cvelistv5
Published
2026-08-22 15:32
Modified
2026-08-27 12:39
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
NTB: ntb_netdev: Preserve RX queue depth on allocation failure
ntb_netdev_rx_handler() hands the received skb to the network stack
before allocating its replacement. If the allocation fails, nothing is
reposted. Every failure therefore takes one buffer out of the RX queue
while the interface remains up, and enough failures eventually stall
reception.
A retry path could refill the queue later, but ntb_netdev has none.
Allocate the replacement first instead. If that fails, drop the packet
and repost the same skb. This keeps the queue full and lets packet
delivery resume as soon as memory is available again.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 548c237c0a9972df5d1afaca38aa733ee577128d Version: 548c237c0a9972df5d1afaca38aa733ee577128d Version: 548c237c0a9972df5d1afaca38aa733ee577128d Version: 548c237c0a9972df5d1afaca38aa733ee577128d Version: 548c237c0a9972df5d1afaca38aa733ee577128d Version: 548c237c0a9972df5d1afaca38aa733ee577128d Version: 548c237c0a9972df5d1afaca38aa733ee577128d Version: 548c237c0a9972df5d1afaca38aa733ee577128d |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ntb_netdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6d7f8a23c130d768c0976c2578b214353674e18f",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
},
{
"lessThan": "18781cc0bfb5c7f2a51ac6d678a28f101b7c35c5",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
},
{
"lessThan": "272df0fbe6f3e04e22bc67fbdd9ac24586b942f4",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
},
{
"lessThan": "fcaf8ba7e56bb73319ac107a63b907d59536192c",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
},
{
"lessThan": "3f2a15f33f86f7bd5b920669fd40c06725d72a1e",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
},
{
"lessThan": "a4e340971fe8ccd245d206db4d43b2a0eec240bd",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
},
{
"lessThan": "755fd7843f300d724caceabdf9bb13adc8701540",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
},
{
"lessThan": "d2121faf133ac3bf9531b53a7e21273649a08517",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ntb_netdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.267",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.218",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.185",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.267",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.218",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.185",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.154",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.106",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.46",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNTB: ntb_netdev: Preserve RX queue depth on allocation failure\n\nntb_netdev_rx_handler() hands the received skb to the network stack\nbefore allocating its replacement. If the allocation fails, nothing is\nreposted. Every failure therefore takes one buffer out of the RX queue\nwhile the interface remains up, and enough failures eventually stall\nreception.\n\nA retry path could refill the queue later, but ntb_netdev has none.\nAllocate the replacement first instead. If that fails, drop the packet\nand repost the same skb. This keeps the queue full and lets packet\ndelivery resume as soon as memory is available again."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug is triggered in ntb_netdev_rx_handler() on every Ethernet frame received on the NTB virtual netdev; in dual-controller storage and cluster deployments the NTB interconnect carries bridged or routed IP traffic, so a remote peer can deliver packets that reach this handler without local access to the victim.\nAC:L - An attacker can reliably trigger the failure by flooding the NTB link with packets while inducing GFP_ATOMIC allocation pressure through sustained traffic and/or local memory exhaustion; each failed netdev_alloc_skb permanently consumes one of the 100 RX slots with no recovery path until the interface is restarted.\nPR:N - Reception is driven by raw Ethernet frames from the NTB peer with no authentication, capability checks, or application-layer credentials on the receive path; any host that can send traffic over the established NTB link can reach ntb_netdev_rx_handler().\nUI:N - Exploitation requires only that the NTB netdev link already be up in its normal deployment configuration; no victim login, mount, file open, or other interactive action is needed beyond the attacker sending packets over the interconnect.\nS:U - The impact is permanent loss of receive capability on the NTB netdev within the same kernel security domain; it does not cross a VM, hypervisor, IOMMU, or other security-authority boundary.\nC:N - The defect only leaks RX queue entries on allocation failure and does not involve out-of-bounds access, use-after-free, or any memory read primitive that could disclose kernel data to the attacker.\nI:N - No kernel or user data is modified; the bug only fails to repost a receive buffer, causing progressive RX queue depletion rather than arbitrary memory writes or code execution.\nA:H - Each allocation failure permanently removes one RX buffer with no refill mechanism, and after NTB_RXQ_SIZE (100) failures reception on the NTB netdev stalls completely while the interface remains up, causing a persistent denial of service on a critical cluster interconnect until manual intervention."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:39:48.605Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6d7f8a23c130d768c0976c2578b214353674e18f"
},
{
"url": "https://git.kernel.org/stable/c/18781cc0bfb5c7f2a51ac6d678a28f101b7c35c5"
},
{
"url": "https://git.kernel.org/stable/c/272df0fbe6f3e04e22bc67fbdd9ac24586b942f4"
},
{
"url": "https://git.kernel.org/stable/c/fcaf8ba7e56bb73319ac107a63b907d59536192c"
},
{
"url": "https://git.kernel.org/stable/c/3f2a15f33f86f7bd5b920669fd40c06725d72a1e"
},
{
"url": "https://git.kernel.org/stable/c/a4e340971fe8ccd245d206db4d43b2a0eec240bd"
},
{
"url": "https://git.kernel.org/stable/c/755fd7843f300d724caceabdf9bb13adc8701540"
},
{
"url": "https://git.kernel.org/stable/c/d2121faf133ac3bf9531b53a7e21273649a08517"
}
],
"title": "NTB: ntb_netdev: Preserve RX queue depth on allocation failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74626",
"datePublished": "2026-08-22T15:32:08.687Z",
"dateReserved": "2026-08-15T05:44:03.921Z",
"dateUpdated": "2026-08-27T12:39:48.605Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…